Skip to content

feat(dev): add effect ts skill#433

Merged
skulidropek merged 1 commit into
mainfrom
codex/add-effect-ts-skills
Jun 20, 2026
Merged

feat(dev): add effect ts skill#433
skulidropek merged 1 commit into
mainfrom
codex/add-effect-ts-skills

Conversation

@skulidropek

@skulidropek skulidropek commented Jun 20, 2026

Copy link
Copy Markdown
Member

Source TZ / Issues

  • Source TZ: user request to add out-of-the-box use of https://github.com/ProverCoderAI/effect-ts-skills to this project without duplicating upstream skill files.
  • Related discussion: project-scoped Codex skills and Effect-TS compliance workflow.
  • Fixes: no linked GitHub issue.

Requirements Alignment

Implemented

  • Adds ProverCoderAI/effect-ts-skills as a git submodule at third_party/effect-ts-skills.
  • Replaces the project-local .codex/skills/effect-ts-guide copy with a symlink to third_party/effect-ts-skills/plugins/effect-ts-skills/skills/effect-ts-guide.
  • Keeps Codex discovery on the usual project skill path while avoiding duplicated upstream skill files in this repository.
  • Adds bun run effect:skill:init to initialize the submodule.
  • Updates bun run effect:skill:check to initialize the submodule first, then run the upstream bundled strict checker against the currently green OpenAPI Effect boundary.
  • Documents the submodule source, symlink layout, usage, and update procedure in docs/integrations/effect-ts-skills.md.

Out of scope

  • No application runtime code changes.
  • No full-monorepo Effect migration in this PR.
  • No global Codex plugin installation is required or modified.

Security-sensitive

  • The submodule is pinned to ProverCoderAI/effect-ts-skills commit 178adff12f5bf020b55e1aef347e2258e5033192.
  • No credentials or tokens are added.
  • The upstream bundled checker asset stays in the submodule rather than being copied into the main repository tree.

Mathematical Guarantees

Invariants

  • forall Codex session c opened in this repository after submodule initialization: effect-ts-guide resolves from .codex/skills/effect-ts-guide to the upstream submodule skill directory.
  • bun run effect:skill:check initializes the submodule before executing the bundled strict checker.
  • bun run effect:skill:check fails on detected strict-profile violations in the configured OpenAPI Effect boundary.
  • The full monorepo scan remains explicitly documented as backlog discovery, not as a merge gate.

Preconditions

  • The workspace can execute git, bash, bun, and npx.
  • Network or npm cache is available for dependencies used by the bundled checker runner.
  • Filesystem supports the project skill symlink.

Postconditions

  • Agents and humans can invoke the project-local Effect-TS skill/checker without installing effect-ts-skills globally.
  • Upstream skill updates are managed by moving the submodule gitlink instead of copying files.
  • The integration source and refresh procedure are documented.

Complexity

  • Skill discovery: O(1) path lookup under .codex/skills plus symlink resolution.
  • Checker runtime: O(n) in checked source size.

Proof of fix

  • Cause: the first PR version copied the upstream skill files into .codex/skills/effect-ts-guide, which would duplicate the same skill content across repositories.
  • Solution: add effect-ts-skills as a submodule, replace the copied project skill directory with a symlink to the submodule skill, and make the root check script initialize the submodule before running the checker.
  • Proof: bun run effect:skill:init && bun run effect:skill:check passes on the configured OpenAPI Effect boundary through the symlinked skill path.

Verification

  • bun run effect:skill:init && bun run effect:skill:check
  • git diff --check

@skulidropek

skulidropek commented Jun 20, 2026

Copy link
Copy Markdown
Member Author

AI Session Backup

Commit: 099da38
Status: success
Files: 19 (35.42 MB)
Links: README | Manifest

git status

On branch codex/add-effect-ts-skills
Your branch is up to date with 'origin/codex/add-effect-ts-skills'.

nothing to commit, working tree clean

@skulidropek skulidropek marked this pull request as draft June 20, 2026 05:33
@coderabbitai

coderabbitai Bot commented Jun 20, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@skulidropek, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 46 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cba543c6-2204-4755-9b57-0ed55d45ec51

📥 Commits

Reviewing files that changed from the base of the PR and between 099da38 and c48c94e.

📒 Files selected for processing (8)
  • .codex/skills/effect-ts-guide
  • .codex/skills/effect-ts-guide/SKILL.md
  • .codex/skills/effect-ts-guide/references/best-practices.md
  • .codex/skills/effect-ts-guide/references/platform-map.md
  • .gitmodules
  • docs/integrations/effect-ts-skills.md
  • package.json
  • third_party/effect-ts-skills
📝 Walkthrough

Walkthrough

Добавлен vendored Codex skill effect-ts-guide: bash-скрипты run-effect-ts-check.sh и refresh-effect-ts-check-asset.sh, справочные документы (lint-checks.md, manual-writing-rules.md, editor-tooling.md, обновлённые best-practices.md и platform-map.md), конфигурация агента OpenAI, переработанный SKILL.md и проектная интеграция через docs/integrations/effect-ts-skills.md и package.json.

Changes

Effect TS Guide Skill

Layer / File(s) Summary
Bash-скрипты запуска и обновления effect-ts-check
.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh, .codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh
run-effect-ts-check.sh находит локальный tarball по glob-паттерну, проверяет его наличие и запускает effect-ts-check через exec npx --package. refresh-effect-ts-check-asset.sh пересобирает пакет через pnpm pack, валидирует количество .tgz и заменяет артефакт в директории assets с авто-очисткой через trap.
Справочная документация
.codex/skills/effect-ts-guide/references/lint-checks.md, .codex/skills/effect-ts-guide/references/manual-writing-rules.md, .codex/skills/effect-ts-guide/references/editor-tooling.md, .codex/skills/effect-ts-guide/references/best-practices.md, .codex/skills/effect-ts-guide/references/platform-map.md
Добавлены lint-checks.md (профили minimal/strict/strict-format, правила CORE/SHELL boundary) и manual-writing-rules.md (applicability gate, архитектурные/стилевые/review/response/editor правила). editor-tooling.md разграничивает CLI и language service. best-practices.md сокращён по всем блокам и дополнен разделом Editor Setup. platform-map.md сжат до Common Mappings и Guidance.
SKILL.md и конфигурация агента
.codex/skills/effect-ts-guide/SKILL.md, .codex/skills/effect-ts-guide/agents/openai.yaml
SKILL.md переписан: руководство по run-effect-ts-check.sh, разделы What The Check Covers и What Still Needs Judgment, расширенный список references. agents/openai.yaml добавлен с display_name, default_prompt и allow_implicit_invocation: true.
Интеграция в проект
docs/integrations/effect-ts-skills.md, package.json
effect-ts-skills.md документирует источник skill, команды запуска и процедуру обновления. В package.json добавлен скрипт effect:skill:check для запуска checker с профилем strict по целевым файлам проекта.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Requirements Alignment ❌ Error The PR introduces refresh-effect-ts-check-asset.sh script that requires packages/effect-ts-check to exist, but this package is not present in the repository. The script is undocumented in the m... Either remove the refresh-effect-ts-check-asset.sh script since it's not a documented workflow, or document why it exists and for whom it's intended, plus add a directory existence check as suggested in review comment #3.
✅ Passed checks (6 passed)
Check name Status Explanation
Title check ✅ Passed Заголовок корректно описывает основное изменение: добавление Effect TypeScript skill с конкретным префиксом области (dev) и ключевым словом (feat).
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Security Regression ✅ Passed No high-confidence security regressions found. Shell scripts safely quote variables, use absolute paths, avoid command injection, bundle tools locally without external registry pulls, and contain n...
Description check ✅ Passed Pull request description is comprehensive and well-structured, covering all required template sections including source/issues, implemented features, out-of-scope items, and verification steps.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/add-effect-ts-skills

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh (1)

21-22: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Отсутствует финальный перевод строки в конце файла.

Скрипт заканчивается на строке 21 без символа новой строки (видна пустая строка 22 без ~). Bash-скрипты должны завершаться переводом строки.

exec npx --yes --package "$TARBALL" effect-ts-check "$@"
+
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh around lines 21
- 22, The bash script in run-effect-ts-check.sh is missing a final newline
character at the end of the file after the exec command. Add a newline character
at the end of the file after the line containing exec npx --yes --package
"$TARBALL" effect-ts-check "$@" to ensure the script properly terminates with a
newline, which is a standard requirement for bash scripts.
.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh (1)

29-29: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Отсутствует финальный перевод строки в конце файла.

mv "${TARBALLS[0]}" "$ASSET_DIR/"
+
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh at
line 29, The file refresh-effect-ts-check-asset.sh is missing a final newline
character at the end. Add a newline character at the very end of the file after
the last line of code to ensure the file ends with a proper line terminator,
which is a standard convention for shell scripts and required by most linters.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.codex/skills/effect-ts-guide/references/best-practices.md:
- Around line 12-14: The three consecutive bullet points in the Composition
section starting at line 12 all begin with "Use", creating repetitive language
that reduces readability in this reference document. Rephrase these three bullet
points to use varied sentence structures and formulations while preserving the
same technical guidance about pipe, Effect.flatMap, Effect.map, Effect.gen,
Match.exhaustive, Effect.try, and Effect.tryPromise.

In @.codex/skills/effect-ts-guide/references/lint-checks.md:
- Around line 8-12: The instruction for setting SKILL_DIR in the lint-checks.md
file is vague and doesn't clearly indicate the actual directory path for typical
users. Replace the generic placeholder text "SKILL_DIR=<directory containing
this SKILL.md>" with a concrete example showing the actual path like
"SKILL_DIR=~/.codex/skills/effect-ts-guide" to make it immediately clear to
users what directory they need to reference, or alternatively provide an
explanation of how to determine the skill directory programmatically if the
script location can vary.

In @.codex/skills/effect-ts-guide/references/manual-writing-rules.md:
- Around line 18-20: The three consecutive bullet points in the manual writing
rules section starting at line 18 all begin with the word "Avoid", creating
repetitive phrasing that reduces readability. Rewrite these bullet points to
vary the sentence structure and wording while preserving the same guidance about
async/await, try/catch, and Promise chains. For example, consider using
different phrasings such as "Do not use", "Prefer avoiding", or restructuring as
positive guidance to create better visual and linguistic variety across the
three related recommendations.

In @.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh:
- Line 15: The script executes the corepack pnpm pack command in the
`packages/effect-ts-check` directory without first verifying that the directory
exists. Add a check before the pnpm command to verify that the directory
`$REPO_ROOT/packages/effect-ts-check` exists, and if it does not exist, output a
clear error message and exit the script with a non-zero status code to prevent
the script from continuing with invalid assumptions.

In @.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh:
- Around line 7-15: The script currently only checks if no tarballs are found
but does not validate that exactly one tarball exists before using it on the
line where TARBALL is assigned to TARBALLS[0]. Add a validation check after the
existing empty check that verifies the TARBALLS array contains exactly one
element (length equals 1), and if not, print an error message indicating the
expected count versus the actual count found and exit with status 1. This
ensures the script is protected against scenarios where multiple tarballs or
unexpected file states occur.

---

Outside diff comments:
In @.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh:
- Line 29: The file refresh-effect-ts-check-asset.sh is missing a final newline
character at the end. Add a newline character at the very end of the file after
the last line of code to ensure the file ends with a proper line terminator,
which is a standard convention for shell scripts and required by most linters.

In @.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh:
- Around line 21-22: The bash script in run-effect-ts-check.sh is missing a
final newline character at the end of the file after the exec command. Add a
newline character at the end of the file after the line containing exec npx
--yes --package "$TARBALL" effect-ts-check "$@" to ensure the script properly
terminates with a newline, which is a standard requirement for bash scripts.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 347efe88-ca5c-44e3-8536-4b4db8dd4dfc

📥 Commits

Reviewing files that changed from the base of the PR and between 08ee941 and 099da38.

📒 Files selected for processing (12)
  • .codex/skills/effect-ts-guide/SKILL.md
  • .codex/skills/effect-ts-guide/agents/openai.yaml
  • .codex/skills/effect-ts-guide/assets/effect-ts-check/prover-coder-ai-effect-ts-check-0.1.0.tgz
  • .codex/skills/effect-ts-guide/references/best-practices.md
  • .codex/skills/effect-ts-guide/references/editor-tooling.md
  • .codex/skills/effect-ts-guide/references/lint-checks.md
  • .codex/skills/effect-ts-guide/references/manual-writing-rules.md
  • .codex/skills/effect-ts-guide/references/platform-map.md
  • .codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh
  • .codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh
  • docs/integrations/effect-ts-skills.md
  • package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (9)
  • GitHub Check: E2E (Runtime volumes + SSH)
  • GitHub Check: E2E (Browser command)
  • GitHub Check: E2E (Login context)
  • GitHub Check: Lint
  • GitHub Check: E2E (Clone auto-open SSH)
  • GitHub Check: E2E (OpenCode)
  • GitHub Check: E2E (Clone cache)
  • GitHub Check: Test
  • GitHub Check: Final build (windows-latest)
🧰 Additional context used
📓 Path-based instructions (8)
**/{setup,install,config,*.sh,*.md}

📄 CodeRabbit inference engine (README.md)

Ensure default projects directory is ~/.docker-git

Files:

  • docs/integrations/effect-ts-skills.md
**/*

⚙️ CodeRabbit configuration file

**/*: Ты строгий ревьюер SPEC DRIVEN DEVELOPMENT.

Перед выводами изучи README.md, другие *.md файлы, linked issues,
PR description, PR comments/discussion и релевантную кодовую базу.

Сверь изменения с исходным ТЗ/спекой и обсуждением. Флагай любой уход
от спеки, недокументированное изменение поведения, отсутствие тестов
для заявленного поведения и security-риск. Если спека не видна,
попроси автора добавить ее в issue или PR description.

Проверь решение с точки зрения формальной верификации: какие инварианты,
предусловия и постусловия можно доказать математически, а где доказуемость
слабая. Оцени решение с точки зрения теории игр: устойчивы ли стимулы,
нет ли выгодного обхода правил, и какое решение было бы сильнее.

Files:

  • docs/integrations/effect-ts-skills.md
  • package.json
**

⚙️ CodeRabbit configuration file

**: РОЛЬ: Математик-программист, специализирующийся на формально верифицируемой функциональной архитектуре.

ЦЕЛЬ: Создавать математически доказуемые решения через функциональную парадигму с полным разделением чистых вычислений и контролируемых эффектов.

МОДЕЛЬ РАССУЖДЕНИЯ:

  • Не выдавать “личные мнения”. Формировать вывод как результат симуляции профессионального обсуждения релевантных ролей
    (архитектор Effect/FP, ревьюер типов, страж CORE↔SHELL, тест-инженер).
  • Если запрос сформулирован как “что думаешь”, отвечать в терминах аргументов ролей и выбирать решение
    по критериям инвариантов, типовой безопасности и тестируемости (если пользователь явно просит выбор — выбрать и обосновать).

ПРАВИЛО ПРОЦЕССА (НЕ ФОРМАТ ОТВЕТА):
В начале работы (внутренне) формулировать Deep Research вопрос:
"I am looking for code that does , is there existing code that can do this?"
Далее:

  • если доступен проект/код — сперва искать и переиспользовать существующие паттерны (минимальный корректный diff),
  • если проект недоступен — опираться на предоставленный контекст и явно фиксировать допущения,
  • код писать только после формального понимания задачи (типы/инварианты → архитектура → код → тесты),
  • источники указывать только если реально использован внешний материал; иначе SOURCE: n/a.

ИНСТРУМЕНТАЛЬНОЕ ПОВЕДЕНИЕ (ОБЯЗАТЕЛЬНО, НЕ ФОРМАТ ОТВЕТА):

  • Агент всегда использует доступные инструменты среды (терминал, поиск по проекту, запуск тестов/скриптов, анализ сборки, web-ресёрч при необходимости)
    для ресёрча, проверки гипотез и выполнения действий. Приоритет: проверяемость, воспроизводимость, минимальный риск.
  • Агент не предлагает “гайд” как замену действия. Если действие возможно выполнить инструментами — агент выполняет его сам,
    затем сообщает, что было сделано и как повторить.
  • Любые инструкции (команды/процедуры) агент даёт только после собственной проверки на доступной среде.
    Если проверить невозможно — явно фиксирует ограничение и перечисляе...

Files:

  • docs/integrations/effect-ts-skills.md
  • package.json
docs/integrations/**

⚙️ CodeRabbit configuration file

docs/integrations/**: # Skiller Integration

Skiller is included as an isolated git submodule so docker-git can reuse the upstream desktop skills manager without mixing Electron dependencies into the docker-git Bun workspace.

Upstream

The submodule is intentionally outside packages/* and is not listed in the root workspace. This keeps the existing docker-git build, check, typecheck, and test scripts scoped to docker-git packages unless a Skiller-specific script is run.

Commands

Initialize the pinned submodule:

bun run skiller:init

Install Skiller dependencies inside the submodule:

bun run skiller:install

Run Skiller as its own Electron app:

bun run skiller:dev

Run Skiller checks:

bun run skiller:check

docker-git Web Launch

The docker-git web terminal header includes a Skiller button next to Open browser. In a project terminal the button calls POST /projects/by-key/:projectKey/terminal-sessions/:sessionId/skiller/open first, which launches the pinned submodule Electron app as a separate process, registers the terminal session filesystem scope, and writes launcher output to ~/.docker-git/logs/skiller.log. After that response succeeds, the browser opens the returned /api/ssh/session/:sessionId/skiller/app/ URL using the same terminal session id that is present in /ssh/session/:sessionId.

docker-git serves Skiller's built renderer from the submodule and proxies /api/ssh/session/:sessionId/skiller/trpc/* to the running Skiller tRPC backend, so the user sees the actual Skiller UI instead of an invisible background desktop process. The session id is part of the URL so a Skiller tab can be tied back to the terminal...

Files:

  • docs/integrations/effect-ts-skills.md
docs/**

⚙️ CodeRabbit configuration file

docs/**: # Процесс разработки (SDD: Spec-Driven Development)

Этот документ описывает канонический цикл разработки в docker-git: от issue до
проверяемого PR. Он отвечает на вопрос «как должна проходить разработка» из
issue #390 и связывает
шаги процесса с уже существующими инструментами репозитория.

Базовая философия задана в AGENTS.md и CLAUDE.md:

«Если это нельзя доказать — это нельзя доверить продакшену.»
Каждая функция — теорема, каждый тест — доказательство, каждый тип — утверждение.

SDD означает, что сначала формализуем (спецификация + инварианты), потом
программируем
. Спецификация и её инварианты живут вместе с кодом и проверяются
автоматически.

Обзор цикла

issue ──▶ clone (среда) ──▶ /plan ──▶ уточнение ТЗ + Deep Research
  │                                          │
  │                                          ▼
  │                            Story + Prove (инварианты проверяемости)
  │                                          │
  │                            апрув плана ──▶ plan-to-git ──▶ PR (память)
  │                                          │
  │                                          ▼
  └──────────────── разработка (код + тесты + Playwright MCP)
                                             │
                                ToDos + subagents (декомпозиция)
                                             │
                                             ▼
                          CI/CD ──▶ сверка с инвариантами плана ──▶ merge

1. Issue — источник истины

Разработка всегда начинается с issue. Issue фиксирует намерение и становится
точкой привязки для плана, PR и итоговой проверки инвариантов.

2. Среда: клонирование с изоляцией

Для каждой issue поднимается отдельное Docker-окружение. Браузерная автоматизация
включается флагом --mcp-playwright (Playwright MCP + Chromium sidecar):

bun run docker-git clone https://...

Files:

  • docs/integrations/effect-ts-skills.md
**/*.{js,ts,jsx,tsx,py,java,go,rb,php,sh,bash,yml,yaml,json,env*,toml,cfg,config,dockerfile,dockerignore}

📄 CodeRabbit inference engine (Custom checks)

Fail if changed files expose credentials, tokens, private-keys, or PII in source, generated config, logs, or CI output

Files:

  • package.json
**/{package*.json,requirements*.txt,setup.py,setup.cfg,Pipfile,Pipfile.lock,pyproject.toml,pom.xml,build.gradle,Gemfile,Gemfile.lock,go.mod,go.sum,composer.json,Cargo.toml,Cargo.lock}

📄 CodeRabbit inference engine (Custom checks)

Fail if dependency or package-manager changes materially increase supply-chain risk without justification

Files:

  • package.json
package.json

📄 CodeRabbit inference engine (AGENTS.md)

Dependencies must include effect ^3.x and @effect/schema ^0.x; prohibit downgrading these versions or introducing incompatible alternatives (async-only libraries without Effect support)

Require Effect and @effect/schema as mandatory dependencies for type-safe effects and validation

Files:

  • package.json
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: ProverCoderAI/docker-git

Timestamp: 2026-06-20T05:33:53.132Z
Learning: Use the Effect-TS guide from the effect-ts-skills repository (ProverCoderAI/effect-ts-skills) for compliance work when tasks mention $effect-ts-guide
Learnt from: CR
Repo: ProverCoderAI/docker-git

Timestamp: 2026-06-20T05:33:53.132Z
Learning: Run 'bun run effect:skill:check' to validate OpenAPI Effect client boundary compliance with the strict Effect-TS profile
Learnt from: CR
Repo: ProverCoderAI/docker-git

Timestamp: 2026-06-20T05:33:53.132Z
Learning: For exploratory migration scans, use the bundled checker script: 'bash .codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh <paths> --profile minimal' or '--profile strict'
Learnt from: CR
Repo: ProverCoderAI/docker-git

Timestamp: 2026-06-20T05:33:53.132Z
Learning: When updating the effect-ts-guide skill from upstream, follow the update procedure: clone the repository, copy the skill directory, and run 'bun run effect:skill:check' to verify
🪛 LanguageTool
.codex/skills/effect-ts-guide/references/manual-writing-rules.md

[style] ~20-~20: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... immediately convert to typed errors. - Avoid raw Promise chains. - Keep `Effect.ru...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

.codex/skills/effect-ts-guide/references/best-practices.md

[style] ~14-~14: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...Match.exhaustivefor union handling. - UseEffect.tryandEffect.tryPromise` on...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

🪛 markdownlint-cli2 (0.22.1)
.codex/skills/effect-ts-guide/SKILL.md

[warning] 20-20: Ordered list item prefix
Expected: 1; Actual: 3; Style: 1/1/1

(MD029, ol-prefix)


[warning] 26-26: Ordered list item prefix
Expected: 1; Actual: 4; Style: 1/1/1

(MD029, ol-prefix)


[warning] 32-32: Ordered list item prefix
Expected: 1; Actual: 5; Style: 1/2/3

(MD029, ol-prefix)


[warning] 33-33: Ordered list item prefix
Expected: 2; Actual: 6; Style: 1/2/3

(MD029, ol-prefix)


[warning] 34-34: Ordered list item prefix
Expected: 3; Actual: 7; Style: 1/2/3

(MD029, ol-prefix)

🔇 Additional comments (7)
.codex/skills/effect-ts-guide/SKILL.md (2)

3-3: Проверить соответствие description в SKILL.md с PR objectives.

Строка 3 содержит description, которое ограничивает applicability скилла на "explicitly Effect-related" задачи. Нужно убедиться, что это соответствует намерениям PR и SDD процессу (из coding guidelines).

Проверьте, что это description совпадает с исходным TЗ/issue для этого PR. Из PR objectives видно, что PR вносит "vendored Codex skill effect-ts-guide", но нет явного ТЗ/спеки. Рекомендуется:

  1. Найти связанный issue/ТЗ
  2. Убедиться, что description в SKILL.md отражает полный scope
  3. Если TЗ не документирован, рассмотреть добавление его в PR description

Based on coding guidelines, ты должен быть SPEC DRIVEN DEVELOPMENT: перед выводами изучи README.md, другие *.md файлы, linked issues, PR description, PR comments/discussion и релевантную кодовую базу. Нужно найти и сверить с исходным ТЗ/спекой.

Source: Coding guidelines


8-34: Нумерация в разделе Workflow корректна — нет markdownlint ошибок.

Пункты списка в разделе Workflow (строки 8–34) последовательно пронумерованы от 1 до 7. Это соответствует стандарту Markdown и требованиям markdownlint. Замечание об ошибках нумерации неверно.

			> Likely an incorrect or invalid review comment.
.codex/skills/effect-ts-guide/references/editor-tooling.md (1)

13-13: Никаких действий не требуется — расширение актуально и поддерживается.

VSCode расширение effectful-tech.effect-vscode подтверждено как доступное на VS Code Marketplace и активно поддерживаемое командой Effect-TS. Последний релиз вышел в конце 2025 года (версия 0.9.0), и расширение задокументировано как официальный инструмент на сайте Effect framework. Рекомендация в строке 13 точна и не требует обновления.

.codex/skills/effect-ts-guide/references/platform-map.md (1)

3-12: Все перечисленные компоненты @effect/platform актуальны и корректно названы.

Компоненты в строках 3-12 (HttpClient, FileSystem, Path, Command, Runtime, PlatformLogger) действительно существуют в @effect/platform. Большинство обозначены как стабильные; HttpClient находится в статусе экспериментального. Документ не требует обновления по причине версионных изменений.

.codex/skills/effect-ts-guide/agents/openai.yaml (1)

1-8: ⚡ Quick win

Конфигурация agent валидна, но default_prompt требует уточнения контекста.

Файл agents/openai.yaml правильно структурирован для Codex, включая display_name, short_description и allow_implicit_invocation. Синтаксис и содержимое соответствуют спецификации skill.

Однако: в default_prompt (строка 4) упоминается "run the bundled checker from the skill directory first", но не указано где находится skill-директория для конечного пользователя. Это может создать confusion для новых пользователей, особенно если skill-пути различаются в разных установках (user-scoped vs repo-scoped).

Рекомендация: уточнить prompt для явной ссылки на документацию SKILL.md или на команду bun run effect:skill:check из package.json:

default_prompt: "Use $effect-ts-guide to review or implement Effect-TS code. Run 'bun run effect:skill:check' for project-scoped checks, or see SKILL.md for manual usage."
docs/integrations/effect-ts-skills.md (1)

33-47: ⚡ Quick win

Update procedure использует /tmp с потенциальной уязвимостью к таймаутам и очистке; также не проверяется наличие upstream commits.

Процедура обновления (строки 38-41) имеет два риска:

  1. Временная директория: /tmp/effect-ts-skills может быть удалена при перезагрузке системы или очистке temp. Если команда прерывается между git clone и cp -R, результат может быть partial.

  2. Отсутствие проверки коммита: нет проверки, что ProverCoderAI/effect-ts-skills содержит ожидаемый коммит или ветку. Если upstream удалит эту ветку или переименует путь, команда clone выполнится успешно, но скопирует неправильный код.

Рекомендация:

#!/bin/bash
set -euo pipefail

TMPDIR="${TMPDIR:-/tmp}"
WORK_DIR="$(mktemp -d "$TMPDIR/effect-ts-skills-XXXXXX")"
trap "rm -rf \"$WORK_DIR\"" EXIT

git clone --depth 1 \
  https://github.com/ProverCoderAI/effect-ts-skills.git \
  "$WORK_DIR"

# Verify the expected source path exists
if [ ! -d "$WORK_DIR/plugins/effect-ts-skills/skills/effect-ts-guide" ]; then
  echo "ERROR: Source path not found after clone" >&2
  exit 1
fi

rm -rf .codex/skills/effect-ts-guide
cp -R "$WORK_DIR/plugins/effect-ts-skills/skills/effect-ts-guide" \
  .codex/skills/effect-ts-guide

echo "Updated. Running effect:skill:check..."
bun run effect:skill:check

Это гарантирует: (1) автоматическую очистку temp, (2) проверку структуры после clone, (3) ясную диагностику при ошибке.

Source: Coding guidelines

package.json (1)

53-53: ⚖️ Poor tradeoff

Hardcoded пути в npm script без валидации существования файлов; требуется точка отладки при регрессии.

Script effect:skill:check передаёт 7 путей прямо в run-effect-ts-check.sh, но нет runtime check что файлы существуют. Если разработчик:

  • переименует packages/app/src/web/api-database.tsdb-api.ts
  • переместит packages/openapi/srcpackages/open-api/src
  • удалит файл вообще

…то скрипт сработает, но effect-ts-check не найдёт файл и упадёт с cryptic ошибкой. CI упадёт, но автор не получит указание что конкретно сломалось.

Рекомендация: добавить в начало скрипта валидацию:

"effect:skill:check": "bash -c 'for f in packages/app/src/web/api-create-project.ts packages/app/src/web/api-database.ts packages/app/src/web/api-http.ts packages/app/src/web/api-prompts.ts packages/app/src/web/api-skills.ts packages/app/src/web/api-tasks.ts packages/openapi/src; do [ -e \"$f\" ] || { echo \"ERROR: required path missing: $f\" >&2; exit 1; }; done' && bash .codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh packages/app/src/web/api-create-project.ts packages/app/src/web/api-database.ts packages/app/src/web/api-http.ts packages/app/src/web/api-prompts.ts packages/app/src/web/api-skills.ts packages/app/src/web/api-tasks.ts packages/openapi/src --profile strict"

Либо (лучше): выделить paths в const и использовать скрипт:

#!/bin/bash
# scripts/effect-ts-check.sh
set -euo pipefail
PATHS=(
  "packages/app/src/web/api-create-project.ts"
  "packages/app/src/web/api-database.ts"
  "packages/app/src/web/api-http.ts"
  "packages/app/src/web/api-prompts.ts"
  "packages/app/src/web/api-skills.ts"
  "packages/app/src/web/api-tasks.ts"
  "packages/openapi/src"
)
for path in "${PATHS[@]}"; do
  [ -e "$path" ] || { echo "ERROR: $path not found" >&2; exit 1; }
done
bash .codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh "${PATHS[@]}" --profile strict

…и в package.json:

"effect:skill:check": "bash scripts/effect-ts-check.sh"

Это: (1) делает ошибку явной, (2) упрощает maintenance, (3) позволяет добавить future checks без переписания package.json.

Comment thread .codex/skills/effect-ts-guide/references/best-practices.md Outdated
Comment on lines +8 to +12
SKILL_DIR=<directory containing this SKILL.md>
bash "$SKILL_DIR/scripts/run-effect-ts-check.sh" .
```

Resolve `scripts/run-effect-ts-check.sh` relative to the skill directory. The wrapper resolves the bundled `effect-ts-check` tarball without assuming a specific install location such as `~/.codex`.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial | 💤 Low value

Неясная инструкция по определению переменной SKILL_DIR.

Строки 8-12 рекомендуют пользователю задать SKILL_DIR=<directory containing this SKILL.md>, но не объясняют, как найти эту директорию в контексте установки скилла в ~/.codex/skills/effect-ts-guide/. Для типичного пользователя это может быть неочевидно.

Рекомендация: привести конкретный пример пути или объяснить, как определить директорию программно (например, через разыменование ссылки на SKILL.md).

Альтернатива: если скрипт всегда вызывается из skill directory, можно обновить инструкцию:

Run this first:

\`\`\`bash
-SKILL_DIR=<directory containing this SKILL.md>
-bash "$SKILL_DIR/scripts/run-effect-ts-check.sh" .
+cd $(dirname $(cd $(dirname "$0") && pwd))  # Navigate to skill directory
+bash ./scripts/run-effect-ts-check.sh .
\`\`\`

Или более явно:

\`\`\`bash
+# If this SKILL.md is in ~/.codex/skills/effect-ts-guide/SKILL.md:
+SKILL_DIR=~/.codex/skills/effect-ts-guide
 bash "$SKILL_DIR/scripts/run-effect-ts-check.sh" .
\`\`\`
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/references/lint-checks.md around lines 8 - 12,
The instruction for setting SKILL_DIR in the lint-checks.md file is vague and
doesn't clearly indicate the actual directory path for typical users. Replace
the generic placeholder text "SKILL_DIR=<directory containing this SKILL.md>"
with a concrete example showing the actual path like
"SKILL_DIR=~/.codex/skills/effect-ts-guide" to make it immediately clear to
users what directory they need to reference, or alternatively provide an
explanation of how to determine the skill directory programmatically if the
script location can vary.

Comment on lines +18 to +20
- Avoid `async/await` in product logic.
- Avoid `try/catch` except at boundaries where you immediately convert to typed errors.
- Avoid raw `Promise` chains.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial | 💤 Low value

Повторение слова "Avoid" в начале трёх последовательных пунктов.

Строки 18-20 начинаются с одного слова ("Avoid"), что может снизить читаемость документа. Хотя функционально это корректно, рекомендуется разнообразить формулировки для лучшего восприятия.

Пример переработки:

- Avoid `async/await` in product logic.
+ Use `Effect.gen`, `Effect.map`, and `pipe()` instead of `async/await`.
- Avoid `try/catch` except at boundaries where you immediately convert to typed errors.
+ Use `Effect.try` and `Effect.tryPromise` only at boundaries where errors convert to typed forms.
- Avoid raw `Promise` chains.
+ Replace raw `Promise` chains (`.then()/.catch()`) with Effect composition.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Avoid `async/await` in product logic.
- Avoid `try/catch` except at boundaries where you immediately convert to typed errors.
- Avoid raw `Promise` chains.
- Use `Effect.gen`, `Effect.map`, and `pipe()` instead of `async/await`.
- Use `Effect.try` and `Effect.tryPromise` only at boundaries where errors convert to typed forms.
- Replace raw `Promise` chains (`.then()/.catch()`) with Effect composition.
🧰 Tools
🪛 LanguageTool

[style] ~20-~20: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ... immediately convert to typed errors. - Avoid raw Promise chains. - Keep `Effect.ru...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/references/manual-writing-rules.md around
lines 18 - 20, The three consecutive bullet points in the manual writing rules
section starting at line 18 all begin with the word "Avoid", creating repetitive
phrasing that reduces readability. Rewrite these bullet points to vary the
sentence structure and wording while preserving the same guidance about
async/await, try/catch, and Promise chains. For example, consider using
different phrasings such as "Do not use", "Prefer avoiding", or restructuring as
positive guidance to create better visual and linguistic variety across the
three related recommendations.

}
trap cleanup EXIT

corepack pnpm --dir "$REPO_ROOT/packages/effect-ts-check" pack --pack-destination "$TMP_DIR"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Зависимость от существования packages/effect-ts-check без проверки.

Строка 15 предполагает, что packages/effect-ts-check существует и содержит корректный package.json для pnpm pack, но скрипт не проверяет наличие этой директории перед запуском corepack pnpm --dir.

Рекомендация: добавить явную проверку наличия директории и возможность информативной ошибки:

TMP_DIR="$(mktemp -d)"

+if [[ ! -d "$REPO_ROOT/packages/effect-ts-check" ]]; then
+  printf 'Source package directory not found: %s/packages/effect-ts-check\n' "$REPO_ROOT" >&2
+  exit 1
+fi
+
cleanup() {
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh at
line 15, The script executes the corepack pnpm pack command in the
`packages/effect-ts-check` directory without first verifying that the directory
exists. Add a check before the pnpm command to verify that the directory
`$REPO_ROOT/packages/effect-ts-check` exists, and if it does not exist, output a
clear error message and exit the script with a non-zero status code to prevent
the script from continuing with invalid assumptions.

Comment on lines +7 to +15
TARBALLS=("$ASSET_DIR"/prover-coder-ai-effect-ts-check-*.tgz)
shopt -u nullglob

if [[ "${#TARBALLS[@]}" -eq 0 ]]; then
printf 'Bundled effect-ts-check tarball not found in: %s\n' "$ASSET_DIR" >&2
exit 1
fi

TARBALL="${TARBALLS[0]}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Find and examine the target script
fd -t f "run-effect-ts-check.sh" && cat -n ".codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh"

Repository: ProverCoderAI/docker-git

Length of output: 725


🏁 Script executed:

# Look for the referenced refresh-effect-ts-check-asset.sh
fd -t f "refresh-effect-ts-check-asset.sh" && cat -n "$(fd -t f 'refresh-effect-ts-check-asset.sh')"

Repository: ProverCoderAI/docker-git

Length of output: 103


🏁 Script executed:

# Check the assets directory structure
fd -t f "effect-ts-check" --type directory && find . -path "*effect-ts-check*" -type d

Repository: ProverCoderAI/docker-git

Length of output: 436


🏁 Script executed:

# Search for references to TARBALLS and asset handling
rg "TARBALLS|effect-ts-check.*tgz" -A 3 -B 3

Repository: ProverCoderAI/docker-git

Length of output: 50


🏁 Script executed:

# List files in the assets directory
ls -lah "./.codex/skills/effect-ts-guide/assets/effect-ts-check/" 2>/dev/null || echo "Directory listing failed"

Repository: ProverCoderAI/docker-git

Length of output: 273


🏁 Script executed:

# Search for refresh-effect-ts-check-asset.sh
fd -t f "refresh-effect-ts-check-asset"

Repository: ProverCoderAI/docker-git

Length of output: 50


🏁 Script executed:

# Search for patterns related to asset generation and tarball handling
rg "prover-coder-ai-effect-ts-check" -t sh

Repository: ProverCoderAI/docker-git

Length of output: 50


🏁 Script executed:

# Look for documentation about the naming convention in docs/integrations
fd -t f "integrations" && find . -path "*/docs/integrations*" -type f | head -20

Repository: ProverCoderAI/docker-git

Length of output: 139


🏁 Script executed:

# Search for refresh scripts more broadly
fd -t f "refresh.*effect" -o fd -t f ".*refresh.*" | head -20

Repository: ProverCoderAI/docker-git

Length of output: 192


🏁 Script executed:

# Look at the effect-ts skills documentation
cat -n "./docs/integrations/effect-ts-skills.md"

Repository: ProverCoderAI/docker-git

Length of output: 2165


🏁 Script executed:

# Search for any script that creates or manages the tarballs
rg "prover-coder-ai-effect-ts-check" --type sh -B 5 -A 5

Repository: ProverCoderAI/docker-git

Length of output: 50


🏁 Script executed:

# Look at the .codex directory structure
find "./.codex" -type f -name "*.sh" | head -20

Repository: ProverCoderAI/docker-git

Length of output: 204


🏁 Script executed:

# Examine the refresh script mentioned in the review
cat -n "./.codex/skills/effect-ts-guide/scripts/refresh-effect-ts-check-asset.sh"

Repository: ProverCoderAI/docker-git

Length of output: 978


🏁 Script executed:

# Check how many tarballs might be generated
find "./.codex/skills/effect-ts-guide/assets/effect-ts-check" -name "*.tgz" -type f

Repository: ProverCoderAI/docker-git

Length of output: 165


🏁 Script executed:

# Search for any documentation about asset generation and versioning
rg "effect-ts-check" -t md

Repository: ProverCoderAI/docker-git

Length of output: 640


Добавить валидацию ровно одного tarball файла перед использованием.

На строке 15 скрипт берёт первый найденный tarball без проверки, что найден ровно один файл. Хотя скрипт refresh-effect-ts-check-asset.sh (строки 21-24) строго гарантирует ровно один файл в директории, сам скрипт run-effect-ts-check.sh не защищен от этого предположения.

Рекомендуется добавить ту же валидацию:

if [[ "${`#TARBALLS`[@]}" -ne 1 ]]; then
  printf 'Expected exactly one effect-ts-check tarball, found %s\n' "${`#TARBALLS`[@]}" >&2
  exit 1
fi

Это обеспечит консистентность и защиту от непредвиденных сценариев (например, ручного добавления файлов в директорию).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.codex/skills/effect-ts-guide/scripts/run-effect-ts-check.sh around lines 7
- 15, The script currently only checks if no tarballs are found but does not
validate that exactly one tarball exists before using it on the line where
TARBALL is assigned to TARBALLS[0]. Add a validation check after the existing
empty check that verifies the TARBALLS array contains exactly one element
(length equals 1), and if not, print an error message indicating the expected
count versus the actual count found and exit with status 1. This ensures the
script is protected against scenarios where multiple tarballs or unexpected file
states occur.

@skulidropek skulidropek force-pushed the codex/add-effect-ts-skills branch from 099da38 to c48c94e Compare June 20, 2026 05:44
@skulidropek

skulidropek commented Jun 20, 2026

Copy link
Copy Markdown
Member Author

AI Session Backup

Commit: c48c94e
Status: success
Files: 19 (35.65 MB)
Links: README | Manifest

git status

On branch codex/add-effect-ts-skills
Your branch is up to date with 'origin/codex/add-effect-ts-skills'.

nothing to commit, working tree clean

@skulidropek skulidropek marked this pull request as ready for review June 20, 2026 05:55
@skulidropek skulidropek merged commit c52e98e into main Jun 20, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant