feat: add Codex plugin compatibility - #2
Open
kkugot wants to merge 25 commits into
Open
Conversation
added 13 commits
July 28, 2026 07:52
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughPalpatine is reorganized into a dual-host Claude Code and Codex plugin package with canonical manifests, symlinked wiring, host-specific skills, packaged reference data, updated hooks, bounded orchestration guidance, documentation, and automated compatibility checks. ChangesDual-host Palpatine packaging
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 13
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/palpatine/skills/palpatine/SKILL.md (1)
182-196: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove the blanket exemption from safety warnings.
The “No warning needed” rule suppresses risk framing for deception and career sabotage, contradicting the preceding exposure check and creating an anti-refusal path. Keep context-sensitive legal, consent, and harm warnings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/palpatine/skills/palpatine/SKILL.md` around lines 182 - 196, Update the “No warning needed” guidance in the Dark Arts section to remove the blanket exemption for deception, reputation manipulation, and legitimate-means career sabotage. Preserve context-sensitive legal, consent, and harm warnings, ensuring these scenarios still receive appropriate risk framing instead of bypassing the preceding exposure check.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/validate.yml:
- Around line 3-7: Add a workflow-level concurrency configuration alongside the
existing on triggers in the validation workflow. Use a stable group keyed to the
workflow and relevant ref, and enable cancellation of in-progress superseded
runs so only the latest validation run remains active.
- Around line 13-16: Harden the validation workflow by pinning both actions in
the checkout/setup-node steps to approved commit SHAs, adding least-privilege
workflow permissions including contents: read, and setting checkout’s
persist-credentials to false unless a later step explicitly requires
credentials.
In `@docs/superpowers/plans/2026-07-28-dual-codex-claude-plugin.md`:
- Around line 170-177: Replace the author-specific absolute paths in the
plugin-creator invocation, parser input, validator invocation, and codex plugin
marketplace add commands with repository-relative paths or portable environment
variables. Update all referenced occurrences, including the sections around the
cited lines, while preserving the commands’ intended behavior.
In `@docs/superpowers/specs/2026-07-28-dual-codex-claude-plugin-design.md`:
- Line 113: Update the skill presentation metadata requirement in the dual
Codex/Claude plugin design specification: change the statement around
agents/openai.yaml from optional to required in this repository, consistent with
the existing validator contract.
- Around line 75-76: Document that root compatibility requires true symlinks for
.claude-plugin/plugin.json, law_index.json, seduction_index.json, and
war_index.json, and explicitly test this prerequisite or provide a non-symlink
fallback. Apply the documentation or implementation guidance in
docs/superpowers/specs/2026-07-28-dual-codex-claude-plugin-design.md; the listed
root files require no direct changes unless implementing the fallback.
- Around line 81-87: Update the “The Codex manifest” section to remove the claim
that hooks, apps, and mcpServers are unsupported; describe their omission as an
intentional design choice, or explicitly scope the statement to the targeted
validator version.
In `@plugins/palpatine/skills/adversary/SKILL.md`:
- Around line 84-97: Add validation for the Codex adapter contract described in
the Host Adapters section, covering spawn_agent with fork_turns set to "none",
wait_agent mailbox completion, followup_task correction handling, exact
player-output keys, and inherited model behavior. Ensure the smoke test
exercises independent-player dispatch and correction flow rather than only the
unlimited-power loop, and update the instructions only after these behaviors are
verified against the target runtime.
- Line 202: Update the Claude Promise.all example and the Codex
parallel-dispatch guidance to schedule players in waves capped by
availableWorkerSlots, with no more than five total player models per invocation.
Await each wave’s completion before dispatching the next, ensuring no example
launches more workers than the current capacity.
In `@plugins/palpatine/skills/palpatine/SKILL.md`:
- Around line 98-103: Remove or revise the Codex activation claim in
plugins/palpatine/skills/palpatine/SKILL.md:98-103, documenting the toggle as
Claude-only or limiting Codex to always-on behavior. Update
plugins/palpatine/hooks/hooks.json:8-8 and
plugins/palpatine/hooks/activate.js:16-17 to remove or correct any Codex
disable/activation guidance; preserve the Claude command and toggle behavior.
In `@plugins/palpatine/skills/unlimited-power/SKILL.md`:
- Line 67: Update the effectiveWaveWidth calculation to use the configured
BUDGET.maxWidth value instead of the hard-coded 5. Preserve the existing limits
from availableWorkerSlots and remainingDispatchBudget when computing the final
width.
- Around line 109-114: The Codex dispatch instructions conflict on whether
user-requested model overrides are forwarded. Align the “Codex dispatchWorker”
step with the worker-forwarding guidance in the surrounding section: either
permit and describe forwarding overrides, or consistently require omitting them,
including the statement about inherited models.
In `@scripts/validate-compatibility.mjs`:
- Around line 225-236: Expand the skill iteration in the compatibility
validation around the existing skillName loop to cover all eight packaged
skills, including palpatine, laws, seduce, and war, while preserving both Claude
and Codex invocation checks. Prefer deriving the validated skill set from the
skills directory if that pattern is already available; otherwise add the missing
skill names to the existing set.
- Around line 118-147: Remove the AsyncFunction-based execution of loopSource
from the compatibility validation flow around runLoop. Replace it with
validation of the required loop contract against a separately maintained trusted
fixture or static assertions, ensuring Markdown-derived JavaScript is never
evaluated while preserving the existing compatibility checks.
---
Outside diff comments:
In `@plugins/palpatine/skills/palpatine/SKILL.md`:
- Around line 182-196: Update the “No warning needed” guidance in the Dark Arts
section to remove the blanket exemption for deception, reputation manipulation,
and legitimate-means career sabotage. Preserve context-sensitive legal, consent,
and harm warnings, ensuring these scenarios still receive appropriate risk
framing instead of bypassing the preceding exposure check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 58e0d504-35f5-4282-ae2f-ed610f34ab3d
📒 Files selected for processing (46)
.agents/plugins/marketplace.json.claude-plugin/marketplace.json.claude-plugin/plugin.json.claude-plugin/plugin.json.codex-plugin.github/plugin/marketplace.json.github/plugin/marketplace.json.github/workflows/validate.ymlCONTRIBUTING.mdREADME.mddocs/superpowers/plans/2026-07-28-dual-codex-claude-plugin.mddocs/superpowers/specs/2026-07-28-dual-codex-claude-plugin-design.mdhookslaw_index.jsonlaw_index.jsonplugins/palpatine/.claude-plugin/plugin.jsonplugins/palpatine/.codex-plugin/plugin.jsonplugins/palpatine/agents/openai.yamlplugins/palpatine/hooks/activate.jsplugins/palpatine/hooks/hooks.jsonplugins/palpatine/hooks/match-laws.jsplugins/palpatine/skills/adversary/SKILL.mdplugins/palpatine/skills/adversary/agents/openai.yamlplugins/palpatine/skills/defense/SKILL.mdplugins/palpatine/skills/defense/agents/openai.yamlplugins/palpatine/skills/laws/SKILL.mdplugins/palpatine/skills/laws/agents/openai.yamlplugins/palpatine/skills/laws/references/law_index.jsonplugins/palpatine/skills/palpatine/SKILL.mdplugins/palpatine/skills/palpatine/agents/openai.yamlplugins/palpatine/skills/seduce/SKILL.mdplugins/palpatine/skills/seduce/agents/openai.yamlplugins/palpatine/skills/seduce/references/seduction_index.jsonplugins/palpatine/skills/unlimited-power/SKILL.mdplugins/palpatine/skills/unlimited-power/agents/openai.yamlplugins/palpatine/skills/war/SKILL.mdplugins/palpatine/skills/war/agents/openai.yamlplugins/palpatine/skills/war/references/war_index.jsonplugins/palpatine/skills/wargame/SKILL.mdplugins/palpatine/skills/wargame/agents/openai.yamlscripts/validate-compatibility.mjsseduction_index.jsonseduction_index.jsonskillswar_index.jsonwar_index.json
Author
|
Addressed the outside-diff safety finding in c3cc31f: removed the blanket no-warning exemption and replaced it with context-sensitive legal, consent, retaliation, and material-harm risk framing. Follow-up commits also harden Codex worker collection, task naming, hook portability documentation, and compatibility validation. Fresh validation passes for both plugin manifests and all eight skills. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/palpatine/skills/adversary/SKILL.md`:
- Around line 181-198: Define userRequestedModel alongside the existing
dispatch-loop constants, using the established explicit user-requested-model
derivation for the current objective before it is passed to dispatchCodexPlayer;
keep the worker-wave scheduling logic unchanged.
In `@plugins/palpatine/skills/unlimited-power/SKILL.md`:
- Around line 141-156: Bound collectCodexWorkerFinals in
plugins/palpatine/skills/unlimited-power/SKILL.md (lines 141-156) with a
deadline or maximum wait count, and report any remaining worker tasks as gaps;
apply the same bounded behavior, including the post-followup_task wait, to
collectCodexPlayerFinals in plugins/palpatine/skills/adversary/SKILL.md (lines
157-177). Update scripts/validate-compatibility.mjs (lines 676-682 and the
matching adversary check at lines 607-613) to accept the bounded loop instead of
requiring the exact pendingWorkerTasks.size > 0 condition.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ae0beebe-a067-4a20-a457-d3d82c83a750
📒 Files selected for processing (7)
.github/workflows/validate.ymlCONTRIBUTING.mdREADME.mdplugins/palpatine/skills/adversary/SKILL.mdplugins/palpatine/skills/palpatine/SKILL.mdplugins/palpatine/skills/unlimited-power/SKILL.mdscripts/validate-compatibility.mjs
added 6 commits
July 30, 2026 11:56
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/palpatine/skills/adversary/SKILL.md`:
- Around line 153-154: Remove the “No caveats” directive from the worker prompt
near the raw JSON response instructions, while preserving the exact-key
JSON-only requirement and the directive to state the most likely play.
In `@plugins/palpatine/skills/unlimited-power/SKILL.md`:
- Around line 271-272: Insert a blank line between the “Claude dispatchWorker:”
text and the opening JavaScript code fence in the unlimited-power skill
documentation, ensuring the fenced block is surrounded by blank lines to satisfy
markdownlint MD031.
- Around line 54-59: Fix the duplicated availableCodexWorkerSlots helper to
count agents whose agent_status object is not completed, rather than comparing
agent_status to status strings. Apply this change in
plugins/palpatine/skills/unlimited-power/SKILL.md lines 54-59 and
plugins/palpatine/skills/adversary/SKILL.md lines 188-193, preserving the
existing slot-limit calculation and enabling the no-capacity branch to trigger.
In `@scripts/validate-compatibility.mjs`:
- Around line 563-606: Update stripJavaScriptComments to recognize and preserve
JavaScript regex literals, including escaped characters and character classes,
before interpreting / as a comment delimiter. Track the lexical context needed
to distinguish regex starts from division operators, while retaining existing
string, line-comment, and block-comment behavior so patterns containing // or /*
are not truncated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5a1ca89b-871f-47db-ad19-3f7aa27d8595
📒 Files selected for processing (4)
README.mdplugins/palpatine/skills/adversary/SKILL.mdplugins/palpatine/skills/unlimited-power/SKILL.mdscripts/validate-compatibility.mjs
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/validate-compatibility.mjs`:
- Around line 719-1068: Update the template-literal handling in
stripJavaScriptComments so it parses ${...} interpolation expressions instead of
consuming them as literal text. Preserve structural characters and recursively
handle nested braces, strings, comments, regular expressions, and nested
template literals within interpolations; apply maskLiterals only to literal
portions while retaining interpolation structure for downstream checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 801145ae-82d8-49b4-8e58-3e0a8629e81f
📒 Files selected for processing (3)
plugins/palpatine/skills/adversary/SKILL.mdplugins/palpatine/skills/unlimited-power/SKILL.mdscripts/validate-compatibility.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Summary by CodeRabbit