version-matrix-impact-reviewer

version-matrix-impact-reviewer is an agent for Claude Code from hmj1026/dhpk. It costs 116 tokens per session (2,080 once invoked), scanned A, original, MIT.

A review helper for libraries tested against several dependency-version combinations in continuous integration (CI). It examines changes to version-specific code, dependency constraints, and CI test matrices before releases.

In plain words
What is it for?
Use it when changing version-specific PHP code, Composer requirements, or GitHub Actions matrices, or before tagging a release.
Why use it?
It shows which dependency combinations a change could affect, so developers can run the smallest relevant set of tests instead of the entire matrix locally.

Agent for Claude Code

Written for Claude Code: effort in frontmatter. Also seen: model in frontmatter.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the dhpk plugin — 65 skills, 31 commands, 37 agents, 4 hooks shipped together

Good fit Use it when changing version-specific PHP code, Composer requirements, or GitHub Actions matrices, or before tagging a release.

Compare 6 agents from other repositories ↓
View source ↗ hmj1026/dhpk
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add hmj1026/dhpk
Claude Code
/plugin install dhpk

Made for: Claude Code.

Or install dhpk, the plugin that ships this one along with the rest of its 65 skills, 31 commands, 37 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for version-matrix-impact-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/hmj1026/dhpk/version-matrix-impact-reviewer.svg)](https://agentmods.dev/agents/hmj1026/dhpk/version-matrix-impact-reviewer)
Your own site
<a href="https://agentmods.dev/agents/hmj1026/dhpk/version-matrix-impact-reviewer"><img src="https://agentmods.dev/badge/agents/hmj1026/dhpk/version-matrix-impact-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 116 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,080 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00116 $0.02080
Opus 5 $0.00058 $0.01040
Sonnet 5 $0.00023 $0.00416
Haiku 4.5 $0.00012 $0.00208

Measured 8d ago against content hash 0d6a8ae246f3, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

version-matrix-impact-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/version-matrix-impact-reviewer.md · 176 lines

How it starts

The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Version Matrix Impact Reviewer

Beyond path matching: confirm the real blast radius with gitnexus_impact({target, direction:"upstream"}) (or cx references --name X) — a file in src/Laravel/ called only from a Core-tier symbol narrows the affected cells. Optional external tools; fall back to Grep / path heuristics when absent. See ${CLAUDE_PLUGIN_ROOT}/rules/tool-routing.md.

For PHP packages whose composer constraint spans multiple major versions of a key dependency (Laravel 6–11, Monolog 2/3, PHPUnit 8–11). The question this agent answers is "which of the N cells in the CI matrix could this diff break, and what's the minimum subset I need to run locally before pushing?"

Mental model: the diff is a query, the CI matrix is a table, and the answer is a SELECT — which rows of the matrix touch the changed code. Running the full matrix in CI is fine; running it locally for every change is wasteful. This agent finds the minimum-correct subset.

When NOT

  • Per-file guard coverage → polyfill-reviewer. This agent is the diff blast radius across matrix cells.

Detect stack (run once at start)

# composer constraint — the *declared* matrix
cat composer.json 2>/dev/null | python3 -c "import json,sys;d=json.load(sys.stdin);print('PHP=',d.get('require',{}).get('php',''));[print(k,'=',v) for k,v in d.get('require',{}).items() if k!='php'];[print(k,'=',v) for k,v in d.get('require-dev',{}).items()]" 2>/dev/null

# CI matrix — the *executed* matrix (only the rows CI actually runs)
ls .github/workflows/*.yml .gitlab-ci.yml 2>/dev/null

# Testsuite mapping — which test dirs run for which scenario
test -f phpunit.xml && grep -A2 'testsuite' phpunit.xml | head -20

# Diff to analyse — staged first, then unstaged, then last commit
git diff --staged --name-only 2>/dev/null
git diff --name-only 2>/dev/null

If composer.json has no || in any constraint and CI has no matrix: key, this agent has nothing to do — exit immediately with "single-version project; matrix audit not applicable."

Read the full file on GitHub · 176 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 176 lines · 116 tokens per session scan A 0d6a8ae246f3

Subscribe to this mod's changes

version-matrix-impact-reviewer is an agent published in the GitHub repository hmj1026/dhpk (2 stars, last pushed yesterday), licensed MIT. It adds 116 tokens to every session and 2,080 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

data-model-reviewer

A critical review agent for checking a database design before tables, migrations, or access rules are implemented.

andrewcigan/vibe-dev-plugin · 134 tokens

adversarial-reviewer

Plays "what could go wrong" against a Wave's diff. Surfaces race conditions, edge cases, silent failures, and operability gaps that other reviewers miss. Triggered LAST in the review pipeline (after spec-compliance and security have completed) so it can avoid duplicating their findings.

iroha924/mumei · 66 tokens

security-reviewer

Reviews a Wave's diff for OWASP Top 10 vulnerabilities introduced in this change. Triggered automatically by /mumei:compose after a Wave is implemented. Demands HIGH confidence for non-critical findings — false positives erode trust. Does NOT cover code quality, spec, or correctness.

iroha924/mumei · 63 tokens

spec-compliance-reviewer

Reviews a Wave's implementation against requirements.md and tasks.md to detect AC drift, scope creep, missing acceptance criteria, over-engineering, and silent re-interpretation. Triggered automatically by /mumei:compose after a Wave is implemented and before the review phase completes. Does NOT review code quality…

iroha924/mumei · 78 tokens

design-reviewer

Reviews a draft design.md against the approved requirements.md. Detects coverage gaps (ACs without a corresponding design element), missing architectural artifacts (no diagram, no Components, no Trade-offs), and Wave Plan defects (granularity unfit for tasks decomposition). Triggered automatically by /mumei:compose…

iroha924/mumei · 89 tokens

issue-validator

Re-validates a single finding produced by another reviewer with fresh context. Returns valid / invalid / unsure. Triggered by /mumei:compose after the 3 reviewers complete (spec-compliance / security / adversarial) — invoked once per finding in parallel for severity=HIGH/CRITICAL findings. Filters false positives…

iroha924/mumei · 74 tokens