Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/proggarapsody/bitbottle/04-code-qualitygit clone --depth 1 https://github.com/proggarapsody/bitbottleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03976 |
| Opus 5 | $0.00000 | $0.01988 |
| Sonnet 5 | $0.00000 | $0.00795 |
| Haiku 4.5 | $0.00000 | $0.00398 |
Grade A, and why
04-code-quality scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
04 — Code Quality Analysis: Cycles 158–187
Analyst: code-quality agent · Dataset:
dataset.json+ git log v1.119.0..HEAD +stream-2026-06-01-cycles-178-187.md
TL;DR
Six DJ BLOCKERs escaped to main in cycles 178–187, all confirmed real (0 false positives). The defect classes are: missing test file (×2), API-default mismatch (×1), duplicated abstraction (×1), wrong format helper (×1), zero-value flag bug (×1). Core repo conventions — paging.Collect, typed errors, ContentTypePolicy, conventional commits — are consistently followed in the new feature code. The one structural gap that predates this window and persists through it is systemic under-coverage of tier-2 integration tests: 42 command packages exist, 8 have *_integration_test.go files (19%). Cycles 158–177 added ~20 new command packages and none got tier-2 tests. DJ only started flagging this in cycles 185 and 187 because those packages (repo/sync, commit) already had integration test neighbours in the same directory tree.
Escaped-defect catalogue
All 6 BLOCKERs were caught by DJ after auto-merge (post-merge race, not pre-merge miss).
| Cycle | Scope | Defect | Class | Root cause | Fix commit |
|---|---|---|---|---|---|
| 180 | REPO-HOOK-SCRIPTS | handlers_repohook_test.go not created |
Missing test — MCP triplet incomplete | TDD subagent wrote handlers_repohook.go + tools_repohook.go but omitted the *_test.go counterpart required by the MCP handler triplet convention |
0a3b2e9 (+142 lines) |
| 183 | DEPLOY-KEY-PERMISSION | add_deploy_key MCP tool defaulted permission="" while CLI --permission defaulted to "read" |
API-default mismatch | GetString("permission", "") in the handler used empty string; the CLI flag used "read" as the default. The two surfaces became inconsistent |
a1c6116 (+46 lines) |
| 184 | REPO-PIPELINE-VAR-VIEW | variableView handler inlined a 3-case scope switch identical to the logic in shared.ResolveVariableOps / ops.GetVariableByKey; also skills/references/variable.md not updated with the new view subcommand |
Duplicated logic + missing doc | TDD subagent implemented scope dispatch directly in the MCP handler instead of delegating to the existing shared ops layer. The reference doc omission was a separate checklist miss | f7b2ba6 (−70/+41 LOC net; 4 files) |
| 185 | REPO-SYNC | Custom isJSONRequested(cmd) function used instead of standard format.ConfigFromCmd(cmd) + format.RegisterOutputFlags(cmd); sync_integration_test.go absent |
Wrong abstraction + missing test | The subagent wrote a 14-line private helper that re-implements flag lookup by name. The format package already provides this as a one-liner, also wires --json/--yaml/--jq/--template as a bundle |
e01a4c3 (+138 lines; replaces the helper, adds 4-test integration suite) |
| 186 | ADMIN-RATE-LIMIT | setRun guarded RequestsPerHour != 0 and ThrottleWaitMS != 0 to decide whether to apply a partial update; setting either flag to 0 was silently ignored |
Zero-value flag bug | The common flag.Changed() pattern (already used for --enabled via EnabledSet) was not extended to the two int flags; their zero value was the guard instead of Flags().Changed() |
b3ca126 (+50 lines; adds RequestsPerHourSet/ThrottleWaitMSSet) |
| 187 | COMMIT-SEARCH | search_integration_test.go absent |
Missing test | Same root cause as cycle 185: the TDD subagent produced unit tests (search_test.go), API tests, MCP handler tests, and a txtar script but did not produce a tier-2 pkg/cmd/commit/search_integration_test.go |
7bfe6b6 (+159 lines) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 193 lines · 0 tokens per session scan A 9c785e438bd6
04-code-quality is an agent published in the GitHub repository proggarapsody/bitbottle (3 stars, last pushed 14d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,976 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
validation
How to run checks in this repository without rebuilding all 38 packages for a two-file change.
e2e-testing
pnpm expo run:ios pnpm expo run:android.
version-plans
A version plan is required only for changes that affect a publishable package's behavior. Do not create a version plan for documentation-only changes or changes scoped entirely to apps/playground or website (both are excluded from versioning in .changeset/config.json).
playground-testing
Rozenite DevTools plugins. Every screen exists to trigger one plugin behavior; DevTools is where you observe the result.
plugin-development
src/tests/release-bundle.test.ts proving its DevTools panel cannot reach a shipped app; plugins exporting a bundler integration (./metro) guard that too. See release bundle testing.
debugger
Debugs errors, test failures, and unexpected behavior. Knows PromptScript architecture.