bug-fix

A structured bug-fixing workflow that takes a problem from reproduction and evidence-based cause finding through approval, implementation, testing, and cleanup.

In plain words
What is it for?
Use it to investigate reported bugs, identify the responsible files and code paths, implement an approved fix, and verify the result.
Why use it?
It reduces guesswork by requiring proof of the cause before changes and proof from tests or a build after the fix.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/rushengzhou/sid-code/bug-fix
Any agent
npx skills add rushengzhou/sid-code --skill bug-fix
Clone the repo
git clone --depth 1 https://github.com/rushengzhou/sid-code

Made for: Claude Code, Codex.

Per session 62 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,128 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00062 $0.02128
Opus 5 $0.00031 $0.01064
Sonnet 5 $0.00012 $0.00426
Haiku 4.5 $0.00006 $0.00213

Measured yesterday against content hash c3766a2b2a29, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bug-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/core/src/skill/builtin/bug-fix/SKILL.md · 132 lines

How it starts

The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bug Fix Skill — 半自动修复标准作业流程(SOP)

你是 sid-code 内置的 bug-fix Skill,负责把一个 bug 从「报错」走到「已验证修复」的完整闭环。 你的核心原则是 要证据、不拍脑袋:每个根因结论都要有 file:line 实证,每个"已修复"都要有测试/构建通过的实证。

这是「为 AI 代码兜底」叙事里的修复环节——code-review 只读不改、负责发现问题;bug-fix 负责落地修复。 两者职责互补,本 Skill 会写代码(allowed-tools 含 write/edit),因此必须经过 plan mode + 人工审批才动手。


0. 执行总纲(六步,顺序不可跳)

Step 1 复现与范围确认  →  Step 2 定位根因(要证据)  →  Step 3 plan 出方案
   →  [人工审批]  →  Step 4 实现  →  Step 5 测试验证  →  Step 6 清理与汇报

开始前先用 todo_write 把这六步登记成 todo,逐步推进、逐步勾掉,避免长任务中途遗漏环节。


Step 1:复现与范围确认

  1. 读取用户给的报错信息 / 失败用例 / 异常堆栈,提炼出确切的失败现象(什么输入 → 期望什么 → 实际什么)。
  2. grep / glob 圈定涉及的文件与符号(报错里的函数名、文件名、错误文案是最好的检索锚点)。
  3. 如果项目可运行:先跑一次复现bash 跑相关测试 / 启动命令),亲眼确认失败,而不是假设它失败。
    • 跑不起来 / 缺环境 → 如实说明,基于静态阅读继续,但在汇报里标注"未实测复现"。

产出:一句话描述确切失败现象 + 一份"嫌疑文件清单"。


Step 2:定位根因(要证据,不拍脑袋)

  1. read 读嫌疑文件的完整相关段落(不只看片段——很多根因要靠上下文才能看清)。
  2. 沿调用链追:谁调用了它、它依赖什么、数据从哪来到哪去,一直追到真正的根因,而非表层症状。
  3. 每一个根因结论都必须引用 file:line 实证
    • ✅ "根因在 src/query/empty-param.ts:43-48isEmptyToolInput({}) 对任何空对象返回 true,不看工具是否本就无参数。"
    • ❌ "可能是参数校验有问题"(无位置、无证据 → 禁止)。
  4. 区分根因症状:报错出现的地方往往不是根因所在。改症状不改根因 = 没修。

⚠️ 红线 RL-FIX-1:未拿到 file:line 证据前,不得进入 Step 3 出方案。


Step 3:进入 plan mode 出修复方案

  1. 调用 enter_plan_mode 进入计划模式。
  2. 在计划文件里写清三件事:
    • 根因:用 Step 2 的 file:line 证据链说明问题出在哪、为什么会触发。
    • 修复点:要改哪些文件、改成什么样、为什么这样改能根治(而非打补丁掩盖症状)。
    • 验证方式:改完怎么证明修好了(跑哪些测试、补哪些用例、构建是否通过)。
  3. 评估影响面与可逆性:是否触及共享状态 / 删除数据 / 改动认证或基础设施——高风险点在 plan 里显式标注。
  4. 调用 exit_plan_mode 提交人工审批审批通过前不写任何代码。

这一步是 bug-fix 做成 activate 模式的原因:只有在主对话里才能进 plan mode 并等用户审批 (子代理被禁止进入 plan mode)。


Step 4:实现

审批通过后再动手:

  1. 按方案用 write / edit 落地修复。遵守全局文件编辑规范:
    • 改动 > 30 行或同文件改 3 处以上 → 用 write 整块覆盖,不要连续 edit
    • editold_string 要带上下文保证唯一;连续失败 2 次立即重新 read 再改。
    • 禁止三连点省略占位符:代码里 NEVER 用 // ... rest of 代替已存在代码。
  2. 只解决被问的那个 bug:不顺手重构无关代码、不加方案外的功能。
  3. 如需排查复杂分支,可临时加调试日志;修复确认后必须在 Step 6 清理掉

红线 RL-FIX-2:不修改测试断言来"让测试变绿"。测试暴露的是问题,不是要被改的对象。

Read the full file on GitHub · 132 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 132 lines · 62 tokens per session scan A c3766a2b2a29

Subscribe to this mod's changes

bug-fix is a skill published in the GitHub repository rushengzhou/sid-code (2 stars, last pushed 2d ago), licensed MIT. It adds 62 tokens to every session and 2,128 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

omd-contract

把审议结论结晶成正式契约文档落盘 docs/plan/,当 /omd-execute 的执行契约。承接 /omd-grill 的决策记录表,写给没有对话上下文的执行器看。含 crystallize/crystals 职能。Trigger:/omd-contract、定契约、写成执行契约、写成 SDD、SDD、结晶、方案定了记下来、列结晶。.

AbyssCN/oh-my-dag · 105 tokens

omd-grill

锁 plan/SDD 前的对抗式审问:沿决策树走、先给推荐答案、事实自查·技术 Decision 自裁·真 owner 岔口才阻塞问、对标外部实现逼问「为何偏离」;宽解岔口就地开 council;产决策记录表喂 /omd-contract。审议纪律:只讨论不动手。Trigger:/omd-grill、审问、盘问这个方案、把这事讨论清楚、压测计划、stress-test。.

AbyssCN/oh-my-dag · 122 tokens

omd-video

视频→逐段结构化笔记 (MiMo-v2.5 原生吃画面+音频, 非 whisper 转写; 可重入管线)。讲解/课程视频里 PPT 框架图/代码/提示词是画面独有、音频拿不到的信息。产 ALL-NOTES.md 交 /omd-council 或 dagresearch 做综合。Trigger:/omd-video、抖音/B站/YouTube 讲解视频、课程系列、把这些视频学一遍/提炼、画面里有代码/图表/PPT。Skip:文字原文综合→/omd-council;网页内容→dagresearch(检索版)。.

AbyssCN/oh-my-dag · 155 tokens

omd-docs-drift

文档漂移追踪:确定性死路径/死锚闸(bun test 常驻)之外的语义半——按 docs/docs-map.md 声明表裁出「文档 ↔ 变更源」对, 经 dagrun 派 Sonnet 座逐对判"文档原句是否还站得住", 出口恒为 suggested 票, 人 confirm。Trigger:/omd-docs-drift、查文档漂移、文档跟没跟上代码、docs drift。.

AbyssCN/oh-my-dag · 119 tokens

omd-audit

安全专项审计:经 omd run 派多视角安全审查 DAG,按信任边界清单扫注入/认证/fail-open + untrusted 入口校验覆盖率,产按严重度排序的结构化报告。Trigger:/omd-audit、安全审计、查漏洞、信任边界、security review。.

AbyssCN/oh-my-dag · 80 tokens

omd-research-deep

终极档深度调研:种子作者化多角度抓取 + council 分解 + 多轮缺口补挖,一条工具调用出整领域 grounded 报告。Trigger:/omd-research-deep、深度调研、deep research、整领域调研、调研到 grounded 底座、把这个领域研究透。Skip:轻量单点查证(tavily 直查)/ 单问题综合(dagresearch 默认档)/ 代码理解(dag-map)。.

AbyssCN/oh-my-dag · 117 tokens