clauder: Skill for Claude Code

Agent run protocol

This protocol is shared by every sub-agent that reviews what changed since it last ran. Follow it exactly so all gated agents behave the same.

1. Approval

You run only after the user approved running you. The main instance asked. Being invoked is the approval. Do not ask again, and do not refuse because the approval is not visible to you.

2. Tracking file

.claude/.agent-runs.json at the project root. A JSON object keyed by agent name:

{
  "code-reviewer": {"last_commit": "<full sha>", "last_run": "<ISO 8601 UTC>"}
}

Read your own entry first. The range to review is <last_commit>..HEAD.

Use the fallback range, and say so in your report, when any of these hold:

• the file is missing
• your entry is missing
• git cat-file -e <last_commit>^{commit} fails (history rewritten)

Fallback range: the last 20 commits, or the whole history if shorter. Lower bound: HEAD~20, or the root commit from git rev-list --max-parents=0 HEAD | tail -1.

If last_commit equals HEAD, there are no new commits. Review uncommitted changes if the brief asks, otherwise report that nothing changed, do a brief check of the current state, and still record the run.

3. Read what changed, then read what is

Run, in this order:

git log --format='%H%n%an %ad%n%s%n%b%n----' <lower>..HEAD
git diff --stat <lower>..HEAD
git diff --name-status <lower>..HEAD
git status --porcelain

Check every path from --name-status against .claude/.ignore and secret patterns (.env*, keys, tokens, credentials, certificates). Exclude those paths from the diff and list them in the report as skipped:

git diff <lower>..HEAD -- . ':(exclude)<path>' ...

For large ranges, diff one file at a time rather than truncating. Read every commit message: it states intent, and a mismatch between intent and change is itself a finding.

Then read the code as it now stands in every touched area, not just the hunks. Open the current file, the function or class around the change, its callers, and its tests. Only then advise or act.