Skip to content

feat(skills): replace legacy skills with vendored officecli skill bundle - #707

Merged
Astro-Han merged 9 commits into
devfrom
claude/officecli-skill-bundle
May 18, 2026
Merged

feat(skills): replace legacy skills with vendored officecli skill bundle#707
Astro-Han merged 9 commits into
devfrom
claude/officecli-skill-bundle

Conversation

@Astro-Han

@Astro-Han Astro-Han commented May 17, 2026

Copy link
Copy Markdown
Owner

Summary

Drop the three legacy built-in skills (data-analysis, document-processing, writing-assistant) and vendor officecli's 9 SKILL.md files (officecli-docx/xlsx/pptx, officecli-pitch-deck, officecli-academic-paper, officecli-financial-model, officecli-data-dashboard, morph-ppt, morph-ppt-3d) into skills/. Each vendored SKILL.md gets a fixed PawWork override blockquote injected after its frontmatter; companion files (editing.md, creating.md, reference/**) are vendored byte-for-byte alongside SKILL.md so the cross-doc links that upstream SKILL.md text relies on resolve in packaged builds. A new sync-officecli-skills.ts maintenance script handles vendor + override + content-deterministic SHA256 validation, and the existing officecli-bump.yml workflow now runs sync as part of each bump PR.

Why

The three legacy skills were authored for the long-removed "pills" onboarding UI. Their descriptions (~15 words each) lose the description-quality competition against Anthropic's anthropic-agent-skills (xlsx/docx/pptx, ~150 words each) when both are installed, routing Office tasks away from PawWork's bundled officecli binary. Upstream officecli ships SKILL.md files with matching description hardness, so vendoring them restores PawWork's Office differentiation.

Related Issue

Closes #697.

Human Review Status

Pending. A human should make the final merge decision after reviewing the final diff and verification evidence.

Review Focus

  • Confirm skills/ diff shows upstream byte-equivalent content for every file under each skill dir (SKILL.md + companion docs + reference/**), plus the fixed PawWork override blockquote injected only into each SKILL.md.
  • Confirm officecli.skillsTarballSha256 in bundled-tools.json matches the computed content SHA shown by sync-skills (= 4797152b826fa8c1ee31dcb1291cd2dcbcb7931ccabe75751bdebff78ce0d485).
  • Confirm .github/workflows/officecli-bump.yml still passes the meta-test guard (packages/opencode/test/github/officecli-bump-workflow.test.ts) — all locked substrings preserved.
  • Confirm electron-builder.config.ts skills/ filter is **/* so companion docs that packages/opencode/src/tool/skill.ts:39-48 exposes as sibling files (<skill_files>) are present in packaged Resources. SKILL.md cross-doc references such as [editing.md](editing.md) must resolve in the packaged app.

Risk Notes

  • Deviation from issue scope: issue [Task] Replace built-in skills with officecli's own skill bundle #697 lists "Modifying upstream skill content" as out of scope. This PR injects a fixed 5-line PawWork override blockquote after each SKILL.md's frontmatter; upstream content is otherwise byte-identical (companion docs are vendored verbatim). Rationale: upstream's ## Setup section instructs curl ... install.sh / irm ... install.ps1, which contradicts PawWork's bundled-binary stance. Override is positioned before any setup body content so the model sees the bundling note first. Documented in THIRD_PARTY_NOTICES.md per Apache-2.0 4(b)/4(c).
  • Upstream skill count: spec and plan assumed 10 skills at v1.0.63; actual upstream tag ships 9 (no officecli-word-form). Sync script handles either count — no skill-count assumption in code.
  • No runtime download: sync is a manual / workflow-only maintenance step. Cold offline launch and rate-limited devices are unaffected.
  • macOS + Windows packaging: electron-builder filter is **/* under skills/, so the packaged Resources/skills/ mirrors the repo skills/ tree exactly (SKILL.md + companion docs + reference assets). Bundle grows from ~600 KB (SKILL.md only) to ~2 MB; the increase is dominated by morph-ppt/reference/styles/*/*.pptx upstream templates. Negligible against existing Electron app footprint. No path or signing changes.

How To Verify

bun --cwd packages/desktop-electron test                                  394 pass, 0 fail
bun --cwd packages/opencode test                                          2753 pass, 9 skip, 1 todo, 0 fail
bun --cwd packages/app run test:unit                                      1165 pass, 0 fail
bun --cwd packages/desktop-electron test sync-officecli-skills            23 pass (injectOverride + computeContentSha + extractTarball + pruneSkillsDir + syncSkills, incl. companion-doc preservation + byte identity + stale-companion cleanup)
bun --cwd packages/opencode test officecli-bump-workflow                  1 pass (meta-test locks preserved)
bun run typecheck                                                         8 successful
bun --cwd packages/desktop-electron run typecheck:release                  0 errors (release tsconfig includes sync script)
bun --cwd packages/desktop-electron run sync-skills (re-run) + git status  working tree clean (idempotent)

Not verified in this session and to be confirmed by reviewer manually with bun run dev:desktop:

  • Excel chip + real .xlsx routes to officecli-xlsx (description competition vs ~/.agents/skills/xlsx/ if installed).
  • officecli --version works from PTY terminal panel and the chat input ! shell mode.
  • Packaged Resources/skills/ contains the 9 bundle dirs with full companion-doc trees, and .app boot does not log skill not found. CI desktop-smoke workflow is expected to cover the packaged path.

Screenshots or Recordings

Not applicable — no visible UI change in this PR.

Checklist

  • Human review status is stated above as pending, approved, or not required
  • I linked the related issue, or stated why there is no issue
  • This PR has exactly one type label (bug, enhancement, task, or documentation), at least one primary routing label (app, ui, platform, harness, or ci), and exactly one priority label (P0 to P3), or I requested maintainer labeling
  • I described the review focus and any meaningful risks
  • I listed the relevant verification steps and the key result for each
  • I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope
  • I manually checked visible UI or copy changes when needed, with screenshots or recordings
  • I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes
  • I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant
  • I reviewed the final diff for unrelated changes and suspicious dependency changes
  • I am targeting dev, and my PR title and commit messages use Conventional Commits in English

Summary by CodeRabbit

  • New Features

    • Added comprehensive OfficeCLI skill support: academic papers, Excel dashboards, Word documents, financial models, and PowerPoint pitch decks.
    • Introduced morph-ppt skill with advanced 3D capabilities.
    • Expanded skill library with 40+ reference styles and builder scripts.
  • Documentation

    • Added complete skill guides, design principles, and quality checklists.
    • Included reference helpers (Python/Bash scripts) for morph transitions and validation.
  • Chores

    • Updated skill synchronization infrastructure and vendored bundle management.
    • Removed legacy skills (data-analysis, document-processing, writing-assistant).
    • Enhanced test coverage for skill sync operations.

Review Change Stack

Astro-Han added 5 commits May 18, 2026 01:08
Add the maintenance script that vendor-syncs officecli SKILL.md files
into repo-root skills/ on demand. The script downloads the upstream tag
tarball, validates a content-deterministic SHA256 against the manifest,
injects a fixed PawWork override blockquote after each file's
frontmatter, and prunes stale officecli-*/morph-ppt* dirs.

Modes:
  bun run sync-skills                  validate SHA, inject, prune
  bun run sync-skills -- --compute-sha download, compute SHA, write manifest, exit
  bun run sync-skills -- --dry-run     do everything except writes

Spec: docs/superpowers/specs/2026-05-17-officecli-skill-bundle-design.md
…c into bump workflow

Bootstrap officecli.skillsTarballSha256 in bundled-tools.json with the
content SHA of v1.0.63's vendored skill files. Update
officecli-bump.yml so the auto-bump PR additionally runs sync-skills,
stages skills/ and the refreshed SHA, and adjusts the PR body to make
the skills/ diff a documented review focus.

This closes the drift window where version bump and skills could land
in different PRs.

Spec: docs/superpowers/specs/2026-05-17-officecli-skill-bundle-design.md
Run sync-officecli-skills to vendor the 9 upstream officecli SKILL.md
files (officecli-docx/xlsx/pptx, officecli-pitch-deck, officecli-academic-paper,
officecli-financial-model, officecli-data-dashboard, morph-ppt, morph-ppt-3d).
Each file has a PawWork override blockquote injected after its
frontmatter; the rest of the content is byte-identical to upstream
v1.0.63.

Also tighten the electron-builder extraResources filter for skills/ from
"**/*" to "**/SKILL.md" so future sync temporary files or .DS_Store
cannot leak into the packaged Resources/skills/.

The legacy data-analysis/document-processing/writing-assistant directories
are still present in this commit; they are removed in the next commit
together with their test assertions.

Spec: docs/superpowers/specs/2026-05-17-officecli-skill-bundle-design.md
…g-assistant

Drop the three legacy skills that were authored for the long-removed
"pills" onboarding UI. Their descriptions (~15 words) lose the model's
description-quality competition against Anthropic's anthropic-agent-skills
xlsx/docx/pptx (~150 words), routing Office tasks away from PawWork's
bundled officecli binary. The officecli skill bundle vendored in the
previous commit replaces them with matching description hardness.

Update test assertions: skill.test.ts "discovers bundled skills" now
asserts officecli-docx/xlsx/pptx; the legacy-specific structure-assertion
test "bundled productivity skills enforce clarify-first workflow" is
removed because officecli skills do not share that internal layout.
session-skill.test.ts switches to officecli-docx as the persistence
fixture name.

Spec: docs/superpowers/specs/2026-05-17-officecli-skill-bundle-design.md
…NOTICES

Document that PawWork vendors OfficeCLI's SKILL.md files alongside the
binary, all under Apache-2.0. State the local modification (a fixed
PawWork override blockquote injected after each file's frontmatter)
and the sync entrypoint, satisfying Apache-2.0 4(b)/4(c) requirements.

Spec: docs/superpowers/specs/2026-05-17-officecli-skill-bundle-design.md
@Astro-Han Astro-Han added task Narrow execution, audit, spike, migration, tracking, or upstream follow-up work platform Electron shell, OS integration, packaging, updater, signing, paths, and permissions labels May 17, 2026
@github-actions github-actions Bot added ci Continuous integration / GitHub Actions platform Electron shell, OS integration, packaging, updater, signing, paths, and permissions harness Model harness, prompts, tool descriptions, and session mechanics labels May 17, 2026
@coderabbitai

coderabbitai Bot commented May 17, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@Astro-Han has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 22 minutes and 23 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: aaaaf57b-fbdf-4ac4-aa88-5158429f95ed

📥 Commits

Reviewing files that changed from the base of the PR and between 5f56d86 and 9b96788.

📒 Files selected for processing (1)
  • packages/opencode/test/skill/skill.test.ts
📝 Walkthrough

Walkthrough

Adds a sync script and tests to vendor OfficeCLI skills from releases, integrates it into the OfficeCLI bump workflow, updates manifest/config/tests, removes legacy skills, and adds extensive OfficeCLI skill/reference documentation under skills/.

Changes

OfficeCLI Skills Sync and Library Update

Layer / File(s) Summary
End-to-end skills sync and library replacement
.github/workflows/officecli-bump.yml, packages/desktop-electron/*, packages/opencode/test/*, skills/*
Workflow runs sync to compute SHA and vendor skills; manifest/config updated; tests reflect new skills; legacy skills removed; OfficeCLI skill docs and morph references added.

Sequence Diagram(s)

sequenceDiagram
  participant Developer
  participant GH Actions
  participant Sync CLI (bun)
  participant Upstream Tarball
  participant Repo

  Developer->>GH Actions: Trigger officecli bump
  GH Actions->>Sync CLI (bun): sync --compute-sha
  Sync CLI (bun)->>Upstream Tarball: download/extract skills/*
  Sync CLI (bun)->>Repo: update bundled-tools.json (skillsTarballSha256)
  GH Actions->>Sync CLI (bun): sync (verify SHA, write skills)
  Sync CLI (bun)->>Repo: inject overrides, write skills/, prune
  GH Actions->>Repo: git add skills/ + bundled-tools.json, open PR
Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related issues

Possibly related PRs

Suggested labels

enhancement, upstream, desktop

Poem

A rabbit with Bun and a SHA to weigh,
Hopped to the tarball, brought skills our way.
Morphs now dance; old scrolls retire—
Docs aglow like slides on fire.
Commit, prune, verify—hip hooray!
Syncing the warren, the OfficeCLI way. 🐇✨

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch claude/officecli-skill-bundle

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested priority: P2 (includes non-doc, non-test paths outside the low-risk bucket).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.

@Astro-Han Astro-Han added the P1 High priority label May 17, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 11

🧹 Nitpick comments (3)
packages/opencode/test/skill/skill.test.ts (1)

459-466: ⚡ Quick win

Expand bundled-skill assertions to cover the full vendored set.

This test currently validates only 3 positive skill names, so it can miss regressions where some of the other newly vendored skills disappear from the bundle. Consider asserting all expected officecli/morph skill names introduced by this migration.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/opencode/test/skill/skill.test.ts` around lines 459 - 466, The test
only asserts three positive bundled skills but should assert the complete set of
vendored officecli/morph skill names to catch regressions; update the assertions
in the test that references the skills array (variable skills in skill.test.ts)
to include expect(...).toBeDefined() checks for every expected vendored skill
name (e.g., all officecli-* and morph-* names introduced by the migration) and
keep the existing negative assertions for legacy names (data-analysis,
document-processing, writing-assistant); ensure each expected name is referenced
exactly as a string in the skills.find checks so missing items fail the test.
skills/morph-ppt-3d/SKILL.md (1)

58-61: ⚡ Quick win

Add missing fenced-code languages (MD040).

These code blocks should specify a language (text, bash, etc.) to satisfy markdownlint and keep doc quality consistent.

Also applies to: 103-121, 407-415

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/morph-ppt-3d/SKILL.md` around lines 58 - 61, The fenced code blocks in
SKILL.md (e.g., the block containing "Search: '[topic keyword] 3d model glb free
download' / Example: 'fox 3d model glb free download' and the other blocks at
lines 103-121 and 407-415) are missing a language tag and trigger markdownlint
MD040; update each triple-backtick fence to include an appropriate language
identifier (for example use "text" for plain search/example snippets or "bash"
if they are shell examples) so the blocks read ```text or ```bash accordingly,
preserving the existing content and formatting.
skills/morph-ppt/SKILL.md (1)

26-31: ⚡ Quick win

Add fence languages to satisfy markdownlint MD040.

These fenced blocks are missing language identifiers. Add text (or a concrete language) to avoid lint warnings and keep docs consistent.

Also applies to: 312-318, 365-368

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/morph-ppt/SKILL.md` around lines 26 - 31, The fenced code blocks in
SKILL.md (the triple-backtick blocks containing the slide examples such as the
block starting with "Slide 1: shape name=\"!!circle\" x=5cm  width=8cm" and the
other blocks around the slide examples) are missing language identifiers and
trigger markdownlint MD040; update each triple-backtick fence to include a
language tag (use "text" or another appropriate language) so they become ```text
instead of ``` to satisfy the linter and keep the docs consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/desktop-electron/scripts/sync-officecli-skills.ts`:
- Line 120: The tar extraction call using execFileAsync("tar", ["-xzf",
tarballPath, "-C", extractDir"]) is vulnerable to unsafe entries; update the
extraction in sync-officecli-skills.ts to harden it by either (A) adding safe
tar flags to the execFileAsync invocation such as "--no-absolute-filenames" and
"--warning=no-unknown-keyword" and consider "--strip-components=1" as
appropriate to prevent path traversal and absolute paths, or (B) replace this
direct tar call with a Node.js tar parser (e.g., the tar module) that iterates
entries, validates each entry’s path (reject entries with "..", absolute paths,
or unsafe symlinks), and only writes validated files into extractDir; target the
execFileAsync invocation and the surrounding extraction/cleanup logic so the
extraction rejects or sanitizes unsafe entries before writing.

In `@skills/morph-ppt-3d/SKILL.md`:
- Around line 10-12: The SKILL.md extension for "morph-ppt" references external
style and reference assets that may not be available in packaged skills; update
SKILL.md (the "3D-specific additions" and "enriched design system" sections that
extend morph-ppt) to either bundle the required assets or make the guidance
self-contained by inlining concrete palettes, font pairings, layout tokens, and
any 3D reference images/URLs as embedded data or local examples; specifically
ensure every external dependency referenced by "morph-ppt" and the 3D extension
is replaced with an included asset or substituted with explicit, copy-pastable
values (color hex codes, font stack names, example component specs, and sample
ghosting/verification rules) so the skill can run correctly when only SKILL.md
is distributed.

In `@skills/morph-ppt/SKILL.md`:
- Line 39: The SKILL.md references external helper/docs
(reference/decision-rules.md, reference/pptx-design.md,
reference/officecli-pptx-min.md, reference/styles/INDEX.md,
reference/morph-helpers.py) which will be excluded by the **/SKILL.md resource
filter; either bundle those files into the skill package (add them to the SKILL
resource set and update packaging manifest) or remove/inline the hard links and
any usage text in SKILL.md that points to those files (search for the explicit
reference strings in SKILL.md and replace with embedded guidance or internal
links), ensuring the morph helper functions called from SKILL.md are included or
replaced so runtime doesn’t break.
- Around line 529-532: The examples using name-based selectors (e.g.,
"shape[`@name`=!! ShapeName]") conflict with the documented limitation that
name-based selectors break after transition=morph and also use incorrect syntax;
update those examples to use the supported selector form "/slide[N]/!!ShapeName"
(no spaces inside the name token and no "shape[`@name`=...]" wrapper) for the Edit
shape text, Change color/style and Remove an element examples, and ensure the
Find & replace example continues to use "/" for document-wide operations;
replace each instance of "shape[`@name`=!! ShapeName]" with
"/slide[N]/!!ShapeName" and remove embedded spaces so the examples match the
working examples elsewhere in SKILL.md.

In `@skills/officecli-academic-paper/SKILL.md`:
- Line 75: The table row in SKILL.md currently has a single cell ("Optional:
watermark, charts, custom bordered blocks, cross-references") which breaks the
2-column layout; update that row so it has two cells labeled to match the table
headers (e.g., "Component" and "Description") by splitting into "Optional" in
the first cell and "watermark, charts, custom bordered blocks, cross-references"
in the second cell so the table renders correctly.

In `@skills/officecli-docx/SKILL.md`:
- Around line 45-46: The SKILL.md currently links to external companion docs
editing.md and creating.md which are not included in the packaged skill bundle;
either vendor (add) those two files into the package alongside SKILL.md or
inline the essential guidance from editing.md and creating.md directly into
SKILL.md so the packaged skill is self-contained — update SKILL.md to include
the necessary instructions (or add editing.md and creating.md into the bundle)
and ensure the links/TOC reference the newly included files or sections.
- Around line 15-31: Replace the conflicting upstream install commands for
officecli (the curl | bash and irm | iex install.sh/install.ps1 snippets) with
PawWork-only remediation: keep the initial presence check for "officecli" but,
instead of running remote install scripts, instruct agents to use the
PawWork-approved installer or package mirror (or request the approved package
from PawWork ops), provide the exact PawWork installation command or link to the
internal package (e.g., PawWork package manager or local artifact name), and
include a fallback note to open a PawWork ticket if the package is unavailable;
ensure references to "officecli", "install.sh", and "install.ps1" are removed
from runnable examples.

In `@skills/officecli-financial-model/SKILL.md`:
- Line 199: Update the broken markdown link in SKILL.md: replace the incorrect
reference "[xlsx SKILL.md](../xlsx/SKILL.md)" with the vendored path "[xlsx
SKILL.md](../officecli-xlsx/SKILL.md)" so the link points to the correct
officecli-xlsx SKILL document.

In `@skills/officecli-pitch-deck/SKILL.md`:
- Line 284: Replace the hardcoded color in the example command that violates the
palette-only rule: change the `--prop fill=FF0000` fragment in the `officecli
set deck.pptx '/slide[N]/shape[M]' --prop fill=FF0000` example to use a palette
variable (e.g., `--prop fill=$PRIMARY`) or another neutral placeholder so the
example follows the palette-only / no ad-hoc color policy.

In `@skills/officecli-xlsx/SKILL.md`:
- Around line 11-33: The "BEFORE YOU START (CRITICAL)" section currently gives
upstream installer commands (curl -fsSL ... | bash and irm ... | iex) which
conflict with the PawWork override; remove those curl/irm install snippets and
replace the block with PawWork-only troubleshooting: keep the verify step
(officecli --version), instruct users/agents to open a new terminal if not
found, provide a PawWork-safe update/reinstall flow or internal install
instructions (or to contact ops/sysadmin), and explicitly note that upstream
installer scripts must not be run; reference the section header "BEFORE YOU
START (CRITICAL)" and the specific entries "officecli --version", "curl -fsSL
... | bash" and "irm ... | iex" when making the edits.
- Around line 42-43: The MD file SKILL.md currently references sibling docs
editing.md and creating.md which will break when only SKILL.md is bundled;
replace those relative links by either inlining the essential guidance from
editing.md and creating.md directly into SKILL.md, or change the links to
guaranteed/bundled locations (e.g., canonical repo URLs or a docs site) so they
resolve at runtime; update the two table entries ("Edit existing workbook" and
"Create from scratch") to point to the inlined sections or the new stable links
and remove dependency on the local sibling files.

---

Nitpick comments:
In `@packages/opencode/test/skill/skill.test.ts`:
- Around line 459-466: The test only asserts three positive bundled skills but
should assert the complete set of vendored officecli/morph skill names to catch
regressions; update the assertions in the test that references the skills array
(variable skills in skill.test.ts) to include expect(...).toBeDefined() checks
for every expected vendored skill name (e.g., all officecli-* and morph-* names
introduced by the migration) and keep the existing negative assertions for
legacy names (data-analysis, document-processing, writing-assistant); ensure
each expected name is referenced exactly as a string in the skills.find checks
so missing items fail the test.

In `@skills/morph-ppt-3d/SKILL.md`:
- Around line 58-61: The fenced code blocks in SKILL.md (e.g., the block
containing "Search: '[topic keyword] 3d model glb free download' / Example: 'fox
3d model glb free download' and the other blocks at lines 103-121 and 407-415)
are missing a language tag and trigger markdownlint MD040; update each
triple-backtick fence to include an appropriate language identifier (for example
use "text" for plain search/example snippets or "bash" if they are shell
examples) so the blocks read ```text or ```bash accordingly, preserving the
existing content and formatting.

In `@skills/morph-ppt/SKILL.md`:
- Around line 26-31: The fenced code blocks in SKILL.md (the triple-backtick
blocks containing the slide examples such as the block starting with "Slide 1:
shape name=\"!!circle\" x=5cm  width=8cm" and the other blocks around the slide
examples) are missing language identifiers and trigger markdownlint MD040;
update each triple-backtick fence to include a language tag (use "text" or
another appropriate language) so they become ```text instead of ``` to satisfy
the linter and keep the docs consistent.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f175678d-0100-48a6-8090-c730ff85f049

📥 Commits

Reviewing files that changed from the base of the PR and between 94b4792 and 905ed6f.

⛔ Files ignored due to path filters (1)
  • packages/desktop-electron/scripts/__fixtures__/sync-skills/mini-skills.tar.gz is excluded by !**/*.gz
📒 Files selected for processing (22)
  • .github/workflows/officecli-bump.yml
  • THIRD_PARTY_NOTICES.md
  • packages/desktop-electron/bundled-tools.json
  • packages/desktop-electron/electron-builder.config.ts
  • packages/desktop-electron/package.json
  • packages/desktop-electron/scripts/sync-officecli-skills.test.ts
  • packages/desktop-electron/scripts/sync-officecli-skills.ts
  • packages/desktop-electron/tsconfig.release.json
  • packages/opencode/test/session/session-skill.test.ts
  • packages/opencode/test/skill/skill.test.ts
  • skills/data-analysis/SKILL.md
  • skills/document-processing/SKILL.md
  • skills/morph-ppt-3d/SKILL.md
  • skills/morph-ppt/SKILL.md
  • skills/officecli-academic-paper/SKILL.md
  • skills/officecli-data-dashboard/SKILL.md
  • skills/officecli-docx/SKILL.md
  • skills/officecli-financial-model/SKILL.md
  • skills/officecli-pitch-deck/SKILL.md
  • skills/officecli-pptx/SKILL.md
  • skills/officecli-xlsx/SKILL.md
  • skills/writing-assistant/SKILL.md
💤 Files with no reviewable changes (3)
  • skills/writing-assistant/SKILL.md
  • skills/document-processing/SKILL.md
  • skills/data-analysis/SKILL.md

Comment thread packages/desktop-electron/scripts/sync-officecli-skills.ts
Comment thread skills/morph-ppt-3d/SKILL.md
Comment thread skills/morph-ppt/SKILL.md
Comment thread skills/morph-ppt/SKILL.md
Comment thread skills/officecli-academic-paper/SKILL.md
Comment thread skills/officecli-docx/SKILL.md
Comment thread skills/officecli-financial-model/SKILL.md
Comment thread skills/officecli-pitch-deck/SKILL.md
Comment thread skills/officecli-xlsx/SKILL.md
Comment thread skills/officecli-xlsx/SKILL.md

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a synchronization script, sync-officecli-skills.ts, to vendor and inject custom overrides into OfficeCLI SKILL.md files, replacing several legacy internal skills. The changes include updates to the build configuration, manifest files, and existing test suites to accommodate the new skill naming convention. Review feedback suggests adding a timeout to the fetch operation in the sync script to improve robustness and refactoring the manifest parsing logic into a helper function to eliminate redundant I/O and prevent potential data loss during inline casting.

Comment thread packages/desktop-electron/scripts/sync-officecli-skills.ts Outdated
Comment thread packages/desktop-electron/scripts/sync-officecli-skills.ts Outdated
- Add 30s AbortSignal.timeout to tarball fetch so a hung GitHub mirror
  cannot stall the officecli bump workflow indefinitely (gemini-code-assist).
- Drop the redundant readFile/JSON.parse in the --compute-sha branch and
  mutate the already-parsed manifest in place. JSON.stringify still
  serializes the full top-level object, so no key is lost (gemini-code-assist).
- Expand the bundled-skill discovery test to assert every vendored
  officecli/morph skill, not just docx/xlsx/pptx, so a partial sync that
  drops one skill fails CI (coderabbit nitpick).
@Astro-Han

Copy link
Copy Markdown
Owner Author

Review round 1 — applied + push-back summary

Thanks for the thorough pass, @coderabbitai / @gemini-code-assist. Posting a single summary so the rationale is in one place; inline thread replies are individually resolved.

Applied in bd70673

  • gemini L221 — added signal: AbortSignal.timeout(30000) to the tarball fetch.
  • gemini L264 — dropped the redundant readFile/JSON.parse round-trip in the --compute-sha branch (mutates the already-parsed manifest in place; JSON.stringify still preserves every top-level key).
  • coderabbit nitpick on packages/opencode/test/skill/skill.test.ts:459 — expanded the assertion set from 3 to all 9 vendored skill names so a partial sync that drops one skill fails CI.

Not applied — upstream-vendored by design

All inline findings on skills/**/SKILL.md (install snippets, links to editing.md/creating.md, reference/* references, the morph-ppt selector example, the academic-paper table row, the pitch-deck fill=FF0000, the financial-model link, and the MD040 fenced-code language nitpicks on morph-ppt/morph-ppt-3d) are upstream officecli content. The PawWork vendor design is byte-identical upstream + the override blockquote injected after the frontmatter — any other edit breaks the content-SHA verification that sync-officecli-skills.ts runs on every upstream bump (the SHA is computed over the canonical file set; manual edits cause the next sync to hard-fail). The install-snippet conflict in particular is what the override blockquote was designed to neutralize. Content fixes are being filed upstream so they flow back on the next bump.

Not applied — sync-script defense-in-depth (L120 tar extraction)

Tarball source is pinned to a versioned upstream GitHub release tag, the SHA256 over the canonical file set is verified before any write into skills/, and extraction runs inside an isolated mkdtemp that is removed in finally. Switching to a Node tar parser to validate entries before writing would require pre-verifying the SHA on raw tarball bytes (current SHA is computed post-extract so it survives gzip regeneration); that is a larger redesign than this PR's scope. Tracking as a follow-up if we ever drop the pinned-tag/manifest-SHA guarantee.

@gemini-code-assist

Copy link
Copy Markdown

Thanks for the summary, @Astro-Han. The approach of using a deterministic SHA256 check on the vendored skill set is a robust way to ensure the integrity of the vendored OfficeCLI content while allowing for the necessary PawWork-specific overrides.

I have reviewed the changes, and the implementation of the sync-officecli-skills.ts script, along with the integration into the bump workflow and the updated test suite, correctly addresses the infrastructure requirements for managing these vendored skills. The decision to keep the upstream content byte-identical (aside from the injected override) is appropriate for maintaining compliance and ease of future upstream syncs.

Your handling of the feedback—specifically the addition of the AbortSignal timeout and the cleanup of the JSON.parse round-trip—improves the script's reliability and efficiency. The expanded test assertions in skill.test.ts also provide the necessary coverage to prevent regression during future syncs.

This looks ready for merge.

@coderabbitai

coderabbitai Bot commented May 17, 2026

Copy link
Copy Markdown
Contributor

Tip

For best results, initiate chat on the files or code changes.

@Astro-Han: Thanks for the detailed round-1 summary — the applied/not-applied breakdown is very clear.

Applied changes (bd70673) — all three look good:

  • The AbortSignal.timeout(30000) on the fetch is a solid guard.
  • Removing the readFile/JSON.parse round-trip in the --compute-sha branch is the right call since the manifest is already parsed in-memory.
  • Expanding the assertion set to all 9 vendored skill names is the right direction — a partial sync that silently drops one skill will now fail CI immediately.

Not applied — upstream-vendored content — the rationale is well-founded. The content-SHA verification loop means any out-of-band edit to the vendored SKILL.md files will hard-fail on the next sync-officecli-skills.ts run, so keeping them byte-identical upstream + override blockquote is the correct constraint. Filing fixes upstream so they flow in on the next bump is exactly the right process.

Not applied — tar extraction (L120) — the layered defense (pinned release tag + post-extract SHA256 over the canonical file set + isolated mkdtemp/finally) is a reasonable current posture. The point about the SHA being computed post-extract (to survive gzip regeneration) is the key reason a pre-extract raw-byte hash won't work as a straight swap. Would you like me to open a follow-up issue to track the pre-extraction entry-validation hardening for when the pinned-tag/manifest-SHA guarantee changes?

(´。• ᵕ •。`) ♡


✏️ Learnings added
Learnt from: Astro-Han
URL: https://github.com/Astro-Han/pawwork/pull/707

Timestamp: 2026-05-17T22:38:40.918Z
Learning: In the PawWork repository (packages/desktop-electron), the `skills/**/SKILL.md` files under the officecli-* and morph-ppt* directories are upstream-vendored content from officecli. They are kept byte-identical to upstream plus a single PawWork override blockquote injected immediately after the frontmatter. Any manual edits to these files beyond the override blockquote will cause `sync-officecli-skills.ts` to hard-fail on the next upstream bump because the content-deterministic SHA256 (stored in bundled-tools.json as `officecli.skillsTarballSha256`) is computed over the canonical extracted file set. Content fixes should be filed upstream so they flow in on the next version bump. Do not suggest edits to these vendored SKILL.md files in code review.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

Reverses last round's "SKILL-only" packaging scope. The skill tool
(packages/opencode/src/tool/skill.ts:39-48) lists every sibling file
under each skill dir into `<skill_files>` and instructs the model to
follow relative paths like `editing.md` / `reference/*` from SKILL.md.
With the previous `**/SKILL.md` filter, those references resolved to
nothing in the packaged build, so the model would attempt to read
missing companion docs and degrade to guessing commands.

Vendor scope is now `**/*` under each upstream skill dir:

- extractTarball recursively walks `<skill-name>/**`, collecting
  SKILL.md plus companion docs (editing.md, creating.md) and the
  full reference/ subtree (decision-rules.md, morph-helpers.py/.sh,
  styles/*/, etc.).
- syncSkills wipes each upstream skill dir before rewriting so a stale
  companion file from a prior sync (e.g. an upstream rename) cannot
  linger.
- Override blockquote is still only injected into SKILL.md; companion
  files are written byte-for-byte from the tarball.
- Content SHA is recomputed over the full canonical file set
  (4797152b...e0d485) so the next sync hard-fails if upstream retargets
  the tag.
- electron-builder skills filter restored to ["**/*"].
- New SyncOptions.skillsDirOverride lets unit tests drive writes into a
  temp dir; three new tests cover companion preservation, byte identity,
  and stale companion cleanup.

Bundle impact: skills/ grows from 9 SKILL.md (~600KB) to 131 files
(~2MB). morph-ppt/reference/styles/*/*.pptx accounts for most of the
delta (upstream pptx style templates). Negligible against the existing
Electron app footprint.

Byte-identical vendor invariant is preserved — only the override
blockquote inside each SKILL.md is PawWork content. The "we don't
modify upstream text" rule still holds; what changes is the scope of
files we choose to ship.

Verified: desktop-electron 394 pass, opencode 2753 pass / 9 skip / 1
todo / 0 fail, app 1165 pass, typecheck + typecheck:release clean,
sync-skills re-run produces zero diff.
@Astro-Han

Copy link
Copy Markdown
Owner Author

Round 2 — reversed scope decision in 09a86cc

Follow-up to the earlier review summary. A second review pass surfaced a P2 finding I missed: packages/opencode/src/tool/skill.ts:39-48 lists every sibling file under each skill dir into <skill_files> and explicitly tells the model that relative paths like editing.md / reference/* are anchored at the skill base directory. With the previous **/SKILL.md filter, the cross-doc links the upstream SKILL.md text uses (e.g. Read [editing.md](editing.md)) would resolve to nothing in packaged builds — exactly the "agent attempts missing companion docs and degrades to guessing commands" failure mode the reviewer predicted.

My earlier push-back on the four companion-doc threads was based on a wrong premise: I treated SKILL.md-only bundling as a deliberate design choice when it was really an unverified simplification I had assumed was safe. The byte-identical-upstream invariant was conflated with vendor scope; they are separate.

09a86cc widens vendor scope:

  • extractTarball recursively walks <skill-name>/** so SKILL.md + companion docs (editing.md, creating.md) + the full reference/ subtree (decision-rules.md, morph-helpers.py/.sh, styles/*/) all get vendored.
  • syncSkills wipes each upstream skill dir before rewriting, so a stale companion from a prior sync cannot linger after an upstream rename.
  • Override blockquote is still only injected into SKILL.md; companion files are byte-for-byte.
  • New skillsDirOverride SyncOption + three new tests cover companion preservation, byte identity, and stale-companion cleanup.
  • Content SHA recomputed over the full file set (4797152b…e0d485); next sync hard-fails on retarget.
  • electron-builder skills filter restored to ["**/*"].

What stays the same: PawWork modifies zero bytes of upstream content — only the override blockquote inside each SKILL.md is PawWork-introduced. The "we don't edit upstream text" rule still holds; what changed is the set of upstream files we ship.

Bundle impact: skills/ grows from 9 SKILL.md (~600 KB) to 131 files (~2 MB). The growth is dominated by morph-ppt/reference/styles/*/*.pptx (upstream pptx templates). Negligible against existing Electron app footprint.

Verified: desktop-electron 394 pass, opencode 2753 pass / 9 skip / 1 todo / 0 fail, app 1165 pass, typecheck + typecheck:release clean, sync-skills re-run produces zero diff.

The four companion-doc threads (morph-ppt-3d:12, morph-ppt:39, docx:46, xlsx:43) are intentionally left unresolved so the next review pass can confirm the fix. The other push-backs (docx:31 / xlsx:33 install snippets neutralized by the override blockquote, morph-ppt:532 selector example, academic-paper:75 table, financial-model:199 link, pitch-deck:284 palette example, tar-extraction defense-in-depth) still stand on their original rationale.

@Astro-Han

Copy link
Copy Markdown
Owner Author

Round 3 — handling

Three findings reached me out-of-band (not posted as inline comments). Verified each against the current branch; here is how each is resolved.

P3 — PR body stale (fixed). Body updated in this PR. Review Focus now references the correct content SHA (4797152b…e0d485), the electron-builder.config.ts skills/ filter is described as **/* (matching 09a86cc7), the macOS+Windows Risk Notes describe the widened scope and bundle-size impact (~600 KB → ~2 MB, dominated by morph-ppt/reference/styles/*/*.pptx), and the How To Verify counts match latest runs (desktop-electron 394 pass, sync-officecli-skills 23 pass). Memory: feedback_pr_body_iterate_with_impl.md — should have happened at 09a86cc7 time; closing the gap now.

P2 — morph-ppt Adjustments After Creation uses name-based selectors (acknowledged, upstream already fixed). Confirmed locally at skills/morph-ppt/SKILL.md:521-531 — the table still uses /slide[N]/shape[@name=!! ShapeName] while the warning at L51-66 / L380-381 says name-based selectors break post-morph. Checked iOfficeAI/OfficeCLI@main: the file has been rewritten — L488 of the current upstream main reads “Use index paths after morph is set: get /slide[N] --depth 1 to list shapes, then address via /slide[N]/shape[K], exactly the reviewer’s recommendation. Upstream is now at v1.0.93; this branch pins to v1.0.63. Per the PawWork vendor invariant (byte-identical upstream text; the only PawWork-introduced bytes are the 5-line override blockquote), we do not hand-edit vendored content. The fix will land naturally on the next officecli-bump.yml auto-run when the pinned tag advances. Not modified in this PR — matches the reviewer’s own “不建议在本 PR 直接手改 vendored upstream 文本” recommendation.

P2 — officecli-financial-model references ../xlsx/SKILL.md (acknowledged, upstream already fixed). Confirmed locally at skills/officecli-financial-model/SKILL.md:199. Checked upstream main: the link has been replaced with the fully-qualified path “Read skills/officecli-xlsx/SKILL.md first”. Same vendor invariant applies — fix arrives on next bump. Not modified in this PR.

Filing upstream issues is unnecessary because both fixes already exist in tags after v1.0.63. The architectural conclusion stands: PawWork modifies zero bytes of upstream content; the upstream officecli-bump.yml is the channel for content drift.

Sketch of next-bump plan (informational, not part of this PR): a separate PR retargets bundled-tools.json officecli.version to a newer tag (currently v1.0.93); sync-skills --compute-sha recomputes skillsTarballSha256; sync-skills rewrites skills/; both P2 fixes land verbatim from upstream. The binary version bump is part of the same change because the binary and skills share the same pinned tag.

Section L7 said "SKILL.md files" but commit 09a86cc widened
vendor scope to entire skill directories (SKILL.md + companion
docs like editing.md / creating.md + reference/** assets). The
notice now describes the full set so the Apache-2.0 4(b)/4(c)
attribution matches actual distributed content.
@Astro-Han

Copy link
Copy Markdown
Owner Author

P3 notice scope mismatch — fixed in 5f56d8622.

THIRD_PARTY_NOTICES.md L7 now describes the full vendor scope: skill directories (not just SKILL.md files), including companion docs like editing.md / creating.md and the reference/** subtree (decision rules, helper scripts, style templates). The injected-bytes clause is also tightened: the PawWork override blockquote is injected only into each SKILL.md; companion files and the rest of upstream content are byte-for-byte unmodified. Apache-2.0 4(b)/4(c) attribution now matches actual distributed content.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 16

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skills/morph-ppt/reference/decision-rules.md`:
- Around line 103-105: Update the stale hard-coded counts in the "Consider 6
categories" list item inside decision-rules.md (the line showing "dark (16),
light (10), warm (11), bw (5), vivid (6), mixed (7)") so they reflect the
current totals in reference/styles/INDEX.md; either replace the numbers with the
up-to-date counts copied from INDEX.md or remove the inline counts entirely and
add a short note pointing readers to reference/styles/INDEX.md for
authoritative, maintained totals to avoid divergence.

In `@skills/morph-ppt/reference/morph-helpers.py`:
- Around line 243-257: The try/except around
json.loads(curr_json_str).get("data", {}) and the subsequent _check_unghosted
call is swallowing parser/JSON or runtime errors and printing "No unghosted
content detected" which falsely passes verification; change the except to catch
Exception as e, log or print the actual error (include e and the offending
curr_json_str or context), and mark the verification as failed (set has_error =
True) or re-raise so failures don't silently pass; apply the same change to the
similar block handling the other slide check (the second try/except in this
file) so all parser/runtime exceptions surface instead of being treated as
successful verification.
- Around line 100-107: The helper morph_clone_slide currently calls sys.exit(1)
when the morph transition check fails (in the block that calls _run and uses
_has_morph_transition), which can terminate importing callers; change this to
raise a clear exception (e.g. RuntimeError or a custom MorphError) including the
slide number and output details, or alternatively return a falsy status so
callers can handle the failure; update morph_clone_slide to remove sys.exit(1)
and propagate the error via exception (and adjust any callers to catch/handle
it).

In `@skills/morph-ppt/reference/morph-helpers.sh`:
- Around line 141-176: The inline Python snippets (e.g., the block that
populates unghosted_check and the similar block later) currently swallow
exceptions by calling sys.exit(0) in the except clause and redirecting stderr to
/dev/null, which masks parse/quoting failures; change the except handlers to
write the exception message to stderr and call sys.exit(2) (or another non-zero
code) instead of sys.exit(0), stop redirecting stderr (remove 2>/dev/null) when
invoking these Python blocks, and update the Bash logic that consumes those
exits (the code that checks unghosted_check / return codes) to treat exit code 2
as an error (set has_error=1) rather than success so parsing/JSON errors fail
the verification.
- Around line 40-45: The function in morph-helpers.sh is currently calling exit
1 when the transition check fails (the block that sets local trans using
officecli and checks [ -z "$trans" ]), which will terminate the caller's shell
when this script is sourced; change that exit 1 to return 1 so the function
returns an error status instead of killing the calling shell, keeping the
surrounding echo error messages intact and ensuring the caller can handle the
failure.

In `@skills/morph-ppt/reference/pptx-design.md`:
- Around line 312-332: Close the open fenced code block that starts with the
"Format: EFFECT[-DIRECTION]..." line by adding a closing triple-backtick
immediately before the '---' divider so the subsequent "## Design Freedom"
header renders as normal text; also remove any duplicate/trailing backticks at
the end of the section so there's only one closing fence placed right after the
code example.

In `@skills/morph-ppt/reference/styles/bw--swiss-system/style.md`:
- Line 37: The style documentation for bw--swiss-system incorrectly references a
non-existent file build.py; either add a proper build.sh script to the
bw--swiss-system style directory following the same contents/permissions pattern
used by the other 27 styles, or update the style.md text to reference build.sh
(and remove build.py). Locate the offending line in style.md that states
"Complete build script available in `build.py` and replace it with the correct
build script name or add the actual build.sh implementation (ensure executable
bit and matching commands used by other styles).

In `@skills/morph-ppt/reference/styles/dark--premium-navy/build.sh`:
- Line 265: The officecli command invocation that sets slide text currently uses
text="$128M" which Bash will expand as a positional parameter; update the
argument passed to officecli (the command line that references
'/slide[4]/shape[11]') to escape the literal dollar sign so the metric renders
correctly by changing the text value to use an escaped dollar (e.g., "\$128M")
in the --prop text= argument.

In `@skills/morph-ppt/reference/styles/INDEX.md`:
- Line 23: INDEX.md references non-existent style directories
(dark--tech-cosmos, warm--minimal-brand, warm--creative-marketing) which breaks
style selection; open the INDEX.md used by the morph-ppt styles list and remove
the table rows that reference the three keys (dark--tech-cosmos,
warm--minimal-brand, warm--creative-marketing) so only styles that have
corresponding directories in reference/styles/ remain; update the table so
formatting stays valid and commit the file.

In `@skills/morph-ppt/reference/styles/light--glassmorphism-vc/style.md`:
- Line 21: The README in
skills/morph-ppt/reference/styles/light--glassmorphism-vc/style.md points to a
non-existent build.py; update style.md to either remove or correct the dead
relative link, or add the missing build.py into the vendored style directory so
the cross-doc link resolves; ensure the fix aligns with how
packages/opencode/src/tool/skill.ts enumerates sibling files (i.e., include the
referenced file in the packaged payload or change the reference to an existing
sibling file).

In `@skills/morph-ppt/reference/styles/light--spring-launch/style.md`:
- Line 57: The style markdown references a sibling script "build.sh" but that
file is not included in the vendored package, causing a broken relative link;
add the missing build.sh into the style package (next to
styles/light--spring-launch/style.md) or else update
styles/light--spring-launch/style.md to point to an existing script/file or
remove the reference; ensure the referenced filename exactly matches (build.sh)
and is packaged alongside the style so the relative cross-doc link resolves at
runtime.

In `@skills/morph-ppt/reference/styles/mixed--bauhaus-blocks/style.md`:
- Line 96: The reference in style.md to "Complete build script available in
`build.py`" is stale because vendored files for the skill only include style.md;
update the reference so it resolves within the packaged sibling files: either
add the actual build.py into the skill package and keep the reference, or change
the line in style.md to point to the correct relative sibling file that exists
(e.g., a README or build instructions file) — locate the string in style.md
referencing build.py and replace it with the correct relative path or include
the missing build.py file in the package.

In `@skills/morph-ppt/reference/styles/mixed--chromatic-aberration/style.md`:
- Line 82: The reference in styles/mixed--chromatic-aberration/style.md that
points to `build.py` is stale because the vendored files for this style only
include `style.md`; update the reference so cross-doc links resolve against
packaged sibling files by either (A) adding the missing `build.py` into the
style's vendored files, or (B) changing the `build.py` mention in `style.md` to
the correct existing artifact (or removing the dead link) so the relative link
resolves within the skill directory; locate and edit `style.md` to implement the
chosen fix.

In `@skills/morph-ppt/reference/styles/mixed--duotone-split/style.md`:
- Around line 52-56: The table rows S1 through S5 each have only three
pipe-separated cells while the header defines four columns (Slide | Type |
Elements | Description); update each row (S1, S2, S3, S4, S5) to include a
fourth cell for Description (either a short description or an explicit empty
cell like a trailing pipe) so the number of columns matches the header and the
Markdown table renders correctly.

In `@skills/morph-ppt/reference/styles/vivid--candy-stripe/style.md`:
- Around line 57-61: The table rows S1–S5 in style.md are missing the 4th
"Description" column causing column-count lint errors; update each row (S1, S2,
S3, S4, S5) to include a fourth pipe-delimited Description cell that briefly
summarizes intended usage (e.g., "Cover layout with centered title", "Statement
with top color bar", "Three-column card backgrounds", "Data slide with expanded
blue stripe", "Closing footer with inverted gradient") so each row matches the
4-column schema and resolves lint warnings.

In `@skills/morph-ppt/reference/styles/warm--playful-organic/build.sh`:
- Around line 345-353: The loop and subsequent reveals are off-by-one: the
for-loop currently hides slide[5]/shape[24] (the comparison left title) and the
reveal commands expose slide[5]/shape[28] (the CTA title). Fix by changing the
hiding range from {7..24} to {7..23} so shape[24] remains visible, and update
the reveal calls to set slide[5]/shape[24], slide[5]/shape[25],
slide[5]/shape[26], slide[5]/shape[27] (instead of 25..28) with the same x
positions as intended.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a3fa7eb6-495e-4224-98bd-ae36cd41a597

📥 Commits

Reviewing files that changed from the base of the PR and between 905ed6f and 5f56d86.

⛔ Files ignored due to path filters (27)
  • skills/morph-ppt/reference/styles/bw--brutalist-raw/bw__brutalist_raw.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/bw--mono-line/bw__mono_line.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/bw--swiss-bauhaus/bw__swiss_bauhaus.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--architectural-plan/dark__architectural_plan.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--blueprint-grid/dark__blueprint_grid.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--circle-digital/dark__circle_digital.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--cosmic-neon/dark__cosmic_neon.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--cyber-future/dark__cyber_future.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--diagonal-cut/dark__diagonal_cut.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--editorial-story/dark__editorial_story.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--investor-pitch/template.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--liquid-flow/dark__liquid_flow.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--luxury-minimal/dark__luxury_minimal.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--neon-productivity/dark__neon_productivity.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--premium-navy/dark__premium_navy.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--space-odyssey/dark__space_odyssey.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/dark--spotlight-stage/dark__spotlight_stage.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/light--bold-type/light__bold_type.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/light--isometric-clean/light__isometric_clean.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/light--minimal-product/light__minimal_product.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/light--watercolor-wash/light__watercolor_wash.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/mixed--duotone-split/mixed__duotone_split.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/vivid--candy-stripe/vivid__candy_stripe.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/vivid--playful-marketing/vivid__playful_marketing.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/warm--brand-refresh/warm__brand_refresh.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/warm--earth-organic/warm__earth_organic.pptx is excluded by !**/*.pptx
  • skills/morph-ppt/reference/styles/warm--playful-organic/Cat-Secret-Life.pptx is excluded by !**/*.pptx
📒 Files selected for processing (100)
  • THIRD_PARTY_NOTICES.md
  • packages/desktop-electron/bundled-tools.json
  • packages/desktop-electron/scripts/sync-officecli-skills.test.ts
  • packages/desktop-electron/scripts/sync-officecli-skills.ts
  • packages/opencode/test/skill/skill.test.ts
  • skills/morph-ppt/reference/decision-rules.md
  • skills/morph-ppt/reference/morph-helpers.py
  • skills/morph-ppt/reference/morph-helpers.sh
  • skills/morph-ppt/reference/officecli-pptx-min.md
  • skills/morph-ppt/reference/pptx-design.md
  • skills/morph-ppt/reference/quality-gates.md
  • skills/morph-ppt/reference/styles/INDEX.md
  • skills/morph-ppt/reference/styles/bw--brutalist-raw/build.sh
  • skills/morph-ppt/reference/styles/bw--brutalist-raw/style.md
  • skills/morph-ppt/reference/styles/bw--mono-line/build.sh
  • skills/morph-ppt/reference/styles/bw--mono-line/style.md
  • skills/morph-ppt/reference/styles/bw--swiss-bauhaus/build.sh
  • skills/morph-ppt/reference/styles/bw--swiss-bauhaus/style.md
  • skills/morph-ppt/reference/styles/bw--swiss-system/style.md
  • skills/morph-ppt/reference/styles/dark--architectural-plan/build.sh
  • skills/morph-ppt/reference/styles/dark--architectural-plan/style.md
  • skills/morph-ppt/reference/styles/dark--aurora-softedge/style.md
  • skills/morph-ppt/reference/styles/dark--blueprint-grid/build.sh
  • skills/morph-ppt/reference/styles/dark--blueprint-grid/style.md
  • skills/morph-ppt/reference/styles/dark--circle-digital/build.sh
  • skills/morph-ppt/reference/styles/dark--circle-digital/style.md
  • skills/morph-ppt/reference/styles/dark--cosmic-neon/build.sh
  • skills/morph-ppt/reference/styles/dark--cosmic-neon/style.md
  • skills/morph-ppt/reference/styles/dark--cyber-future/build.sh
  • skills/morph-ppt/reference/styles/dark--cyber-future/style.md
  • skills/morph-ppt/reference/styles/dark--diagonal-cut/build.sh
  • skills/morph-ppt/reference/styles/dark--diagonal-cut/style.md
  • skills/morph-ppt/reference/styles/dark--editorial-story/build.sh
  • skills/morph-ppt/reference/styles/dark--editorial-story/style.md
  • skills/morph-ppt/reference/styles/dark--investor-pitch/build.sh
  • skills/morph-ppt/reference/styles/dark--investor-pitch/style.md
  • skills/morph-ppt/reference/styles/dark--liquid-flow/build.sh
  • skills/morph-ppt/reference/styles/dark--liquid-flow/style.md
  • skills/morph-ppt/reference/styles/dark--luxury-minimal/build.sh
  • skills/morph-ppt/reference/styles/dark--luxury-minimal/style.md
  • skills/morph-ppt/reference/styles/dark--midnight-blueprint/style.md
  • skills/morph-ppt/reference/styles/dark--neon-productivity/build.sh
  • skills/morph-ppt/reference/styles/dark--neon-productivity/style.md
  • skills/morph-ppt/reference/styles/dark--obsidian-amber/style.md
  • skills/morph-ppt/reference/styles/dark--premium-navy/build.sh
  • skills/morph-ppt/reference/styles/dark--premium-navy/style.md
  • skills/morph-ppt/reference/styles/dark--sage-grain/style.md
  • skills/morph-ppt/reference/styles/dark--space-odyssey/build.sh
  • skills/morph-ppt/reference/styles/dark--space-odyssey/style.md
  • skills/morph-ppt/reference/styles/dark--spotlight-stage/build.sh
  • skills/morph-ppt/reference/styles/dark--spotlight-stage/style.md
  • skills/morph-ppt/reference/styles/dark--velvet-rose/style.md
  • skills/morph-ppt/reference/styles/light--bold-type/build.sh
  • skills/morph-ppt/reference/styles/light--bold-type/style.md
  • skills/morph-ppt/reference/styles/light--firmwise-saas/style.md
  • skills/morph-ppt/reference/styles/light--fluid-gradient/style.md
  • skills/morph-ppt/reference/styles/light--glassmorphism-vc/style.md
  • skills/morph-ppt/reference/styles/light--isometric-clean/build.sh
  • skills/morph-ppt/reference/styles/light--isometric-clean/style.md
  • skills/morph-ppt/reference/styles/light--minimal-corporate/style.md
  • skills/morph-ppt/reference/styles/light--minimal-product/build.sh
  • skills/morph-ppt/reference/styles/light--minimal-product/style.md
  • skills/morph-ppt/reference/styles/light--project-proposal/style.md
  • skills/morph-ppt/reference/styles/light--spring-launch/style.md
  • skills/morph-ppt/reference/styles/light--training-interactive/style.md
  • skills/morph-ppt/reference/styles/light--watercolor-wash/build.sh
  • skills/morph-ppt/reference/styles/light--watercolor-wash/style.md
  • skills/morph-ppt/reference/styles/mixed--bauhaus-blocks/style.md
  • skills/morph-ppt/reference/styles/mixed--chromatic-aberration/style.md
  • skills/morph-ppt/reference/styles/mixed--duotone-split/build.sh
  • skills/morph-ppt/reference/styles/mixed--duotone-split/style.md
  • skills/morph-ppt/reference/styles/mixed--spectral-grid/style.md
  • skills/morph-ppt/reference/styles/vivid--bauhaus-electric/style.md
  • skills/morph-ppt/reference/styles/vivid--candy-stripe/build.sh
  • skills/morph-ppt/reference/styles/vivid--candy-stripe/style.md
  • skills/morph-ppt/reference/styles/vivid--energy-neon/style.md
  • skills/morph-ppt/reference/styles/vivid--pink-editorial/style.md
  • skills/morph-ppt/reference/styles/vivid--playful-marketing/build.sh
  • skills/morph-ppt/reference/styles/vivid--playful-marketing/style.md
  • skills/morph-ppt/reference/styles/warm--bloom-academy/style.md
  • skills/morph-ppt/reference/styles/warm--brand-refresh/build.sh
  • skills/morph-ppt/reference/styles/warm--brand-refresh/style.md
  • skills/morph-ppt/reference/styles/warm--coral-culture/style.md
  • skills/morph-ppt/reference/styles/warm--earth-organic/build.sh
  • skills/morph-ppt/reference/styles/warm--earth-organic/style.md
  • skills/morph-ppt/reference/styles/warm--monument-editorial/style.md
  • skills/morph-ppt/reference/styles/warm--playful-organic/build.sh
  • skills/morph-ppt/reference/styles/warm--playful-organic/style.md
  • skills/morph-ppt/reference/styles/warm--sunset-mosaic/style.md
  • skills/morph-ppt/reference/styles/warm--vital-bloom/style.md
  • skills/officecli-academic-paper/creating.md
  • skills/officecli-data-dashboard/creating.md
  • skills/officecli-docx/creating.md
  • skills/officecli-docx/editing.md
  • skills/officecli-financial-model/creating.md
  • skills/officecli-pitch-deck/creating.md
  • skills/officecli-pptx/creating.md
  • skills/officecli-pptx/editing.md
  • skills/officecli-xlsx/creating.md
  • skills/officecli-xlsx/editing.md
✅ Files skipped from review due to trivial changes (34)
  • skills/morph-ppt/reference/styles/bw--swiss-bauhaus/style.md
  • skills/morph-ppt/reference/styles/warm--playful-organic/style.md
  • skills/morph-ppt/reference/styles/warm--vital-bloom/style.md
  • skills/morph-ppt/reference/styles/dark--midnight-blueprint/style.md
  • skills/morph-ppt/reference/styles/warm--sunset-mosaic/style.md
  • skills/morph-ppt/reference/styles/dark--cosmic-neon/style.md
  • skills/morph-ppt/reference/styles/warm--monument-editorial/style.md
  • skills/morph-ppt/reference/styles/dark--aurora-softedge/style.md
  • skills/morph-ppt/reference/styles/dark--blueprint-grid/style.md
  • skills/morph-ppt/reference/styles/dark--velvet-rose/style.md
  • skills/morph-ppt/reference/styles/dark--sage-grain/style.md
  • skills/morph-ppt/reference/styles/dark--luxury-minimal/style.md
  • skills/morph-ppt/reference/styles/light--project-proposal/style.md
  • skills/morph-ppt/reference/styles/dark--investor-pitch/style.md
  • skills/morph-ppt/reference/styles/dark--circle-digital/style.md
  • skills/morph-ppt/reference/styles/dark--neon-productivity/style.md
  • skills/morph-ppt/reference/styles/dark--editorial-story/style.md
  • skills/morph-ppt/reference/styles/light--minimal-product/style.md
  • skills/morph-ppt/reference/styles/light--isometric-clean/style.md
  • packages/desktop-electron/bundled-tools.json
  • skills/morph-ppt/reference/styles/dark--architectural-plan/style.md
  • skills/morph-ppt/reference/styles/warm--coral-culture/style.md
  • skills/morph-ppt/reference/styles/dark--spotlight-stage/style.md
  • skills/morph-ppt/reference/styles/light--training-interactive/style.md
  • skills/morph-ppt/reference/styles/dark--space-odyssey/style.md
  • skills/morph-ppt/reference/styles/mixed--spectral-grid/style.md
  • skills/morph-ppt/reference/styles/vivid--playful-marketing/style.md
  • skills/morph-ppt/reference/styles/light--minimal-corporate/style.md
  • skills/morph-ppt/reference/styles/dark--cyber-future/style.md
  • skills/morph-ppt/reference/styles/dark--obsidian-amber/style.md
  • THIRD_PARTY_NOTICES.md
  • skills/morph-ppt/reference/styles/light--firmwise-saas/style.md
  • skills/morph-ppt/reference/styles/dark--cyber-future/build.sh
  • skills/morph-ppt/reference/styles/light--fluid-gradient/style.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • packages/opencode/test/skill/skill.test.ts
  • packages/desktop-electron/scripts/sync-officecli-skills.ts

Comment thread skills/morph-ppt/reference/decision-rules.md
Comment thread skills/morph-ppt/reference/morph-helpers.py
Comment thread skills/morph-ppt/reference/morph-helpers.py
Comment thread skills/morph-ppt/reference/morph-helpers.sh
Comment thread skills/morph-ppt/reference/morph-helpers.sh
Comment thread skills/morph-ppt/reference/styles/mixed--bauhaus-blocks/style.md
Comment thread skills/morph-ppt/reference/styles/mixed--duotone-split/style.md
Comment thread skills/morph-ppt/reference/styles/vivid--candy-stripe/style.md
Comment thread skills/morph-ppt/reference/styles/warm--playful-organic/build.sh
@Astro-Han

Copy link
Copy Markdown
Owner Author

Round 4 — batch response on 16 morph-ppt/reference/** findings

All 16 actionable findings in this review pass target files under skills/morph-ppt/reference/**, which were introduced in 09a86cc7 as part of widening vendor scope from SKILL.md-only to entire upstream skill directories. Every file under that subtree is vendored byte-for-byte from iOfficeAI/OfficeCLI@v1.0.63; PawWork modifies zero bytes of this content.

Not addressed in this PR. PawWork's vendor invariant on #707 is that the only PawWork-introduced bytes are the 5-line override blockquote injected into each SKILL.md. Companion docs and reference/** assets are not modified in-tree. Editing any of these files would break the skillsTarballSha256 content-SHA contract enforced by sync-officecli-skills.ts and convert the sync from "verbatim vendor of pinned tag" into "upstream + in-tree patches," which is the architectural direction #707 deliberately avoids.

Unlike rounds 2-3, these are not yet fixed upstream. Spot-checked iOfficeAI/OfficeCLI@main:

  • skills/morph-ppt/reference/styles/bw--swiss-system/ upstream main contents: style.md only — the missing build.sh is an upstream gap that exists in v1.0.63 and in current main.
  • skills/morph-ppt/reference/morph-helpers.py:106 upstream main: still sys.exit(1) inside morph_clone_slide.

So officecli-bump.yml will not auto-resolve this batch by retargeting to a newer tag — these are upstream's open issues. We are intentionally not filing upstream tracking issues from this PR (out of #707's scope).

Severity in practice. The Critical and Major labels reflect CodeRabbit's static grading. Concrete runtime exposure for PawWork users is bounded: the sys.exit(1) / exit 1 patterns only misbehave under import / source usage (the model normally runs these helpers as CLI subprocesses); the doc-reference and table-column issues are read-only documentation drift. None of these block packaged-app boot, skill loading, or any happy path covered by CI.

Leaving the 16 threads unresolved so a future reviewer or upstream sync can confirm. Per-thread replies on each will link back to this comment.

The vendoredNames list only asserted that each expected skill is
present, so an upstream sync that introduces a new officecli-* or
morph-ppt* skill would pass without the test being updated. Add a
prefix-filtered length assertion so any future scope drift surfaces
in CI rather than slipping through the bump PR.

Refs CodeRabbit crosscheck round 1 (Codex P2 / Claude P2).
@Astro-Han
Astro-Han merged commit c6c78de into dev May 18, 2026
27 checks passed
@Astro-Han
Astro-Han deleted the claude/officecli-skill-bundle branch May 18, 2026 02:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci Continuous integration / GitHub Actions harness Model harness, prompts, tool descriptions, and session mechanics P1 High priority platform Electron shell, OS integration, packaging, updater, signing, paths, and permissions task Narrow execution, audit, spike, migration, tracking, or upstream follow-up work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Task] Replace built-in skills with officecli's own skill bundle

1 participant