container: /cq + /verify-tests skills, auto-mode off, Hermes CDP

[AnExiledDev]

Summary

Branch grew beyond the original /cq skill refactor. Now covers four independent container improvements, all aimed at removing auto-firing lifecycle hooks, hardening defaults, and fixing the Windows host-Chrome CDP workflow.

Commits

refactor(auto-code-quality): replace Stop hooks with /cq skill — 6b9e596

• Replaces format-on-stop.py, lint-file.py, advisory-test-runner.py with a single on-demand /cq skill invoked explicitly by Claude
• New quality-gate.py Stop hook (~1ms) prompts Claude to run /cq when files were edited and no background tasks are active
• task-tracker.py keeps the gate quiet while agents are working, eliminating file-mutation conflicts

refactor(agent-system): replace test-verification hooks with /verify-tests skill — e9bc9a5

• Removes four hooks that ran the test suite on agent lifecycle events (30–120s serialized delay each): TaskCompleted (task-completed-check.py), implementer Stop + refactorer PostToolUse (verify-no-regression.py), test-writer Stop (verify-tests-pass.py)
• Adds /verify-tests skill: detects the project's test framework and runs the suite on-demand with structured reporting
• Same pattern as /cq — explicit invocation instead of passive firing

feat(settings): disable auto permission mode by default — a2914f4

• Adds "disableAutoMode": "disable" to all 7 settings profiles (settings.base.json + settings.json + 5 overlays)
• Removes auto from the Shift+Tab permission cycle and rejects --permission-mode auto at startup
• Users who want it back can override via ~/.claude/settings.json

feat(agent-browser): Hermes Chrome CDP helper for Windows + portproxy workflow — 4fda330

• Adds start-hermes-chrome.ps1: Administrator PowerShell helper that launches Chrome on 127.0.0.1:9222 and creates 0.0.0.0:9223 -> 127.0.0.1:9222 via netsh portproxy + matching firewall rule
• Adds HERMES_CDP_ENDPOINT env var (http://192.168.65.254:9223) to devcontainer.json
• Container side resolves host.docker.internal to IPv4 (Chrome CDP rejects DNS Host headers) and connects on port 9223
• Updates agent-browser feature README/install, skill-engine agent-browser skill (SKILL.md + references), and docs site (environment-variables, troubleshooting, windows-networking, accessing-services)

docs: backfill user-facing changelog with CI canary + dashboard cleanup notes — 813065f

• Syncs docs/ changelog with CI changes already on main (canary publishing on staging push, removal of dead dashboard release workflow, release.yml sed header fix)

chore(container): reformat test.js — 69e95ca

• Biome/Prettier formatting only (arrow-fn wrap, two console.log wraps). No logic change.

Test plan

/cq skill

• Edit a file → stop → gate blocks → Claude runs /cq → formats + lints + tests → stops clean
• Spawn background task → edit file → stop → gate skips (tasks active) → stop after tasks complete → gate blocks
• Ask a question (no edits) → stop → gate finds no temp file → clean exit
• Type /cq manually → skill runs quality checks on edited files
• Edit a .json with bad syntax → PostToolUse catches it immediately (unchanged)
• Add quality-gate to disabled-hooks.json → gate skips entirely

/verify-tests skill

• Spawn implementer → edits code → finishes → no automatic test run (hook removed)
• Spawn test-writer → writes tests → finishes → no automatic test run (hook removed)
• Type /verify-tests → detects framework → runs tests → reports pass/fail
• /verify-tests path/to/file.py → scopes run to that file

Auto mode disable

• Open Claude Code → Shift+Tab cycle skips auto permission mode
• claude --permission-mode auto → rejected at startup
• Override via ~/.claude/settings.json with "disableAutoMode": "enable" → auto returns

Hermes Chrome CDP (Windows)

• Run .\.devcontainer\scripts\start-hermes-chrome.ps1 from Administrator PowerShell → Chrome launches on 127.0.0.1:9222 with dedicated profile
• Invoke-WebRequest http://127.0.0.1:9223/json/version on host → returns JSON
• From container: CDP_HOST=$(getent ahostsv4 host.docker.internal | awk 'NR==1 {print $1}') → curl http://$CDP_HOST:9223/json/version → returns JSON
• agent-browser connect $CDP_HOST:9223 → successful session
• start-hermes-chrome.ps1 -Cleanup → portproxy + firewall rule removed

Docs backfill

• Run cd docs && npm run build → docs site builds clean with the new CI section

test.js

• cd container && npm test → all tests pass

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a2415b74-f6b5-4a67-add9-59c29b4e175c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/cq-skill

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[AnExiledDev]

Code review fixes applied

task-tracker.py:

• Added fcntl-based exclusive file locking with retry (3 attempts, 100ms delay) on both append and read-modify-write paths — prevents race conditions from concurrent hooks
• Added event type validation — early exit on unknown events

quality-gate.py:

• Moved temp file deletion AFTER json.dump() block response — ensures the block is always sent even if cleanup fails
• Added session_id missing warning to stderr

devcontainer.json:

• Replaced hardcoded 192.168.65.254 with host.docker.internal for dynamic CDP endpoint resolution

install.sh:

• Replaced escaped echo lines with heredoc for copy-pasteable host Chrome usage examples

PowerShell hardening: Opened #83 to track separately (low priority).

All 298 pytest + npm tests pass.