Deferred from the skills expert review (correctness-first pass landed in acf100e).
Files: skills/developing-with-idfkit/scripts/discover.py, tests/discovery/test_discover.py.
Detection edge cases
- conda
base false positive (discover.py:101-105): CONDA_PREFIX is exported (pointing at base) whenever conda is initialized, even with no project env active. The branch fires on the env var alone, so on a machine whose base env lacks idfkit the script advises conda install ... idfkit into base — the anti-pattern the tag-driven advice was meant to avoid. Fix: skip when basename(CONDA_PREFIX) == "base" / CONDA_DEFAULT_ENV == "base".
- lockfile-without-manifest misfire (
discover.py:110-117): the poetry/pdm/uv branches fire on a bare lockfile with no usable project, yielding a confusing exit-1 message that leaks the tool's own stderr (e.g. "Poetry could not find a pyproject.toml...") instead of install advice. Fix: gate these branches on a manifest (require pyproject.toml alongside poetry.lock/pdm.lock/uv.lock), or detect the "no project/cannot sync" stderr and re-route.
Test coverage gaps
test_discover.py integration-tests only exit 5. The contract-critical upstream-restructure branches — exit 2 (idfkit too old) and exit 4 (layout changed) — have zero coverage, as do detection branches conda, venv-parent, venv-git-root, pipenv, poetry, pdm. Suggested: monkeypatch subprocess.run to drive exits 0/1/2/4 deterministically and fake the package path to exercise the .agents/skills/... presence/absence branches.
Severity: Medium.
Deferred from the skills expert review (correctness-first pass landed in
acf100e).Files:
skills/developing-with-idfkit/scripts/discover.py,tests/discovery/test_discover.py.Detection edge cases
basefalse positive (discover.py:101-105):CONDA_PREFIXis exported (pointing atbase) whenever conda is initialized, even with no project env active. The branch fires on the env var alone, so on a machine whose base env lacks idfkit the script advisesconda install ... idfkitinto base — the anti-pattern the tag-driven advice was meant to avoid. Fix: skip whenbasename(CONDA_PREFIX) == "base"/CONDA_DEFAULT_ENV == "base".discover.py:110-117): thepoetry/pdm/uvbranches fire on a bare lockfile with no usable project, yielding a confusing exit-1 message that leaks the tool's own stderr (e.g. "Poetry could not find a pyproject.toml...") instead of install advice. Fix: gate these branches on a manifest (requirepyproject.tomlalongsidepoetry.lock/pdm.lock/uv.lock), or detect the "no project/cannot sync" stderr and re-route.Test coverage gaps
test_discover.pyintegration-tests only exit 5. The contract-critical upstream-restructure branches — exit 2 (idfkit too old) and exit 4 (layout changed) — have zero coverage, as do detection branchesconda,venv-parent,venv-git-root,pipenv,poetry,pdm. Suggested: monkeypatchsubprocess.runto drive exits 0/1/2/4 deterministically and fake the package path to exercise the.agents/skills/...presence/absence branches.Severity: Medium.