vibesubin 0.3.2

vibesubin 0.3.2 — post-edit review loop, baked in.

Two coordinated additions for one specific workflow: "I've finished a batch of edits. Run an external review. Feed the findings back. Let Claude resolve them with verification."

What's new

refactor-verify gains a "Review-driven fix mode" — the portable engine for resolving external review findings. Accepts input from any source: pasted notes, a human PR review, a Sentry alert, gitleaks / pip-audit / cargo audit / govulncheck, Semgrep, Bandit, or a hand-off from a wrapper skill. The procedure: capture the review snapshot SHA, parse and normalize findings, triage each as real / false-positive / defer / duplicate, map each item to a commit via git blame, plan the fixes as a dependency tree, execute leaves-up with the standard 4-check verification (AST diff relaxed for intentionally-behavior-changing fixes, full call-site closure on the untouched surface), commit each fix with a back-reference (<type>: resolve <review-source>#<item-id> — ...), and report resolution item by item. This works on every agent that supports SKILL.md — Claude Code, Codex CLI, Cursor, Copilot, Cline, anything skills.sh talks to.

codex-fix skill — a deliberately thin (~100 lines) Claude Code + Codex plugin wrapper. It owns only the Codex-specific glue: host check, templated /codex:rescue prompt scoped to the current branch's diff, output collection, and the hand-off to refactor-verify's new mode. No parsing, no verification, no committing inside the wrapper — everything substantial delegates. This is the convenience path for operators who run the Codex loop often enough that the copy-paste between Codex output and Claude resolution was friction worth removing.

⚠ On non-matching hosts, this skill gracefully passes

codex-fix declares its host dependency explicitly. On any host that is not Claude Code + Codex plugin (Codex CLI itself, Cursor, Copilot, Cline, or Claude Code without the plugin), the skill's first action is a one-line fallback:

"Codex plugin not detected — this skill is Claude Code + Codex specific. To resolve a review from a different source, invoke /refactor-verify directly with the findings."

Then it exits. No hangs, no loud errors, no pasted-findings prompt. Graceful pass on non-matching hosts is the expected outcome, not a failure. Operators on other hosts or with other review sources should invoke /refactor-verify directly — same engine, same verification discipline, different input adapter.

New invariant: portable engines can have host-specific wrappers

docs/PHILOSOPHY.md gains rule 9: "Portable engines can have host-specific wrappers." The pack's core skills stay host-agnostic. When a frequent host-specific workflow justifies a dedicated trigger, it goes into a thin wrapper skill that declares the host dependency in its frontmatter, checks the host as its first action, emits a graceful one-line fallback on non-matching hosts, delegates everything substantial to a portable engine skill, and has no sweep mode. codex-fix is the first such wrapper; future ones (for Sentry, gitleaks, etc.) would follow the same shape. The engine is the contract; the wrapper is convenience.

10-worker cap reached

With codex-fix, the pack has exactly 10 worker skills (the vibesubin umbrella is not counted). The cap is full: refactor-verify, audit-security, fight-repo-rot, write-for-ai, setup-ci, manage-secrets-env, project-conventions, manage-assets, unify-design, codex-fix. Any future new capability must extend an existing skill, split one, or displace one — the surface area does not grow past 10, because users cannot remember more than ~10 tools.

Migration

No user-visible migration. Existing direct calls and natural-language triggers still work exactly as before.

If you want the new post-edit review loop:

• Claude Code + Codex plugin: type "codex 돌려서 고쳐줘" or /codex-fix after finishing a batch of edits.
• Any other agent or review source: invoke /refactor-verify directly with pasted findings — or any of the trigger phrases for the new review-driven fix mode ("resolve these findings", "fix this review", "리뷰 사항 처리해줘").

The full CHANGELOG is at CHANGELOG.md.