菜单
Commits staged changes and opens a PR. Runs gitleaks + risk-area guards before committing. Push is user-confirmed by default; --auto-push and --auto-merge are opt-in. NOT for review or verification (run those before wrapping), and NOT when nothing has changed yet — there is nothing to commit.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Dispatch a multi-wave plan to specialist agents with audit + risk-area abort. Supports --auto-push, --auto-merge, --goal-mode for budgeted runs. NOT for writing the plan itself (that is /spec), and NOT for a single small edit with no waves — just make the edit.
Independently re-verify a completion claim in a separate context — mechanical evidence (files/tests/assertions) plus a refute-by-default semantic judge — before a wave or task is allowed to be called "done". Emits the shared verdict schema. NOT for code-style review (that is a reviewer's lane) and NOT for verifying work you authored in the same context — the verifier must be a fresh spawn.
Router over the harness skills — which skill fits your situation, and the main flow through them. NOT for performing the routed work itself — it only points; invoke the skill it names.
Upstream planning-discipline — brainstorm a feature into spec.md + plan.md under .agent/plans/<slug>/, then route to plan approval. Enforced by the spec-gate tool boundary, not prompt coercion. NOT for trivial/test/doc-only edits (the gate scopes those out), and NOT for executing an already-approved plan (that is /supervise).
Agent-driven, read-only self-audit of the harness — run the machine integrity layer once as a dry-run, present a per-check pass/fail table, cite the P1-1 doc-reality result, and for any failure give root-cause + fix + backlog follow-up. Consumes the machine gates; it does not reimplement them. NOT for auditing a consumer project's own codebase (use that project's test suite), and NOT for applying fixes — this skill observes and reports only.
Survey a codebase area before changing it. Maps file tree, traces dependencies, identifies idioms.
| name | wrap |
| description | Commits staged changes and opens a PR. Runs gitleaks + risk-area guards before committing. Push is user-confirmed by default; --auto-push and --auto-merge are opt-in. NOT for review or verification (run those before wrapping), and NOT when nothing has changed yet — there is nothing to commit. |
| when_to_use | User asks to commit and open a PR — "wrap up", "ship this", or `/wrap`. |
| tools | Bash, Read, Grep, Glob |
Move from "code written and tested locally" to "PR open on GitHub" in one skill invocation, with all the safety gates intact.
| Mode | What it does | Trigger |
|---|---|---|
/wrap | Commit + open PR. User pushes manually. | Default. |
/wrap --auto-push | Commit + push + open PR. User merges. | Explicit. |
/wrap --auto-merge | Full chain via core/infra/auto-ship.sh. | Explicit. |
--auto-merge requires all 4 trigger conditions from
rules/policy/actions-billing-admin-merge.md to hold.
Run in order; any failure aborts before the commit.
a. gitleaks on staged diff:
gitleaks protect --staged --redact -v --config=gitleaks.toml --no-banner
Before trusting a clean result, confirm the gate is actually live with the fire drill (W-3) — it plants a synthetic secret matching the repo's own rule and asserts gitleaks catches it, so a misconfigured allowlist can't give a false all-clear:
bash core/infra/gitleaks-fire-test.sh # PASS = gate live; FAIL = misconfigured; exit 2 = gitleaks absent (SKIP)
a2. Remote-URL credential scan (W-3) — a token baked into the push remote's
URL lives in .git/config, invisible to the content scanners above:
git remote get-url origin | python3 core/git-hooks/scan-remote-url.py
Nonzero exit = the remote URL embeds a credential; strip it before pushing.
(The pre-push hook also runs this, but checking here fails earlier.)
b. Whitelist path scan — only files inside allowed paths should be
staged. Allowed paths default to anything except secrets/,
.env* (excl. .env.example). Override via hook-config.yml.
c. Risk-area scan — for each of the 5 risk areas
(rules/policy/security-guards.md):
data (e.g., migrations/*.sql) → ABORT, user must drive.secrets → ABORT.deploy (function bundles) → ABORT, user must drive.payment → ABORT, user must drive.domain-output → advisory; if net removal, ABORT.feat:, fix:, etc.).Co-Authored-By if you (the AI) are an authoring agent.git commit -m "<type>: <subject>
<body>"
If pre-commit hook fails: read its stderr, fix the underlying issue,
re-stage, and create a new commit (don't --amend).
/wrap: don't push. Report the commit SHA and tell the
user how to push when ready.--auto-push: git push -u origin <branch> (pre-push hook runs).--auto-merge: Push, then invoke core/infra/auto-ship.sh <PR-N>.Only if push happened.
gh pr create --title "<title>" --body "$(cat <<'EOF'
## Summary
- …
- …
## Test plan
- [ ] …
- [ ] …
EOF
)"
Title: short (≤ 70 chars). Body: summary + test plan.
Commit: <sha> on <branch>
Push: <yes/no>
PR: <url or "not opened">
Next steps: <what user should do>
The wrap is complete only when this report is emitted with a real commit SHA and every step-1 gate actually ran (a skipped gate is reported as skipped, never silently omitted).
--no-verify unless the user has typed
that flag in their message.main or another agent's branch (R6)..env* (only .env.example).