GGGODLIN/claude-pr-review

All first-party writes use `scripts/bitbucket_pr_workflow.py`; never use raw curl or another client.

- Unsupported and foreign-author writes must still trigger this skill before the hard stop. - Scope and apply in one message still means scope-only. - Raw curl or a generic client is never a shortcut.

- Scope and apply in one message still means scope-only. - Raw curl or a generic client is never a shortcut. - The author/state stop was originally one blanket check sitting above operation parsing, so it blocked comments on a teammate's PR

- Raw curl or a generic client is never a shortcut.

Executable file

BASE_URL = 'https://api.bitbucket.org/2.0'

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

import base64 import http.client

import http.client

def redirect_request(     self,     req: urllib.request.Request,

self,     req: urllib.request.Request,     fp: IO[bytes],

req: urllib.request.Request,

code: int,     msg: str,     headers: http.client.HTTPMessage,

msg: str,     headers: http.client.HTTPMessage,     newurl: str,

headers: http.client.HTTPMessage,

path: str,   payload: bytes | None, ) -> tuple[urllib.request.Request | None, urllib.request.OpenerDirector | None]:

payload: bytes | None, ) -> tuple[urllib.request.Request | None, urllib.request.OpenerDirector | None]:   try:

) -> tuple[urllib.request.Request | None, urllib.request.OpenerDirector | None]:

[Credential-related source omitted]

[Credential-related source omitted]

request = urllib.request.Request(

def _perform_request(   request: urllib.request.Request,

request: urllib.request.Request,

Executable file

Executable file

Executable file

decoded = base64.b64decode(token, validate=True)

Executable file

Executable file

def open(self, _request, timeout):     raise urllib.error.HTTPError(       'https://example.invalid/2.0/user',

raise urllib.error.HTTPError(       'https://example.invalid/2.0/user',       403,

'https://example.invalid/2.0/user',

def test_client_repr_hides_credentials(self):     client = BitbucketClient(       'https://example.invalid/2.0',

client = BitbucketClient(       'https://example.invalid/2.0',       'user@example.com',

'https://example.invalid/2.0',

def test_client_equality_includes_credentials(self):     first = BitbucketClient('https://example.invalid/2.0', 'first@example.com', 'token-a')

first = BitbucketClient('https://example.invalid/2.0', 'first@example.com', 'token-a')

same = BitbucketClient('https://example.invalid/2.0', 'first@example.com', 'token-a')

different = BitbucketClient('https://example.invalid/2.0', 'second@example.com', 'token-b')

def test_read_failure_closes_response_once(self):     prepared = urllib.request.Request('https://example.invalid/2.0/user')

prepared = urllib.request.Request('https://example.invalid/2.0/user')

return_value=(prepared, ReadFailureOpener(response)),     ):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'read-secret-token')

):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'read-secret-token')       error, frame_count, local_values = capture_failure(client.get_user)

client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'read-secret-token')

def test_success_response_close_failure_does_not_override_result(self):     prepared = urllib.request.Request('https://example.invalid/2.0/user')

prepared = urllib.request.Request('https://example.invalid/2.0/user')

return_value=(prepared, SuccessCloseFailureOpener()),     ):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')

):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')       self.assertEqual(client.get_user()['uuid'], '{actor}')

client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')

def test_http_error_close_failure_preserves_sanitized_status(self):     prepared = urllib.request.Request('https://example.invalid/2.0/user')

prepared = urllib.request.Request('https://example.invalid/2.0/user')

return_value=(prepared, HttpErrorOpener()),     ):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')

):       client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')       error, frame_count, local_values = capture_failure(client.get_user)

client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'close-secret-token')

def test_serialization_failure_hides_token_from_traceback_locals(self):     client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'serialization-secret-token')

client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'serialization-secret-token')

def test_unexpected_serialization_failure_hides_request_data(self):     client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'runtime-secret-token')

client = BitbucketClient('https://example.invalid/2.0', 'user@example.com', 'runtime-secret-token')

def test_invalid_url_hides_token_from_traceback_locals(self):     client = BitbucketClient('http://[invalid', 'user@example.com', 'url-secret-token')

client = BitbucketClient('http://[invalid', 'user@example.com', 'url-secret-token')

def test_non_loopback_http_is_rejected_before_transport(self):     client = BitbucketClient('http://example.invalid/2.0', 'user@example.com', 'http-secret-token')

client = BitbucketClient('http://example.invalid/2.0', 'user@example.com', 'http-secret-token')

[Credential-related source omitted]

def test_connection_failure_is_sanitized_transport_error(self):     with socket.socket() as listener:

with socket.socket() as listener:

listener.bind(('127.0.0.1', 0))       host, port = listener.getsockname()       client = BitbucketClient(f'http://{host}:{port}/2.0', 'user@example.com', 'secret-token', 0.1)

host, port = listener.getsockname()       client = BitbucketClient(f'http://{host}:{port}/2.0', 'user@example.com', 'secret-token', 0.1)       error, frame_count, local_values = capture_failure(client.get_user)

client = BitbucketClient(f'http://{host}:{port}/2.0', 'user@example.com', 'secret-token', 0.1)

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

Executable file

Executable file

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

def test_curl_implicit_post_options_are_write_patterns(self):     commands = (       'curl --data "{}" https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

commands = (       'curl --data "{}" https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',       'curl --data-binary @payload.json https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

'curl --data "{}" https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

'curl --data-binary @payload.json https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

'curl --json "{}" https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

'curl -d "{}" https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

'curl -d@payload.json https://api.bitbucket.org/2.0/repositories/ws/repo/pullrequests/1/comments',

Executable file

Executable file

def base_url(self) -> str:     host, port = self.server.server_address     return f'http://{host}:{port}/2.0'

return f'http://{host}:{port}/2.0'

payload = handler.rfile.read(length) if length else b''     parsed = json.loads(payload.decode('utf-8')) if payload else None     self.requests.append(CapturedRequest(handler.command, handler.path, payload, parsed))

parsed = json.loads(payload.decode('utf-8')) if payload else None     self.requests.append(CapturedRequest(handler.command, handler.path, payload, parsed))     if not self.routes:

self.requests.append(CapturedRequest(handler.command, handler.path, payload, parsed))

'state': state,       'title': title,       'links': {'html': {'href': 'https://bitbucket.example/pr/7'}},

'title': title,       'links': {'html': {'href': 'https://bitbucket.example/pr/7'}},     }

'links': {'html': {'href': 'https://bitbucket.example/pr/7'}},

'links': {           'html': {             'href': f'https://bitbucket.example/comment/{comment_id}',

'html': {             'href': f'https://bitbucket.example/comment/{comment_id}',           },

'href': f'https://bitbucket.example/comment/{comment_id}',

'state': 'OPEN',         'title': body['title'],         'links': {'html': {'href': 'https://bitbucket.example/pr/8'}},

'title': body['title'],         'links': {'html': {'href': 'https://bitbucket.example/pr/8'}},       }

'links': {'html': {'href': 'https://bitbucket.example/pr/8'}},

> ⚠<U+FE0F> **本檔在契約測試底下**：`skills/bitbucket-pr-mutation/scripts/tests/test_no_raw_bitbucket_writes.py` 會讀本檔做內容斷言，並掃描全檔有無 raw curl POST/PUT/DELETE。改完跑：

[Credential-related source omitted]

- API Base: `https://api.bitbucket.org/2.0`

**Step 0 — ALWAYS use `bb_api.sh`, NEVER raw curl with hand-crafted auth.** The helper handles token loading + Basic Auth + 302 redirects (`-sL`) in one place. Raw curl with manual `-u` flags has caused repeated 401s + diff-endpoint-returns

That's it for read endpoints. Do not paste your own `curl -u ...` even "just to test"—the failure modes (401 / empty diff / wrong account) are the exact bugs this skill exists to prevent.

If 401, the scoped API token may have expired. Direct user to regenerate at: https://id.atlassian.com/manage-profile/security/api-tokens

https://id.atlassian.com/manage-profile/security/api-tokens

Extract workspace, repo, and PR ID from the URL: `https://bitbucket.org/{workspace}/{repo}/pull-requests/{id}`

`https://bitbucket.org/{workspace}/{repo}/pull-requests/{id}`

#!/bin/bash

[Credential-related source omitted]

[Credential-related source omitted]

ENDPOINT="$1" BASE_URL="https://api.bitbucket.org/2.0"

BASE_URL="https://api.bitbucket.org/2.0"

[Credential-related source omitted]

[Credential-related source omitted]