feat(skills): ask-colleague → colleague 1.63.0 (Qwen3.8, resume, per-seat effort)

[OriNachum]

Re-vendors all 5 ask-colleague files byte-verbatim from the origin repo (agentculture/colleague @ 1.63.0), so this repo can drive the current local Qwen.

What this brings

• Default model unsloth/Qwen3.8-27B-NVFP4 (was the Qwen3.6 pin). The lobes gateway on :8001 no longer serves 3.6, so the old default only worked via colleague's auto-refresh warning path.
• New resume <task-id|last> [--detach] verb — pick a cut / timed-out / SIGTERM'd run back up from its persisted artifact, continuing on the original colleague/<id> work branch.
• Per-seat thinking effort — --effort (acting seat), --seat-effort S=R (any seat), --role NAME (colleague#416). Rule of thumb: --effort off for small well-specified briefs, default for ordinary work, xhigh for open-ended judgement.

Files

.claude/skills/ask-colleague/: SKILL.md, scripts/ask-colleague.sh, prompts/explore.md, prompts/review.md, prompts/write.md.

Byte-verbatim — no localization needed; colleague's Provenance paragraph is consumer-neutral. Verify with:

diff -r ../colleague/.claude/skills/ask-colleague .claude/skills/ask-colleague

Verification

Live-tested against the running vLLM Qwen3.8-27B from rollout-cli before the fan-out: ask-colleague explore --effort off completed in 10 steps with a correct answer, exercising both the new model default and the new --effort flag. Broadcast from rollout-cli via /mass-update --slug qwen-3-8.

Runtime dep: the colleague CLI on PATH.

• rollout-cli (Claude)

[github-actions]

⚠️ Version not bumped — pyproject.toml still has 0.6.1 (same as main). Bump before merging to avoid a failed PyPI publish.

[qodo-code-review]

PR Summary by Qodo

ask-colleague: add plan/resume, thinking-effort controls, and native mode support

✨ Enhancement 📝 Documentation 🕐 40+ Minutes

AI Description

• Add new plan and resume verbs to the ask-colleague wrapper.
• Expose thinking-effort and role controls to tune runtime cost vs quality.
• Improve review UX by front-loading a filtered, capped diff in the prompt.

Diagram

graph TD
  A["ask-colleague.sh (wrapper)"] --> B["colleague CLI"] --> C[("Git repo / worktree")]
  A --> D[(".colleague artifacts")]
  B --> D
  A --> E["Git diff (review)"] --> B
  A --> F{{"Backend (vLLM/OpenAI)"}}
  B --> F

  subgraph Legend
    direction LR
    _p["Process"] ~~~ _db[("State/Artifacts")] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Rewrite wrapper in Python (argparse + subprocess)

• ➕ More robust flag parsing/validation and help text generation
• ➕ Easier structured error output consistency across paths
• ➕ Cleaner unit testing of edge cases (mode detection, resume detach, etc.)
• ➖ Loses “single-file bash” portability and increases runtime dependencies
• ➖ Migration risk for existing users and shell integrations

2. Push more UX into colleague CLI (diff front-load + wrapper verbs)

• ➕ Avoids duplicating behavior in wrappers across repos
• ➕ Keeps compatibility logic (e.g., --mode) in one place
• ➖ Requires upstream CLI changes and coordinated releases
• ➖ Wrapper still needs some glue for repo policy and artifact preservation

Recommendation: Keep the current approach: it adds meaningful capabilities while preserving backwards compatibility with older colleague CLIs (via --mode detection and legacy fallback). Consider a Python rewrite only if wrapper complexity continues to grow or if cross-platform portability becomes a priority.

Files changed (5) +357 / -50

Enhancement (1) +302 / -36

ask-colleague.shAdd plan/resume verbs, native mode selection, and richer diagnostics +302/-36

Add plan/resume verbs, native mode selection, and richer diagnostics

• Extends the wrapper with new verbs ('plan', 'resume'), new flags ('--role', '--effort', '--seat-effort', '--detach', '--quick', '--no-workforce'), and updates the default model to Qwen3.8. Switches from 'colleague drive' to 'colleague work', front-loads a filtered/capped diff into review instructions, detects and uses colleague's native '--mode explore|review' when available (with a legacy fallback), and improves error/partial-run messaging and JSON-mode failure reporting.

.claude/skills/ask-colleague/scripts/ask-colleague.sh

Documentation (4) +55 / -14

SKILL.mdDocument new plan/resume verbs and thinking-effort controls +31/-7

Document new plan/resume verbs and thinking-effort controls

• Updates the skill docs to reference the Qwen3.8 model, adds documentation for new 'plan' and 'resume' commands, and documents per-seat thinking-effort tuning ('--role', '--effort', '--seat-effort') and updated max-steps behavior.

.claude/skills/ask-colleague/SKILL.md

explore.mdStrengthen explore guidance (delegation + progress narration) +10/-0

Strengthen explore guidance (delegation + progress narration)

• Adds explicit instructions to delegate wide repo surveys to subagents and to narrate progress before each tool call to improve operator visibility and avoid budget waste.

.claude/skills/ask-colleague/prompts/explore.md

review.mdAssume diff is pre-provided; add progress narration rule +8/-7

Assume diff is pre-provided; add progress narration rule

• Removes instructions to run 'git diff' manually and instead tells the model the diff is embedded below, with file reads only for extra context. Adds a progress narration rule to avoid silent tool-call turns.

.claude/skills/ask-colleague/prompts/review.md

write.mdAdd progress narration rule to write prompt +6/-0

Add progress narration rule to write prompt

• Adds guidance to narrate progress before each tool call and to stop early with partial results when close to the step budget.

.claude/skills/ask-colleague/prompts/write.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Max-steps parse crashes ✗ Dismissed 🐞 Bug ☼ Reliability

Description

print_result() now does int(ASK_COLLEAGUE_MAX_STEPS) without guarding non-integer input, so a
user typo like --max-steps foo causes a Python traceback and breaks the wrapper’s error/exit-code
contract. The script currently accepts --max-steps as an unvalidated string and always passes it
into that conversion.

Code

.claude/skills/ask-colleague/scripts/ask-colleague.sh[R522-523]

+max_steps = int(os.environ.get("ASK_COLLEAGUE_MAX_STEPS", "20"))
+stats = d.get("stats") or {}

Evidence

The wrapper accepts --max-steps with no numeric validation, passes it through to the Python
print_result() via ASK_COLLEAGUE_MAX_STEPS, and then unconditionally converts it with int(...)
which will throw on non-numeric values.

.claude/skills/ask-colleague/scripts/ask-colleague.sh[216-228]
.claude/skills/ask-colleague/scripts/ask-colleague.sh[460-476]
.claude/skills/ask-colleague/scripts/ask-colleague.sh[520-537]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ask-colleague.sh` sets `ASK_COLLEAGUE_MAX_STEPS` from the unvalidated `--max-steps` flag, and the embedded Python in `print_result()` unconditionally parses it with `int(...)`. If the value is not a valid integer, `python3 -c` crashes with a traceback, bypassing the wrapper’s intended structured `error:` / `hint:` (or JSON error object) behavior.

### Issue Context
This is user-input, but it should fail fast and clean (exit 1, helpful message) rather than emitting a Python traceback and potentially masking the underlying colleague error.

### Fix Focus Areas
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[216-229]
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[472-476]
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[520-537]

### Suggested fix
1) Validate `--max-steps` in bash right after parsing (e.g., `[[ "$MAX_STEPS" =~ ^[0-9]+$ ]]`), and on failure print `error: --max-steps must be an integer` + `hint: run 'ask-colleague --help'` then exit 1.
2) Defense-in-depth: wrap the Python `int(...)` parse in `try/except ValueError` and fall back to 20 (or omit reached/max info) rather than crashing.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Resume wrongly requires mktemp ✗ Dismissed 🐞 Bug ☼ Reliability

Description

The newly-added resume verb falls through to the default require_tools branch and therefore
requires mktemp, but run_resume() never uses mktemp. This makes ask-colleague resume ...
fail in minimal environments that lack mktemp even though resuming doesn’t need it.

Code

.claude/skills/ask-colleague/scripts/ask-colleague.sh[R268-272]

+    feedback | clean | plan) require_tools git ;;
+    monitor | guide | stop) : ;;  # resume needs the engine path like write, so it is NOT listed here
    write)
        if [[ "$APPLY" -eq 1 || "$OPEN_PR" -eq 1 ]]; then
            require_tools git python3

Evidence

The tool-requirement case statement doesn’t include resume, so it matches the default branch that
includes mktemp. The implementation of run_resume() does not use mktemp at all (it calls
colleague work --continue and pipes to print_result).

.claude/skills/ask-colleague/scripts/ask-colleague.sh[147-151]
.claude/skills/ask-colleague/scripts/ask-colleague.sh[262-278]
.claude/skills/ask-colleague/scripts/ask-colleague.sh[895-910]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`resume` is a new verb but is not handled explicitly in the per-verb `require_tools` matrix. As a result, it falls into the default branch which requires `git python3 mktemp`, even though `run_resume()` does not create a throwaway worktree and does not call `mktemp`.

### Issue Context
This is a regression: it blocks the new feature in minimal shells/containers where `mktemp` is absent.

### Fix Focus Areas
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[267-278]
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[895-910]

### Suggested fix
Update the `case "$VERB" in` tool requirements to explicitly include `resume` with only the tools it actually needs (likely `git python3`). If `--detach` is used, optionally also check for `setsid` and `nohup` (or degrade with a clear error when missing).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Unreadable pyproject hard-fails ✗ Dismissed 🐞 Bug ☼ Reliability

Description

_pyproject_is_colleague() reads pyproject.toml via input redirection under set -e, so a
permission error (file exists but unreadable) aborts the entire script instead of just treating the
uv fallback as “not applicable”. Previously, the grep ... 2>/dev/null approach would simply return
false in this scenario.

Code

.claude/skills/ask-colleague/scripts/ask-colleague.sh[R46-51]

+_pyproject_is_colleague() {
+    local line
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        [[ "$line" == 'name = "colleague"'* ]] && return 0
+    done < "$1"
+    return 1

Evidence

The script enables set -e, and _pyproject_is_colleague() performs done < "$1" which will
terminate the script if the redirect fails. This function is called from _colleague_via_uv() after
only checking -f, not -r.

.claude/skills/ask-colleague/scripts/ask-colleague.sh[38-65]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`_pyproject_is_colleague()` uses `done < "$1"` under `set -euo pipefail`. If `$1` exists but is not readable (permissions/ACL), the redirection fails and terminates the entire script, turning a non-critical uv-detection step into a fatal error.

### Issue Context
This is specifically in the “local-dev uv fallback” resolver path and should degrade cleanly (return 1) rather than exiting the whole wrapper.

### Fix Focus Areas
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[38-52]
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[54-65]

### Suggested fix
Add an explicit readability guard (`[[ -r "$1" ]] || return 1`) before the redirect, or wrap the redirecting loop in an `if ! ...; then return 1; fi` so `set -e` doesn’t terminate the script. Consider also redirecting read errors to `/dev/null` to match the previous `grep ... 2>/dev/null` behavior.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Cap env can break review ✗ Dismissed 🐞 Bug ☼ Reliability

Description

front_load_review_diff() performs arithmetic with COLLEAGUE_MAX_OUTPUT_CHARS ($((cap + 1)))
without validating it is numeric, so a non-numeric environment value causes an immediate bash
arithmetic error and aborts review due to set -e. This is a new failure mode introduced with
diff front-loading.

Code

.claude/skills/ask-colleague/scripts/ask-colleague.sh[876]

+    diff_body="$(git -C "$REPO" diff "$BASE"...HEAD -- . ':(exclude)*.lock' ':(exclude)**/*.lock' ':(exclude)package-lock.json' ':(exclude)**/package-lock.json' ':(exclude)*.min.js' ':(exclude)**/*.min.js' 2>/dev/null | head -c "$((cap + 1))" || true)"

Evidence

cap is sourced directly from an environment variable and then used in $((cap + 1)); with `set
-euo pipefail`, an invalid arithmetic expansion terminates the script.

.claude/skills/ask-colleague/scripts/ask-colleague.sh[38-39]
.claude/skills/ask-colleague/scripts/ask-colleague.sh[861-877]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`front_load_review_diff()` reads `cap` from `COLLEAGUE_MAX_OUTPUT_CHARS` and uses it in arithmetic expansion `$((cap + 1))` and string slicing. If the env var is set to a non-integer, bash throws an arithmetic error; with `set -e`, the entire wrapper exits.

### Issue Context
This affects `ask-colleague review` runs, since the function output is appended into the prompt and is executed before dispatch.

### Fix Focus Areas
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[38-39]
- .claude/skills/ask-colleague/scripts/ask-colleague.sh[861-882]

### Suggested fix
Validate `cap` with a numeric regex and fall back to a safe default (e.g., 100000) when invalid; optionally emit a stderr warning in text mode. Also consider clamping to a minimum/maximum reasonable range to avoid huge memory use.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 3 rules

✅ Skills: cicd, doc-test-alignment, version-bump

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[OriNachum]

Qodo triage — routed upstream, not patched here

Thanks Qodo. Every finding on this PR lands on .claude/skills/ask-colleague/scripts/ask-colleague.sh, which this PR vendors byte-verbatim from its origin, agentculture/colleague @ 1.63.0.

Under cite, don't import, a finding against a vendored script is fixed upstream and pulled back on the next sync — never patched downstream. A local patch is exactly the drift the skill ledger exists to prevent: the next re-sync silently reverts it, and in the meantime diff -r against the origin stops being a meaningful check.

So none of these are being applied to this PR. They have been triaged and raised at the origin instead:

• colleague#434 — 11 deduped findings from 8 independent Qodo reviews of this same re-vendor, ranked. Top of the list is a path traversal in resume --detach (the logfile path is built from an unsanitized task id), which three separate repos flagged.
• colleague#433 — --dry-run accepted and silently ignored on every verb except clean.

None of these were introduced by this PR; they are existing upstream state that fanning the skill out to 10 repos put in front of 8 independent reviewers at once. When colleague ships the fixes, this repo picks them up through a normal re-vendor.

Verify the copy is clean with:

diff -r ../colleague/.claude/skills/ask-colleague .claude/skills/ask-colleague

• rollout-cli (Claude)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud