{"id":51600280,"url":"https://github.com/jdforsythe/wolfe-pack","last_synced_at":"2026-07-11T21:30:42.881Z","repository":{"id":364903598,"uuid":"1269675564","full_name":"jdforsythe/wolfe-pack","owner":"jdforsythe","description":"A pack of autonomous, verification-gated review-and-fix bots for your repo. Claude-Code-native. No slop.","archived":false,"fork":false,"pushed_at":"2026-06-15T02:32:50.000Z","size":4892,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-06-15T03:22:38.228Z","etag":null,"topics":["ai-agents","autonomous-agents","bots","claude-code","code-quality","code-review","developer-tools","devtools","github-actions","static-analysis"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jdforsythe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-15T01:51:58.000Z","updated_at":"2026-06-15T02:32:54.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/jdforsythe/wolfe-pack","commit_stats":null,"previous_names":["jdforsythe/wolfe-pack"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/jdforsythe/wolfe-pack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdforsythe%2Fwolfe-pack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdforsythe%2Fwolfe-pack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdforsythe%2Fwolfe-pack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdforsythe%2Fwolfe-pack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jdforsythe","download_url":"https://codeload.github.com/jdforsythe/wolfe-pack/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdforsythe%2Fwolfe-pack/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35376133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","autonomous-agents","bots","claude-code","code-quality","code-review","developer-tools","devtools","github-actions","static-analysis"],"created_at":"2026-07-11T21:30:39.792Z","updated_at":"2026-07-11T21:30:42.873Z","avatar_url":"https://github.com/jdforsythe.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# wolfe-pack\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/jdforsythe/wolfe-pack/master/docs/hero.png\" alt=\"wolfe-pack — Winston Wolfe and the pack of autonomous review-and-fix bots\" width=\"100%\"\u003e\n\u003c/p\u003e\n\n\u003e A coordinated pack of autonomous review-and-fix bots you drop into any\n\u003e repository. Claude-Code-native. Verification-gated. **No slop.**\n\n```bash\nnpx wolfe-pack init\n```\n\nThat's the whole setup. It explores your repo, asks **two questions**, shows\nyou a complete plan, and — only after you approve — scaffolds a tailored bot\ncrew **into your repo**. You own every file, and every prompt is readable\nmarkdown.\n\n## What you get\n\nThe pack hunts across ten categories and closes the loop on what it finds:\n\n| Bot | Hunts | Verified means |\n|---|---|---|\n| `wolfe-bugs` | runtime/logic errors, races, data integrity | a reproducer test that fails before the fix, passes after |\n| `wolfe-security` | injection, authz flaws, secrets, vulnerable deps | reachability proven locally or tool-verified (always file-only — humans gate security) |\n| `wolfe-docs` | documentation drift — and the pack's own files | the broken thing mechanically re-checked; prose claims cite `file:line` |\n| `wolfe-test-gaps` | untested paths, vacuous tests, weak assertions | the new test fails before the gap closes (or under a stated mutation) |\n| `wolfe-a11y` | accessibility defects in your UI code | an automated check goes red → green |\n| `wolfe-i18n` | locale key parity, ICU mismatches, hardcoded strings | a mechanical check goes red → green; never machine-translates |\n| `wolfe-perf` | N+1s, hot-path waste, query wins | a real benchmark (warmups, iterations, median±stdev) or query-plan diff |\n| `wolfe-tech-debt` | duplication, dead code, shallow modules | existing tests pass **unchanged** (risky refactors get characterization tests first) |\n| `wolfe-arch` | undocumented decisions, violated ADRs | anchored quotes — decision sentence + offending `file:line` |\n| `wolfe-infra` | Dockerfiles, CI workflows, IaC posture | the validator reproduces the flag, then goes clean |\n| `winston-wolfe` | **the namesake** — drains your approved-issue queue into merge-ready PRs | the repo's own verify command, fully green, tests-first |\n\nBots whose surface doesn't exist in your repo no-op gracefully — a CLI tool\ngets no a11y bot unless you ask for it.\n\n## No slop, by construction\n\nThe defining promise: **nothing is surfaced unverified.**\n\n- A finding only becomes a **draft PR** when it carries a failing test + a\n  verified fix and clears a confidence gate (≥0.85).\n- Medium confidence (0.6–0.85) → a labeled issue with evidence and a\n  suggested verification. Below that → discarded, counted, never filed.\n- Where the pack *can't* run your code (tests need a database it doesn't\n  have), findings **degrade to issues marked `[unverified]`** — never PRs.\n  No environment, no exceptions, no override.\n- Every artifact carries a fingerprint; rejected findings (`wolfe:rejected`)\n  are never re-filed. Per-run caps, scope-relative budgets, and a hard\n  wall-clock ceiling bound every run.\n\n## The autonomy dial\n\nVerification is always on. Autonomy only decides what a *verified* finding\nbecomes — and it starts conservative:\n\n```\n0  report artifact only\n1  + file issues                      ← default\n2  + draft PRs (failing test + fix)\n3  + the fixer drains your queue\n```\n\nThe loop at autonomy 3: a bot files an issue → **you** label it\n`wolfe:queued` → the fixer claims it (`wolfe:fixing`), writes the failing\ntest, fixes it, drives your CI green, opens a ready-for-review PR — and\n**stops short of merge. Always.** Bots can't approve, can't merge, can't\ntouch your workflow files; branch protection plus least-privilege tokens\nmake that structural, not aspirational.\n\n## Two ways to run\n\n**Local (zero setup).** `npx wolfe-pack run bugs --dry-run` runs in your\nauthenticated session — your Claude subscription, your `gh` login, your\ncommit signature. Bot PRs trigger CI like yours do. Loop it however you like.\n\n**GitHub Actions (while you sleep).** Opt in during init: weekly staggered\nhunts, a label-triggered fixer, optional on-PR diff scans. Issues-only\nautonomy needs one secret (your Claude credential). Draft-PR autonomy adds a\n~2-minute walkthrough that creates **your own** GitHub App (no third-party\ntrust) — required because `GITHUB_TOKEN`-authored PRs never trigger CI, and\na bot PR without CI can't satisfy your safety rails.\n\n## What lands in your repo\n\n```\nWOLFE.md                        ← the index: stack, areas, commands, roster, registry\nCLAUDE.md                       ← +1 pointer line\n.claude/skills/wolfe-*/         ← the bots (readable markdown, verbatim, you own them)\n.claude/agents/wolfe-*.md       ← specialists forged for *your* stack\n.wolfe/                         ← freshness ledger + run history (runs gitignored)\n.github/workflows/wolfe-*.yml   ← only if you chose Actions\n```\n\n`WOLFE.md` is the pack's single source of repo truth — visible, readable,\nmachine-maintained by the docs steward, and the only file bots hardcode a\nlink to. Your existing agents are **reused, never overwritten**; your labels\nare reused; everything the pack creates is namespaced `wolfe:`/`wolfe-*`.\n\n## Cost, honestly\n\nAutonomous fleets die by surprise bills, so budgets are structural: every\nrun's budget scales with its scope (KLOC or diff size), calibrated from your\nown run history; at 75% it stops fanning out, at 90% it triages what it has,\nand it always reports what it skipped. Tiered models (cheap scans → mid-tier\nspecialists → top-tier gates) keep the floor low, and every run summary\nrecords tokens and approximate cost.\n\n## About the name\n\n\u003cimg src=\"https://raw.githubusercontent.com/jdforsythe/wolfe-pack/master/docs/winston.png\" alt=\"Winston Wolfe, the fixer\" align=\"right\" width=\"280\"\u003e\n\n\u003e \"I'm Winston Wolfe. I solve problems.\"\n\u003e *(Winston Wolfe, Pulp Fiction)*\n\nIn *Pulp Fiction*, Jules and Vincent have a dead body in the back seat, brains\nall over the upholstery, and maybe an hour before it gets ugly. They are losing\nit. Marsellus makes one phone call and Winston Wolfe shows up in a tuxedo at 8\nin the morning like it's the most normal thing in the world. No lecture, no\ndrama. He sizes up the mess, hands out the jobs, and the problem just goes away.\n\nThat's the bot this whole thing is named after. `winston-wolfe` is the fixer.\nThe hunters find the bodies (bugs, gaps, drift, the works). The Wolf cleans them\nup the right way: a failing test, a verified fix, a PR you actually merge. He\ndoesn't panic, he doesn't freelance, and he never merges his own work, because\nthe job isn't finished until you sign off on it.\n\nAnd he's unreasonably polite about the whole thing. The pack reuses your labels,\nnever touches a file it doesn't own, and asks before it writes a single line.\nPretty please.\n\n## Requirements\n\n- [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (`claude` CLI)\n- `git`, and `gh` (authenticated) for anything beyond report-only\n- Node ≥ 20 to run `npx wolfe-pack`\n- macOS / Linux / WSL\n\n## FAQ\n\n**Why Claude-Code-native instead of runtime-agnostic?** The tiered subagent\norchestration the gates depend on is a Claude Code primitive. An agnostic v1\nwould multiply the surface 5–10× and bet the product on abstractions over\nfast-moving runtimes. Deliberate scope, recorded in\n[DESIGN.md](https://github.com/jdforsythe/wolfe-pack/blob/master/DESIGN.md).\n\n**What if a specialist is wrong?** Specialists *advise*; bots *gate*. A weak\nspecialist degrades expertise, never safety — nothing a specialist returns\ncan skip verification or open a PR by itself.\n\n**Prompt injection?** Repository content, issue bodies, diffs, and all\nsubagent output are treated as partially-trusted data, never instructions —\nstated in every bot, enforced by least-privilege tokens that can't merge or\nreach other repos even if something slips.\n\n**Can I turn a bot off? Add one later?** Yes — the roster lives in\n`WOLFE.md` (`wolfe/bots`). Every catalog bot is opt-in-able any time; absent\nsurfaces no-op.\n\n**Where do I read the design?**\n[DESIGN.md](https://github.com/jdforsythe/wolfe-pack/blob/master/DESIGN.md) —\nevery locked decision with its rationale and rejected alternatives.\n[docs/architecture.md](https://github.com/jdforsythe/wolfe-pack/blob/master/docs/architecture.md)\ncovers implementation mechanics;\n[docs/deferred.md](https://github.com/jdforsythe/wolfe-pack/blob/master/docs/deferred.md)\ntracks what v1 deliberately left out. (Absolute links — the design docs live\nin the repo, not the npm tarball.)\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdforsythe%2Fwolfe-pack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjdforsythe%2Fwolfe-pack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdforsythe%2Fwolfe-pack/lists"}