Resolve update-command-spec-version repo paths dynamically

[warp-dev-github-integration]

Description

The update-command-spec-version skill's scripts hardcoded fixed repo
locations (~/warp and ~/command-signatures), so they only worked when both
repos happened to be checked out at those exact paths and failed everywhere
else. This resolves both repos dynamically instead.

Changes

• Added scripts/common.sh, sourced by every bash script, which resolves:
  • command-signatures from the script's own location via
    git rev-parse --show-toplevel (the scripts live inside the repo).
  • warp from $WARP_DIR when set, otherwise a sibling of the
    command-signatures repo (<parent>/warp).
• Mirrored the command-signatures resolution in list_merged_prs.py.
• ensure_repos.sh now only fetches the command-signatures checkout it runs
  from (it no longer checkout main + pulls into the user's working tree,
  which is unsafe now that it operates on the real checkout rather than a
  throwaway clone); warp is still cloned if missing, else fetched.
• Documented the new resolution in SKILL.md.

Validation

• bash -n on all shell scripts + py_compile on list_merged_prs.py: pass.
• common.sh resolves correctly both with $WARP_DIR set and unset (falling
  back to the sibling path).
• End-to-end read-only runs against real checkouts:
  • get_latest_hash.sh returns the command-signatures origin/main hash.
  • get_current_hash.sh reads the warp origin/master:Cargo.toml rev via the
    sibling-resolved WARP_DIR (previously would have failed on ~/warp).
  • list_merged_prs.py resolves its repo dir and runs.

Conversation: https://staging.warp.dev/conversation/b34001b4-4abb-4cb1-be9d-98f75676605e
Run: https://oz.staging.warp.dev/runs/019f5d4d-27c2-750d-823f-90a8b0a92b9c

This PR was generated with Oz.

[oz-for-oss]

@warp-dev-github-integration[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR removes hardcoded ~/warp and ~/command-signatures assumptions by adding shared repo-path resolution and wiring the update-command-spec-version scripts to use it. The path resolution approach is reasonable, and I did not find security issues or spec-drift concerns because no approved/repository spec context was provided.

Concerns

• ensure_repos.sh now avoids mutating the command-signatures working tree, but its generic git fetch origin calls do not guarantee the specific remote refs later consumed by get_latest_hash.sh and get_current_hash.sh are present or fresh in branch-limited/shallow checkouts.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

⚠️ [IMPORTANT] Fetch the exact remote refs that later scripts read; git fetch origin follows the checkout's configured refspec, so branch-limited or shallow checkouts can leave origin/main or origin/master missing/stale.

Suggested change

	echo "Fetching command-signatures (${CMD_SIGS_DIR})..." >&2
	git -C "${CMD_SIGS_DIR}" fetch origin
	if [ -d "${WARP_DIR}" ]; then
	echo "Fetching warp..." >&2
	echo "Fetching warp (${WARP_DIR})..." >&2
	git -C "${WARP_DIR}" fetch origin
	echo "Fetching command-signatures (${CMD_SIGS_DIR})..." >&2
	git -C "${CMD_SIGS_DIR}" fetch origin main:refs/remotes/origin/main
	if [ -d "${WARP_DIR}" ]; then
	echo "Fetching warp (${WARP_DIR})..." >&2
	git -C "${WARP_DIR}" fetch origin master:refs/remotes/origin/master

[warp-dev-github-integration]

Done in e9cdee2 — ensure_repos.sh now fetches the exact refs the later scripts read: git -C "${CMD_SIGS_DIR}" fetch origin main:refs/remotes/origin/main and git -C "${WARP_DIR}" fetch origin master:refs/remotes/origin/master, so origin/main / origin/master stay fresh even in branch-limited or shallow checkouts.