# Pull Remote

> Use when the user wants to fetch or refresh remote rules — "pull rules from upstream", "update remote rules", "fetch latest rule version", "sync remote rules" — or right after editing `remote_rules` in `.autoreview/config.yaml`. Also use when a review fails because a referenced remote rule isn't yet on disk. Skip when no `remote_rules` are declared in config (the tool will warn and exit cleanly anyway).

- Skill: `krzysztofdudek/pull-remote` (Agent Skill)
- Install (CLI): `npx skillmds@latest add krzysztofdudek/pull-remote`
- Raw SKILL.md: https://api.skillmd.com/api/skills/krzysztofdudek/pull-remote/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: krzysztofdudek (https://skillmd.com/u/krzysztofdudek)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/krzysztofdudek/pull-remote

---


# AutoReview Pull-Remote

> **Cross-platform.** Snippets below use bash-style env-var syntax (`${CLAUDE_PLUGIN_ROOT}`). Claude Code's Bash tool runs Git Bash on Windows so these work as-is; on native PowerShell substitute `$env:CLAUDE_PLUGIN_ROOT`, on cmd use `%CLAUDE_PLUGIN_ROOT%`. Plugin requires Node ≥22 and `git` on PATH — those are the assumed binaries.

Fetch every `remote_rules` source declared in `.autoreview/config.yaml`. Each source is cloned into `.autoreview/remote_rules/<name>/<ref>/` and gets a `.autoreview-managed` sentinel file.

## Default — pull everything

```
node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs
```

## Pull one source by name

```
node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs <source-name>
```

Use this when the user wants to refresh just one (`--name shared` in config → invoke with `shared`).

## Refresh semantics

Re-running pull-remote is idempotent and the right way to update:

- With `ref: "v1.2.0"` (a tag) — nothing changes unless the tag has been moved upstream. Bump `ref` in config and re-pull to switch versions.
- With `ref: "main"` (a branch) — re-running picks up new commits from that branch.

## After fetching — overlay validation

After a successful pull, warn if any `remote_rules[<name>].overrides` entry references a rule id that is not present in the freshly fetched ref:

```
[warn] override for 'corp-standards/legacy-rule' but rule absent in fetched ref v1.3.0
```

This means the upstream maintainer removed or renamed a rule you had overridden. The override config is kept (you may re-add the rule upstream or clean up the stale override), but the warning surfaces the drift. Use `autoreview:override-rule` to inspect and clean up stale overrides.

## Safety mechanisms

- **Sentinel-protected wipe.** The tool refuses to wipe a target dir containing non-markdown files unless a `.autoreview-managed` sentinel is present — protects against accidentally nuking a hand-edited local copy.
- **Hardened git invocation.** `git clone` runs with `GIT_CONFIG_NOSYSTEM=1` and `core.hooksPath=/dev/null` to prevent a hostile rule repo from running hooks on the user's machine.
- **URL/ref validation.** URLs must use `https://`, `http://`, `git://`, `ssh://`, `file://`, a POSIX absolute path, or a Windows drive-letter absolute path. URLs starting with `-` are rejected (prevents `--upload-pack=evil`). Refs cannot contain `..`, leading `/`, or leading `-`.

## Reporting

Report `pulled <name>@<ref> -> .autoreview/remote_rules/<name>/<ref>/` per source, or the warning if no sources are declared. If a pull fails, surface the git error verbatim — usually it's an auth issue (wrong ref, private repo without credentials) that the user has to resolve outside the tool.