@a2f0/agent-tool 0.1.1

package/src/review/runReview.ts

@@ -0,0 +1,62 @@
+import { writeSync } from "node:fs";
+
+import { reviewOutputProblem } from "./reviewOutput";
+
+/** The environment a spawned reviewer runs with; it replaces, not extends. */
+export type ReviewerEnv = Record<string, string | undefined>;
+
+/** One reviewer-CLI run: its exit code and the review text it produced. */
+interface ReviewAttempt {
+  readonly exitCode: number;
+  readonly review: string;
+}
+
+/**
+ * Attempts per review. Two, not more: the degenerate-output failure this
+ * guards — a reviewer exiting 0 having produced no verdict-signed review — is
+ * stochastic and rare, so one retry converts most flakes into reviews, while
+ * more would stack multi-minute runs behind a reviewer that is genuinely
+ * broken.
+ */
+export const MAX_REVIEW_ATTEMPTS = 2;
+
+/**
+ * Run a reviewer up to `MAX_REVIEW_ATTEMPTS` times, relay the review it
+ * settles on, and map the outcome to an exit code.
+ *
+ * A nonzero CLI exit is returned as-is with no retry — those failures (auth,
+ * credits, missing binary) are deterministic, and retrying stacks minutes on a
+ * lost cause. An exit-0 run whose output fails the verdict gate is retried;
+ * only the final attempt's output is relayed, so a caller never reads a
+ * discarded degenerate attempt as the review.
+ *
+ * The relay uses writeSync, not process.stdout.write: when stdout is a pipe —
+ * which is how every calling agent runs this — the async write queues, and
+ * `process.exit` in index.ts drops whatever has not drained. That silently
+ * truncated reviews at the 64 KiB pipe buffer, taking the trailing verdict
+ * line with them while the in-memory check below still saw a complete review
+ * and exited 0.
+ */
+export function relayReviewWithRetry(
+  command: string,
+  runAttempt: () => ReviewAttempt,
+): number {
+  let last: ReviewAttempt = { exitCode: 1, review: "" };
+  for (let attempt = 1; attempt <= MAX_REVIEW_ATTEMPTS; attempt += 1) {
+    last = runAttempt();
+    if (last.exitCode !== 0) {
+      writeSync(1, last.review);
+      return last.exitCode;
+    }
+    const problem = reviewOutputProblem(last.review);
+    if (problem === null) {
+      writeSync(1, last.review);
+      return 0;
+    }
+    process.stderr.write(
+      `${command} exited 0 but produced no usable review (attempt ${attempt}/${MAX_REVIEW_ATTEMPTS}): ${problem}\n`,
+    );
+  }
+  writeSync(1, last.review);
+  return 1;
+}

package/src/review/solicitClaudeCodeReview.ts

@@ -0,0 +1,140 @@
+import { reviewExecutable } from "./executable";
+import { loadConfig } from "../config";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+import {
+  MAX_BUFFER_BYTES,
+  resolveReviewContext,
+  spawnExitCode,
+} from "../git/prContext";
+import { withPinnedReviewInput } from "./pinnedReviewInput";
+import {
+  DEFAULT_CLAUDE_EFFORT,
+  type ReviewEffort,
+  resolveReviewEffort,
+} from "./reviewEffort";
+import { buildReviewPrompt, CLAUDE_ACCESS_NOTE } from "./reviewPrompt";
+import { type ReviewerEnv, relayReviewWithRetry } from "./runReview";
+
+/**
+ * Tools the reviewer gets. Read-only, and deliberately not empty: the diff alone
+ * does not show whether a changed line is safe, so the good findings come from
+ * reading around it — an unchanged branch further up the file, the source-shape
+ * baseline a file has to stay under, the callers a signature change breaks.
+ *
+ * `Bash` is withheld for two reasons, neither of which is reliability. A review
+ * needs no shell, so every Bash call is a turn spent earning a denial (`--print`
+ * denies what would need approval, hands the denial back, and carries on). And
+ * the session's context is a PR diff — attacker-influenceable text on a public
+ * repo — which is not something to hand a shell.
+ *
+ * `--safe-mode` also disables project/user instructions, skills, plugins,
+ * hooks, and MCP servers so the branch cannot expand the reviewer's authority.
+ * Browser integration and session persistence are disabled explicitly too.
+ * `dontAsk` fails closed on unapproved access, while the absolute Read rule
+ * confines file inspection to the immutable snapshot.
+ */
+const REVIEW_TOOLS = ["Read", "Grep", "Glob"] as const;
+
+function absoluteClaudeReadRule(snapshotRoot: string): string {
+  const normalized = path.resolve(snapshotRoot).replaceAll("\\", "/");
+  return `Read(//${normalized.replace(/^\/+/, "")}/**)`;
+}
+
+/**
+ * Build the `claude` argv for a non-interactive review at the given effort
+ * level. The prompt itself goes over stdin, not argv.
+ */
+export function buildClaudeReviewArgs(
+  effort: ReviewEffort,
+  snapshotRoot: string,
+  model?: string | null,
+): string[] {
+  return [
+    ...(model ? ["--model", model] : []),
+    "--effort",
+    effort,
+    "--print",
+    "--safe-mode",
+    "--no-chrome",
+    "--no-session-persistence",
+    "--permission-mode",
+    "dontAsk",
+    "--tools",
+    REVIEW_TOOLS.join(","),
+    "--allowedTools",
+    absoluteClaudeReadRule(snapshotRoot),
+  ];
+}
+
+/**
+ * Run `claude` over an already-built review prompt and relay whatever it says.
+ *
+ * Returns nonzero both when the CLI fails outright and when it exits 0 having
+ * produced something that is not a review — after one retry of the latter, since
+ * that failure is stochastic — so a caller's fallback chain treats a degenerate
+ * review the same as a crashed one.
+ */
+export function spawnClaudeReview(
+  prompt: string,
+  effort: ReviewEffort,
+  snapshotRoot: string,
+  env: ReviewerEnv = process.env,
+): number {
+  const executable = reviewExecutable("claude", env);
+  if (executable === undefined) {
+    process.stderr.write("Claude executable unavailable outside the repository.\n");
+    return 1;
+  }
+  return relayReviewWithRetry("claude", () => {
+    // Captured rather than inherited: a review has to be read to be judged, and
+    // `claude` exits 0 whether it reviewed the diff or merely said it would.
+    // `--print` emits the review in one final block, so nothing streams anyway.
+    const result = spawnSync(
+      executable,
+      buildClaudeReviewArgs(effort, snapshotRoot, loadConfig().review.claudeModel),
+      {
+        stdio: ["pipe", "pipe", "inherit"],
+        input: prompt,
+        encoding: "utf8",
+        maxBuffer: MAX_BUFFER_BYTES,
+          timeout: loadConfig().review.timeoutMs,
+        cwd: snapshotRoot,
+        // Passed explicitly so `claude` resolves against this PATH rather than
+        // the one the runtime snapshotted at startup.
+        env,
+      },
+    );
+    return {
+      exitCode: spawnExitCode("claude", result),
+      review: result.stdout ?? "",
+    };
+  });
+}
+
+/**
+ * Ask the local `claude` CLI to review the current branch's diff. Branch/PR/base
+ * are derived from git + GitHub; when the branch has no PR yet the diff is taken
+ * against the default branch, so a review can run before the PR is opened. The
+ * prompt is streamed via stdin (not argv) to avoid "Argument list too long"
+ * failures on large PRs. The effort level defaults to `xhigh` for Claude.
+ */
+export function solicitClaudeCodeReview(
+  rootDir: string,
+  effortArg?: string,
+): number {
+  const effort = resolveReviewEffort(effortArg, DEFAULT_CLAUDE_EFFORT);
+  const context = resolveReviewContext();
+  return withPinnedReviewInput(rootDir, context, (input) => {
+    const prompt = buildReviewPrompt({
+      context,
+      diff: input.diff,
+      reviewInstructions: input.reviewInstructions,
+      accessNote: CLAUDE_ACCESS_NOTE,
+      repositoryRoot: input.snapshotRoot,
+    });
+
+    return spawnClaudeReview(prompt, effort, input.snapshotRoot);
+  });
+}

package/src/review/solicitCodexReview.ts

@@ -0,0 +1,205 @@
+import { reviewExecutable } from "./executable";
+import { loadConfig } from "../config";
+import { spawnSync } from "node:child_process";
+import {
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import {
+  MAX_BUFFER_BYTES,
+  resolveReviewContext,
+  spawnExitCode,
+} from "../git/prContext";
+import { withPinnedReviewInput } from "./pinnedReviewInput";
+import {
+  DEFAULT_CODEX_EFFORT,
+  type ReviewEffort,
+  resolveReviewEffort,
+} from "./reviewEffort";
+import { buildReviewPrompt, CODEX_ACCESS_NOTE } from "./reviewPrompt";
+import { type ReviewerEnv, relayReviewWithRetry } from "./runReview";
+
+/** How much transcript tail to relay when a codex attempt fails outright. */
+const TRANSCRIPT_TAIL_CHARS = 2000;
+
+/**
+ * Build the `codex exec` argv. `exec`, not `review`: `codex review` writes its
+ * own prompt, so it carries no verdict line to gate on and interleaves its
+ * findings with an investigative transcript. `exec` takes this repo's prompt —
+ * the same verdict-gated one Claude reviews under — reading it from stdin
+ * (`-`) to dodge argv limits. A custom permission profile denies the host
+ * filesystem by default and exposes only the immutable review snapshot plus
+ * Codex's minimal runtime paths. The effort is pinned so the review never
+ * silently inherits `~/.codex/config.toml`, and the final message is written
+ * alone to `lastMessageFile`, so what gets relayed is the review, not the
+ * transcript.
+ *
+ * `--ignore-user-config` keeps the session hermetic. The sandbox confines only
+ * model-generated shell commands, so MCP servers configured in
+ * `~/.codex/config.toml` would still load and could mutate external state on
+ * behalf of that attacker-influenceable diff — and `-c mcp_servers={}` cannot
+ * remove them, since table overrides merge instead of replacing (verified
+ * against codex 0.145: `codex mcp list` is unchanged under that override).
+ * Ignoring the user config drops those servers wholesale; auth still works,
+ * and everything the review needs is pinned explicitly right here.
+ * `--disable plugins/hooks/apps` closes the remaining gaps: plugin-provided
+ * MCP servers, trusted hooks, and app connectors all live outside
+ * `config.toml`, so ignoring the config alone would leave them active. Hosted
+ * web search is disabled separately because it is not governed by the sandbox
+ * network permission.
+ * Codex also runs ephemerally from a temporary non-repository cwd so
+ * branch-controlled AGENTS.md files are not injected into its prompt. Model
+ * commands inherit no host environment, and strict config validation makes an
+ * unsupported permission profile fail closed.
+ */
+export function buildCodexReviewArgs(
+  effort: ReviewEffort,
+  lastMessageFile: string,
+  snapshotRoot: string,
+  codexRuntimeRoot: string,
+  model?: string | null,
+): string[] {
+  const readableRoots = [...new Set([codexRuntimeRoot, snapshotRoot])];
+  const filesystemPermissions = [
+    '":root"="deny"',
+    '":minimal"="read"',
+    ...readableRoots.map((root) => `${JSON.stringify(root)}="read"`),
+  ];
+  return [
+    "exec",
+    ...(model ? ["--model", model] : []),
+    "--ignore-user-config",
+    "--ignore-rules",
+    "--strict-config",
+    "--ephemeral",
+    "--disable",
+    "plugins",
+    "--disable",
+    "hooks",
+    "--disable",
+    "apps",
+    "--skip-git-repo-check",
+    "-c",
+    `model_reasoning_effort="${effort}"`,
+    "-c",
+    'web_search="disabled"',
+    "-c",
+    'default_permissions="review-snapshot"',
+    "-c",
+    `permissions.review-snapshot.filesystem={${filesystemPermissions.join(",")}}`,
+    "-c",
+    "permissions.review-snapshot.network.enabled=false",
+    "-c",
+    'shell_environment_policy.inherit="none"',
+    "--color",
+    "never",
+    "--output-last-message",
+    lastMessageFile,
+    "-",
+  ];
+}
+
+/** Content of the last-message file, or "" when codex never wrote one. */
+function readLastMessage(lastMessageFile: string): string {
+  try {
+    return readFileSync(lastMessageFile, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Run `codex exec` over an already-built review prompt and relay the final
+ * message it writes.
+ *
+ * The review is read from `--output-last-message`, not the process streams:
+ * codex prints its session transcript — including a verbatim echo of the
+ * prompt and diff — to stderr and the final message to stdout, and inheriting
+ * either would bury the verdict in noise (the exact failure this replaces).
+ * Both streams are captured; on a failed launch the stderr tail is relayed so
+ * the error is still diagnosable. Degenerate exit-0 output is retried once via
+ * the shared gate, same as the Claude path.
+ */
+export function spawnCodexReview(
+  prompt: string,
+  effort: ReviewEffort,
+  snapshotRoot: string,
+  env: ReviewerEnv = process.env,
+): number {
+  const codexExecutable = reviewExecutable("codex", env);
+  if (codexExecutable === undefined) {
+    process.stderr.write("Codex executable unavailable outside the repository.\n");
+    return 1;
+  }
+  const outDir = mkdtempSync(path.join(tmpdir(), "agent-tool-codex-"));
+  const codexRuntimeRoot = path.dirname(codexExecutable);
+  let attempt = 0;
+  try {
+    return relayReviewWithRetry("codex", () => {
+      // A fresh file per attempt, so a retry that crashes before writing can
+      // never be read as the previous attempt's stale message.
+      attempt += 1;
+      const lastMessageFile = path.join(outDir, `review-${attempt}.md`);
+      const result = spawnSync(
+        codexExecutable,
+        buildCodexReviewArgs(
+          effort,
+          lastMessageFile,
+          snapshotRoot,
+          codexRuntimeRoot,
+          loadConfig().review.codexModel,
+        ),
+        {
+          stdio: ["pipe", "pipe", "pipe"],
+          input: prompt,
+          encoding: "utf8",
+          maxBuffer: MAX_BUFFER_BYTES,
+          timeout: loadConfig().review.timeoutMs,
+          // Codex loads project AGENTS.md from its cwd. Keep cwd neutral and
+          // grant read-only access to the reviewed repository explicitly.
+          cwd: outDir,
+          env,
+        },
+      );
+      const exitCode = spawnExitCode("codex", result);
+      const transcript = result.stderr ?? "";
+      if (exitCode !== 0 && transcript.length > 0) {
+        process.stderr.write(
+          `codex transcript (tail):\n${transcript.slice(-TRANSCRIPT_TAIL_CHARS)}\n`,
+        );
+      }
+      return { exitCode, review: readLastMessage(lastMessageFile) };
+    });
+  } finally {
+    rmSync(outDir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Ask the local `codex` CLI to review the current branch's diff. Branch/PR/base
+ * are derived from git + GitHub; when the branch has no PR yet the diff is
+ * taken against the default branch, so a review can run before the PR is
+ * opened. The effort level defaults to `high` for Codex.
+ */
+export function solicitCodexReview(
+  rootDir: string,
+  effortArg?: string,
+): number {
+  const effort = resolveReviewEffort(effortArg, DEFAULT_CODEX_EFFORT);
+  const context = resolveReviewContext();
+  return withPinnedReviewInput(rootDir, context, (input) => {
+    const prompt = buildReviewPrompt({
+      context,
+      diff: input.diff,
+      reviewInstructions: input.reviewInstructions,
+      accessNote: CODEX_ACCESS_NOTE,
+      repositoryRoot: input.snapshotRoot,
+    });
+
+    return spawnCodexReview(prompt, effort, input.snapshotRoot);
+  });
+}

package/src/review/solicitOpencodeReview.ts

@@ -0,0 +1,233 @@
+import { reviewExecutable } from "./executable";
+import { loadConfig, DEFAULT_CONFIG } from "../config";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import {
+  MAX_BUFFER_BYTES,
+  resolveReviewContext,
+  spawnExitCode,
+} from "../git/prContext";
+import { withPinnedReviewInput } from "./pinnedReviewInput";
+import {
+  DEFAULT_OPENCODE_EFFORT,
+  type ReviewEffort,
+  resolveReviewEffort,
+} from "./reviewEffort";
+import { buildReviewPrompt, OPENCODE_ACCESS_NOTE } from "./reviewPrompt";
+import { type ReviewerEnv, relayReviewWithRetry } from "./runReview";
+
+/**
+ * The model every opencode review runs under. Pinned so the review never
+ * silently inherits whatever the ambient opencode config selects, and so the
+ * fallback works when the *other* agents are out of credits but this provider
+ * is not.
+ */
+const OPENCODE_MODEL = DEFAULT_CONFIG.review.opencodeModel;
+
+/**
+ * Name of the read-only reviewer agent defined in the inline config. A
+ * distinctive name keeps a same-named agent in the user's global config from
+ * being shadowed or shadowing this one; `OPENCODE_CONFIG_CONTENT` has the
+ * highest precedence among the non-managed config tiers anyway.
+ */
+const OPENCODE_REVIEW_AGENT = "agent-tool-review";
+
+/**
+ * Map the shared effort vocabulary to a `--variant` deepseek-v4-pro accepts.
+ * The skill's levels are `low | medium | high | xhigh | max`; this model's
+ * variants are `low | medium | high | max`, so `xhigh` collapses onto `max`.
+ */
+export function resolveOpencodeVariant(
+  effort: ReviewEffort,
+  variants: Record<string, string> = DEFAULT_CONFIG.review.opencodeVariants,
+): string {
+  return variants[effort] ?? effort;
+}
+
+/**
+ * Inline opencode config (`OPENCODE_CONFIG_CONTENT`) that defines the reviewer
+ * agent and its confinement. This is the hermetic substitute for opencode
+ * having no per-run "safe mode": every tool is denied by default and only the
+ * read-only `read`/`glob`/`grep`/`list` tools are re-allowed, and reads
+ * outside its own (empty) cwd are gated by `external_directory` to the
+ * snapshot alone.
+ *
+ * The default deny matters because opencode's built-in ruleset starts from
+ * `"*": "allow"` and still loads the user's global config, so any MCP server
+ * defined there would otherwise hand the reviewer its tools. Opencode appends
+ * agent rules after its defaults and the last matching rule wins, so `"*"`
+ * must come first here for the specific allows after it to take effect. The
+ * named denies repeat the default for the tools that matter most.
+ *
+ * The snapshot path appears both as `mkdtempSync` wrote it and as `realpath`
+ * resolves it, because on macOS the temp dir is a symlink (`/var` →
+ * `/private/var`) and the model may pass either spelling; a denied spelling
+ * only costs the model a retry, but both spellings allowed costs nothing.
+ */
+export function buildOpencodeInlineConfig(snapshotRoot: string, model = OPENCODE_MODEL): string {
+  const normalized = path.resolve(snapshotRoot).replaceAll("\\", "/");
+  const resolved = realpathSync(snapshotRoot).replaceAll("\\", "/");
+  const externalDirectory: Record<string, string> = { "*": "deny" };
+  for (const root of new Set([normalized, resolved])) {
+    externalDirectory[`${root}/**`] = "allow";
+  }
+  return JSON.stringify({
+    $schema: "https://opencode.ai/config.json",
+    agent: {
+      [OPENCODE_REVIEW_AGENT]: {
+        description:
+          "Read-only reviewer confined to the immutable repository snapshot.",
+        prompt:
+          "You are a read-only code reviewer. Use only the read, glob, and grep tools; never modify files, run commands, or fetch anything.",
+        model,
+        permission: {
+          "*": "deny",
+          read: "allow",
+          glob: "allow",
+          grep: "allow",
+          list: "allow",
+          edit: "deny",
+          bash: "deny",
+          question: "deny",
+          skill: "deny",
+          task: "deny",
+          webfetch: "deny",
+          websearch: "deny",
+          external_directory: externalDirectory,
+        },
+      },
+    },
+  });
+}
+
+/**
+ * Build the `opencode run` argv for a non-interactive review. The prompt goes
+ * over stdin (opencode reads stdin when no message positional is given), so a
+ * large diff never hits argv limits. `--pure` drops external plugins, and the
+ * confinement itself lives in the inline config passed through the
+ * environment: opencode has no per-run flag for permissions, and
+ * `--dangerously-skip-permissions` would only *add* authority, never remove
+ * it.
+ */
+export function buildOpencodeReviewArgs(variant: string, model = OPENCODE_MODEL): string[] {
+  return [
+    "run",
+    "--model",
+    model,
+    "--variant",
+    variant,
+    "--agent",
+    OPENCODE_REVIEW_AGENT,
+    "--pure",
+  ];
+}
+
+/**
+ * How much stderr tail to relay when an opencode attempt fails outright.
+ */
+const TRANSCRIPT_TAIL_CHARS = 2000;
+
+/**
+ * Run `opencode run` over an already-built review prompt and relay whatever it
+ * prints to stdout — the final message alone, since run mode keeps its TUI
+ * noise on stderr. Exit codes and the verdict gate behave exactly like the
+ * Claude and Codex paths: a nonzero CLI exit is returned as-is, and an exit-0
+ * run without a verdict-signed review is retried once before failing.
+ *
+ * Both streams are captured: opencode prints its session transcript — tool
+ * call echo, progress lines, and the like — to stderr, and inheriting it
+ * would bury the review under noise on every run. On a failed launch the
+ * stderr tail is relayed so the error is still diagnosable (the Codex path
+ * makes the same trade-off).
+ *
+ * The reviewer runs from a fresh, empty, non-repository cwd so nothing
+ * branch-controlled loads: not the snapshot's `AGENTS.md` or `opencode.json`,
+ * and not its `.opencode/` directory. `OPENCODE_CONFIG_DIR` points at that
+ * same empty directory so no user-defined agents, commands, or plugins from
+ * `~/.config/opencode` ride along either; `--pure` additionally disables
+ * external plugins. That directory is *config* only: opencode's credentials
+ * live in its data directory (`~/.local/share/opencode/auth.json` on macOS),
+ * which `OPENCODE_CONFIG_DIR` does not touch, so the deepseek auth the review
+ * needs still resolves. Global config still loads, but the inline config's
+ * agent-scoped deny rules take precedence over whatever it sets.
+ */
+export function spawnOpencodeReview(
+  prompt: string,
+  effort: ReviewEffort,
+  snapshotRoot: string,
+  env: ReviewerEnv = process.env,
+): number {
+  const executable = reviewExecutable("opencode", env);
+  if (executable === undefined) {
+    process.stderr.write("OpenCode executable unavailable outside the repository.\n");
+    return 1;
+  }
+  const model = loadConfig().review.opencodeModel;
+  const outDir = mkdtempSync(path.join(tmpdir(), "agent-tool-opencode-"));
+  try {
+    return relayReviewWithRetry("opencode", () => {
+      const result = spawnSync(
+        executable,
+        buildOpencodeReviewArgs(resolveOpencodeVariant(effort, loadConfig().review.opencodeVariants), model),
+        {
+          stdio: ["pipe", "pipe", "pipe"],
+          input: prompt,
+          encoding: "utf8",
+          maxBuffer: MAX_BUFFER_BYTES,
+          timeout: loadConfig().review.timeoutMs,
+          // Neutral cwd: opencode would otherwise load the snapshot's
+          // branch-controlled config and instructions into the reviewer.
+          cwd: outDir,
+          env: {
+            ...env,
+            OPENCODE_CONFIG_CONTENT: buildOpencodeInlineConfig(snapshotRoot, model),
+            OPENCODE_CONFIG_DIR: outDir,
+          },
+        },
+      );
+      const exitCode = spawnExitCode("opencode", result);
+      const transcript = result.stderr ?? "";
+      if (exitCode !== 0 && transcript.length > 0) {
+        process.stderr.write(
+          `opencode transcript (tail):\n${transcript.slice(-TRANSCRIPT_TAIL_CHARS)}\n`,
+        );
+      }
+      return {
+        exitCode,
+        review: result.stdout ?? "",
+      };
+    });
+  } finally {
+    rmSync(outDir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Ask the local `opencode` CLI to review the current branch's diff with
+ * deepseek-v4-pro. Branch/PR/base are derived from git + GitHub; when the
+ * branch has no PR yet the diff is taken against the default branch, so a
+ * review can run before the PR is opened. The prompt is streamed via stdin
+ * (not argv) to avoid "Argument list too long" failures on large PRs. The
+ * effort level defaults to `high` for opencode.
+ */
+export function solicitOpencodeReview(
+  rootDir: string,
+  effortArg?: string,
+): number {
+  const effort = resolveReviewEffort(effortArg, DEFAULT_OPENCODE_EFFORT);
+  const context = resolveReviewContext();
+  return withPinnedReviewInput(rootDir, context, (input) => {
+    const prompt = buildReviewPrompt({
+      context,
+      diff: input.diff,
+      reviewInstructions: input.reviewInstructions,
+      accessNote: OPENCODE_ACCESS_NOTE,
+      repositoryRoot: input.snapshotRoot,
+    });
+
+    return spawnOpencodeReview(prompt, effort, input.snapshotRoot);
+  });
+}