@agentskit/code-review 0.1.0 → 0.4.1

package/.doc-bridge/capabilities.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 1,
+  "type": "doc-bridge-capabilities",
+  "package": "@agentskit/doc-bridge",
+  "version": "1.1.1",
+  "project": {
+    "name": "AgentsKit Code Review",
+    "root": "."
+  },
+  "contentHash": "fc48bc555bbddf9102ae8fdbd4712da1e9cfa5bd2649dec2ac9cc7687994aa52",
+  "artifacts": {
+    "index": ".doc-bridge/index.json",
+    "llmsTxt": "llms.txt"
+  },
+  "capabilities": [
+    "index",
+    "query",
+    "search",
+    "agent-handoff",
+    "gates",
+    "mcp",
+    "human-docs"
+  ],
+  "surfaces": {
+    "cli": {
+      "bin": "ak-docs",
+      "defaultFormat": "text"
+    },
+    "mcp": {
+      "enabled": true,
+      "transport": "stdio"
+    }
+  }
+}

package/.doc-bridge/index.json

@@ -0,0 +1,94 @@
+{
+  "schemaVersion": 1,
+  "contentHash": "fc48bc555bbddf9102ae8fdbd4712da1e9cfa5bd2649dec2ac9cc7687994aa52",
+  "contentHashAlgo": "sha256-normalized-v1",
+  "generatedAt": "2026-09-05T21:26:44.865Z",
+  "project": {
+    "name": "AgentsKit Code Review",
+    "root": "."
+  },
+  "knowledge": [
+    {
+      "id": "code-review-cli",
+      "type": "agent-doc",
+      "title": "Code Review CLI handoff",
+      "path": "docs/for-agents/code-review-cli.md",
+      "description": "Provider-neutral, low-noise AI code review for local Git diffs, files/stdin, and GitHub pull requests. Seven focused lenses propose findings; adversarial votes remove weak findings; reporters emit Markdown, GitHub reviews, and SARIF.",
+      "body": "Code Review CLI handoff Purpose Provider-neutral, low-noise AI code review for local Git diffs, files/stdin, and GitHub pull requests. Seven focused lenses propose findings; adversarial votes remove weak findings; reporters emit Markdown, GitHub reviews, and SARIF. Ownership map - src/cli.ts : public flags, source selection, provider selection, exit policy. - src/<provider -adapter.ts : logged-in local CLI adapters. - agents/code-review/ : review pipeline, lenses, input normalization, reporters. - action.yml : composite GitHub Action contract. - .github/workflows/release.yml : Changesets version-pull-request workflow. - .github/workflows/publish.yml : version-PR-gated npm Trusted Publishing and GitHub Release workflow. - examples/ : copy-ready Action workflows. - README.md and docs/OPERATIONS.md : public adoption and operations guidance. - ecosystem.json , llms.txt , and llms-full.txt : canonical product graph and machine-readable discovery/full-corpus surfaces. - test/ : credential-free CLI, Action, and documentation contract proofs. Boundaries - Depend on AgentsKit adapter/runtime/tool contracts; do not create a second model abstraction. - Preserve provider neutrality and advisory-by-default Action behavior. - Never expose provider keys in arguments, docs fixtures, logs, or PR output. - This product intentionally has no Fumadocs site and no embedded AgentsChat. - The vendored review agent tracks the AgentsKit Registry source; keep divergences explicit. Change routes - CLI flag/provider behavior: start at src/cli.ts , then update README, operations docs, and tests. - Local CLI subprocess behavior: start at the matching src/<provider -adapter.ts and add an offline fixture. - Review logic or noise reduction: start at agents/code-review/agent.ts and the relevant lens; prove both survival and rejection behavior. - GitHub comments/SARIF: start at agents/code-review/reporters.ts and verify permissions/failure docs. - Action input: update action.yml , examples/pull-request.yml , README, and contract tests together. - Release automation: update .github/workflows/release.yml , .github/workflows/publish.yml , Changesets configuration, and the automated publishing section in docs/OPERATIONS.md together. Verification npm run check includes typecheck, build, an end-to-end offline stdin review, Action/documentation tests, Doc Bridge gates, and CLI help. Ecosystem routes - AgentsKit — runtime, adapters, and custom review agents: https://www.agentskit.io/docs - Registry — ready-made agent source: https://registry.agentskit.io/docs - AgentsKit Chat — conversational delivery; do not embed a chat runtime here: https://chat.agentskit.io/docs - Playbook — engineering discipline before verification: https://playbook.agentskit.io/docs - Doc Bridge — documentation ownership, freshness, and handoff generation: https://agentskit-io.github.io/doc-bridge/ - AKOS — enterprise orchestration and production governance: https://akos.agentskit.io/docs Use llms.txt for discovery and llms-full.txt only when the complete public, operational, and agent-handoff context is required. Human guide - README: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/README.md - Operations guide: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/docs/OPERATIONS.md - Contributing: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/CONTRIBUTING.md - Security: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/SECURITY.md"
+    },
+    {
+      "id": "index",
+      "type": "agent-doc",
+      "title": "Code Review agent docs",
+      "path": "docs/for-agents/index.md",
+      "description": "- Code Review CLI handoff — ownership, change routes, security boundaries, and verification: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/docs/for-agents/code-review-cli.md - Concise machine map — discovery, raw sources, and all seven ecosystem products: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/llms.txt - Full machine corpus — public, operational,",
+      "body": "Code Review agent docs - Code Review CLI handoff — ownership, change routes, security boundaries, and verification: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/docs/for-agents/code-review-cli.md - Concise machine map — discovery, raw sources, and all seven ecosystem products: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/llms.txt - Full machine corpus — public, operational, governance, maturity, and agent handoffs: https://raw.githubusercontent.com/AgentsKit-io/code-review/main/llms-full.txt"
+    }
+  ],
+  "handoffs": {
+    "code-review-cli": {
+      "type": "agent-handoff",
+      "schemaVersion": 1,
+      "source": ".doc-bridge/index.json",
+      "target": {
+        "type": "package",
+        "id": "code-review-cli",
+        "path": "."
+      },
+      "startHere": "docs/for-agents/code-review-cli.md",
+      "readBeforeEditing": [
+        "docs/for-agents/code-review-cli.md",
+        "AGENTS.md"
+      ],
+      "editRoots": [
+        "."
+      ],
+      "checks": [
+        "npm run check",
+        "npm pack --dry-run"
+      ],
+      "humanDoc": "OPERATIONS",
+      "bridge": {
+        "humanDoc": "linked"
+      },
+      "notes": [
+        "Provider-neutral local and GitHub code review CLI, Action, reporters, and repository documentation."
+      ]
+    }
+  },
+  "lookup": {
+    "packages": [
+      "code-review-cli"
+    ],
+    "ownership": {
+      "code-review-cli": {
+        "id": "code-review-cli",
+        "path": ".",
+        "checks": [
+          "npm run check",
+          "npm pack --dry-run"
+        ],
+        "purpose": "Provider-neutral local and GitHub code review CLI, Action, reporters, and repository documentation.",
+        "humanDoc": "OPERATIONS",
+        "agentDoc": "docs/for-agents/code-review-cli.md"
+      }
+    },
+    "intents": {
+      "understand-or-run-code-review": {
+        "id": "understand-or-run-code-review",
+        "title": "Understand or run Code Review",
+        "paths": [
+          "README.md",
+          "docs/OPERATIONS.md"
+        ]
+      }
+    },
+    "changes": {
+      "change-cli-provider-or-action": {
+        "id": "change-cli-provider-or-action",
+        "title": "Change a CLI provider, flag, reporter, or Action input",
+        "startHere": "docs/for-agents/code-review-cli.md"
+      }
+    }
+  }
+}

package/.pre-commit-hooks.yaml

@@ -0,0 +1,9 @@
+- id: agentskit-review
+  name: AgentsKit Code Review
+  description: Run provider-neutral, adversarial code review over the repository diff.
+  entry: agentskit-review
+  language: node
+  pass_filenames: false
+  always_run: true
+  require_serial: true
+  stages: [manual]

package/AGENTS.md

@@ -0,0 +1,20 @@
+# AGENTS.md — AgentsKit Code Review
+
+Read [`docs/for-agents/code-review-cli.md`](docs/for-agents/code-review-cli.md) before editing. It owns the module map, public boundaries, change routes, and verification commands.
+
+## Non-negotiable boundaries
+
+- Keep provider behavior behind the AgentsKit adapter contract.
+- Keep the GitHub Action advisory by default; blocking is explicit policy.
+- Never place API keys in arguments, fixtures, logs, documentation examples, or review output.
+- Keep this product repository-native: do not add Fumadocs or embedded AgentsChat.
+- Update public docs and offline tests with any CLI, provider, reporter, or Action contract change.
+
+## Verification
+
+Run both commands before shipping:
+
+```bash
+npm run check
+npm pack --dry-run
+```

package/CHANGELOG.md

@@ -0,0 +1,85 @@
+# Changelog
+
+## 0.4.1
+
+### Patch Changes
+
+- [#73](https://github.com/AgentsKit-io/code-review/pull/73) [`f99c9a3`](https://github.com/AgentsKit-io/code-review/commit/f99c9a37478440b7030c33ac480746db4204d0ef) Thanks [@EmersonBraun](https://github.com/EmersonBraun)! - Add a deterministic continuous-improvement benchmark for clean, required-lens-failure, and deadline review behavior.
+
+- [#73](https://github.com/AgentsKit-io/code-review/pull/73) [`f99c9a3`](https://github.com/AgentsKit-io/code-review/commit/f99c9a37478440b7030c33ac480746db4204d0ef) Thanks [@EmersonBraun](https://github.com/EmersonBraun)! - Automate version pull requests, GitHub releases, and npm trusted publishing without a long-lived npm token. Stabilize OpenCode ACP protocol fixtures without weakening their timeout coverage.
+
+All notable changes will be documented here. This project follows Semantic Versioning.
+
+## [Unreleased]
+
+## [0.4.0] - 2026-09-05
+
+### Added
+
+- Added machine-readable preflight manifests for reviewable and unreviewed files, with stable file-batch planning for external orchestration.
+- Added private JSON review-result artifacts and SHA/policy-bound batch-coverage primitives for safe Orca aggregation.
+- Added fail-closed consolidation: every batch artifact must match the immutable PR/SHA/policy/file manifest and have complete lens evidence before a single review can be published.
+- Added CLI consolidation and publication gates so Orca can create exactly one review only from a current, complete consolidated artifact.
+
+### Changed
+
+- Expanded reviewable product files to include HTML, CSS, Markdown, and MDX.
+- Made GitHub inline findings agent-actionable with correction rationale, required change, acceptance check, and verification confidence.
+- Reworked the persistent PR walkthrough into a compact CodeRabbit-style status card; finding detail now lives only on the relevant inline review comments.
+
+### Security
+
+- Reject GitHub publication from a partial review batch; only a complete consolidated review may post.
+- Document the intentionally local, private batch-artifact writes so CodeQL does not misclassify serialized PR metadata as executable file access.
+
+## [0.3.0] - 2026-08-30
+
+### Added
+
+- Added global cancellation deadlines, provider health preflight, a circuit breaker, and bounded execution evidence.
+- Added the explicit `fast` profile with a single required-lens batch for lower latency and predictable calls.
+- Added CI Action inputs for profile, deadline, and health-check policy.
+
+## [0.2.3] - 2026-08-30
+
+### Fixed
+
+- Stop issuing additional provider calls after a terminal authentication failure; reviews still fail closed without spending one failed call per lens.
+
+## [0.2.2] - 2026-08-29
+
+### Added
+
+- Added a GitHub Release workflow for tag-verified npm Trusted Publishing with OIDC and provenance.
+
+### Fixed
+
+- Prevented Codex authentication, timeout, and process failures from being retried as output-schema compatibility failures.
+- Documented and exposed explicit trusted-local mode for logged-in Codex/Claude CLI workflows.
+- Raised the default Codex local-worker deadline to five minutes and made GitHub PR file budgets enforceable and fail-closed.
+- Bounded GitHub Action calls, propagated Claude OAuth credentials, made review fingerprints version-aware, paginated comment reconciliation with a fail-closed cap, and bounded GitHub API responses.
+
+## [0.2.1] - 2026-08-29
+
+### Fixed
+
+- Applied Codex timeout defaults in direct library usage, bounded GitHub PR metadata/content ingestion, and transient-only GitHub GET retries.
+- Added Ollama request deadlines and integration coverage for rate limits, posting failures, stalled requests, and large PR limits.
+
+## [0.2.0] - 2026-08-29
+
+### Changed
+
+- Added strict versioned `.agentskit-review.json` policy with lens coverage, budgets, thresholds, context, and safe CI precedence; incomplete profiles require explicit local opt-in.
+- Hardened the shared local CLI worker with cancellation, process-tree cleanup, isolated temporary environments, bounded output, and redacted diagnostics.
+- Added bounded source snapshots with infrastructure/configuration file support, denylisted sensitive paths, symlink checks, input limits, and data-boundary-aware secret redaction.
+- Added provider-free `--plan`/`--dry-run` preflight with explicit file/byte/call budgets, bounded retries, CLI concurrency defaults, and fail-closed required-lens coverage.
+- Made reviews fail closed when any reviewable file has no successful primary lens or cannot be ingested; advisory mode now suppresses finding-based failures only, never source/provider/execution failures.
+- Added primary-lens execution coverage to review summaries so partial provider degradation is visible.
+- Repositioned the CLI and GitHub Action as provider-neutral.
+- Made provider selection explicit and removed provider-specific model defaults.
+- Added bounded GitHub review reconciliation with SHA/policy fingerprints, incremental compare scope when the prior SHA is an ancestor, fork-safe skip behavior, and idempotent summary updates.
+- Added experimental Grok Build CLI ACP support with isolated capability denial, versioned output validation, bounded invalid-output retry, and offline lifecycle fixtures.
+- Added experimental OpenCode CLI ACP support with the same isolated, versioned, bounded worker contract and offline lifecycle fixtures.
+- Added provider-specific Grok/OpenCode headless transports with explicit local-only ACP fallback via `--transport auto`.
+- Added package metadata, CLI help, open-source governance, and contribution guidance.

package/CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing
+
+Thanks for helping make AI code review more useful and less noisy.
+
+## Start here
+
+1. Fork and clone the repository.
+2. Create a focused branch from `main`.
+3. Run `npm install`.
+4. Make the smallest change that solves the issue.
+5. Run `npm run check` before opening a pull request.
+
+Node.js 20 or newer is required.
+
+## Project map
+
+- `src/cli.ts` — arguments, providers, review policy, and reporters.
+- `src/*-adapter.ts` — adapters for logged-in local CLIs.
+- `agents/code-review/` — vendored review agent, lenses, sources, and reporters.
+- `action.yml` — GitHub Action interface.
+- `examples/` — copy-ready workflows.
+
+## Good contributions
+
+- Reduce a reproducible false positive.
+- Add a provider through the existing adapter contract.
+- Add a focused review lens with clear evidence requirements.
+- Improve a reporter or source without tying it to one model.
+- Add provider-neutral examples and documentation.
+
+Please open an issue before a large architectural change. Small fixes and documentation improvements can go straight to a pull request.
+
+## Pull requests
+
+- Keep one concern per PR.
+- Explain the user-visible behavior and how you tested it.
+- Add or update tests for behavior changes.
+- Preserve provider neutrality: provider-specific behavior belongs in its adapter.
+- Never commit API keys, model output containing private code, or review tokens.
+- Update README or examples when changing the public CLI or Action interface.
+
+Project decisions, maintainer responsibilities, and the release process are
+documented in [GOVERNANCE.md](GOVERNANCE.md).
+
+By participating, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).