@anthropologies/claudestory 0.1.58 → 0.1.60

package/dist/mcp.js

@@ -3689,8 +3689,48 @@ var init_session_types = __esm({
         maxTicketsPerSession: z9.number().min(0).default(5),
         handoverInterval: z9.number().min(0).default(3),
         compactThreshold: z9.string().default("high"),
-        reviewBackends: z9.array(z9.string()).default(["codex", "agent"])
+        reviewBackends: z9.array(z9.string()).default(["codex", "agent"]),
+        // T-181: Multi-lens review config
+        lensConfig: z9.object({
+          lenses: z9.union([z9.literal("auto"), z9.array(z9.string())]).default("auto"),
+          maxLenses: z9.number().min(1).max(8).default(8),
+          lensTimeout: z9.union([
+            z9.number(),
+            z9.object({ default: z9.number(), opus: z9.number() })
+          ]).default({ default: 60, opus: 120 }),
+          findingBudget: z9.number().min(1).default(10),
+          confidenceFloor: z9.number().min(0).max(1).default(0.6),
+          tokenBudgetPerLens: z9.number().min(1e3).default(32e3),
+          hotPaths: z9.array(z9.string()).default([]),
+          lensModels: z9.record(z9.string()).default({ default: "sonnet", security: "opus", concurrency: "opus" })
+        }).optional(),
+        blockingPolicy: z9.object({
+          neverBlock: z9.array(z9.string()).default([]),
+          alwaysBlock: z9.array(z9.string()).default(["injection", "auth-bypass", "hardcoded-secrets"]),
+          planReviewBlockingLenses: z9.array(z9.string()).default(["security", "error-handling"])
+        }).optional(),
+        requireSecretsGate: z9.boolean().default(false),
+        requireAccessibility: z9.boolean().default(false),
+        testMapping: z9.object({
+          strategy: z9.literal("convention"),
+          patterns: z9.array(z9.object({
+            source: z9.string(),
+            test: z9.string()
+          }))
+        }).optional()
       }).default({ maxTicketsPerSession: 5, compactThreshold: "high", reviewBackends: ["codex", "agent"], handoverInterval: 3 }),
+      // T-181: Lens review findings history (for lessons feedback loop)
+      lensReviewHistory: z9.array(z9.object({
+        ticketId: z9.string(),
+        stage: z9.enum(["CODE_REVIEW", "PLAN_REVIEW"]),
+        lens: z9.string(),
+        category: z9.string(),
+        severity: z9.string(),
+        disposition: z9.enum(["open", "addressed", "contested", "deferred"]),
+        description: z9.string(),
+        dismissReason: z9.string().optional(),
+        timestamp: z9.string()
+      })).default([]),
       // T-123: Issue sweep tracking
       issueSweepState: z9.object({
         remaining: z9.array(z9.string()),
@@ -3719,7 +3759,8 @@ var init_session_types = __esm({
       resolvedDefaults: z9.object({
         maxTicketsPerSession: z9.number(),
         compactThreshold: z9.string(),
-        reviewBackends: z9.array(z9.string())
+        reviewBackends: z9.array(z9.string()),
+        handoverInterval: z9.number().optional()
       }).optional()
     }).passthrough();
   }
@@ -4096,8 +4137,8 @@ var init_session = __esm({
 
 // src/mcp/index.ts
 init_esm_shims();
-import { realpathSync as realpathSync2, existsSync as existsSync11 } from "fs";
-import { resolve as resolve8, join as join19, isAbsolute } from "path";
+import { realpathSync as realpathSync2, existsSync as existsSync12 } from "fs";
+import { resolve as resolve8, join as join20, isAbsolute } from "path";
 import { z as z11 } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -4150,7 +4191,7 @@ init_errors();
 init_helpers();
 init_types();
 import { z as z10 } from "zod";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/cli/commands/status.ts
 init_esm_shims();
@@ -5444,8 +5485,8 @@ init_handover();
 init_esm_shims();
 init_session_types();
 init_session();
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, readdirSync as readdirSync4 } from "fs";
+import { join as join15 } from "path";
 
 // src/autonomous/state-machine.ts
 init_esm_shims();
@@ -5984,6 +6025,22 @@ function djb2Hash(content) {
   }
   return hash.toString(36);
 }
+function buildLensHistoryUpdate(findings, existing, ticketId, stage) {
+  const existingKeys = new Set(
+    existing.map((e) => `${e.ticketId}:${e.stage}:${e.lens}:${e.category}`)
+  );
+  const newEntries = findings.map((f) => ({
+    ticketId,
+    stage,
+    lens: typeof f.lens === "string" && f.lens !== "" ? f.lens : "unknown",
+    category: f.category,
+    severity: f.severity,
+    disposition: f.disposition ?? "open",
+    description: f.description,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  })).filter((e) => !existingKeys.has(`${e.ticketId}:${e.stage}:${e.lens}:${e.category}`));
+  return newEntries.length > 0 ? [...existing, ...newEntries] : null;
+}
 
 // src/autonomous/stages/index.ts
 init_esm_shims();
@@ -6254,6 +6311,31 @@ var PlanReviewStage = class {
     const reviewer = nextReviewer(existingReviews, backends);
     const risk = ctx.state.ticket?.risk ?? "low";
     const minRounds = requiredRounds(risk);
+    if (reviewer === "lenses") {
+      return {
+        instruction: [
+          `# Multi-Lens Plan Review \u2014 Round ${roundNum} of ${Math.max(minRounds, roundNum)} minimum`,
+          "",
+          "This round uses the **multi-lens review orchestrator** for plan review. It fans out to specialized review agents (Clean Code, Security, Error Handling, and more) in parallel to evaluate the plan from multiple perspectives.",
+          "",
+          "1. Read the plan file",
+          "2. Call `prepareLensReview()` with the plan text (stage: PLAN_REVIEW)",
+          "3. Spawn all lens subagents in parallel",
+          "4. Collect results and pass through the merger and judge pipeline",
+          "5. Report the final SynthesisResult verdict and findings",
+          "",
+          "When done, call `claudestory_autonomous_guide` with:",
+          "```json",
+          `{ "sessionId": "${ctx.state.sessionId}", "action": "report", "report": { "completedAction": "plan_review_round", "verdict": "<approve|revise|reject>", "findings": [...] } }`,
+          "```"
+        ].join("\n"),
+        reminders: [
+          "Report the exact verdict and findings from the synthesizer.",
+          "Lens subagents run in parallel with read-only tools (Read, Grep, Glob)."
+        ],
+        transitionedFrom: ctx.state.previousState ?? void 0
+      };
+    }
     return {
       instruction: [
         `# Plan Review \u2014 Round ${roundNum} of ${Math.max(minRounds, roundNum)} minimum`,
@@ -6315,9 +6397,19 @@ var PlanReviewStage = class {
       nextAction = "PLAN_REVIEW";
     }
     const reviewsForWrite = isReject ? { ...ctx.state.reviews, plan: [] } : { ...ctx.state.reviews, plan: planReviews };
-    ctx.writeState({
+    const stateUpdate = {
       reviews: reviewsForWrite
-    });
+    };
+    if (reviewerBackend === "lenses" && findings.length > 0) {
+      const updated = buildLensHistoryUpdate(
+        findings,
+        ctx.state.lensReviewHistory ?? [],
+        ctx.state.ticket?.id ?? "unknown",
+        "PLAN_REVIEW"
+      );
+      if (updated) stateUpdate.lensReviewHistory = updated;
+    }
+    ctx.writeState(stateUpdate);
     ctx.appendEvent("plan_review", {
       round: roundNum,
       verdict,
@@ -6661,6 +6753,25 @@ var TestStage = class {
 
 // src/autonomous/stages/code-review.ts
 init_esm_shims();
+
+// src/autonomous/review-lenses/cache.ts
+init_esm_shims();
+import { createHash } from "crypto";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync9, rmSync as rmSync2, renameSync as renameSync2 } from "fs";
+import { join as join12 } from "path";
+
+// src/autonomous/review-lenses/schema-validator.ts
+init_esm_shims();
+
+// src/autonomous/review-lenses/cache.ts
+var CACHE_DIR = "lens-cache";
+function clearCache(sessionDir2) {
+  const dir = join12(sessionDir2, CACHE_DIR);
+  if (!existsSync9(dir)) return;
+  rmSync2(dir, { recursive: true, force: true });
+}
+
+// src/autonomous/stages/code-review.ts
 var CodeReviewStage = class {
   id = "CODE_REVIEW";
   async enter(ctx) {
@@ -6673,6 +6784,32 @@ var CodeReviewStage = class {
     const mergeBase = ctx.state.git.mergeBase;
     const diffCommand = mergeBase ? `\`git diff ${mergeBase}\`` : `\`git diff HEAD\` AND \`git ls-files --others --exclude-standard\``;
     const diffReminder = mergeBase ? `Run: git diff ${mergeBase} \u2014 pass FULL output to reviewer.` : "Run: git diff HEAD + git ls-files --others --exclude-standard \u2014 pass FULL output to reviewer.";
+    if (reviewer === "lenses") {
+      return {
+        instruction: [
+          `# Multi-Lens Code Review \u2014 Round ${roundNum} of ${rounds} minimum`,
+          "",
+          `Capture the diff with: ${diffCommand}`,
+          "",
+          "This round uses the **multi-lens review orchestrator**. It fans out to specialized review agents (Clean Code, Security, Error Handling, and more) in parallel, then synthesizes findings into a single verdict.",
+          "",
+          "1. Capture the full diff",
+          "2. Call `prepareLensReview()` with the diff and changed file list",
+          "3. Spawn all lens subagents in parallel (each prompt is provided by the orchestrator)",
+          "4. Collect results and pass through the merger and judge pipeline",
+          "5. Report the final SynthesisResult verdict and findings",
+          "",
+          "When done, report verdict and findings."
+        ].join("\n"),
+        reminders: [
+          diffReminder,
+          "Do NOT compress or summarize the diff.",
+          "Lens subagents run in parallel with read-only tools (Read, Grep, Glob).",
+          "If the reviewer flags pre-existing issues unrelated to your changes, file them as issues using claudestory_issue_create with severity and impact. Do not fix them in this ticket."
+        ],
+        transitionedFrom: ctx.state.previousState ?? void 0
+      };
+    }
     return {
       instruction: [
         `# Code Review \u2014 Round ${roundNum} of ${rounds} minimum`,
@@ -6738,8 +6875,10 @@ var CodeReviewStage = class {
       nextAction = "CODE_REVIEW";
     }
     if (nextAction === "PLAN") {
+      clearCache(ctx.dir);
       ctx.writeState({
         reviews: { plan: [], code: [] },
+        lensReviewHistory: [],
         ticket: ctx.state.ticket ? { ...ctx.state.ticket, realizedRisk: void 0 } : ctx.state.ticket
       });
       ctx.appendEvent("code_review", {
@@ -6751,9 +6890,19 @@ var CodeReviewStage = class {
       await ctx.fileDeferredFindings(findings, "code");
       return { action: "back", target: "PLAN", reason: "plan_redirect" };
     }
-    ctx.writeState({
+    const stateUpdate = {
       reviews: { ...ctx.state.reviews, code: codeReviews }
-    });
+    };
+    if (reviewerBackend === "lenses" && findings.length > 0) {
+      const updated = buildLensHistoryUpdate(
+        findings,
+        ctx.state.lensReviewHistory ?? [],
+        ctx.state.ticket?.id ?? "unknown",
+        "CODE_REVIEW"
+      );
+      if (updated) stateUpdate.lensReviewHistory = updated;
+    }
+    ctx.writeState(stateUpdate);
     ctx.appendEvent("code_review", {
       round: roundNum,
       verdict,
@@ -7482,6 +7631,44 @@ var LessonCaptureStage = class {
       planFindings,
       codeFindings
     });
+    const lensHistory = ctx.state.lensReviewHistory ?? [];
+    const dismissed = lensHistory.filter(
+      (f) => f.disposition === "contested"
+    );
+    const tupleCounts = /* @__PURE__ */ new Map();
+    for (const f of lensHistory) {
+      const key = `${f.lens}:${f.category}`;
+      const entry = tupleCounts.get(key) ?? { total: 0, dismissed: 0 };
+      entry.total++;
+      if (f.disposition === "contested") {
+        entry.dismissed++;
+      }
+      tupleCounts.set(key, entry);
+    }
+    const falsePositivePatterns = [];
+    for (const [key, counts] of tupleCounts) {
+      if (counts.total >= 5 && counts.dismissed / counts.total >= 0.6) {
+        falsePositivePatterns.push(
+          `- **${key}**: ${counts.dismissed}/${counts.total} dismissed (${Math.round(counts.dismissed / counts.total * 100)}%)`
+        );
+      }
+    }
+    const lensSection = falsePositivePatterns.length > 0 ? [
+      "",
+      "## Lens False Positive Patterns",
+      "",
+      "These (lens, category) tuples have a >60% dismissal rate over 5+ reviews. Create a lesson for each:",
+      ...falsePositivePatterns,
+      "",
+      'For each pattern above, create a lesson: "Lens X tends to flag category Y, but this project considers it acceptable because [reason from dismiss history]."',
+      'Tag with `source: "lens-feedback"` and `tags: ["lens", lens-name]`.'
+    ].join("\n") : "";
+    const dismissedSection = dismissed.length > 0 && falsePositivePatterns.length === 0 ? [
+      "",
+      `## Dismissed Lens Findings (${dismissed.length})`,
+      "",
+      "Some lens findings were dismissed this session. Not enough data for automatic patterns yet (need 5+ reviews per tuple at >60% dismissal rate)."
+    ].join("\n") : "";
     return {
       instruction: [
         "# Capture Lessons from Review Findings",
@@ -7497,15 +7684,18 @@ var LessonCaptureStage = class {
         "   - If it matches an existing lesson \u2192 call `claudestory_lesson_reinforce`",
         '   - If it\'s a new pattern \u2192 call `claudestory_lesson_create` with `source: "review"`',
         "3. Skip patterns that are one-off or already well-covered",
+        lensSection,
+        dismissedSection,
         `4. Call \`claudestory_autonomous_guide\` with completedAction: "lessons_captured"`,
         "",
         "```json",
         `{ "sessionId": "${ctx.state.sessionId}", "action": "report", "report": { "completedAction": "lessons_captured" } }`,
         "```"
-      ].join("\n"),
+      ].filter(Boolean).join("\n"),
       reminders: [
         "Check existing lessons first \u2014 reinforce before creating duplicates.",
-        "Only capture patterns worth remembering across sessions."
+        "Only capture patterns worth remembering across sessions.",
+        ...falsePositivePatterns.length > 0 ? ["Lens false positive patterns MUST be captured as lessons \u2014 they improve future reviews."] : []
       ]
     };
   }
@@ -7692,8 +7882,8 @@ Impact: ${nextIssue.impact}` : ""}` : `Fix issue ${next}.`,
 // src/autonomous/stages/handover.ts
 init_esm_shims();
 init_handover();
-import { writeFileSync as writeFileSync2 } from "fs";
-import { join as join12 } from "path";
+import { writeFileSync as writeFileSync3 } from "fs";
+import { join as join13 } from "path";
 var HandoverStage = class {
   id = "HANDOVER";
   async enter(ctx) {
@@ -7724,8 +7914,8 @@ var HandoverStage = class {
     } catch {
       handoverFailed = true;
       try {
-        const fallbackPath = join12(ctx.dir, "handover-fallback.md");
-        writeFileSync2(fallbackPath, content, "utf-8");
+        const fallbackPath = join13(ctx.dir, "handover-fallback.md");
+        writeFileSync3(fallbackPath, content, "utf-8");
       } catch {
       }
     }
@@ -7797,8 +7987,8 @@ init_queries();
 
 // src/autonomous/version-check.ts
 init_esm_shims();
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join13, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join14, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function checkVersionMismatch(runningVersion, installedVersion) {
   if (!installedVersion) return null;
@@ -7810,12 +8000,12 @@ function getInstalledVersion() {
   try {
     const thisFile = fileURLToPath3(import.meta.url);
     const candidates = [
-      join13(dirname4(thisFile), "..", "..", "package.json"),
-      join13(dirname4(thisFile), "..", "package.json")
+      join14(dirname4(thisFile), "..", "..", "package.json"),
+      join14(dirname4(thisFile), "..", "package.json")
     ];
     for (const candidate of candidates) {
       try {
-        const raw = readFileSync6(candidate, "utf-8");
+        const raw = readFileSync7(candidate, "utf-8");
         const pkg = JSON.parse(raw);
         if (pkg.version) return pkg.version;
       } catch {
@@ -7827,7 +8017,7 @@ function getInstalledVersion() {
   }
 }
 function getRunningVersion() {
-  return "0.1.58";
+  return "0.1.60";
 }
 
 // src/autonomous/guide.ts
@@ -7852,18 +8042,18 @@ var RECOVERY_MAPPING = {
 function buildGuideRecommendOptions(root) {
   const opts = {};
   try {
-    const handoversDir = join14(root, ".story", "handovers");
+    const handoversDir = join15(root, ".story", "handovers");
     const files = readdirSync4(handoversDir, "utf-8").filter((f) => f.endsWith(".md")).sort();
     if (files.length > 0) {
-      opts.latestHandoverContent = readFileSync7(join14(handoversDir, files[files.length - 1]), "utf-8");
+      opts.latestHandoverContent = readFileSync8(join15(handoversDir, files[files.length - 1]), "utf-8");
     }
   } catch {
   }
   try {
-    const snapshotsDir = join14(root, ".story", "snapshots");
+    const snapshotsDir = join15(root, ".story", "snapshots");
     const snapFiles = readdirSync4(snapshotsDir, "utf-8").filter((f) => f.endsWith(".json")).sort();
     if (snapFiles.length > 0) {
-      const raw = readFileSync7(join14(snapshotsDir, snapFiles[snapFiles.length - 1]), "utf-8");
+      const raw = readFileSync8(join15(snapshotsDir, snapFiles[snapFiles.length - 1]), "utf-8");
       const snap = JSON.parse(raw);
       if (snap.issues) {
         opts.previousOpenIssueCount = snap.issues.filter((i) => i.status !== "resolved").length;
@@ -8251,7 +8441,7 @@ Staged: ${stagedResult.data.join(", ")}`
       }
     }
     const { state: projectState, warnings } = await loadProject(root);
-    const handoversDir = join14(root, ".story", "handovers");
+    const handoversDir = join15(root, ".story", "handovers");
     const ctx = { state: projectState, warnings, root, handoversDir, format: "md" };
     let handoverText = "";
     try {
@@ -8268,7 +8458,7 @@ Staged: ${stagedResult.data.join(", ")}`
       }
     } catch {
     }
-    const rulesText = readFileSafe2(join14(root, "RULES.md"));
+    const rulesText = readFileSafe2(join15(root, "RULES.md"));
     const lessonDigest = buildLessonDigest(projectState.lessons);
     const digestParts = [
       handoverText ? `## Recent Handovers
@@ -8284,7 +8474,7 @@ ${rulesText}` : "",
     ].filter(Boolean);
     const digest = digestParts.join("\n\n---\n\n");
     try {
-      writeFileSync3(join14(dir, "context-digest.md"), digest, "utf-8");
+      writeFileSync4(join15(dir, "context-digest.md"), digest, "utf-8");
     } catch {
     }
     if (mode !== "auto" && args.ticketId) {
@@ -9037,7 +9227,7 @@ function guideError(err) {
 }
 function readFileSafe2(path2) {
   try {
-    return readFileSync7(path2, "utf-8");
+    return readFileSync8(path2, "utf-8");
   } catch {
     return "";
   }
@@ -9047,8 +9237,8 @@ function readFileSafe2(path2) {
 init_esm_shims();
 init_session();
 init_session_types();
-import { readFileSync as readFileSync8, existsSync as existsSync10 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync11 } from "fs";
+import { join as join16 } from "path";
 
 // src/core/session-report-formatter.ts
 init_esm_shims();
@@ -9254,7 +9444,7 @@ async function handleSessionReport(sessionId, root, format = "md") {
     };
   }
   const dir = sessionDir(root, sessionId);
-  if (!existsSync10(dir)) {
+  if (!existsSync11(dir)) {
     return {
       output: `Error: Session ${sessionId} not found.`,
       exitCode: 1,
@@ -9262,8 +9452,8 @@ async function handleSessionReport(sessionId, root, format = "md") {
       isError: true
     };
   }
-  const statePath2 = join15(dir, "state.json");
-  if (!existsSync10(statePath2)) {
+  const statePath2 = join16(dir, "state.json");
+  if (!existsSync11(statePath2)) {
     return {
       output: `Error: Session ${sessionId} corrupt \u2014 state.json missing.`,
       exitCode: 1,
@@ -9272,7 +9462,7 @@ async function handleSessionReport(sessionId, root, format = "md") {
     };
   }
   try {
-    const rawJson = JSON.parse(readFileSync8(statePath2, "utf-8"));
+    const rawJson = JSON.parse(readFileSync9(statePath2, "utf-8"));
     if (rawJson && typeof rawJson === "object" && "schemaVersion" in rawJson && rawJson.schemaVersion !== CURRENT_SESSION_SCHEMA_VERSION) {
       return {
         output: `Error: Session ${sessionId} \u2014 unsupported session schema version ${rawJson.schemaVersion}.`,
@@ -9301,7 +9491,7 @@ async function handleSessionReport(sessionId, root, format = "md") {
   const events = readEvents(dir);
   let planContent = null;
   try {
-    planContent = readFileSync8(join15(dir, "plan.md"), "utf-8");
+    planContent = readFileSync9(join16(dir, "plan.md"), "utf-8");
   } catch {
   }
   let gitLog = null;
@@ -9326,7 +9516,7 @@ init_issue();
 init_roadmap();
 init_output_formatter();
 init_helpers();
-import { join as join16, resolve as resolve6 } from "path";
+import { join as join17, resolve as resolve6 } from "path";
 var PHASE_ID_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var PHASE_ID_MAX_LENGTH = 40;
 function validatePhaseId(id) {
@@ -9435,7 +9625,7 @@ function formatMcpError(code, message) {
 async function runMcpReadTool(pinnedRoot, handler) {
   try {
     const { state, warnings } = await loadProject(pinnedRoot);
-    const handoversDir = join17(pinnedRoot, ".story", "handovers");
+    const handoversDir = join18(pinnedRoot, ".story", "handovers");
     const ctx = { state, warnings, root: pinnedRoot, handoversDir, format: "md" };
     const result = await handler(ctx);
     if (result.errorCode && INFRASTRUCTURE_ERROR_CODES.includes(result.errorCode)) {
@@ -9993,10 +10183,10 @@ init_esm_shims();
 init_project_loader();
 init_errors();
 import { mkdir as mkdir4, stat as stat2, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
-import { join as join18, resolve as resolve7 } from "path";
+import { join as join19, resolve as resolve7 } from "path";
 async function initProject(root, options) {
   const absRoot = resolve7(root);
-  const wrapDir = join18(absRoot, ".story");
+  const wrapDir = join19(absRoot, ".story");
   let exists = false;
   try {
     const s = await stat2(wrapDir);
@@ -10016,11 +10206,11 @@ async function initProject(root, options) {
       ".story/ already exists. Use --force to overwrite config and roadmap."
     );
   }
-  await mkdir4(join18(wrapDir, "tickets"), { recursive: true });
-  await mkdir4(join18(wrapDir, "issues"), { recursive: true });
-  await mkdir4(join18(wrapDir, "handovers"), { recursive: true });
-  await mkdir4(join18(wrapDir, "notes"), { recursive: true });
-  await mkdir4(join18(wrapDir, "lessons"), { recursive: true });
+  await mkdir4(join19(wrapDir, "tickets"), { recursive: true });
+  await mkdir4(join19(wrapDir, "issues"), { recursive: true });
+  await mkdir4(join19(wrapDir, "handovers"), { recursive: true });
+  await mkdir4(join19(wrapDir, "notes"), { recursive: true });
+  await mkdir4(join19(wrapDir, "lessons"), { recursive: true });
   const created = [
     ".story/config.json",
     ".story/roadmap.json",
@@ -10060,7 +10250,7 @@ async function initProject(root, options) {
   };
   await writeConfig(config, absRoot);
   await writeRoadmap(roadmap, absRoot);
-  const gitignorePath = join18(wrapDir, ".gitignore");
+  const gitignorePath = join19(wrapDir, ".gitignore");
   await ensureGitignoreEntries(gitignorePath, STORY_GITIGNORE_ENTRIES);
   const warnings = [];
   if (options.force && exists) {
@@ -10099,7 +10289,7 @@ async function ensureGitignoreEntries(gitignorePath, entries) {
 // src/mcp/index.ts
 var ENV_VAR2 = "CLAUDESTORY_PROJECT_ROOT";
 var CONFIG_PATH2 = ".story/config.json";
-var version = "0.1.58";
+var version = "0.1.60";
 function tryDiscoverRoot() {
   const envRoot = process.env[ENV_VAR2];
   if (envRoot) {
@@ -10111,7 +10301,7 @@ function tryDiscoverRoot() {
     const resolved = resolve8(envRoot);
     try {
       const canonical = realpathSync2(resolved);
-      if (existsSync11(join19(canonical, CONFIG_PATH2))) {
+      if (existsSync12(join20(canonical, CONFIG_PATH2))) {
         return canonical;
       }
       process.stderr.write(`Warning: No .story/config.json at ${canonical}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anthropologies/claudestory",
-  "version": "0.1.58",
+  "version": "0.1.60",
   "license": "PolyForm-Noncommercial-1.0.0",
   "description": "An agentic development framework. Track tickets, issues, and progress for your project so every session builds on the last.",
   "homepage": "https://claudestory.com",

package/src/skill/SKILL.md

@@ -23,6 +23,7 @@ claudestory tracks tickets, issues, roadmap, and handovers in a `.story/` direct
 - `/story settings` -> manage project settings (see Settings section below)
 - `/story design` -> evaluate frontend design (read `design/design.md` in the same directory as this skill file; if not found, tell user to run `claudestory setup-skill`)
 - `/story design <platform>` -> evaluate for specific platform: web, ios, macos, android (read `design/design.md` in the same directory as this skill file)
+- `/story review-lenses` -> run multi-lens review on current diff (read `review-lenses/review-lenses.md` in the same directory as this skill file; if not found, tell user to run `claudestory setup-skill`). Note: the autonomous guide invokes lenses automatically when `reviewBackends` includes `"lenses"` -- this command is for manual/debug use.
 - `/story help` -> show all capabilities (read `reference.md` in the same directory as this skill file; if not found, tell user to run `claudestory setup-skill`)
 
 If the user's intent doesn't match any of these, use the full context load.
@@ -354,7 +355,24 @@ Do NOT search source code for this. The full config.json schema is shown below.
       },
       "LESSON_CAPTURE": { "enabled": "boolean" },
       "ISSUE_SWEEP": { "enabled": "boolean" }
-    }
+    },
+    "lensConfig": {
+      "lenses": "\"auto\" | string[] (default: \"auto\")",
+      "maxLenses": "number (1-8, default: 8)",
+      "lensTimeout": "number | { default: number, opus: number } (default: { default: 60, opus: 120 })",
+      "findingBudget": "number (default: 10)",
+      "confidenceFloor": "number 0-1 (default: 0.6)",
+      "tokenBudgetPerLens": "number (default: 32000)",
+      "hotPaths": "string[] (glob patterns for Performance lens, default: [])",
+      "lensModels": "Record<string, string> (default: { default: sonnet, security: opus, concurrency: opus })"
+    },
+    "blockingPolicy": {
+      "neverBlock": "string[] (lens names that never produce blocking findings, default: [])",
+      "alwaysBlock": "string[] (categories that always block, default: [injection, auth-bypass, hardcoded-secrets])",
+      "planReviewBlockingLenses": "string[] (default: [security, error-handling])"
+    },
+    "requireSecretsGate": "boolean (default: false, require detect-secrets for lens reviews)",
+    "requireAccessibility": "boolean (default: false, make accessibility findings blocking)"
   }
 }
 ```
@@ -367,3 +385,4 @@ Additional skill documentation, loaded on demand:
 - **`autonomous-mode.md`** -- Autonomous mode, review, plan, and guided execution tiers
 - **`reference.md`** -- Full CLI command and MCP tool reference
 - **`design/design.md`** -- Frontend design evaluation and implementation guidance, with platform references in `design/references/`
+- **`review-lenses/review-lenses.md`** -- Multi-lens review orchestrator (8 specialized parallel reviewers), with lens prompts in `review-lenses/references/`

package/src/skill/review-lenses/references/judge.md

@@ -0,0 +1,18 @@
+---
+name: judge
+version: v1
+model: sonnet
+---
+
+# Judge
+
+Synthesis step 2. Receives deduplicated findings and tensions from the Merger. Performs severity calibration, stage-aware verdict generation, and completeness assessment.
+
+Verdict rules:
+- reject: critical + confidence >= 0.8 + blocking (plan review: only security/integrity)
+- revise: major + blocking, or any blocking tension
+- approve: only minor/suggestion/non-blocking remain
+
+Partial review (required lens failed): never approves, maximum is revise.
+
+See `src/autonomous/review-lenses/judge.ts` for the full prompt.

package/src/skill/review-lenses/references/lens-accessibility.md

@@ -0,0 +1,17 @@
+---
+name: accessibility
+version: v1
+model: sonnet
+type: surface-activated
+maxSeverity: major
+scope: web-first
+activation: ".tsx, .jsx, .html, .vue, .svelte, .css, .scss"
+---
+
+# Accessibility Lens
+
+Finds WCAG compliance issues preventing users with disabilities from using the application. Web-first scope. Checks: missing alt text, non-semantic HTML, missing ARIA labels, no keyboard navigation, color contrast, missing focus management, skip-to-content, form labels, ARIA landmarks, auto-playing media, missing live regions, CSS focus removal, hidden-but-focusable elements.
+
+Native mobile/desktop accessibility is out of scope for v1.
+
+See `src/autonomous/review-lenses/lenses/accessibility.ts` for the full prompt.

package/src/skill/review-lenses/references/lens-api-design.md

@@ -0,0 +1,14 @@
+---
+name: api-design
+version: v1
+model: sonnet
+type: surface-activated
+maxSeverity: critical
+activation: "**/api/**", route handlers, controllers, GraphQL resolvers
+---
+
+# API Design Lens
+
+Focuses on REST/GraphQL API quality -- consistency, correctness, backward compatibility, consumer experience. Checks: breaking changes, inconsistent error format, wrong HTTP status codes, non-RESTful patterns, missing pagination, naming inconsistency, missing Content-Type, overfetching/underfetching, missing idempotency, auth inconsistency.
+
+See `src/autonomous/review-lenses/lenses/api-design.ts` for the full prompt.