@clearlydev/nx-archweave 0.2.1 → 0.3.0

package/dist/generators/add-review/generator.js

@@ -133,6 +133,30 @@ function buildOverEngineeringPrompt(locale) {
   return [...body, "", renderFindingSchemaInstruction(locale, OVER_ENGINEERING_PRIORITIES), "", renderDedupInstruction(locale)].join("\n");
 }
 
+// ../review-policy/dist/verdict-gate/verdict-comment.js
+var VERDICT_MARKER = "<!-- archweave-verdict -->";
+function renderCommitLine(locale, shortSha) {
+  return locale === "en" ? `<sub>Commit \`${shortSha}\` \xB7 this comment is updated on every review round.</sub>` : `<sub>\uCEE4\uBC0B \`${shortSha}\` \xB7 \uC774 \uCF54\uBA58\uD2B8\uB294 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC\uB9C8\uB2E4 \uAC31\uC2E0\uB429\uB2C8\uB2E4.</sub>`;
+}
+var NOT_RUN_REASON = {
+  en: {
+    secret: (secretName) => `the ${secretName} secret is not registered`,
+    fork: () => "this pull request comes from a fork, and GitHub passes no secrets to runs from forks",
+    dependabot: (secretName) => `Dependabot runs receive only Dependabot secrets, and ${secretName} is not one of them`,
+    rounds: (_secretName, maxRounds) => `the automated review round limit (${maxRounds}) is reached`
+  },
+  ko: {
+    secret: (secretName) => `${secretName} \uC2DC\uD06C\uB9BF\uC774 \uB4F1\uB85D\uB418\uC9C0 \uC54A\uC74C`,
+    fork: () => "\uD3EC\uD06C\uC5D0\uC11C \uC628 pull request\uC774\uACE0, GitHub\uB294 \uD3EC\uD06C \uC2E4\uD589\uC5D0 \uC2DC\uD06C\uB9BF\uC744 \uB118\uAE30\uC9C0 \uC54A\uC74C",
+    dependabot: (secretName) => `Dependabot \uC2E4\uD589\uC740 Dependabot \uC2DC\uD06C\uB9BF\uB9CC \uBC1B\uB294\uB370, ${secretName}\uB294 \uADF8\uC911\uC5D0 \uC5C6\uC74C`,
+    rounds: (_secretName, maxRounds) => `\uC790\uB3D9 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC \uD55C\uB3C4(${maxRounds})\uC5D0 \uB3C4\uB2EC\uD568`
+  }
+};
+function renderNotRunNotice(locale, reason, secretName, maxRounds) {
+  const why = NOT_RUN_REASON[locale][reason](secretName, maxRounds);
+  return locale === "en" ? `AI review did not run for this commit (${why}). A green check here does not mean the change was reviewed.` : `\uC774 \uCEE4\uBC0B\uC5D0\uB294 AI \uB9AC\uBDF0\uAC00 \uC2E4\uD589\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4(${why}). \uC774 green \uCCB4\uD06C\uB294 \uBCC0\uACBD \uC0AC\uD56D\uC774 \uB9AC\uBDF0\uB418\uC5C8\uB2E4\uB294 \uB73B\uC774 \uC544\uB2D9\uB2C8\uB2E4.`;
+}
+
 // ../review-policy/dist/verdict-gate/verdict-gate.js
 var ROUND_MARKER = "<!-- archweave-review-round -->";
 
@@ -177,13 +201,14 @@ function renderConcurrencyBlock() {
     "  cancel-in-progress: false"
   ].join("\n");
 }
-function renderPermissionsBlock() {
-  return ["permissions:", "  contents: read", "  pull-requests: write", "  id-token: write"].join("\n");
+var REVIEW_GATE_CONDITION = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+function renderReviewPermissions(idToken) {
+  return ["permissions:", "  contents: read", "  pull-requests: write", ...idToken ? ["  id-token: write"] : []].join("\n");
 }
 function renderCheckoutStep(gateCondition, extraWith = []) {
   return [
     "- name: Checkout repository",
-    `  if: ${gateCondition}`,
+    ...gateCondition === void 0 ? [] : [`  if: ${gateCondition}`],
     `  uses: ${pinnedUses("actions/checkout")}`,
     "  with:",
     ...extraWith.map((line) => `    ${line}`),
@@ -225,10 +250,84 @@ function renderRoundGateStep(maxRounds) {
     "    fi"
   ].join("\n");
 }
+function shellQuote(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function renderNotRunFunction(secretName, maxRounds, locale) {
+  const reasons = ["secret", "fork", "dependabot", "rounds"];
+  const [commitBefore, commitAfter] = renderCommitLine(locale, "\0").split("\0");
+  return [
+    "not_run() {",
+    '  case "$1" in',
+    ...reasons.map((reason) => `    ${reason}) annotation=${shellQuote(renderNotRunNotice("en", reason, secretName, maxRounds))}; notice=${shellQuote(renderNotRunNotice(locale, reason, secretName, maxRounds))} ;;`),
+    "  esac",
+    '  echo "::notice title=AI review did not run::$annotation"',
+    `  printf '%s\\n' "$notice" >> "$GITHUB_STEP_SUMMARY"`,
+    `  short_sha=$(printf '%s' "$HEAD_SHA" | cut -c1-7)`,
+    '  case "$short_sha" in',
+    "    '' | *[!0-9a-f]*) short_sha= ;;",
+    "  esac",
+    "  {",
+    '    echo "notice-body<<ARCHWEAVE_NOT_RUN_EOF"',
+    `    printf '%s\\n' ${shellQuote(VERDICT_MARKER)} "\u2139\uFE0F $notice"`,
+    `    if [ -n "$short_sha" ]; then printf '\\n%s\\n' ${shellQuote(commitBefore)}"$short_sha"${shellQuote(commitAfter)}; fi`,
+    '    echo "ARCHWEAVE_NOT_RUN_EOF"',
+    '    echo "run=false"',
+    '  } >> "$GITHUB_OUTPUT"',
+    "}"
+  ];
+}
+var JUDGE_CONDITION = "steps.ai-review-result.outputs.run == 'true'";
+function renderAiReviewResultStep(secretName, maxRounds, locale) {
+  return [
+    "- name: Check the AI review result",
+    "  id: ai-review-result",
+    "  env:",
+    "    AI_REVIEW_RESULT: ${{ needs.ai-review.result }}",
+    "    REVIEW_ENABLED: ${{ needs.ai-review.outputs.enabled }}",
+    "    REVIEW_ALLOWED: ${{ needs.ai-review.outputs.allowed }}",
+    "    LAST_COMMENT_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
+    "    HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_AUTHOR: ${{ github.event.pull_request.user.login }}",
+    "  run: |",
+    ...renderNotRunFunction(secretName, maxRounds, locale).map((line) => `    ${line}`),
+    '    if [ "$AI_REVIEW_RESULT" != success ]; then',
+    `      echo "::error title=AI review did not succeed::The AI review job ended with '$AI_REVIEW_RESULT'."`,
+    "      exit 1",
+    "    fi",
+    '    case "$REVIEW_ENABLED/$REVIEW_ALLOWED" in',
+    "      false/*)",
+    '        if [ "$HEAD_REPOSITORY" != "$REPOSITORY" ]; then not_run fork',
+    `        elif [ "$PR_AUTHOR" = 'dependabot[bot]' ]; then not_run dependabot`,
+    "        else not_run secret",
+    "        fi",
+    "        exit 0",
+    "        ;;",
+    "      true/false)",
+    "        not_run rounds",
+    "        exit 0",
+    "        ;;",
+    "      true/true)",
+    '        case "$LAST_COMMENT_ID" in',
+    "          '' | *[!0-9]*) ;;",
+    "          *)",
+    '            echo "run=true" >> "$GITHUB_OUTPUT"',
+    "            exit 0",
+    "            ;;",
+    "        esac",
+    "        ;;",
+    "    esac",
+    `    echo "::error title=Review verdict not computed::The AI review job's results did not reach this job, so no verdict can be computed. Re-run all jobs."`,
+    "    exit 1"
+  ].join("\n");
+}
 function renderVerdictGateStep(maxRounds, locale) {
   return [
     "- name: Compute review verdict",
-    "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
+    "  id: verdict",
+    `  if: ${JUDGE_CONDITION}`,
     "  env:",
     "    GH_TOKEN: ${{ github.token }}",
     "    GITHUB_REPOSITORY: ${{ github.repository }}",
@@ -236,7 +335,8 @@ function renderVerdictGateStep(maxRounds, locale) {
     `    ARCHWEAVE_MAX_ROUNDS: '${maxRounds}'`,
     `    ARCHWEAVE_LOCALE: '${locale}'`,
     "    ARCHWEAVE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
-    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    ARCHWEAVE_VERDICT_OUTPUT: 'github-output'",
     "  run: |",
     "    if [ -x node_modules/.bin/archweave-review-verdict ]; then",
     "      node_modules/.bin/archweave-review-verdict",
@@ -245,16 +345,49 @@ function renderVerdictGateStep(maxRounds, locale) {
     "    fi"
   ].join("\n");
 }
+function renderBlockStep() {
+  return [
+    "- name: Fail on a blocking verdict",
+    "  if: steps.verdict.outputs.blocked == 'true'",
+    "  run: |",
+    '    echo "The review check failed: the verdict is BLOCK, or the AI review left no readable summary. See the verdict comment on this pull request."',
+    "    exit 1"
+  ].join("\n");
+}
+function renderVerdictCommentStep() {
+  return [
+    "- name: Post review verdict",
+    "  env:",
+    "    GH_TOKEN: ${{ github.token }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+    "    VERDICT_BODY: ${{ needs.review.outputs.comment-body }}",
+    "    PREVIOUS_ID: ${{ needs.review.outputs.previous-comment-id }}",
+    "  run: |",
+    `    payload=$(jq -n --arg body "$VERDICT_BODY" '{body: $body}')`,
+    '    if [ -z "$PREVIOUS_ID" ]; then',
+    `      PREVIOUS_ID=$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --paginate --jq '.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("${VERDICT_MARKER}")) | .id' | tail -n 1) || PREVIOUS_ID=`,
+    "    fi",
+    '    case "$PREVIOUS_ID" in',
+    "      ''|*[!0-9]*) PREVIOUS_ID= ;;",
+    "    esac",
+    `    if [ -n "$PREVIOUS_ID" ] && printf '%s' "$payload" | gh api -X PATCH "repos/$REPOSITORY/issues/comments/$PREVIOUS_ID" --input - > /dev/null; then`,
+    "      exit 0",
+    "    fi",
+    `    printf '%s' "$payload" | gh api -X POST "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --input - > /dev/null \\`,
+    '      || echo "Could not post the verdict comment (continuing)."'
+  ].join("\n");
+}
 var SETUP_NODE_VERSION = "22";
 var FALLBACK_PNPM_VERSION = "10";
 var INSTALL_LINES = {
-  pnpm: ["    pnpm install --frozen-lockfile"],
-  npm: ["    npm ci"],
+  pnpm: ["    pnpm install --frozen-lockfile --ignore-scripts"],
+  npm: ["    npm ci --ignore-scripts"],
   yarn: [
     "    corepack enable yarn",
-    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then yarn install --immutable; else yarn install --frozen-lockfile; fi'
+    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then YARN_ENABLE_SCRIPTS=false yarn install --immutable --mode=skip-build; else yarn install --frozen-lockfile --ignore-scripts; fi'
   ],
-  bun: ["    bun install --frozen-lockfile"]
+  bun: ["    bun install --frozen-lockfile --ignore-scripts"]
 };
 function renderPnpmVersionStep(gate) {
   return [
@@ -270,7 +403,7 @@ function renderPnpmVersionStep(gate) {
   ].join("\n");
 }
 function renderWorkspaceSetupSteps(packageManager) {
-  const gate = "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+  const gate = `  if: ${JUDGE_CONDITION}`;
   const steps = [];
   if (packageManager === "pnpm") {
     steps.push(renderPnpmVersionStep(gate));
@@ -305,21 +438,89 @@ function renderWorkspaceSetupSteps(packageManager) {
   ].join("\n"));
   return steps.join("\n\n");
 }
+var REVIEW_JOB_TIMEOUT_MINUTES = 15;
+function renderReviewWorkflow(input, parts) {
+  const aiReviewSteps = [renderSecretGateStep(parts.secretName), renderRoundGateStep(input.maxRounds), ...parts.reviewSteps];
+  const reviewSteps = [
+    renderAiReviewResultStep(parts.secretName, input.maxRounds, input.locale),
+    renderCheckoutStep(JUDGE_CONDITION),
+    renderWorkspaceSetupSteps(input.packageManager),
+    renderVerdictGateStep(input.maxRounds, input.locale),
+    renderBlockStep()
+  ];
+  return [
+    `name: ${parts.name}`,
+    "",
+    renderTriggerBlock(),
+    "",
+    renderConcurrencyBlock(),
+    "",
+    "permissions: {}",
+    "",
+    "jobs:",
+    "  ai-review:",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    indentBlock(renderReviewPermissions(parts.idToken), 4),
+    "    outputs:",
+    "      enabled: ${{ steps.secret-gate.outputs.enabled }}",
+    "      allowed: ${{ steps.round-gate.outputs.allowed }}",
+    "      last-comment-id: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    steps:",
+    indentBlock(aiReviewSteps.join("\n\n"), 6),
+    "",
+    "  review:",
+    "    needs: ai-review",
+    "    if: always()",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    "    permissions:",
+    "      contents: read",
+    "      pull-requests: read",
+    "    outputs:",
+    "      comment-body: ${{ steps.verdict.outputs.comment-body || steps.ai-review-result.outputs.notice-body }}",
+    "      previous-comment-id: ${{ steps.verdict.outputs.previous-comment-id }}",
+    "    steps:",
+    indentBlock(reviewSteps.join("\n\n"), 6),
+    "",
+    "  review-comment:",
+    "    needs: review",
+    // Runs after a BLOCK failed the review job, too: the comment explains the red check.
+    "    if: ${{ !cancelled() && needs.review.outputs.comment-body != '' }}",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    "    permissions:",
+    "      pull-requests: write",
+    "    steps:",
+    indentBlock(renderVerdictCommentStep(), 6),
+    ""
+  ].join("\n");
+}
 
 // ../template-engine/dist/review/claude/claude-provider.js
 var SECRET_NAME = "CLAUDE_CODE_OAUTH_TOKEN";
 var ALLOWED_TOOLS = "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)";
+var CLAUDE_STEP_ID = "claude-review";
+var PR_CONTEXT = ["REPO: ${{ github.repository }}", "PR NUMBER: ${{ github.event.pull_request.number }}"];
 function renderWorkflowInstructions(locale) {
   const lines = locale === "en" ? [
-    "Review the diff of this pull request using `gh pr diff` and `gh pr view`.",
-    "Post specific findings as inline comments and exactly one top-level summary comment.",
+    ...PR_CONTEXT,
+    "",
+    "Review the diff of this pull request using `gh pr diff <PR NUMBER>` and `gh pr view <PR NUMBER>`.",
+    "Post specific findings as inline comments with `mcp__github_inline_comment__create_inline_comment` (pass `confirmed: true`), and exactly one top-level summary comment.",
+    "Post the summary with `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`, the body on the following lines, then a line `ARCHWEAVE_EOF` (the quoted delimiter keeps backticks and `$` literal). Never pass the body with `--body \"...\"` or `$(...)`.",
+    "Run each `gh` command on its own: no pipes to other programs, no `&&` chains.",
     `Always include the literal marker ${ROUND_MARKER} in the top-level summary comment.`,
     "If there are no findings that require action, post exactly one top-level comment saying so (and still include the marker).",
     "Do not modify any code, and never approve or merge the pull request.",
     "Write summaries and explanations in English; keep file names, function names, and identifiers verbatim."
   ] : [
-    "\uC774 pull request\uC758 diff\uB97C `gh pr diff`\uC640 `gh pr view`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
-    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 inline comment\uB85C, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    ...PR_CONTEXT,
+    "",
+    "\uC774 pull request\uC758 diff\uB97C `gh pr diff <PR NUMBER>`\uC640 `gh pr view <PR NUMBER>`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
+    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 `mcp__github_inline_comment__create_inline_comment`(`confirmed: true` \uC804\uB2EC)\uB85C inline comment\uB97C \uB2EC\uACE0, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    "\uC694\uC57D\uC740 `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`\uB85C \uAC8C\uC2DC\uD558\uC138\uC694. \uB2E4\uC74C \uC904\uBD80\uD130 \uBCF8\uBB38\uC744 \uC4F0\uACE0, \uB9C8\uC9C0\uB9C9 \uC904\uC5D0 `ARCHWEAVE_EOF`\uB9CC \uC4F0\uC138\uC694(\uB530\uC634\uD45C \uCE5C \uAD6C\uBD84\uC790\uB77C \uBC31\uD2F1\uACFC `$`\uAC00 \uADF8\uB300\uB85C \uB0A8\uC544\uC694). \uBCF8\uBB38\uC744 `--body \"...\"`\uB098 `$(...)`\uB85C \uB118\uAE30\uC9C0 \uB9C8\uC138\uC694.",
+    "`gh` \uBA85\uB839\uC740 \uD558\uB098\uC529 \uB530\uB85C \uC2E4\uD589\uD558\uC138\uC694. \uB2E4\uB978 \uD504\uB85C\uADF8\uB7A8\uC73C\uB85C \uD30C\uC774\uD504\uD558\uAC70\uB098 `&&`\uB85C \uC787\uC9C0 \uB9C8\uC138\uC694.",
     `top-level \uC694\uC57D \uCF54\uBA58\uD2B8\uC5D0\uB294 \uBC18\uB4DC\uC2DC \uB9AC\uD130\uB7F4 \uB9C8\uCEE4 ${ROUND_MARKER}\uB97C \uD3EC\uD568\uD558\uC138\uC694.`,
     '\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uAC00 \uC5C6\uC73C\uBA74 "\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uB97C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4."\uB77C\uB294 top-level comment\uB97C \uC815\uD655\uD788 \uD55C \uAC1C \uAC8C\uC2DC\uD558\uC138\uC694(\uC774\uB54C\uB3C4 \uB9C8\uCEE4\uB294 \uD3EC\uD568).',
     "\uCF54\uB4DC\uB97C \uC218\uC815\uD558\uC9C0 \uB9C8\uC138\uC694(Do not modify any code). PR\uC744 \uC2B9\uC778\uD558\uAC70\uB098 \uBCD1\uD569\uD558\uC9C0 \uB9C8\uC138\uC694(never approve or merge).",
@@ -336,42 +537,44 @@ function composePrompt(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
-function buildWorkflowYaml(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Claude review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
-      "  with:",
-      `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt(input), 6),
-      "    claude_args: |",
-      `      --allowedTools "${ALLOWED_TOOLS}"`
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
+function renderDeniedToolsStep() {
   return [
-    "name: Claude Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
+    "- name: Show denied tool calls",
+    `  if: always() && steps.${CLAUDE_STEP_ID}.outputs.execution_file != ''`,
+    "  env:",
+    `    EXECUTION_FILE: \${{ steps.${CLAUDE_STEP_ID}.outputs.execution_file }}`,
+    "  run: |",
+    '    [ -f "$EXECUTION_FILE" ] || exit 0',
+    `    stop_token="archweave-$(od -An -N16 -tx1 /dev/urandom | tr -d ' \\n')"`,
+    '    echo "::stop-commands::$stop_token"',
+    `    jq -c '.[] | select(.type == "result") | .permission_denials[]? | {tool: .tool_name, command: ((.tool_input.command // "") | tostring | .[0:200])}' "$EXECUTION_FILE" || echo "Could not read the execution file."`,
+    '    echo "::$stop_token::"'
   ].join("\n");
 }
+function buildWorkflowYaml(input) {
+  return renderReviewWorkflow(input, {
+    name: "Claude Code Review",
+    secretName: SECRET_NAME,
+    // The Claude GitHub App signs in with the workflow's OIDC token (claude-code-action's FAQ).
+    idToken: true,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Claude review",
+        `  id: ${CLAUDE_STEP_ID}`,
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
+        "  with:",
+        `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt(input), 6),
+        "    claude_args: |",
+        `      --allowedTools "${ALLOWED_TOOLS}"`
+      ].join("\n"),
+      renderDeniedToolsStep()
+    ]
+  });
+}
 var claudeProvider = {
   id: "claude",
   workflowFileName: ".github/workflows/claude-code-review.yml",
@@ -410,49 +613,41 @@ function composePrompt2(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml2(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME2),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition),
-    [
-      "- name: Install cursor-agent CLI",
-      `  if: ${gateCondition}`,
-      "  run: |",
-      "    curl https://cursor.com/install -fsS | bash",
-      '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
-    ].join("\n"),
-    [
-      "- name: Run Cursor review",
-      `  if: ${gateCondition}`,
-      "  env:",
-      `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
-      "    GH_TOKEN: ${{ github.token }}",
-      "  run: |",
-      `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
-      indentBlock(composePrompt2(input), 4),
-      `    ${PROMPT_HEREDOC_DELIMITER}`,
-      '    )"'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Cursor Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Cursor Code Review",
+    secretName: SECRET_NAME2,
+    // An API key: the Cursor CLI needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Install cursor-agent CLI",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  run: |",
+        // HTTPS only, TLS 1.2 or newer. Cursor publishes no pinned version or checksum for
+        // this installer; docs/pr-review.md states what that leaves open.
+        "    curl --proto '=https' --tlsv1.2 -fsS https://cursor.com/install | bash",
+        // The docs name ~/.cursor/bin; the installer currently links `agent` into ~/.local/bin.
+        // Both go on the PATH, so the next step finds it wherever the installer puts it.
+        '    echo "$HOME/.local/bin" >> "$GITHUB_PATH"',
+        '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
+      ].join("\n"),
+      [
+        "- name: Run Cursor review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
+        "    GH_TOKEN: ${{ github.token }}",
+        "  run: |",
+        // cursor-agent stops at "Workspace Trust Required" without --trust (2026.10.22 on
+        // Actions); the folder is this run's own checkout, and forks never get the secret.
+        `    agent --trust -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
+        indentBlock(composePrompt2(input), 4),
+        `    ${PROMPT_HEREDOC_DELIMITER}`,
+        '    )"'
+      ].join("\n")
+    ]
+  });
 }
 var cursorProvider = {
   id: "cursor",
@@ -490,41 +685,33 @@ function composePrompt3(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
+var GEMINI_CLI_VERSION = "0.65.0";
 function buildWorkflowYaml3(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME3),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Gemini review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
-      "  env:",
-      "    GITHUB_TOKEN: ${{ github.token }}",
-      "  with:",
-      `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt3(input), 6)
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Gemini Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Gemini Code Review",
+    secretName: SECRET_NAME3,
+    // An API key: run-gemini-cli uses OIDC only for Google Cloud workload identity federation.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Gemini review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
+        "  env:",
+        "    GITHUB_TOKEN: ${{ github.token }}",
+        // Gemini CLI 0.65 refuses to run in a folder it hasn't been told to trust (measured
+        // 2026-10-25 on Actions). The folder is this run's own checkout; pull requests from forks
+        // never get here, because they get no secret.
+        "    GEMINI_CLI_TRUST_WORKSPACE: 'true'",
+        "  with:",
+        `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
+        `    gemini_cli_version: '${GEMINI_CLI_VERSION}'`,
+        "    prompt: |",
+        indentBlock(composePrompt3(input), 6)
+      ].join("\n")
+    ]
+  });
 }
 var geminiProvider = {
   id: "gemini",
@@ -563,64 +750,49 @@ function composePrompt4(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml4(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME4),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
-    [
-      "- name: Fetch base and head refs for the PR",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "  run: |",
-      "    # Explicit destinations: the sandboxed review step has no network, so both sides",
-      "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
-      "    git fetch --no-tags origin \\",
-      '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
-      '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
-    ].join("\n"),
-    [
-      "- name: Run Codex review",
-      "  id: codex-review",
-      `  if: ${gateCondition}`,
-      `  uses: ${pinnedUses("openai/codex-action")}`,
-      "  with:",
-      `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
-      '    permission-profile: ":read-only"',
-      "    prompt: |",
-      indentBlock(composePrompt4(input), 6)
-    ].join("\n"),
-    [
-      "- name: Post review comment",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    GH_TOKEN: ${{ github.token }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
-      "  run: |",
-      '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: GPT Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "GPT Code Review",
+    secretName: SECRET_NAME4,
+    // An API key: codex-action needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
+      [
+        "- name: Fetch base and head refs for the PR",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "  run: |",
+        "    # Explicit destinations: the sandboxed review step has no network, so both sides",
+        "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
+        "    git fetch --no-tags origin \\",
+        '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
+        '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
+      ].join("\n"),
+      [
+        "- name: Run Codex review",
+        "  id: codex-review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("openai/codex-action")}`,
+        "  with:",
+        `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
+        '    permission-profile: ":read-only"',
+        "    prompt: |",
+        indentBlock(composePrompt4(input), 6)
+      ].join("\n"),
+      [
+        "- name: Post review comment",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    GH_TOKEN: ${{ github.token }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
+        "  run: |",
+        '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
+      ].join("\n")
+    ]
+  });
 }
 var gptProvider = {
   id: "gpt",
@@ -685,933 +857,8 @@ function renderTemplateFiles(srcFolder, target, substitutions) {
   ).sort((a, b) => a.filePath.localeCompare(b.filePath));
 }
 
-// ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
-function createScanner(text, ignoreTrivia = false) {
-  const len = text.length;
-  let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError = 0;
-  function scanHexDigits(count, exact) {
-    let digits = 0;
-    let value2 = 0;
-    while (digits < count || !exact) {
-      let ch = text.charCodeAt(pos);
-      if (ch >= 48 && ch <= 57) {
-        value2 = value2 * 16 + ch - 48;
-      } else if (ch >= 65 && ch <= 70) {
-        value2 = value2 * 16 + ch - 65 + 10;
-      } else if (ch >= 97 && ch <= 102) {
-        value2 = value2 * 16 + ch - 97 + 10;
-      } else {
-        break;
-      }
-      pos++;
-      digits++;
-    }
-    if (digits < count) {
-      value2 = -1;
-    }
-    return value2;
-  }
-  function setPosition(newPosition) {
-    pos = newPosition;
-    value = "";
-    tokenOffset = 0;
-    token = 16;
-    scanError = 0;
-  }
-  function scanNumber() {
-    let start = pos;
-    if (text.charCodeAt(pos) === 48) {
-      pos++;
-    } else {
-      pos++;
-      while (pos < text.length && isDigit(text.charCodeAt(pos))) {
-        pos++;
-      }
-    }
-    if (pos < text.length && text.charCodeAt(pos) === 46) {
-      pos++;
-      if (pos < text.length && isDigit(text.charCodeAt(pos))) {
-        pos++;
-        while (pos < text.length && isDigit(text.charCodeAt(pos))) {
-          pos++;
-        }
-      } else {
-        scanError = 3;
-        return text.substring(start, pos);
-      }
-    }
-    let end = pos;
-    if (pos < text.length && (text.charCodeAt(pos) === 69 || text.charCodeAt(pos) === 101)) {
-      pos++;
-      if (pos < text.length && text.charCodeAt(pos) === 43 || text.charCodeAt(pos) === 45) {
-        pos++;
-      }
-      if (pos < text.length && isDigit(text.charCodeAt(pos))) {
-        pos++;
-        while (pos < text.length && isDigit(text.charCodeAt(pos))) {
-          pos++;
-        }
-        end = pos;
-      } else {
-        scanError = 3;
-      }
-    }
-    return text.substring(start, end);
-  }
-  function scanString() {
-    let result = "", start = pos;
-    while (true) {
-      if (pos >= len) {
-        result += text.substring(start, pos);
-        scanError = 2;
-        break;
-      }
-      const ch = text.charCodeAt(pos);
-      if (ch === 34) {
-        result += text.substring(start, pos);
-        pos++;
-        break;
-      }
-      if (ch === 92) {
-        result += text.substring(start, pos);
-        pos++;
-        if (pos >= len) {
-          scanError = 2;
-          break;
-        }
-        const ch2 = text.charCodeAt(pos++);
-        switch (ch2) {
-          case 34:
-            result += '"';
-            break;
-          case 92:
-            result += "\\";
-            break;
-          case 47:
-            result += "/";
-            break;
-          case 98:
-            result += "\b";
-            break;
-          case 102:
-            result += "\f";
-            break;
-          case 110:
-            result += "\n";
-            break;
-          case 114:
-            result += "\r";
-            break;
-          case 116:
-            result += "	";
-            break;
-          case 117:
-            const ch3 = scanHexDigits(4, true);
-            if (ch3 >= 0) {
-              result += String.fromCharCode(ch3);
-            } else {
-              scanError = 4;
-            }
-            break;
-          default:
-            scanError = 5;
-        }
-        start = pos;
-        continue;
-      }
-      if (ch >= 0 && ch <= 31) {
-        if (isLineBreak(ch)) {
-          result += text.substring(start, pos);
-          scanError = 2;
-          break;
-        } else {
-          scanError = 6;
-        }
-      }
-      pos++;
-    }
-    return result;
-  }
-  function scanNext() {
-    value = "";
-    scanError = 0;
-    tokenOffset = pos;
-    lineStartOffset = lineNumber;
-    prevTokenLineStartOffset = tokenLineStartOffset;
-    if (pos >= len) {
-      tokenOffset = len;
-      return token = 17;
-    }
-    let code = text.charCodeAt(pos);
-    if (isWhiteSpace(code)) {
-      do {
-        pos++;
-        value += String.fromCharCode(code);
-        code = text.charCodeAt(pos);
-      } while (isWhiteSpace(code));
-      return token = 15;
-    }
-    if (isLineBreak(code)) {
-      pos++;
-      value += String.fromCharCode(code);
-      if (code === 13 && text.charCodeAt(pos) === 10) {
-        pos++;
-        value += "\n";
-      }
-      lineNumber++;
-      tokenLineStartOffset = pos;
-      return token = 14;
-    }
-    switch (code) {
-      // tokens: []{}:,
-      case 123:
-        pos++;
-        return token = 1;
-      case 125:
-        pos++;
-        return token = 2;
-      case 91:
-        pos++;
-        return token = 3;
-      case 93:
-        pos++;
-        return token = 4;
-      case 58:
-        pos++;
-        return token = 6;
-      case 44:
-        pos++;
-        return token = 5;
-      // strings
-      case 34:
-        pos++;
-        value = scanString();
-        return token = 10;
-      // comments
-      case 47:
-        const start = pos - 1;
-        if (text.charCodeAt(pos + 1) === 47) {
-          pos += 2;
-          while (pos < len) {
-            if (isLineBreak(text.charCodeAt(pos))) {
-              break;
-            }
-            pos++;
-          }
-          value = text.substring(start, pos);
-          return token = 12;
-        }
-        if (text.charCodeAt(pos + 1) === 42) {
-          pos += 2;
-          const safeLength = len - 1;
-          let commentClosed = false;
-          while (pos < safeLength) {
-            const ch = text.charCodeAt(pos);
-            if (ch === 42 && text.charCodeAt(pos + 1) === 47) {
-              pos += 2;
-              commentClosed = true;
-              break;
-            }
-            pos++;
-            if (isLineBreak(ch)) {
-              if (ch === 13 && text.charCodeAt(pos) === 10) {
-                pos++;
-              }
-              lineNumber++;
-              tokenLineStartOffset = pos;
-            }
-          }
-          if (!commentClosed) {
-            pos++;
-            scanError = 1;
-          }
-          value = text.substring(start, pos);
-          return token = 13;
-        }
-        value += String.fromCharCode(code);
-        pos++;
-        return token = 16;
-      // numbers
-      case 45:
-        value += String.fromCharCode(code);
-        pos++;
-        if (pos === len || !isDigit(text.charCodeAt(pos))) {
-          return token = 16;
-        }
-      // found a minus, followed by a number so
-      // we fall through to proceed with scanning
-      // numbers
-      case 48:
-      case 49:
-      case 50:
-      case 51:
-      case 52:
-      case 53:
-      case 54:
-      case 55:
-      case 56:
-      case 57:
-        value += scanNumber();
-        return token = 11;
-      // literals and unknown symbols
-      default:
-        while (pos < len && isUnknownContentCharacter(code)) {
-          pos++;
-          code = text.charCodeAt(pos);
-        }
-        if (tokenOffset !== pos) {
-          value = text.substring(tokenOffset, pos);
-          switch (value) {
-            case "true":
-              return token = 8;
-            case "false":
-              return token = 9;
-            case "null":
-              return token = 7;
-          }
-          return token = 16;
-        }
-        value += String.fromCharCode(code);
-        pos++;
-        return token = 16;
-    }
-  }
-  function isUnknownContentCharacter(code) {
-    if (isWhiteSpace(code) || isLineBreak(code)) {
-      return false;
-    }
-    switch (code) {
-      case 125:
-      case 93:
-      case 123:
-      case 91:
-      case 34:
-      case 58:
-      case 44:
-      case 47:
-        return false;
-    }
-    return true;
-  }
-  function scanNextNonTrivia() {
-    let result;
-    do {
-      result = scanNext();
-    } while (result >= 12 && result <= 15);
-    return result;
-  }
-  return {
-    setPosition,
-    getPosition: () => pos,
-    scan: ignoreTrivia ? scanNextNonTrivia : scanNext,
-    getToken: () => token,
-    getTokenValue: () => value,
-    getTokenOffset: () => tokenOffset,
-    getTokenLength: () => pos - tokenOffset,
-    getTokenStartLine: () => lineStartOffset,
-    getTokenStartCharacter: () => tokenOffset - prevTokenLineStartOffset,
-    getTokenError: () => scanError
-  };
-}
-function isWhiteSpace(ch) {
-  return ch === 32 || ch === 9;
-}
-function isLineBreak(ch) {
-  return ch === 10 || ch === 13;
-}
-function isDigit(ch) {
-  return ch >= 48 && ch <= 57;
-}
-var CharacterCodes;
-(function(CharacterCodes2) {
-  CharacterCodes2[CharacterCodes2["lineFeed"] = 10] = "lineFeed";
-  CharacterCodes2[CharacterCodes2["carriageReturn"] = 13] = "carriageReturn";
-  CharacterCodes2[CharacterCodes2["space"] = 32] = "space";
-  CharacterCodes2[CharacterCodes2["_0"] = 48] = "_0";
-  CharacterCodes2[CharacterCodes2["_1"] = 49] = "_1";
-  CharacterCodes2[CharacterCodes2["_2"] = 50] = "_2";
-  CharacterCodes2[CharacterCodes2["_3"] = 51] = "_3";
-  CharacterCodes2[CharacterCodes2["_4"] = 52] = "_4";
-  CharacterCodes2[CharacterCodes2["_5"] = 53] = "_5";
-  CharacterCodes2[CharacterCodes2["_6"] = 54] = "_6";
-  CharacterCodes2[CharacterCodes2["_7"] = 55] = "_7";
-  CharacterCodes2[CharacterCodes2["_8"] = 56] = "_8";
-  CharacterCodes2[CharacterCodes2["_9"] = 57] = "_9";
-  CharacterCodes2[CharacterCodes2["a"] = 97] = "a";
-  CharacterCodes2[CharacterCodes2["b"] = 98] = "b";
-  CharacterCodes2[CharacterCodes2["c"] = 99] = "c";
-  CharacterCodes2[CharacterCodes2["d"] = 100] = "d";
-  CharacterCodes2[CharacterCodes2["e"] = 101] = "e";
-  CharacterCodes2[CharacterCodes2["f"] = 102] = "f";
-  CharacterCodes2[CharacterCodes2["g"] = 103] = "g";
-  CharacterCodes2[CharacterCodes2["h"] = 104] = "h";
-  CharacterCodes2[CharacterCodes2["i"] = 105] = "i";
-  CharacterCodes2[CharacterCodes2["j"] = 106] = "j";
-  CharacterCodes2[CharacterCodes2["k"] = 107] = "k";
-  CharacterCodes2[CharacterCodes2["l"] = 108] = "l";
-  CharacterCodes2[CharacterCodes2["m"] = 109] = "m";
-  CharacterCodes2[CharacterCodes2["n"] = 110] = "n";
-  CharacterCodes2[CharacterCodes2["o"] = 111] = "o";
-  CharacterCodes2[CharacterCodes2["p"] = 112] = "p";
-  CharacterCodes2[CharacterCodes2["q"] = 113] = "q";
-  CharacterCodes2[CharacterCodes2["r"] = 114] = "r";
-  CharacterCodes2[CharacterCodes2["s"] = 115] = "s";
-  CharacterCodes2[CharacterCodes2["t"] = 116] = "t";
-  CharacterCodes2[CharacterCodes2["u"] = 117] = "u";
-  CharacterCodes2[CharacterCodes2["v"] = 118] = "v";
-  CharacterCodes2[CharacterCodes2["w"] = 119] = "w";
-  CharacterCodes2[CharacterCodes2["x"] = 120] = "x";
-  CharacterCodes2[CharacterCodes2["y"] = 121] = "y";
-  CharacterCodes2[CharacterCodes2["z"] = 122] = "z";
-  CharacterCodes2[CharacterCodes2["A"] = 65] = "A";
-  CharacterCodes2[CharacterCodes2["B"] = 66] = "B";
-  CharacterCodes2[CharacterCodes2["C"] = 67] = "C";
-  CharacterCodes2[CharacterCodes2["D"] = 68] = "D";
-  CharacterCodes2[CharacterCodes2["E"] = 69] = "E";
-  CharacterCodes2[CharacterCodes2["F"] = 70] = "F";
-  CharacterCodes2[CharacterCodes2["G"] = 71] = "G";
-  CharacterCodes2[CharacterCodes2["H"] = 72] = "H";
-  CharacterCodes2[CharacterCodes2["I"] = 73] = "I";
-  CharacterCodes2[CharacterCodes2["J"] = 74] = "J";
-  CharacterCodes2[CharacterCodes2["K"] = 75] = "K";
-  CharacterCodes2[CharacterCodes2["L"] = 76] = "L";
-  CharacterCodes2[CharacterCodes2["M"] = 77] = "M";
-  CharacterCodes2[CharacterCodes2["N"] = 78] = "N";
-  CharacterCodes2[CharacterCodes2["O"] = 79] = "O";
-  CharacterCodes2[CharacterCodes2["P"] = 80] = "P";
-  CharacterCodes2[CharacterCodes2["Q"] = 81] = "Q";
-  CharacterCodes2[CharacterCodes2["R"] = 82] = "R";
-  CharacterCodes2[CharacterCodes2["S"] = 83] = "S";
-  CharacterCodes2[CharacterCodes2["T"] = 84] = "T";
-  CharacterCodes2[CharacterCodes2["U"] = 85] = "U";
-  CharacterCodes2[CharacterCodes2["V"] = 86] = "V";
-  CharacterCodes2[CharacterCodes2["W"] = 87] = "W";
-  CharacterCodes2[CharacterCodes2["X"] = 88] = "X";
-  CharacterCodes2[CharacterCodes2["Y"] = 89] = "Y";
-  CharacterCodes2[CharacterCodes2["Z"] = 90] = "Z";
-  CharacterCodes2[CharacterCodes2["asterisk"] = 42] = "asterisk";
-  CharacterCodes2[CharacterCodes2["backslash"] = 92] = "backslash";
-  CharacterCodes2[CharacterCodes2["closeBrace"] = 125] = "closeBrace";
-  CharacterCodes2[CharacterCodes2["closeBracket"] = 93] = "closeBracket";
-  CharacterCodes2[CharacterCodes2["colon"] = 58] = "colon";
-  CharacterCodes2[CharacterCodes2["comma"] = 44] = "comma";
-  CharacterCodes2[CharacterCodes2["dot"] = 46] = "dot";
-  CharacterCodes2[CharacterCodes2["doubleQuote"] = 34] = "doubleQuote";
-  CharacterCodes2[CharacterCodes2["minus"] = 45] = "minus";
-  CharacterCodes2[CharacterCodes2["openBrace"] = 123] = "openBrace";
-  CharacterCodes2[CharacterCodes2["openBracket"] = 91] = "openBracket";
-  CharacterCodes2[CharacterCodes2["plus"] = 43] = "plus";
-  CharacterCodes2[CharacterCodes2["slash"] = 47] = "slash";
-  CharacterCodes2[CharacterCodes2["formFeed"] = 12] = "formFeed";
-  CharacterCodes2[CharacterCodes2["tab"] = 9] = "tab";
-})(CharacterCodes || (CharacterCodes = {}));
-
-// ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/string-intern.js
-var cachedSpaces = new Array(20).fill(0).map((_, index) => {
-  return " ".repeat(index);
-});
-var maxCachedValues = 200;
-var cachedBreakLinesWithSpaces = {
-  " ": {
-    "\n": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\n" + " ".repeat(index);
-    }),
-    "\r": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\r" + " ".repeat(index);
-    }),
-    "\r\n": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\r\n" + " ".repeat(index);
-    })
-  },
-  "	": {
-    "\n": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\n" + "	".repeat(index);
-    }),
-    "\r": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\r" + "	".repeat(index);
-    }),
-    "\r\n": new Array(maxCachedValues).fill(0).map((_, index) => {
-      return "\r\n" + "	".repeat(index);
-    })
-  }
-};
-
-// ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/parser.js
-var ParseOptions;
-(function(ParseOptions2) {
-  ParseOptions2.DEFAULT = {
-    allowTrailingComma: false
-  };
-})(ParseOptions || (ParseOptions = {}));
-function parseTree(text, errors = [], options = ParseOptions.DEFAULT) {
-  let currentParent = { type: "array", offset: -1, length: -1, children: [], parent: void 0 };
-  function ensurePropertyComplete(endOffset) {
-    if (currentParent.type === "property") {
-      currentParent.length = endOffset - currentParent.offset;
-      currentParent = currentParent.parent;
-    }
-  }
-  function onValue(valueNode) {
-    currentParent.children.push(valueNode);
-    return valueNode;
-  }
-  const visitor = {
-    onObjectBegin: (offset) => {
-      currentParent = onValue({ type: "object", offset, length: -1, parent: currentParent, children: [] });
-    },
-    onObjectProperty: (name, offset, length) => {
-      currentParent = onValue({ type: "property", offset, length: -1, parent: currentParent, children: [] });
-      currentParent.children.push({ type: "string", value: name, offset, length, parent: currentParent });
-    },
-    onObjectEnd: (offset, length) => {
-      ensurePropertyComplete(offset + length);
-      currentParent.length = offset + length - currentParent.offset;
-      currentParent = currentParent.parent;
-      ensurePropertyComplete(offset + length);
-    },
-    onArrayBegin: (offset, length) => {
-      currentParent = onValue({ type: "array", offset, length: -1, parent: currentParent, children: [] });
-    },
-    onArrayEnd: (offset, length) => {
-      currentParent.length = offset + length - currentParent.offset;
-      currentParent = currentParent.parent;
-      ensurePropertyComplete(offset + length);
-    },
-    onLiteralValue: (value, offset, length) => {
-      onValue({ type: getNodeType(value), offset, length, parent: currentParent, value });
-      ensurePropertyComplete(offset + length);
-    },
-    onSeparator: (sep, offset, length) => {
-      if (currentParent.type === "property") {
-        if (sep === ":") {
-          currentParent.colonOffset = offset;
-        } else if (sep === ",") {
-          ensurePropertyComplete(offset);
-        }
-      }
-    },
-    onError: (error, offset, length) => {
-      errors.push({ error, offset, length });
-    }
-  };
-  visit(text, visitor, options);
-  const result = currentParent.children[0];
-  if (result) {
-    delete result.parent;
-  }
-  return result;
-}
-function findNodeAtLocation(root, path) {
-  if (!root) {
-    return void 0;
-  }
-  let node = root;
-  for (let segment of path) {
-    if (typeof segment === "string") {
-      if (node.type !== "object" || !Array.isArray(node.children)) {
-        return void 0;
-      }
-      let found = false;
-      for (const propertyNode of node.children) {
-        if (Array.isArray(propertyNode.children) && propertyNode.children[0].value === segment && propertyNode.children.length === 2) {
-          node = propertyNode.children[1];
-          found = true;
-          break;
-        }
-      }
-      if (!found) {
-        return void 0;
-      }
-    } else {
-      const index = segment;
-      if (node.type !== "array" || index < 0 || !Array.isArray(node.children) || index >= node.children.length) {
-        return void 0;
-      }
-      node = node.children[index];
-    }
-  }
-  return node;
-}
-function visit(text, visitor, options = ParseOptions.DEFAULT) {
-  const _scanner = createScanner(text, false);
-  const _jsonPath = [];
-  let suppressedCallbacks = 0;
-  function toNoArgVisit(visitFunction) {
-    return visitFunction ? () => suppressedCallbacks === 0 && visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter()) : () => true;
-  }
-  function toOneArgVisit(visitFunction) {
-    return visitFunction ? (arg) => suppressedCallbacks === 0 && visitFunction(arg, _scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter()) : () => true;
-  }
-  function toOneArgVisitWithPath(visitFunction) {
-    return visitFunction ? (arg) => suppressedCallbacks === 0 && visitFunction(arg, _scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter(), () => _jsonPath.slice()) : () => true;
-  }
-  function toBeginVisit(visitFunction) {
-    return visitFunction ? () => {
-      if (suppressedCallbacks > 0) {
-        suppressedCallbacks++;
-      } else {
-        let cbReturn = visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter(), () => _jsonPath.slice());
-        if (cbReturn === false) {
-          suppressedCallbacks = 1;
-        }
-      }
-    } : () => true;
-  }
-  function toEndVisit(visitFunction) {
-    return visitFunction ? () => {
-      if (suppressedCallbacks > 0) {
-        suppressedCallbacks--;
-      }
-      if (suppressedCallbacks === 0) {
-        visitFunction(_scanner.getTokenOffset(), _scanner.getTokenLength(), _scanner.getTokenStartLine(), _scanner.getTokenStartCharacter());
-      }
-    } : () => true;
-  }
-  const onObjectBegin = toBeginVisit(visitor.onObjectBegin), onObjectProperty = toOneArgVisitWithPath(visitor.onObjectProperty), onObjectEnd = toEndVisit(visitor.onObjectEnd), onArrayBegin = toBeginVisit(visitor.onArrayBegin), onArrayEnd = toEndVisit(visitor.onArrayEnd), onLiteralValue = toOneArgVisitWithPath(visitor.onLiteralValue), onSeparator = toOneArgVisit(visitor.onSeparator), onComment = toNoArgVisit(visitor.onComment), onError = toOneArgVisit(visitor.onError);
-  const disallowComments = options && options.disallowComments;
-  const allowTrailingComma = options && options.allowTrailingComma;
-  function scanNext() {
-    while (true) {
-      const token = _scanner.scan();
-      switch (_scanner.getTokenError()) {
-        case 4:
-          handleError(
-            14
-            /* ParseErrorCode.InvalidUnicode */
-          );
-          break;
-        case 5:
-          handleError(
-            15
-            /* ParseErrorCode.InvalidEscapeCharacter */
-          );
-          break;
-        case 3:
-          handleError(
-            13
-            /* ParseErrorCode.UnexpectedEndOfNumber */
-          );
-          break;
-        case 1:
-          if (!disallowComments) {
-            handleError(
-              11
-              /* ParseErrorCode.UnexpectedEndOfComment */
-            );
-          }
-          break;
-        case 2:
-          handleError(
-            12
-            /* ParseErrorCode.UnexpectedEndOfString */
-          );
-          break;
-        case 6:
-          handleError(
-            16
-            /* ParseErrorCode.InvalidCharacter */
-          );
-          break;
-      }
-      switch (token) {
-        case 12:
-        case 13:
-          if (disallowComments) {
-            handleError(
-              10
-              /* ParseErrorCode.InvalidCommentToken */
-            );
-          } else {
-            onComment();
-          }
-          break;
-        case 16:
-          handleError(
-            1
-            /* ParseErrorCode.InvalidSymbol */
-          );
-          break;
-        case 15:
-        case 14:
-          break;
-        default:
-          return token;
-      }
-    }
-  }
-  function handleError(error, skipUntilAfter = [], skipUntil = []) {
-    onError(error);
-    if (skipUntilAfter.length + skipUntil.length > 0) {
-      let token = _scanner.getToken();
-      while (token !== 17) {
-        if (skipUntilAfter.indexOf(token) !== -1) {
-          scanNext();
-          break;
-        } else if (skipUntil.indexOf(token) !== -1) {
-          break;
-        }
-        token = scanNext();
-      }
-    }
-  }
-  function parseString(isValue) {
-    const value = _scanner.getTokenValue();
-    if (isValue) {
-      onLiteralValue(value);
-    } else {
-      onObjectProperty(value);
-      _jsonPath.push(value);
-    }
-    scanNext();
-    return true;
-  }
-  function parseLiteral() {
-    switch (_scanner.getToken()) {
-      case 11:
-        const tokenValue = _scanner.getTokenValue();
-        let value = Number(tokenValue);
-        if (isNaN(value)) {
-          handleError(
-            2
-            /* ParseErrorCode.InvalidNumberFormat */
-          );
-          value = 0;
-        }
-        onLiteralValue(value);
-        break;
-      case 7:
-        onLiteralValue(null);
-        break;
-      case 8:
-        onLiteralValue(true);
-        break;
-      case 9:
-        onLiteralValue(false);
-        break;
-      default:
-        return false;
-    }
-    scanNext();
-    return true;
-  }
-  function parseProperty() {
-    if (_scanner.getToken() !== 10) {
-      handleError(3, [], [
-        2,
-        5
-        /* SyntaxKind.CommaToken */
-      ]);
-      return false;
-    }
-    parseString(false);
-    if (_scanner.getToken() === 6) {
-      onSeparator(":");
-      scanNext();
-      if (!parseValue()) {
-        handleError(4, [], [
-          2,
-          5
-          /* SyntaxKind.CommaToken */
-        ]);
-      }
-    } else {
-      handleError(5, [], [
-        2,
-        5
-        /* SyntaxKind.CommaToken */
-      ]);
-    }
-    _jsonPath.pop();
-    return true;
-  }
-  function parseObject() {
-    onObjectBegin();
-    scanNext();
-    let needsComma = false;
-    while (_scanner.getToken() !== 2 && _scanner.getToken() !== 17) {
-      if (_scanner.getToken() === 5) {
-        if (!needsComma) {
-          handleError(4, [], []);
-        }
-        onSeparator(",");
-        scanNext();
-        if (_scanner.getToken() === 2 && allowTrailingComma) {
-          break;
-        }
-      } else if (needsComma) {
-        handleError(6, [], []);
-      }
-      if (!parseProperty()) {
-        handleError(4, [], [
-          2,
-          5
-          /* SyntaxKind.CommaToken */
-        ]);
-      }
-      needsComma = true;
-    }
-    onObjectEnd();
-    if (_scanner.getToken() !== 2) {
-      handleError(7, [
-        2
-        /* SyntaxKind.CloseBraceToken */
-      ], []);
-    } else {
-      scanNext();
-    }
-    return true;
-  }
-  function parseArray() {
-    onArrayBegin();
-    scanNext();
-    let isFirstElement = true;
-    let needsComma = false;
-    while (_scanner.getToken() !== 4 && _scanner.getToken() !== 17) {
-      if (_scanner.getToken() === 5) {
-        if (!needsComma) {
-          handleError(4, [], []);
-        }
-        onSeparator(",");
-        scanNext();
-        if (_scanner.getToken() === 4 && allowTrailingComma) {
-          break;
-        }
-      } else if (needsComma) {
-        handleError(6, [], []);
-      }
-      if (isFirstElement) {
-        _jsonPath.push(0);
-        isFirstElement = false;
-      } else {
-        _jsonPath[_jsonPath.length - 1]++;
-      }
-      if (!parseValue()) {
-        handleError(4, [], [
-          4,
-          5
-          /* SyntaxKind.CommaToken */
-        ]);
-      }
-      needsComma = true;
-    }
-    onArrayEnd();
-    if (!isFirstElement) {
-      _jsonPath.pop();
-    }
-    if (_scanner.getToken() !== 4) {
-      handleError(8, [
-        4
-        /* SyntaxKind.CloseBracketToken */
-      ], []);
-    } else {
-      scanNext();
-    }
-    return true;
-  }
-  function parseValue() {
-    switch (_scanner.getToken()) {
-      case 3:
-        return parseArray();
-      case 1:
-        return parseObject();
-      case 10:
-        return parseString(true);
-      default:
-        return parseLiteral();
-    }
-  }
-  scanNext();
-  if (_scanner.getToken() === 17) {
-    if (options.allowEmptyContent) {
-      return true;
-    }
-    handleError(4, [], []);
-    return false;
-  }
-  if (!parseValue()) {
-    handleError(4, [], []);
-    return false;
-  }
-  if (_scanner.getToken() !== 17) {
-    handleError(9, [], []);
-  }
-  return true;
-}
-function getNodeType(value) {
-  switch (typeof value) {
-    case "boolean":
-      return "boolean";
-    case "number":
-      return "number";
-    case "string":
-      return "string";
-    case "object": {
-      if (!value) {
-        return "null";
-      } else if (Array.isArray(value)) {
-        return "array";
-      }
-      return "object";
-    }
-    default:
-      return "null";
-  }
-}
-
-// ../../node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/main.js
-var ScanError;
-(function(ScanError2) {
-  ScanError2[ScanError2["None"] = 0] = "None";
-  ScanError2[ScanError2["UnexpectedEndOfComment"] = 1] = "UnexpectedEndOfComment";
-  ScanError2[ScanError2["UnexpectedEndOfString"] = 2] = "UnexpectedEndOfString";
-  ScanError2[ScanError2["UnexpectedEndOfNumber"] = 3] = "UnexpectedEndOfNumber";
-  ScanError2[ScanError2["InvalidUnicode"] = 4] = "InvalidUnicode";
-  ScanError2[ScanError2["InvalidEscapeCharacter"] = 5] = "InvalidEscapeCharacter";
-  ScanError2[ScanError2["InvalidCharacter"] = 6] = "InvalidCharacter";
-})(ScanError || (ScanError = {}));
-var SyntaxKind;
-(function(SyntaxKind2) {
-  SyntaxKind2[SyntaxKind2["OpenBraceToken"] = 1] = "OpenBraceToken";
-  SyntaxKind2[SyntaxKind2["CloseBraceToken"] = 2] = "CloseBraceToken";
-  SyntaxKind2[SyntaxKind2["OpenBracketToken"] = 3] = "OpenBracketToken";
-  SyntaxKind2[SyntaxKind2["CloseBracketToken"] = 4] = "CloseBracketToken";
-  SyntaxKind2[SyntaxKind2["CommaToken"] = 5] = "CommaToken";
-  SyntaxKind2[SyntaxKind2["ColonToken"] = 6] = "ColonToken";
-  SyntaxKind2[SyntaxKind2["NullKeyword"] = 7] = "NullKeyword";
-  SyntaxKind2[SyntaxKind2["TrueKeyword"] = 8] = "TrueKeyword";
-  SyntaxKind2[SyntaxKind2["FalseKeyword"] = 9] = "FalseKeyword";
-  SyntaxKind2[SyntaxKind2["StringLiteral"] = 10] = "StringLiteral";
-  SyntaxKind2[SyntaxKind2["NumericLiteral"] = 11] = "NumericLiteral";
-  SyntaxKind2[SyntaxKind2["LineCommentTrivia"] = 12] = "LineCommentTrivia";
-  SyntaxKind2[SyntaxKind2["BlockCommentTrivia"] = 13] = "BlockCommentTrivia";
-  SyntaxKind2[SyntaxKind2["LineBreakTrivia"] = 14] = "LineBreakTrivia";
-  SyntaxKind2[SyntaxKind2["Trivia"] = 15] = "Trivia";
-  SyntaxKind2[SyntaxKind2["Unknown"] = 16] = "Unknown";
-  SyntaxKind2[SyntaxKind2["EOF"] = 17] = "EOF";
-})(SyntaxKind || (SyntaxKind = {}));
-var parseTree2 = parseTree;
-var findNodeAtLocation2 = findNodeAtLocation;
-var ParseErrorCode;
-(function(ParseErrorCode2) {
-  ParseErrorCode2[ParseErrorCode2["InvalidSymbol"] = 1] = "InvalidSymbol";
-  ParseErrorCode2[ParseErrorCode2["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
-  ParseErrorCode2[ParseErrorCode2["PropertyNameExpected"] = 3] = "PropertyNameExpected";
-  ParseErrorCode2[ParseErrorCode2["ValueExpected"] = 4] = "ValueExpected";
-  ParseErrorCode2[ParseErrorCode2["ColonExpected"] = 5] = "ColonExpected";
-  ParseErrorCode2[ParseErrorCode2["CommaExpected"] = 6] = "CommaExpected";
-  ParseErrorCode2[ParseErrorCode2["CloseBraceExpected"] = 7] = "CloseBraceExpected";
-  ParseErrorCode2[ParseErrorCode2["CloseBracketExpected"] = 8] = "CloseBracketExpected";
-  ParseErrorCode2[ParseErrorCode2["EndOfFileExpected"] = 9] = "EndOfFileExpected";
-  ParseErrorCode2[ParseErrorCode2["InvalidCommentToken"] = 10] = "InvalidCommentToken";
-  ParseErrorCode2[ParseErrorCode2["UnexpectedEndOfComment"] = 11] = "UnexpectedEndOfComment";
-  ParseErrorCode2[ParseErrorCode2["UnexpectedEndOfString"] = 12] = "UnexpectedEndOfString";
-  ParseErrorCode2[ParseErrorCode2["UnexpectedEndOfNumber"] = 13] = "UnexpectedEndOfNumber";
-  ParseErrorCode2[ParseErrorCode2["InvalidUnicode"] = 14] = "InvalidUnicode";
-  ParseErrorCode2[ParseErrorCode2["InvalidEscapeCharacter"] = 15] = "InvalidEscapeCharacter";
-  ParseErrorCode2[ParseErrorCode2["InvalidCharacter"] = 16] = "InvalidCharacter";
-})(ParseErrorCode || (ParseErrorCode = {}));
-
 // src/generators/shared/json-edit.ts
+import { findNodeAtLocation, parseTree } from "jsonc-parser";
 function detectIndent(raw) {
   for (const line of raw.split("\n")) {
     const match = /^(\t+| +)/.exec(line);
@@ -1669,14 +916,14 @@ function insertProperty(raw, object, key, value, style) {
 }
 function setJsonValue(raw, path, value) {
   const style = styleOf(raw);
-  const root = parseTree2(raw);
+  const root = parseTree(raw);
   if (root === void 0) throw new Error("setJsonValue: not a JSON document");
-  const existing = findNodeAtLocation2(root, path);
+  const existing = findNodeAtLocation(root, path);
   if (existing !== void 0) {
     return splice(raw, existing.offset, existing.offset + existing.length, renderValue(value, lineIndentAt(raw, existing.offset), style));
   }
   for (let depth = path.length - 1; depth >= 0; depth--) {
-    const parent = depth === 0 ? root : findNodeAtLocation2(root, path.slice(0, depth));
+    const parent = depth === 0 ? root : findNodeAtLocation(root, path.slice(0, depth));
     if (parent === void 0) continue;
     if (parent.type !== "object") throw new Error(`setJsonValue: ${path.slice(0, depth).join(".") || "the root"} is not an object`);
     return insertProperty(raw, parent, path[depth], nest(path.slice(depth + 1), value), style);
@@ -1707,6 +954,7 @@ function treePackageManager(tree, config) {
 
 // src/generators/add-review/render.ts
 var DEPENDABOT_PATH = ".github/dependabot.yml";
+var PROVIDER_STATUS_URL = "https://github.com/clearlydev/nx-archweave/blob/main/docs/pr-review.md#provider-status";
 function renderLineDiff(existing, generated) {
   const a = existing.split("\n");
   const b = generated.split("\n");
@@ -1804,6 +1052,10 @@ function renderAddReviewReport(report) {
   }
   lines.push("");
   lines.push(`Note: the review workflow stays green-skipped until you register the ${report.requiredSecretName} secret.`);
+  if (report.betaProvider !== void 0) {
+    lines.push(`Note: the ${report.betaProvider} provider is in beta \u2014 its workflow hasn't finished a review end to end on`);
+    lines.push(`GitHub Actions yet. Status, costs and known issues: ${PROVIDER_STATUS_URL}`);
+  }
   lines.push("Note: this workflow runs with elevated permissions only after it is merged to the default branch \u2014");
   lines.push("merging is the first real validation.");
   return lines.join("\n");
@@ -1844,6 +1096,7 @@ function deepEqual(a, b) {
   return aKeys.every((key) => deepEqual(a[key], b[key]));
 }
 var PROVIDERS = ["claude", "gemini", "gpt", "cursor"];
+var BETA_PROVIDERS = ["gemini", "gpt", "cursor"];
 var MODES = ["fast", "standard", "thorough"];
 function recordedReview(config) {
   const review = config?.["review"];
@@ -1863,9 +1116,10 @@ function runAddReview(tree, options) {
   const packageManager = options.packageManager ?? detectedPm ?? "pnpm";
   const packageManagerNote = options.packageManager === void 0 && detectedPm === null ? "the package manager could not be detected (no pnpm, yarn, bun or npm lockfile) \u2014 the workflow was rendered for pnpm; re-run with --packageManager=npm|yarn|bun if that is wrong." : void 0;
   const recorded = recordedReview(config.parsed);
+  const provider = options.provider ?? recorded.provider ?? "claude";
   const plan = composeReviewSetup({
     enabled: true,
-    provider: options.provider ?? recorded.provider ?? "claude",
+    provider,
     mode: options.mode ?? recorded.mode ?? "standard",
     locale: resolveLocale(options.locale, config),
     maxRounds: options.maxRounds ?? recorded.maxRounds ?? 3,
@@ -1960,7 +1214,8 @@ function runAddReview(tree, options) {
     configError: null,
     dependabot,
     dependabotProposal: dependabot === "proposed" ? dependabotFile.content : null,
-    ...packageManagerNote !== void 0 ? { packageManagerNote } : {}
+    ...packageManagerNote !== void 0 ? { packageManagerNote } : {},
+    ...BETA_PROVIDERS.includes(provider) ? { betaProvider: provider } : {}
   };
 }
 async function addReviewGenerator(tree, options) {