@dunnewold-labs/mr-manager 0.4.31 → 0.4.35

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // cli/index.ts
-import { Command as Command28 } from "commander";
+import { Command as Command30 } from "commander";
 import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join12 } from "path";
@@ -185,7 +185,7 @@ import { fileURLToPath } from "url";
 // cli/package.json
 var package_default = {
   name: "@dunnewold-labs/mr-manager",
-  version: "0.4.31",
+  version: "0.4.35",
   description: "Mr. Manager - Task and project management CLI",
   bin: {
     mr: "./dist/index.mjs"
@@ -880,7 +880,7 @@ async function runTest(options) {
     recordingEnabled = true,
     recordingContext = "test-run"
   } = options;
-  const log2 = onProgress || (() => {
+  const log3 = onProgress || (() => {
   });
   const result = {
     status: "passed",
@@ -897,30 +897,30 @@ async function runTest(options) {
   let wtPath = null;
   const worktreeName = `mr-test-${taskId.slice(0, 8)}`;
   const timeoutHandle = setTimeout(() => {
-    log2("Test timed out after 5 minutes");
+    log3("Test timed out after 5 minutes");
     if (devProc) devProc.kill("SIGTERM");
   }, 5 * 60 * 1e3);
   try {
-    log2("Extracting branch from MR/PR link...");
+    log3("Extracting branch from MR/PR link...");
     const branch = extractBranchFromLink(taskLink, localPath);
     if (!branch) {
       throw new Error(`Could not extract branch from link: ${taskLink}`);
     }
-    log2(`Branch: ${branch}`);
-    log2("Creating git worktree...");
+    log3(`Branch: ${branch}`);
+    log3("Creating git worktree...");
     wtPath = createWorktree(localPath, branch, worktreeName).path;
-    log2(`Worktree created at ${wtPath}`);
-    log2("Installing dependencies...");
+    log3(`Worktree created at ${wtPath}`);
+    log3("Installing dependencies...");
     try {
       installDependencies(wtPath);
     } catch (err) {
-      log2(`Warning: dependency install failed: ${err.message}`);
+      log3(`Warning: dependency install failed: ${err.message}`);
     }
-    log2("Starting dev server...");
+    log3("Starting dev server...");
     const port = await findAvailablePort(4e3);
     devProc = await startDevServer(wtPath, port);
     const baseUrl = `http://127.0.0.1:${port}`;
-    log2(`Dev server running on ${baseUrl}`);
+    log3(`Dev server running on ${baseUrl}`);
     let recordingStarted = false;
     if (recordingEnabled) {
       try {
@@ -929,28 +929,28 @@ async function runTest(options) {
           throw new Error(recordingStart.stdout || "recording-start failed");
         }
         recordingStarted = true;
-        log2("Proof recording started");
+        log3("Proof recording started");
       } catch (err) {
         result.proof = {
           state: "proof_missing_capture_failed",
           details: `Proof recording could not start: ${err.message}`
         };
-        log2(result.proof.details);
+        log3(result.proof.details);
       }
     } else {
       result.proof = {
         state: "proof_missing_disabled",
         details: "Proof recording disabled for this run."
       };
-      log2(result.proof.details);
+      log3(result.proof.details);
     }
     await browseRunner(["goto", baseUrl]);
     const plan = customPlan || buildDefaultTestPlan(baseUrl);
-    log2(`Executing ${plan.length}-step test plan...`);
+    log3(`Executing ${plan.length}-step test plan...`);
     for (let i = 0; i < plan.length; i++) {
       const step = plan[i];
       const stepDesc = step.description || `${step.command} ${(step.args || []).join(" ")}`;
-      log2(`Step ${i + 1}/${plan.length}: ${stepDesc}`);
+      log3(`Step ${i + 1}/${plan.length}: ${stepDesc}`);
       try {
         if (step.command.startsWith("assert")) {
           const assertResult = await evaluateAssertion(step, i, browseRunner);
@@ -1000,7 +1000,7 @@ async function runTest(options) {
         }
       } catch (err) {
         result.errors.push(`Step ${i + 1} (${step.command}): ${err.message}`);
-        log2(`Step ${i + 1} error: ${err.message}`);
+        log3(`Step ${i + 1} error: ${err.message}`);
       }
     }
     if (recordingStarted) {
@@ -1012,7 +1012,7 @@ async function runTest(options) {
           throw new Error(recordingStop.stdout || "recording-stop did not return a file path");
         }
         result.proof.localPath = savedPath;
-        log2(`Proof recording finalized at ${savedPath}`);
+        log3(`Proof recording finalized at ${savedPath}`);
         if (uploadVideo) {
           const videoUrl = await uploadVideo(savedPath);
           if (videoUrl) {
@@ -1034,14 +1034,14 @@ async function runTest(options) {
                 }
               ]
             };
-            log2(`Proof recording uploaded to ${videoUrl}`);
+            log3(`Proof recording uploaded to ${videoUrl}`);
           } else {
             result.proof = {
               state: "proof_missing_upload_failed",
               details: "Proof recording captured, but upload failed.",
               localPath: savedPath
             };
-            log2(result.proof.details);
+            log3(result.proof.details);
           }
         } else {
           result.proof = {
@@ -1049,14 +1049,14 @@ async function runTest(options) {
             details: "Proof recording captured, but no upload handler was configured.",
             localPath: savedPath
           };
-          log2(result.proof.details);
+          log3(result.proof.details);
         }
       } catch (err) {
         result.proof = {
           state: "proof_missing_capture_failed",
           details: `Proof recording could not be finalized: ${err.message}`
         };
-        log2(result.proof.details);
+        log3(result.proof.details);
       }
     }
     const totalAssertions = result.assertions.length;
@@ -1162,6 +1162,19 @@ function taskLikelyDoesNotNeedCodeChanges(task) {
   return NON_CODE_TASK_KEYWORDS.some((keyword) => haystack.includes(keyword)) || NON_CODE_TASK_PATTERNS.some((pattern) => pattern.test(haystack));
 }
 
+// lib/task-branch.ts
+function isPrOrMrUrl(input) {
+  try {
+    const url = new URL(input.trim());
+    const path = url.pathname;
+    if (url.hostname.includes("github") && /\/pull\/\d+/.test(path)) return true;
+    if (url.hostname.includes("gitlab") && /\/merge_requests\/\d+/.test(path)) return true;
+  } catch {
+    return false;
+  }
+  return false;
+}
+
 // cli/browse-runner.ts
 import { execSync as execSync3, spawn as spawn3 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
@@ -1477,11 +1490,21 @@ function ownerPrefix(task) {
   return first || "mr";
 }
 function taskBranchName(task) {
-  if (task.attachedBranch?.trim()) {
-    return task.attachedBranch.trim();
+  const branch = task.attachedBranch?.trim();
+  if (branch && !isPrOrMrUrl(branch)) {
+    return branch;
   }
   return `${ownerPrefix(task)}/${slugify(task.title)}`;
 }
+function resolveBranchFromPrUrl(prUrl, repoDir, vcs) {
+  const cmd = vcs === "gitlab" ? `glab mr view "${prUrl}" --output json 2>/dev/null | jq -r '.source_branch // empty'` : `gh pr view "${prUrl}" --json headRefName -q .headRefName 2>/dev/null`;
+  return new Promise((resolve9) => {
+    exec(cmd, { cwd: repoDir }, (err, stdout) => {
+      const branch = stdout?.trim();
+      resolve9(branch || null);
+    });
+  });
+}
 function formatElapsed(ms) {
   const totalMinutes = Math.max(1, Math.floor(ms / 6e4));
   const hours = Math.floor(totalMinutes / 60);
@@ -1992,7 +2015,7 @@ ${task.notes}` : "";
     ],
     ``,
     `3. Implement the task. You may read, write, and run code across any relevant repos under ${repoDir}.`,
-    `   - If you do significant research or investigation, write your findings to \`research.md\` in ${repoDir} so it gets saved as a project resource.`,
+    `   - If you do significant research or investigation, save your findings as a resource using: \`mr update ${task.id} --resource research "Research \u2014 <short title>" '<markdown content>'\``,
     ...pendingSubtasks.length > 0 ? [
       `   - Work through each subtask in order. After completing each subtask, immediately run \`mr subtask-complete ${task.id} <subtask-id>\` to mark it done before moving on.`
     ] : [],
@@ -2000,7 +2023,7 @@ ${task.notes}` : "";
     `4. Once implementation is complete, for each repo that has changes:`,
     `   a. Commit all changes with a clear, descriptive message.`,
     `   b. Push the branch: \`git push -u origin HEAD\``,
-    ...hasFeedback ? [
+    ...hasFeedback || hasAttachedBranch && task.attachedBranchLink && isPrOrMrUrl(task.attachedBranchLink) ? [
       `   c. The existing ${vcs === "gitlab" ? "merge request" : "pull request"} will be updated automatically when you push to the branch. No need to create a new one.`
     ] : [
       `   c. Write a structured ${vcs === "gitlab" ? "merge request" : "pull request"} description to \`${prBodyPath}\` using the template below.`,
@@ -2019,7 +2042,7 @@ ${task.notes}` : "";
     ``,
     `This tells the watch system to skip looking for a ${vcs === "gitlab" ? "MR" : "PR"} and records what action was taken. You should still clean up any worktrees and exit normally.`,
     ``,
-    ...hasFeedback ? [] : [
+    ...hasFeedback || hasAttachedBranch && task.attachedBranchLink && isPrOrMrUrl(task.attachedBranchLink) ? [] : [
       `## PR Description Template`,
       ``,
       `Write this template to \`${prBodyPath}\`, then replace the placeholders with the actual details from your implementation.`,
@@ -2269,7 +2292,7 @@ function buildPrototypePrompt(proto, repoDir) {
     }
   };
   const config = typeConfig[prototypeType] ?? typeConfig.web_app;
-  const typeLabel = {
+  const typeLabel2 = {
     web_app: "Web App",
     mobile_app: "Mobile App",
     desktop_app: "Desktop App",
@@ -2283,7 +2306,7 @@ function buildPrototypePrompt(proto, repoDir) {
     `## Prototype Request`,
     `Title: ${proto.title}`,
     `ID: ${proto.id}`,
-    `Type: ${typeLabel[prototypeType] ?? prototypeType}`,
+    `Type: ${typeLabel2[prototypeType] ?? prototypeType}`,
     ``,
     `## Design Prompt`,
     `${proto.prompt}`,
@@ -2351,7 +2374,7 @@ function buildRefinementPrompt(proto, parentFiles, repoDir) {
     desktop_app: "You are a desktop UI designer and frontend engineer. Your job is to REFINE an existing desktop app prototype based on user feedback.",
     logo: "You are a graphic designer specializing in logo and brand identity. Your job is to REFINE an existing logo prototype based on user feedback."
   };
-  const typeLabel = {
+  const typeLabel2 = {
     web_app: "Web App",
     mobile_app: "Mobile App",
     desktop_app: "Desktop App",
@@ -2365,7 +2388,7 @@ function buildRefinementPrompt(proto, parentFiles, repoDir) {
     `## Prototype Request`,
     `Title: ${proto.title}`,
     `ID: ${proto.id}`,
-    `Type: ${typeLabel[prototypeType] ?? prototypeType}`,
+    `Type: ${typeLabel2[prototypeType] ?? prototypeType}`,
     ``,
     `## Original Design Prompt`,
     `${proto.prompt}`,
@@ -2639,7 +2662,7 @@ var watchCommand = new Command8("watch").description(
       logWarn(watchTag(), `Network unavailable \u2014 pausing active tasks until connectivity returns (${reason})`);
     }
     for (const taskId of active.keys()) {
-      const nonTaskPrefixes = ["proto-", "repo-", "scan-", "test-"];
+      const nonTaskPrefixes = ["proto-", "repo-", "scan-", "review-", "test-"];
       if (nonTaskPrefixes.some((prefix) => taskId.startsWith(prefix))) continue;
       pauseTaskForNetwork(taskId, reason);
     }
@@ -2686,10 +2709,17 @@ var watchCommand = new Command8("watch").description(
     const sid = shortId(task.id);
     const slug = slugify(task.title);
     const owner = ownerPrefix(task);
-    const branchName = taskBranchName(task);
+    let branchName = taskBranchName(task);
     const legacyBranchName = `mr/${sid}/${slug}`;
     const prefix = taskTag(sid);
     const vcs = detectVcs(repoDir)?.provider ?? "github";
+    if (!task.attachedBranch?.trim() && task.attachedBranchLink && isPrOrMrUrl(task.attachedBranchLink)) {
+      const resolved = await resolveBranchFromPrUrl(task.attachedBranchLink, repoDir, vcs);
+      if (resolved) {
+        branchName = resolved;
+        logInfo(prefix, `Resolved branch ${paint("cyan", resolved)} from attached ${vcs === "gitlab" ? "MR" : "PR"}`);
+      }
+    }
     logDispatch(prefix, `"${paint("bold", task.title)}"  ${paint("gray", repoDir)}  ${paint("dim", `[${vcs}]`)}`);
     await postTaskUpdate(task.id, `Agent dispatched \u2014 starting work on "${task.title}"`, "system");
     let subtasks = [];
@@ -2888,29 +2918,6 @@ var watchCommand = new Command8("watch").description(
         try {
           if (code === 0) {
             try {
-              const researchPath = resolve2(executionDir, "research.md");
-              if (existsSync7(researchPath)) {
-                try {
-                  const researchContent = readFileSync5(researchPath, "utf-8");
-                  const existingResearch = existingResources.find((r) => r.type === "research");
-                  if (existingResearch) {
-                    await api.patch(`/api/tasks/${task.id}/resources/${existingResearch.id}`, {
-                      content: researchContent
-                    });
-                    logSuccess(prefix, `Updated existing research resource`);
-                  } else {
-                    await api.post(`/api/tasks/${task.id}/resources`, {
-                      type: "research",
-                      title: `Research \u2014 ${task.title}`,
-                      content: researchContent
-                    });
-                    logSuccess(prefix, `Uploaded research.md as task resource`);
-                  }
-                  unlinkSync(researchPath);
-                } catch (err) {
-                  logWarn(prefix, `Failed to upload research resource: ${err.message}`);
-                }
-              }
               const noMrPath = resolve2(executionDir, ".mr-no-mr");
               const noMrRequested = existsSync7(noMrPath);
               let noMrDescription;
@@ -2921,7 +2928,11 @@ var watchCommand = new Command8("watch").description(
               }
               const prLabel = vcs === "gitlab" ? "MR" : "PR";
               let prUrl = null;
-              if (!noMrRequested) {
+              if (!noMrRequested && task.attachedBranchLink && isPrOrMrUrl(task.attachedBranchLink)) {
+                prUrl = task.attachedBranchLink;
+                logInfo(prefix, `Using attached ${prLabel} link: ${paint("cyan", prUrl)}`);
+              }
+              if (!noMrRequested && !prUrl) {
                 prUrl = await findPrUrlAcrossRepos(branchName, repoDir, vcs);
                 if (!prUrl && !task.attachedBranch?.trim()) {
                   prUrl = await findPrUrlAcrossRepos(legacyBranchName, repoDir, vcs);
@@ -2968,6 +2979,8 @@ var watchCommand = new Command8("watch").description(
                   logWarn(prefix, `No ${prLabel} found for branch ${paint("cyan", branchName)}`);
                   await postTaskUpdate(task.id, `Agent finished \u2014 no ${prLabel} found for branch ${branchName}`, "system");
                 }
+              } else if (prUrl) {
+                logSuccess(prefix, `${prLabel} ready: ${paint("cyan", prUrl)}`);
               }
               const currentTask = await api.get(`/api/tasks/${task.id}`);
               if (currentTask.status === "completed" || currentTask.status === "review") {
@@ -3412,6 +3425,49 @@ var watchCommand = new Command8("watch").description(
       }
     });
   }
+  function dispatchCodeReview(review, prefix, key) {
+    logDispatch(prefix, `Running code review on branch ${paint("cyan", review.branch)}`);
+    const reviewProc = spawn4(process.execPath, [process.argv[1], "review", "--project", review.projectId, "--report", review.id, "--branch", review.branch, "--base", review.baseBranch], {
+      stdio: ["ignore", "pipe", "pipe"],
+      cwd: rootDir
+    });
+    reviewProc.on("error", (err) => {
+      logError(prefix, `Failed to spawn review: ${err.message}`);
+      active.delete(key);
+      queued.delete(key);
+      failed.set(key, err.message);
+    });
+    active.set(key, {
+      process: reviewProc,
+      title: `review-${review.id.slice(0, 8)}`,
+      repoDir: rootDir,
+      startedAt: Date.now(),
+      lastActivityAt: Date.now(),
+      outputBytes: 0
+    });
+    reviewProc.stdout?.on("data", (d) => {
+      const lines = d.toString().trim().split("\n");
+      for (const line of lines) {
+        console.log(`${timestamp()} ${watchTag()} ${prefix} ${line}`);
+      }
+    });
+    reviewProc.stderr?.on("data", (d) => {
+      const lines = d.toString().trim().split("\n");
+      for (const line of lines) {
+        console.error(`${timestamp()} ${watchTag()} ${prefix} ${line}`);
+      }
+    });
+    reviewProc.on("exit", (code) => {
+      active.delete(key);
+      queued.delete(key);
+      if (code === 0) {
+        logSuccess(prefix, `Code review completed`);
+      } else {
+        logError(prefix, `Code review exited with code ${code}`);
+        failed.set(key, `exit code ${code}`);
+      }
+    });
+  }
   async function processApprovalQueue() {
     if (approvalRunning || approvalQueue.length === 0) return;
     approvalRunning = true;
@@ -3554,7 +3610,7 @@ ${divider}`);
         }
       }
       for (const [taskId, entry] of active) {
-        if (taskId.startsWith("proto-") || taskId.startsWith("repo-") || taskId.startsWith("scan-")) continue;
+        if (taskId.startsWith("proto-") || taskId.startsWith("repo-") || taskId.startsWith("scan-") || taskId.startsWith("review-")) continue;
         if (!activeTaskIds.has(taskId)) {
           logWarn(watchTag(), `Task ${paint("yellow", taskId.slice(0, 8))} no longer active, terminating\u2026`);
           entry.terminatedForError = true;
@@ -3563,7 +3619,7 @@ ${divider}`);
           queued.delete(taskId);
         }
       }
-      const nonTaskPrefixes = ["proto-", "repo-", "scan-", "test-"];
+      const nonTaskPrefixes = ["proto-", "repo-", "scan-", "review-", "test-"];
       for (const taskId of failed.keys()) {
         if (nonTaskPrefixes.some((p) => taskId.startsWith(p))) continue;
         if (!activeTaskIds.has(taskId)) failed.delete(taskId);
@@ -3869,6 +3925,29 @@ ${divider}`);
         }
         dispatchScan(scan, prefix, key);
       }
+      let pendingReviews = [];
+      try {
+        pendingReviews = await api.get("/api/reviews?status=pending&limit=5");
+      } catch (err) {
+        logError(watchTag(), `Failed to fetch pending reviews: ${err.message}`);
+      }
+      for (const review of pendingReviews) {
+        const key = `review-${review.id}`;
+        if (queued.has(key)) continue;
+        if (finishing.has(key)) continue;
+        if (failed.has(key)) continue;
+        const sid = shortId(review.id);
+        const prefix = `${paint("blue", `[review:${sid}]`)}`;
+        queued.add(key);
+        if (dryRun) {
+          logInfo(
+            watchTag(),
+            `${paint("yellow", "[dry-run]")} would run code review ${paint("yellow", sid)} on branch ${paint("cyan", review.branch)}`
+          );
+          continue;
+        }
+        dispatchCodeReview(review, prefix, key);
+      }
       let reviewTasks = [];
       try {
         reviewTasks = await api.get("/api/tasks?status=review");
@@ -4152,9 +4231,9 @@ var prototypeCommand = new Command13("prototype").description("Manage prototypes
     };
     for (const p of prototypes) {
       const date = new Date(p.createdAt).toLocaleDateString();
-      const typeLabel = typeLabels[p.prototypeType] ?? p.prototypeType ?? "web";
+      const typeLabel2 = typeLabels[p.prototypeType] ?? p.prototypeType ?? "web";
       console.log(
-        `  ${paint4("bold", p.title)}  ${statusBadge(p.status)}  ${paint4("blue", `[${typeLabel}]`)}  ${paint4("gray", p.id.slice(0, 8))}  ${paint4("dim", date)}`
+        `  ${paint4("bold", p.title)}  ${statusBadge(p.status)}  ${paint4("blue", `[${typeLabel2}]`)}  ${paint4("gray", p.id.slice(0, 8))}  ${paint4("dim", date)}`
       );
       console.log(`  ${paint4("dim", p.prompt.slice(0, 80) + (p.prompt.length > 80 ? "\u2026" : ""))}`);
       console.log();
@@ -4470,7 +4549,7 @@ async function checkApiConnectivity() {
   }
 }
 function printResults(checks) {
-  const maxNameLen = Math.max(...checks.map((c11) => c11.name.length));
+  const maxNameLen = Math.max(...checks.map((c13) => c13.name.length));
   let allOk = true;
   for (const check of checks) {
     const isOptional = check.optional ?? false;
@@ -4483,16 +4562,16 @@ function printResults(checks) {
   return allOk;
 }
 async function autoFix(checks, agent) {
-  const { spawn: spawn8 } = await import("child_process");
-  const ghInstalled = checks.find((c11) => c11.name === "GitHub CLI (gh)").ok;
-  const ghAuthed = checks.find((c11) => c11.name === "GitHub CLI auth").ok;
-  const mrAuthed = checks.find((c11) => c11.name === "Mr. Manager CLI auth").ok;
-  const claudeCheck = checks.find((c11) => c11.name === "Claude Code (claude)");
+  const { spawn: spawn9 } = await import("child_process");
+  const ghInstalled = checks.find((c13) => c13.name === "GitHub CLI (gh)").ok;
+  const ghAuthed = checks.find((c13) => c13.name === "GitHub CLI auth").ok;
+  const mrAuthed = checks.find((c13) => c13.name === "Mr. Manager CLI auth").ok;
+  const claudeCheck = checks.find((c13) => c13.name === "Claude Code (claude)");
   if (claudeCheck && !claudeCheck.ok && agent === "claude") {
     console.log(paint5("cyan", "  Installing Claude Code..."));
     console.log(paint5("dim", "  Running: curl -fsSL https://claude.ai/install.sh | bash"));
     await new Promise((resolve9) => {
-      const child = spawn8("bash", ["-c", "curl -fsSL https://claude.ai/install.sh | bash"], { stdio: "inherit" });
+      const child = spawn9("bash", ["-c", "curl -fsSL https://claude.ai/install.sh | bash"], { stdio: "inherit" });
       child.on("exit", () => resolve9());
     });
     console.log("");
@@ -4500,7 +4579,7 @@ async function autoFix(checks, agent) {
   if (ghInstalled && !ghAuthed) {
     console.log(paint5("cyan", "  Running gh auth login..."));
     await new Promise((resolve9) => {
-      const child = spawn8("gh", ["auth", "login"], { stdio: "inherit" });
+      const child = spawn9("gh", ["auth", "login"], { stdio: "inherit" });
       child.on("exit", () => resolve9());
     });
     console.log("");
@@ -4509,7 +4588,7 @@ async function autoFix(checks, agent) {
     console.log(paint5("cyan", "  Running mr login..."));
     const entry = process.argv[1];
     await new Promise((resolve9) => {
-      const child = spawn8(process.execPath, [entry, "login"], { stdio: "inherit" });
+      const child = spawn9(process.execPath, [entry, "login"], { stdio: "inherit" });
       child.on("exit", () => resolve9());
     });
     console.log("");
@@ -4550,7 +4629,7 @@ var setupCommand = new Command14("setup").description("Check that all dependenci
     console.log("");
     return;
   }
-  const fixes = checks.filter((c11) => !c11.ok && c11.fix && !c11.optional);
+  const fixes = checks.filter((c13) => !c13.ok && c13.fix && !c13.optional);
   if (fixes.length > 0) {
     console.log(paint5("yellow", "  To fix:"));
     for (const fix of fixes) {
@@ -4566,9 +4645,26 @@ var setupCommand = new Command14("setup").description("Check that all dependenci
 
 // cli/commands/update.ts
 import { Command as Command15 } from "commander";
-var updateCommand = new Command15("update").description("Post a status update to a task (used by agents to report progress)").argument("<task-id>", "Task ID").argument("<message>", "Status update message").option("--source <source>", "Update source: agent, system, or user", "agent").action(async (taskId, message, opts) => {
+var updateCommand = new Command15("update").description("Post a status update to a task, or attach a resource").argument("<task-id>", "Task ID").argument("[message-or-title]", "Status update message, or resource title when using --resource").argument("[content]", "Resource content (only used with --resource)").option("--source <source>", "Update source: agent, system, or user", "agent").option("--resource <type>", "Create a task resource (e.g. test-plan, note, plan, research)").action(async (taskId, messageOrTitle, content, opts) => {
+  if (opts.resource) {
+    if (!messageOrTitle || !content) {
+      console.error(`Usage: mr update <task-id> --resource <type> "<title>" '<content>'`);
+      process.exit(1);
+    }
+    await api.post(`/api/tasks/${taskId}/resources`, {
+      type: opts.resource,
+      title: messageOrTitle,
+      content
+    });
+    console.log(`\u2713 Resource created (${opts.resource}): ${messageOrTitle}`);
+    return;
+  }
+  if (!messageOrTitle) {
+    console.error("Message is required for status updates.");
+    process.exit(1);
+  }
   await api.post(`/api/tasks/${taskId}/updates`, {
-    message,
+    message: messageOrTitle,
     source: opts.source
   });
   console.log(`\u2713 Status update posted`);
@@ -5276,11 +5372,329 @@ var noMrCommand = new Command22("no-mr").description("Signal that a task does no
   console.log(`  Reason: ${description}`);
 });
 
-// cli/commands/scan.ts
+// cli/commands/review.ts
 import { Command as Command23 } from "commander";
+import { spawn as spawn7, execSync as execSync5 } from "child_process";
+var c8 = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  magenta: "\x1B[35m",
+  gray: "\x1B[90m",
+  blue: "\x1B[34m"
+};
+function paint8(color, text) {
+  return `${c8[color]}${text}${c8.reset}`;
+}
+function timestamp2() {
+  return paint8("gray", (/* @__PURE__ */ new Date()).toLocaleTimeString("en-US", { hour12: false }));
+}
+function tag() {
+  return paint8("blue", "[review]");
+}
+function log(msg) {
+  console.log(`${timestamp2()} ${tag()} ${msg}`);
+}
+function logOk(msg) {
+  console.log(`${timestamp2()} ${tag()} ${paint8("green", "\u2713")} ${msg}`);
+}
+function logErr(msg) {
+  console.error(`${timestamp2()} ${tag()} ${paint8("red", "\u2717")} ${msg}`);
+}
+var reviewCommand = new Command23("review").description("Run an automated code review on a branch").option("--project <id>", "Project ID (defaults to linked project)").option("--report <id>", "Use an existing review report ID (created by UI trigger)").option("--branch <name>", "Branch to review (defaults to current branch)").option("--base <name>", "Base branch to diff against (defaults to main)").action(async (opts) => {
+  const config = loadConfig();
+  if (!config.apiKey) {
+    logErr('Not authenticated. Run "mr login" first.');
+    process.exit(1);
+  }
+  const banner = [
+    ``,
+    paint8("blue", `  \u2566\u2550\u2557\u2554\u2550\u2557\u2566  \u2566\u2566\u2554\u2550\u2557\u2566 \u2566`),
+    paint8("blue", `  \u2560\u2566\u255D\u2551\u2563 \u255A\u2557\u2554\u255D\u2551\u2551\u2563 \u2551\u2551\u2551`),
+    paint8("blue", `  \u2569\u255A\u2550\u255A\u2550\u255D \u255A\u255D \u2569\u255A\u2550\u255D\u255A\u2569\u255D`),
+    paint8("dim", `  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`),
+    paint8("dim", `  automated code review`),
+    ``
+  ].join("\n");
+  console.log(banner);
+  const projectId = opts.project || getLinkedProjectId();
+  if (!projectId) {
+    logErr('No project linked. Run "mr link" or pass --project <id>.');
+    process.exit(1);
+  }
+  let project;
+  try {
+    project = await api.get(`/api/projects/${projectId}`);
+  } catch {
+    logErr(`Failed to fetch project ${projectId}`);
+    process.exit(1);
+  }
+  let projectPath = project.localPath;
+  if (!projectPath) {
+    for (const [dir, pid] of Object.entries(config.directories)) {
+      if (pid === projectId) {
+        projectPath = dir;
+        break;
+      }
+    }
+  }
+  if (!projectPath) {
+    projectPath = process.cwd();
+  }
+  let branch = opts.branch;
+  if (!branch) {
+    try {
+      branch = execSync5("git rev-parse --abbrev-ref HEAD", {
+        cwd: projectPath,
+        encoding: "utf-8"
+      }).trim();
+    } catch {
+      logErr("Could not determine current branch. Pass --branch <name>.");
+      process.exit(1);
+    }
+  }
+  const baseBranch = opts.base || "main";
+  log(`Reviewing branch: ${paint8("cyan", branch)} against ${paint8("dim", baseBranch)}`);
+  log(`Project: ${paint8("cyan", project.name)}`);
+  let diff;
+  try {
+    diff = execSync5(`git diff ${baseBranch}...${branch} -- . ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml'`, {
+      cwd: projectPath,
+      encoding: "utf-8",
+      maxBuffer: 10 * 1024 * 1024
+    }).trim();
+  } catch (err) {
+    try {
+      execSync5(`git fetch origin ${baseBranch}`, { cwd: projectPath, encoding: "utf-8", stdio: "pipe" });
+      diff = execSync5(`git diff origin/${baseBranch}...${branch} -- . ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml'`, {
+        cwd: projectPath,
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024
+      }).trim();
+    } catch {
+      logErr(`Failed to get diff between ${baseBranch} and ${branch}: ${err.message}`);
+      process.exit(1);
+    }
+  }
+  if (!diff) {
+    logOk("No changes found between branches. Nothing to review.");
+    process.exit(0);
+  }
+  const filesChanged = (() => {
+    try {
+      const stat = execSync5(`git diff --stat ${baseBranch}...${branch} -- . ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml'`, {
+        cwd: projectPath,
+        encoding: "utf-8"
+      }).trim();
+      const lines = stat.split("\n");
+      return Math.max(0, lines.length - 1);
+    } catch {
+      const fileHeaders = diff.match(/^diff --git/gm);
+      return fileHeaders?.length ?? 0;
+    }
+  })();
+  log(`Diff size: ${paint8("yellow", `${diff.length.toLocaleString()} chars`)}, ${paint8("yellow", `${filesChanged} files`)}`);
+  let reportId;
+  if (opts.report) {
+    reportId = opts.report;
+    log(`Using existing review report ${paint8("yellow", reportId.slice(0, 8))}`);
+  } else {
+    try {
+      const report = await api.post("/api/reviews", {
+        projectId,
+        branch,
+        baseBranch
+      });
+      reportId = report.id;
+      log(`Created review report ${paint8("yellow", reportId.slice(0, 8))}`);
+    } catch (err) {
+      logErr(`Failed to create review report: ${err.message}`);
+      process.exit(1);
+    }
+  }
+  try {
+    await api.patch(`/api/reviews/${reportId}`, { status: "processing" });
+  } catch {
+  }
+  const startTime = Date.now();
+  const MAX_DIFF_CHARS = 8e4;
+  let truncatedDiff = diff;
+  if (diff.length > MAX_DIFF_CHARS) {
+    truncatedDiff = diff.slice(0, MAX_DIFF_CHARS) + "\n\n... (diff truncated, review covers first " + MAX_DIFF_CHARS.toLocaleString() + " characters)";
+    log(paint8("yellow", `Diff truncated to ${MAX_DIFF_CHARS.toLocaleString()} chars for review`));
+  }
+  try {
+    log("Running code review with Claude...");
+    const prompt2 = buildReviewPrompt(branch, baseBranch, truncatedDiff);
+    const output = await runClaude(prompt2);
+    const result = parseReviewOutput(output);
+    const duration = Date.now() - startTime;
+    let wasCancelled = false;
+    try {
+      const current = await api.get(`/api/reviews/${reportId}`);
+      wasCancelled = current.status === "cancelled";
+    } catch {
+    }
+    if (wasCancelled) {
+      log(paint8("yellow", "Review was cancelled \u2014 discarding results."));
+      process.exit(0);
+    }
+    await api.patch(`/api/reviews/${reportId}`, {
+      status: "completed",
+      summary: result.summary,
+      findings: result.findings,
+      filesReviewed: filesChanged,
+      reviewDurationMs: duration
+    });
+    logOk(`Review completed in ${paint8("cyan", formatDuration(duration))}`);
+    logOk(`Found ${paint8("yellow", String(result.findings.length))} findings`);
+    if (result.findings.length > 0) {
+      console.log("");
+      const critical = result.findings.filter((f) => f.severity === "critical").length;
+      const high = result.findings.filter((f) => f.severity === "high").length;
+      const medium = result.findings.filter((f) => f.severity === "medium").length;
+      const low = result.findings.filter((f) => f.severity === "low").length;
+      if (critical > 0) console.log(`  ${paint8("red", "\u25CF")} ${critical} critical`);
+      if (high > 0) console.log(`  ${paint8("red", "\u25CF")} ${high} high`);
+      if (medium > 0) console.log(`  ${paint8("yellow", "\u25CF")} ${medium} medium`);
+      if (low > 0) console.log(`  ${paint8("dim", "\u25CF")} ${low} low`);
+      console.log("");
+    }
+    if (result.summary) {
+      console.log(paint8("dim", "  " + result.summary));
+      console.log("");
+    }
+  } catch (err) {
+    const duration = Date.now() - startTime;
+    const errorMessage = err.message || "Unknown error";
+    logErr(`Review failed: ${errorMessage}`);
+    try {
+      await api.patch(`/api/reviews/${reportId}`, {
+        status: "failed",
+        errorMessage,
+        reviewDurationMs: duration
+      });
+    } catch {
+    }
+    process.exit(1);
+  }
+});
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  return `${Math.floor(s / 60)}m ${s % 60}s`;
+}
+function buildReviewPrompt(branch, baseBranch, diff) {
+  return `You are a senior code reviewer. Review the following git diff for branch "${branch}" compared to "${baseBranch}".
+
+Analyze the code changes and produce a JSON response with your review findings.
+
+Focus on:
+- Bugs and logical errors
+- Security vulnerabilities (XSS, injection, auth issues, secrets exposure)
+- Performance issues (N+1 queries, missing indexes, unnecessary re-renders)
+- Code style and best practices violations
+- Suggestions for improvement
+- Nitpicks (minor style/naming issues)
+
+For each finding, provide:
+- A unique ID (e.g. "f1", "f2", etc.)
+- Type: "bug", "security", "performance", "style", "suggestion", or "nitpick"
+- Severity: "critical", "high", "medium", or "low"
+- Title: a brief one-line summary
+- Description: detailed explanation of the issue
+- File: the file path where the issue was found
+- Line: the approximate line number in the new code (optional)
+- Suggestion: suggested fix or improvement (optional, include actual code when possible)
+
+Return ONLY a JSON object with this structure (no markdown, no explanation before/after):
+{
+  "summary": "Brief overall assessment of the code changes (2-3 sentences)",
+  "findings": [
+    {
+      "id": "f1",
+      "type": "bug",
+      "severity": "high",
+      "title": "Brief title",
+      "description": "Detailed description",
+      "file": "path/to/file.ts",
+      "line": 42,
+      "suggestion": "Suggested fix code"
+    }
+  ]
+}
+
+If the code looks good with no issues, return an empty findings array with a positive summary.
+
+Here is the diff to review:
+
+\`\`\`diff
+${diff}
+\`\`\``;
+}
+function runClaude(prompt2) {
+  return new Promise((resolve9, reject) => {
+    const child = spawn7("claude", ["-p", "--dangerously-skip-permissions", prompt2], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let output = "";
+    let errOutput = "";
+    child.stdout?.on("data", (d) => {
+      output += d.toString();
+    });
+    child.stderr?.on("data", (d) => {
+      errOutput += d.toString();
+    });
+    child.on("exit", (code) => {
+      if (code === 0) resolve9(output.trim());
+      else reject(new Error(`claude exited with code ${code}
+${errOutput.trim()}`));
+    });
+  });
+}
+function parseReviewOutput(output) {
+  const jsonMatch = output.match(/\{[\s\S]*\}/);
+  if (!jsonMatch) {
+    return {
+      summary: "Failed to parse review output",
+      findings: []
+    };
+  }
+  try {
+    const parsed = JSON.parse(jsonMatch[0]);
+    return {
+      summary: parsed.summary || "",
+      findings: (parsed.findings || []).map((f) => ({
+        id: f.id || `f${Math.random().toString(36).slice(2, 8)}`,
+        type: f.type || "suggestion",
+        severity: f.severity || "medium",
+        title: f.title || "Untitled finding",
+        description: f.description || "",
+        file: f.file || "unknown",
+        line: f.line,
+        endLine: f.endLine,
+        suggestion: f.suggestion,
+        status: "new"
+      }))
+    };
+  } catch {
+    return {
+      summary: "Failed to parse review JSON",
+      findings: []
+    };
+  }
+}
+
+// cli/commands/scan.ts
+import { Command as Command24 } from "commander";
 
 // lib/scanner/index.ts
-import { spawn as spawn7 } from "child_process";
+import { spawn as spawn8 } from "child_process";
 
 // lib/scanner/config.ts
 import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
@@ -5349,7 +5763,7 @@ async function authenticateBrowseSession(magicUrl, runBrowse) {
 // lib/scanner/codebase-analysis.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync11, existsSync as existsSync14 } from "fs";
 import { join as join10, relative } from "path";
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 function resolveDir(projectPath, candidates) {
   for (const candidate of candidates) {
     const dir = join10(projectPath, candidate);
@@ -5475,7 +5889,7 @@ function extractInternalLinks(projectPath) {
 }
 function getRecentCommits(projectPath, count = 20) {
   try {
-    const output = execSync5(
+    const output = execSync6(
       `git log --oneline -${count} --no-decorate`,
       { cwd: projectPath, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
@@ -5743,10 +6157,10 @@ ${codebaseAnalysis.routes.map((r) => `- ${r}`).join("\n")}
 ${codebaseAnalysis.prismaModels.map((m) => `- ${m}`).join("\n")}
 
 **Components:**
-${codebaseAnalysis.components.slice(0, 15).map((c11) => `- ${c11}`).join("\n")}
+${codebaseAnalysis.components.slice(0, 15).map((c13) => `- ${c13}`).join("\n")}
 
 **Recent Git Commits:**
-${codebaseAnalysis.recentCommits.slice(0, 8).map((c11) => `- ${c11}`).join("\n")}
+${codebaseAnalysis.recentCommits.slice(0, 8).map((c13) => `- ${c13}`).join("\n")}
 
 **Completed Tasks:**
 ${context.completedTasks.slice(0, 10).map((t) => `- ${t.title}`).join("\n") || "None"}
@@ -5891,7 +6305,7 @@ async function runScanPipeline(opts) {
     crawlResults,
     context.priorFindings
   );
-  const synthesisResult = await runClaude(prompt2);
+  const synthesisResult = await runClaude2(prompt2);
   const parsed = parseSynthesisOutput(synthesisResult);
   const scanDurationMs = Date.now() - startTime;
   opts.onLog(`Scan complete in ${Math.round(scanDurationMs / 1e3)}s \u2014 ${parsed.findings.length} findings`);
@@ -5952,9 +6366,9 @@ async function fetchScanContext(opts) {
     priorFindings
   };
 }
-function runClaude(prompt2) {
+function runClaude2(prompt2) {
   return new Promise((resolve9, reject) => {
-    const child = spawn7("claude", ["-p", "--dangerously-skip-permissions", prompt2], {
+    const child = spawn8("claude", ["-p", "--dangerously-skip-permissions", prompt2], {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let output = "";
@@ -6010,7 +6424,7 @@ function parseSynthesisOutput(output) {
 }
 
 // cli/commands/scan.ts
-var c8 = {
+var c9 = {
   reset: "\x1B[0m",
   bold: "\x1B[1m",
   dim: "\x1B[2m",
@@ -6021,53 +6435,53 @@ var c8 = {
   magenta: "\x1B[35m",
   gray: "\x1B[90m"
 };
-function paint8(color, text) {
-  return `${c8[color]}${text}${c8.reset}`;
+function paint9(color, text) {
+  return `${c9[color]}${text}${c9.reset}`;
 }
-function timestamp2() {
-  return paint8("gray", (/* @__PURE__ */ new Date()).toLocaleTimeString("en-US", { hour12: false }));
+function timestamp3() {
+  return paint9("gray", (/* @__PURE__ */ new Date()).toLocaleTimeString("en-US", { hour12: false }));
 }
 function scanTag() {
-  return paint8("magenta", "[scan]");
+  return paint9("magenta", "[scan]");
 }
-function log(msg) {
-  console.log(`${timestamp2()} ${scanTag()} ${msg}`);
+function log2(msg) {
+  console.log(`${timestamp3()} ${scanTag()} ${msg}`);
 }
-function logOk(msg) {
-  console.log(`${timestamp2()} ${scanTag()} ${paint8("green", "\u2713")} ${msg}`);
+function logOk2(msg) {
+  console.log(`${timestamp3()} ${scanTag()} ${paint9("green", "\u2713")} ${msg}`);
 }
-function logErr(msg) {
-  console.error(`${timestamp2()} ${scanTag()} ${paint8("red", "\u2717")} ${msg}`);
+function logErr2(msg) {
+  console.error(`${timestamp3()} ${scanTag()} ${paint9("red", "\u2717")} ${msg}`);
 }
-var scanCommand = new Command23("scan").description("Run a product scan on the current project \u2014 analyzes codebase, crawls the app, and surfaces findings").option("--project <id>", "Project ID (defaults to linked project)").option("--report <id>", "Use an existing scan report ID (created by UI trigger)").option("--no-crawl", "Skip live crawl (codebase analysis only)").action(async (opts) => {
+var scanCommand = new Command24("scan").description("Run a product scan on the current project \u2014 analyzes codebase, crawls the app, and surfaces findings").option("--project <id>", "Project ID (defaults to linked project)").option("--report <id>", "Use an existing scan report ID (created by UI trigger)").option("--no-crawl", "Skip live crawl (codebase analysis only)").action(async (opts) => {
   const config = loadConfig();
   if (!config.apiKey) {
-    logErr('Not authenticated. Run "mr login" first.');
+    logErr2('Not authenticated. Run "mr login" first.');
     process.exit(1);
   }
   const banner = [
     ``,
-    paint8("magenta", `  \u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2557\u2554`),
-    paint8("magenta", `  \u255A\u2550\u2557\u2551  \u2560\u2550\u2563\u2551\u2551\u2551`),
-    paint8("magenta", `  \u255A\u2550\u255D\u255A\u2550\u255D\u2569 \u2569\u255D\u255A\u255D`),
-    paint8("dim", `  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`),
-    paint8("dim", `  autonomous product scanner`),
+    paint9("magenta", `  \u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2557\u2554`),
+    paint9("magenta", `  \u255A\u2550\u2557\u2551  \u2560\u2550\u2563\u2551\u2551\u2551`),
+    paint9("magenta", `  \u255A\u2550\u255D\u255A\u2550\u255D\u2569 \u2569\u255D\u255A\u255D`),
+    paint9("dim", `  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`),
+    paint9("dim", `  autonomous product scanner`),
     ``
   ].join("\n");
   console.log(banner);
   const projectId = opts.project || getLinkedProjectId();
   if (!projectId) {
-    logErr('No project linked. Run "mr link" or pass --project <id>.');
+    logErr2('No project linked. Run "mr link" or pass --project <id>.');
     process.exit(1);
   }
   let project;
   try {
     project = await api.get(`/api/projects/${projectId}`);
   } catch {
-    logErr(`Failed to fetch project ${projectId}`);
+    logErr2(`Failed to fetch project ${projectId}`);
     process.exit(1);
   }
-  log(`Scanning project: ${paint8("cyan", project.name)}`);
+  log2(`Scanning project: ${paint9("cyan", project.name)}`);
   let projectPath = project.localPath;
   if (!projectPath) {
     for (const [dir, pid] of Object.entries(config.directories)) {
@@ -6083,12 +6497,12 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
   let reportId;
   if (opts.report) {
     reportId = opts.report;
-    log(`Using existing scan report ${paint8("yellow", reportId.slice(0, 8))}`);
+    log2(`Using existing scan report ${paint9("yellow", reportId.slice(0, 8))}`);
   } else {
     try {
       const scans = await api.get(`/api/scans?projectId=${projectId}&status=processing`);
       if (scans.length > 0) {
-        logErr("A scan is already in progress for this project. Wait for it to complete.");
+        logErr2("A scan is already in progress for this project. Wait for it to complete.");
         process.exit(1);
       }
     } catch {
@@ -6099,9 +6513,9 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
         status: "pending"
       });
       reportId = report.id;
-      log(`Created scan report ${paint8("yellow", reportId.slice(0, 8))}`);
+      log2(`Created scan report ${paint9("yellow", reportId.slice(0, 8))}`);
     } catch (err) {
-      logErr(`Failed to create scan report: ${err.message}`);
+      logErr2(`Failed to create scan report: ${err.message}`);
       process.exit(1);
     }
   }
@@ -6112,7 +6526,7 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
   try {
     const current = await api.get(`/api/scans/${reportId}`);
     if (current.status === "cancelled") {
-      log(paint8("yellow", "Scan was cancelled \u2014 aborting."));
+      log2(paint9("yellow", "Scan was cancelled \u2014 aborting."));
       process.exit(0);
     }
   } catch {
@@ -6126,9 +6540,9 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
       apiUrl: config.apiUrl,
       apiKey: config.apiKey,
       runBrowse: runBrowseCommand2,
-      onLog: log,
+      onLog: log2,
       onProgress: (phase, detail) => {
-        log(`${paint8("dim", `[${phase}]`)} ${detail}`);
+        log2(`${paint9("dim", `[${phase}]`)} ${detail}`);
       }
     });
     let wasCancelled = false;
@@ -6140,7 +6554,7 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
     } catch {
     }
     if (wasCancelled) {
-      log(paint8("yellow", "Scan was cancelled by user \u2014 discarding results."));
+      log2(paint9("yellow", "Scan was cancelled by user \u2014 discarding results."));
       process.exit(0);
     }
     await api.patch(`/api/scans/${reportId}`, {
@@ -6151,37 +6565,37 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
       scanDurationMs: result.scanDurationMs,
       routesCrawled: result.routesCrawled
     });
-    logOk(`Scan complete \u2014 ${paint8("cyan", String(result.findings.length))} findings`);
+    logOk2(`Scan complete \u2014 ${paint9("cyan", String(result.findings.length))} findings`);
     console.log("");
-    console.log(`  ${paint8("bold", "Summary:")} ${result.summary}`);
+    console.log(`  ${paint9("bold", "Summary:")} ${result.summary}`);
     console.log("");
     const high = result.findings.filter((f) => f.priority === "high");
     const medium = result.findings.filter((f) => f.priority === "medium");
     const low = result.findings.filter((f) => f.priority === "low");
     if (high.length > 0) {
-      console.log(`  ${paint8("bold", paint8("red", `High Priority (${high.length})`))}`);
+      console.log(`  ${paint9("bold", paint9("red", `High Priority (${high.length})`))}`);
       for (const f of high) {
-        console.log(`    ${paint8("red", "\u25CF")} [${f.type}] ${f.title}`);
-        console.log(`      ${paint8("dim", f.description.slice(0, 120))}`);
+        console.log(`    ${paint9("red", "\u25CF")} [${f.type}] ${f.title}`);
+        console.log(`      ${paint9("dim", f.description.slice(0, 120))}`);
       }
       console.log("");
     }
     if (medium.length > 0) {
-      console.log(`  ${paint8("bold", paint8("yellow", `Medium Priority (${medium.length})`))}`);
+      console.log(`  ${paint9("bold", paint9("yellow", `Medium Priority (${medium.length})`))}`);
       for (const f of medium) {
-        console.log(`    ${paint8("yellow", "\u25CF")} [${f.type}] ${f.title}`);
+        console.log(`    ${paint9("yellow", "\u25CF")} [${f.type}] ${f.title}`);
       }
       console.log("");
     }
     if (low.length > 0) {
-      console.log(`  ${paint8("dim", `Low Priority (${low.length})`)} `);
+      console.log(`  ${paint9("dim", `Low Priority (${low.length})`)} `);
       for (const f of low) {
-        console.log(`    ${paint8("dim", `\u25CB [${f.type}] ${f.title}`)}`);
+        console.log(`    ${paint9("dim", `\u25CB [${f.type}] ${f.title}`)}`);
       }
       console.log("");
     }
   } catch (err) {
-    logErr(`Scan failed: ${err.message}`);
+    logErr2(`Scan failed: ${err.message}`);
     try {
       await api.patch(`/api/scans/${reportId}`, {
         status: "failed",
@@ -6194,7 +6608,7 @@ var scanCommand = new Command23("scan").description("Run a product scan on the c
 });
 
 // cli/commands/doctor.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 import { existsSync as existsSync15 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join11 } from "path";
@@ -6242,7 +6656,7 @@ async function checkProjectLink() {
     optional: true
   };
 }
-var doctorCommand = new Command24("doctor").description("Diagnose Mr. Manager CLI installation and environment").action(async () => {
+var doctorCommand = new Command25("doctor").description("Diagnose Mr. Manager CLI installation and environment").action(async () => {
   const banner = [
     ``,
     paint5("cyan", `  MR DOCTOR`),
@@ -6273,7 +6687,7 @@ var doctorCommand = new Command24("doctor").description("Diagnose Mr. Manager CL
     console.log("");
     return;
   }
-  const fixes = checks.filter((c11) => !c11.ok && c11.fix && !c11.optional);
+  const fixes = checks.filter((c13) => !c13.ok && c13.fix && !c13.optional);
   if (fixes.length > 0) {
     console.log(paint5("yellow", "  To fix:"));
     for (const fix of fixes) {
@@ -6285,14 +6699,14 @@ var doctorCommand = new Command24("doctor").description("Diagnose Mr. Manager CL
 });
 
 // cli/commands/prompt-audit.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 import { resolve as resolve8 } from "path";
 import { existsSync as existsSync16, readFileSync as readFileSync12 } from "fs";
 function auditLine(label, tokens) {
   const bar = "\u2588".repeat(Math.min(60, Math.round(tokens / 200)));
   return `  ${label.padEnd(30)} ${formatTokenCount(tokens).padStart(8)}  ${bar}`;
 }
-var promptAuditCommand = new Command25("prompt-audit").description("Dry-run prompt construction and report estimated token counts by job type").option("--task <id>", "Audit prompts for a specific task ID").option("--all", "Audit all supported job types with representative data", false).option("--json", "Output as JSON instead of plain text", false).action(async (opts) => {
+var promptAuditCommand = new Command26("prompt-audit").description("Dry-run prompt construction and report estimated token counts by job type").option("--task <id>", "Audit prompts for a specific task ID").option("--all", "Audit all supported job types with representative data", false).option("--json", "Output as JSON instead of plain text", false).action(async (opts) => {
   const results = [];
   if (opts.task) {
     try {
@@ -6497,8 +6911,8 @@ ${r.jobType} [${r.identifier}]`);
 });
 
 // cli/commands/skill.ts
-import { Command as Command26 } from "commander";
-var c9 = {
+import { Command as Command27 } from "commander";
+var c10 = {
   reset: "\x1B[0m",
   bold: "\x1B[1m",
   dim: "\x1B[2m",
@@ -6506,7 +6920,7 @@ var c9 = {
   green: "\x1B[32m",
   yellow: "\x1B[33m"
 };
-var skillCommand = new Command26("skill").description("Manage skills \u2014 reusable playbooks for AI agents");
+var skillCommand = new Command27("skill").description("Manage skills \u2014 reusable playbooks for AI agents");
 skillCommand.command("list").alias("ls").description("List all skills").option("--category <category>", "Filter by category").action(async (opts) => {
   const params = new URLSearchParams();
   if (opts.category) params.set("category", opts.category);
@@ -6514,17 +6928,17 @@ skillCommand.command("list").alias("ls").description("List all skills").option("
     `/api/skills${params.toString() ? `?${params}` : ""}`
   );
   if (skills.length === 0) {
-    console.log(`${c9.dim}No skills found.${c9.reset}`);
+    console.log(`${c10.dim}No skills found.${c10.reset}`);
     return;
   }
   for (const skill of skills) {
-    const cat = skill.category ? ` ${c9.dim}[${skill.category}]${c9.reset}` : "";
-    const scope = skill.projectId ? ` ${c9.dim}(project)${c9.reset}` : ` ${c9.dim}(global)${c9.reset}`;
-    console.log(`  ${c9.cyan}${skill.name}${c9.reset}${cat}${scope}`);
+    const cat = skill.category ? ` ${c10.dim}[${skill.category}]${c10.reset}` : "";
+    const scope = skill.projectId ? ` ${c10.dim}(project)${c10.reset}` : ` ${c10.dim}(global)${c10.reset}`;
+    console.log(`  ${c10.cyan}${skill.name}${c10.reset}${cat}${scope}`);
     if (skill.description) {
-      console.log(`    ${c9.dim}${skill.description}${c9.reset}`);
+      console.log(`    ${c10.dim}${skill.description}${c10.reset}`);
     }
-    console.log(`    ${c9.dim}id: ${skill.id}${c9.reset}`);
+    console.log(`    ${c10.dim}id: ${skill.id}${c10.reset}`);
   }
 });
 skillCommand.command("create").description("Create a new skill from a markdown file or inline content").argument("<name>", "Skill name").option("-d, --description <desc>", "Short description").option("-c, --category <cat>", "Category (e.g. Deployment, Testing)").option("-f, --file <path>", "Read content from a markdown file").option("--content <text>", "Inline markdown content").option("-p, --project", "Scope to the linked project").action(async (name, opts) => {
@@ -6560,7 +6974,7 @@ skillCommand.command("create").description("Create a new skill from a markdown f
     projectId
   });
   console.log(
-    `${c9.green}Created skill:${c9.reset} ${c9.bold}${skill.name}${c9.reset} ${c9.dim}(${skill.id})${c9.reset}`
+    `${c10.green}Created skill:${c10.reset} ${c10.bold}${skill.name}${c10.reset} ${c10.dim}(${skill.id})${c10.reset}`
   );
 });
 skillCommand.command("generate").alias("gen").description("Generate a new skill using AI from a text prompt").argument("<prompt>", "Describe the skill to generate").option("-p, --project", "Scope to the linked project").action(async (prompt2, opts) => {
@@ -6574,40 +6988,158 @@ skillCommand.command("generate").alias("gen").description("Generate a new skill
       process.exit(1);
     }
   }
-  console.log(`${c9.dim}Generating skill...${c9.reset}`);
+  console.log(`${c10.dim}Generating skill...${c10.reset}`);
   try {
     const skill = await api.post("/api/skills/generate", {
       prompt: prompt2,
       projectId
     });
     console.log(
-      `${c9.green}Generated skill:${c9.reset} ${c9.bold}${skill.name}${c9.reset}`
+      `${c10.green}Generated skill:${c10.reset} ${c10.bold}${skill.name}${c10.reset}`
     );
     if (skill.description) {
-      console.log(`  ${c9.dim}${skill.description}${c9.reset}`);
+      console.log(`  ${c10.dim}${skill.description}${c10.reset}`);
     }
     if (skill.category) {
-      console.log(`  ${c9.dim}Category: ${skill.category}${c9.reset}`);
+      console.log(`  ${c10.dim}Category: ${skill.category}${c10.reset}`);
     }
-    console.log(`  ${c9.dim}id: ${skill.id}${c9.reset}`);
+    console.log(`  ${c10.dim}id: ${skill.id}${c10.reset}`);
   } catch (err) {
     console.error(`Failed to generate skill: ${err.message}`);
     process.exit(1);
   }
 });
 
+// cli/commands/resource.ts
+import { Command as Command28 } from "commander";
+var c11 = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  magenta: "\x1B[35m"
+};
+var TYPE_COLORS = {
+  plan: c11.cyan,
+  research: c11.magenta,
+  "test-plan": c11.yellow,
+  note: c11.green
+};
+function typeLabel(type) {
+  const color = TYPE_COLORS[type] ?? c11.dim;
+  return `${color}${type}${c11.reset}`;
+}
+var resourceCommand = new Command28("resource").description("Manage resources \u2014 documents, plans, research, and notes");
+resourceCommand.command("list").alias("ls").description("List resources for the linked project (or all)").option("--all", "List all resources across projects").action(async (opts) => {
+  const params = new URLSearchParams();
+  if (opts.all) {
+    params.set("all", "true");
+  } else {
+    const projectId = getLinkedProjectId();
+    if (projectId) params.set("projectId", projectId);
+  }
+  const resources = await api.get(
+    `/api/resources${params.toString() ? `?${params}` : ""}`
+  );
+  if (resources.length === 0) {
+    console.log(`${c11.dim}No resources found.${c11.reset}`);
+    return;
+  }
+  for (const r of resources) {
+    const project = r.projectName ? ` ${c11.dim}[${r.projectName}]${c11.reset}` : "";
+    console.log(`  ${typeLabel(r.type)}  ${c11.bold}${r.title}${c11.reset}${project}`);
+    console.log(`    ${c11.dim}id: ${r.id}${c11.reset}`);
+  }
+});
+resourceCommand.command("create").description("Create a new resource from a file or inline content").argument("<title>", "Resource title").option("-t, --type <type>", "Resource type (note, plan, research, test-plan)", "note").option("-f, --file <path>", "Read content from a file").option("--content <text>", "Inline content").option("--task <taskId>", "Attach to an existing task instead of creating a standalone resource").option("-p, --project", "Scope to the linked project").action(async (title, opts) => {
+  let content = opts.content ?? "";
+  if (opts.file) {
+    const { readFileSync: readFileSync13 } = await import("fs");
+    try {
+      content = readFileSync13(opts.file, "utf-8");
+    } catch (err) {
+      console.error(`Failed to read file: ${err.message}`);
+      process.exit(1);
+    }
+  }
+  if (opts.task) {
+    if (!content.trim()) {
+      console.error("Content is required. Use --file <path> or --content <text>.");
+      process.exit(1);
+    }
+    const resource = await api.post(`/api/tasks/${opts.task}/resources`, {
+      type: opts.type,
+      title,
+      content: content.trim()
+    });
+    console.log(
+      `${c11.green}Created resource:${c11.reset} ${c11.bold}${title}${c11.reset} ${c11.dim}(${resource.id})${c11.reset}`
+    );
+    console.log(`  ${c11.dim}Attached to task ${opts.task}${c11.reset}`);
+    return;
+  }
+  let projectId;
+  if (opts.project) {
+    projectId = getLinkedProjectId() ?? void 0;
+    if (!projectId) {
+      console.error(
+        'No project linked to this directory. Run "mr link <project-id>" first.'
+      );
+      process.exit(1);
+    }
+  }
+  const result = await api.post("/api/resources", {
+    type: opts.type,
+    title,
+    content: content.trim() || " ",
+    projectId
+  });
+  console.log(
+    `${c11.green}Created resource:${c11.reset} ${c11.bold}${title}${c11.reset} ${c11.dim}(${result.resource.id})${c11.reset}`
+  );
+});
+resourceCommand.command("generate").alias("gen").description("Generate a resource using AI from a text prompt").argument("<prompt>", "Describe the resource to generate").option("-t, --type <type>", "Resource type (plan or research)", "research").option("-p, --project", "Scope to the linked project").action(async (prompt2, opts) => {
+  const type = opts.type;
+  if (type !== "plan" && type !== "research") {
+    console.error('Type must be "plan" or "research" for AI generation.');
+    process.exit(1);
+  }
+  let projectId;
+  if (opts.project) {
+    projectId = getLinkedProjectId() ?? void 0;
+    if (!projectId) {
+      console.error(
+        'No project linked to this directory. Run "mr link <project-id>" first.'
+      );
+      process.exit(1);
+    }
+  }
+  console.log(`${c11.dim}Generating ${type}...${c11.reset}`);
+  const result = await api.post("/api/resources", {
+    type,
+    prompt: prompt2,
+    projectId
+  });
+  console.log(
+    `${c11.green}Queued:${c11.reset} ${c11.bold}${result.task.title}${c11.reset}`
+  );
+  console.log(`  ${c11.dim}task: ${result.task.id}${c11.reset}`);
+});
+
 // cli/commands/tests.ts
-import { Command as Command27 } from "commander";
-var c10 = {
+import { Command as Command29 } from "commander";
+var c12 = {
   reset: "\x1B[0m",
   dim: "\x1B[2m",
   yellow: "\x1B[33m"
 };
-var testsCommand = new Command27("tests").description("List MR Test scenarios for the linked project").action(async () => {
+var testsCommand = new Command29("tests").description("List MR Test scenarios for the linked project").action(async () => {
   const projectId = getLinkedProjectId();
   if (!projectId) {
     console.error(
-      `${c10.yellow}No project linked to this directory.${c10.reset} Run "mr link <project-id>" first.`
+      `${c12.yellow}No project linked to this directory.${c12.reset} Run "mr link <project-id>" first.`
     );
     process.exit(1);
   }
@@ -6620,13 +7152,13 @@ var testsCommand = new Command27("tests").description("List MR Test scenarios fo
     process.exit(1);
   }
   if (scenarios.length === 0) {
-    console.log(`${c10.dim}No test scenarios found for this project.${c10.reset}`);
+    console.log(`${c12.dim}No test scenarios found for this project.${c12.reset}`);
     return;
   }
   for (const scenario of scenarios) {
     console.log(`### ${scenario.name}`);
     if (scenario.description) {
-      console.log(`${c10.dim}${scenario.description}${c10.reset}`);
+      console.log(`${c12.dim}${scenario.description}${c12.reset}`);
       console.log();
     }
     console.log(scenario.content);
@@ -6641,7 +7173,7 @@ var userArgs = process.argv.slice(2);
 var bypassCommands = /* @__PURE__ */ new Set(["login", "init", "auth", "help", "--help", "-h", "--version", "-V", "doctor", "setup"]);
 var shouldBypass = userArgs.length > 0 && bypassCommands.has(userArgs[0]);
 if (isFirstRun && !shouldBypass) {
-  const c11 = {
+  const c13 = {
     reset: "\x1B[0m",
     bold: "\x1B[1m",
     dim: "\x1B[2m",
@@ -6651,28 +7183,28 @@ if (isFirstRun && !shouldBypass) {
     magenta: "\x1B[35m"
   };
   console.log("");
-  console.log(`${c11.cyan}  \u2554\u2566\u2557\u2566\u2550\u2557  \u2554\u2566\u2557\u2554\u2550\u2557\u2554\u2557\u2554\u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2550\u2557\u2566\u2550\u2557${c11.reset}`);
-  console.log(`${c11.magenta}  \u2551\u2551\u2551\u2560\u2566\u255D  \u2551\u2551\u2551\u2560\u2550\u2563\u2551\u2551\u2551\u2560\u2550\u2563\u2551 \u2566\u2551\u2563 \u2560\u2566\u255D${c11.reset}`);
-  console.log(`${c11.cyan}  \u2569 \u2569\u2569\u255A\u2550  \u2569 \u2569\u2569 \u2569\u255D\u255A\u255D\u2569 \u2569\u255A\u2550\u255D\u255A\u2550\u255D\u2569\u255A\u2550${c11.reset}`);
-  console.log(`${c11.dim}  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c11.reset}`);
+  console.log(`${c13.cyan}  \u2554\u2566\u2557\u2566\u2550\u2557  \u2554\u2566\u2557\u2554\u2550\u2557\u2554\u2557\u2554\u2554\u2550\u2557\u2554\u2550\u2557\u2554\u2550\u2557\u2566\u2550\u2557${c13.reset}`);
+  console.log(`${c13.magenta}  \u2551\u2551\u2551\u2560\u2566\u255D  \u2551\u2551\u2551\u2560\u2550\u2563\u2551\u2551\u2551\u2560\u2550\u2563\u2551 \u2566\u2551\u2563 \u2560\u2566\u255D${c13.reset}`);
+  console.log(`${c13.cyan}  \u2569 \u2569\u2569\u255A\u2550  \u2569 \u2569\u2569 \u2569\u255D\u255A\u255D\u2569 \u2569\u255A\u2550\u255D\u255A\u2550\u255D\u2569\u255A\u2550${c13.reset}`);
+  console.log(`${c13.dim}  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c13.reset}`);
   console.log("");
-  console.log(`${c11.bold}  Welcome to Mr. Manager!${c11.reset}`);
-  console.log(`${c11.dim}  Let's get you set up in a few quick steps.${c11.reset}`);
+  console.log(`${c13.bold}  Welcome to Mr. Manager!${c13.reset}`);
+  console.log(`${c13.dim}  Let's get you set up in a few quick steps.${c13.reset}`);
   console.log("");
-  console.log(`  ${c11.yellow}Step 1:${c11.reset} Authenticate via Google OAuth`);
-  console.log(`  ${c11.dim}Run:${c11.reset} ${c11.cyan}mr login${c11.reset}`);
+  console.log(`  ${c13.yellow}Step 1:${c13.reset} Authenticate via Google OAuth`);
+  console.log(`  ${c13.dim}Run:${c13.reset} ${c13.cyan}mr login${c13.reset}`);
   console.log("");
-  console.log(`  ${c11.yellow}Step 2:${c11.reset} Verify your environment`);
-  console.log(`  ${c11.dim}Run:${c11.reset} ${c11.cyan}mr setup${c11.reset}`);
+  console.log(`  ${c13.yellow}Step 2:${c13.reset} Verify your environment`);
+  console.log(`  ${c13.dim}Run:${c13.reset} ${c13.cyan}mr setup${c13.reset}`);
   console.log("");
-  console.log(`  ${c11.yellow}Step 3:${c11.reset} Link a repo and start watching`);
-  console.log(`  ${c11.dim}Run:${c11.reset} ${c11.cyan}mr link${c11.reset} ${c11.dim}&&${c11.reset} ${c11.cyan}mr watch${c11.reset}`);
+  console.log(`  ${c13.yellow}Step 3:${c13.reset} Link a repo and start watching`);
+  console.log(`  ${c13.dim}Run:${c13.reset} ${c13.cyan}mr link${c13.reset} ${c13.dim}&&${c13.reset} ${c13.cyan}mr watch${c13.reset}`);
   console.log("");
-  console.log(`${c11.dim}  Or run ${c11.reset}${c11.cyan}mr login${c11.reset}${c11.dim} to get started now.${c11.reset}`);
+  console.log(`${c13.dim}  Or run ${c13.reset}${c13.cyan}mr login${c13.reset}${c13.dim} to get started now.${c13.reset}`);
   console.log("");
   process.exit(0);
 }
-var program = new Command28();
+var program = new Command30();
 program.name("mr").description("Mr. Manager - Task and project management CLI").version(CLI_VERSION);
 program.addCommand(initCommand);
 program.addCommand(authCommand);
@@ -6699,9 +7231,11 @@ program.addCommand(setPathCommand);
 program.addCommand(testCommand);
 program.addCommand(featuresCommand);
 program.addCommand(noMrCommand);
+program.addCommand(reviewCommand);
 program.addCommand(scanCommand);
 program.addCommand(doctorCommand);
 program.addCommand(promptAuditCommand);
 program.addCommand(skillCommand);
+program.addCommand(resourceCommand);
 program.addCommand(testsCommand);
 program.parse();