@humanbased/crosscheck 0.14.0

package/dist/lib/workflow.d.ts

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+export declare const WorkflowStepSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodType<"review" | "fix" | "recheck" | "conflict-resolve">;
+    reviewer: z.ZodDefault<z.ZodEnum<["auto", "claude", "codex", "origin"]>>;
+    when: z.ZodOptional<z.ZodString>;
+    max_rounds: z.ZodDefault<z.ZodNumber>;
+    instructions: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "review" | "fix" | "recheck" | "conflict-resolve";
+    name: string;
+    reviewer: "claude" | "codex" | "auto" | "origin";
+    max_rounds: number;
+    when?: string | undefined;
+    instructions?: string | undefined;
+}, {
+    type: "review" | "fix" | "recheck" | "conflict-resolve";
+    name: string;
+    reviewer?: "claude" | "codex" | "auto" | "origin" | undefined;
+    when?: string | undefined;
+    max_rounds?: number | undefined;
+    instructions?: string | undefined;
+}>;
+export declare const WorkflowSchema: z.ZodObject<{
+    on: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    steps: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodType<"review" | "fix" | "recheck" | "conflict-resolve">;
+        reviewer: z.ZodDefault<z.ZodEnum<["auto", "claude", "codex", "origin"]>>;
+        when: z.ZodOptional<z.ZodString>;
+        max_rounds: z.ZodDefault<z.ZodNumber>;
+        instructions: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "review" | "fix" | "recheck" | "conflict-resolve";
+        name: string;
+        reviewer: "claude" | "codex" | "auto" | "origin";
+        max_rounds: number;
+        when?: string | undefined;
+        instructions?: string | undefined;
+    }, {
+        type: "review" | "fix" | "recheck" | "conflict-resolve";
+        name: string;
+        reviewer?: "claude" | "codex" | "auto" | "origin" | undefined;
+        when?: string | undefined;
+        max_rounds?: number | undefined;
+        instructions?: string | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    on: string[];
+    steps: {
+        type: "review" | "fix" | "recheck" | "conflict-resolve";
+        name: string;
+        reviewer: "claude" | "codex" | "auto" | "origin";
+        max_rounds: number;
+        when?: string | undefined;
+        instructions?: string | undefined;
+    }[];
+}, {
+    steps: {
+        type: "review" | "fix" | "recheck" | "conflict-resolve";
+        name: string;
+        reviewer?: "claude" | "codex" | "auto" | "origin" | undefined;
+        when?: string | undefined;
+        max_rounds?: number | undefined;
+        instructions?: string | undefined;
+    }[];
+    on?: string[] | undefined;
+}>;
+export type WorkflowStep = z.infer<typeof WorkflowStepSchema>;
+export declare const DEFAULT_REVIEW_INSTRUCTIONS: string;
+export declare const DEFAULT_FIX_INSTRUCTIONS: string;
+export declare const DEFAULT_RECHECK_INSTRUCTIONS: string;
+export declare const DEFAULT_CONFLICT_RESOLVE_INSTRUCTIONS: string;
+export declare const DEFAULT_WORKFLOW: WorkflowStep[];
+export declare function loadWorkflow(operatorDir?: string): WorkflowStep[];
+export interface StepResult {
+    verdict?: string | null;
+    commentBody?: string;
+    commentUrl?: string;
+    commentId?: number;
+    applied_count?: number;
+    skipped?: boolean;
+}
+export declare function evaluateWhen(expr: string, results: Record<string, StepResult>): boolean;
+//# sourceMappingURL=workflow.d.ts.map

package/dist/lib/workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/lib/workflow.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,kBAAkB;;UAG4F,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,kBAAkB,CAAC;;;;;;;;;;;;;;;;;;;EAKrL,CAAA;AAEF,eAAO,MAAM,cAAc;;;;cAPgG,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,kBAAkB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUrL,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAE7D,eAAO,MAAM,2BAA2B,QAiB5B,CAAA;AAEZ,eAAO,MAAM,wBAAwB,QAIzB,CAAA;AAEZ,eAAO,MAAM,4BAA4B,QAK7B,CAAA;AAEZ,eAAO,MAAM,qCAAqC,QAKtC,CAAA;AAIZ,eAAO,MAAM,gBAAgB,EAAE,YAAY,EAgB1C,CAAA;AAED,wBAAgB,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,CAkBjE;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAoBvF"}

package/dist/lib/workflow.js

@@ -0,0 +1,116 @@
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import yaml from 'js-yaml';
+import { z } from 'zod';
+export const WorkflowStepSchema = z.object({
+    name: z.string(),
+    // 'address' is the legacy name — normalized to 'fix' at parse time for backward compat
+    type: z.enum(['review', 'fix', 'recheck', 'address', 'conflict-resolve']).transform(t => t === 'address' ? 'fix' : t),
+    reviewer: z.enum(['auto', 'claude', 'codex', 'origin']).default('auto'),
+    when: z.string().optional(),
+    max_rounds: z.number().int().positive().default(1),
+    instructions: z.string().optional(),
+});
+export const WorkflowSchema = z.object({
+    on: z.array(z.string()).default(['opened', 'synchronize']),
+    steps: z.array(WorkflowStepSchema),
+});
+export const DEFAULT_REVIEW_INSTRUCTIONS = [
+    '## Constraints',
+    '- Do not run tsc, ts-node, or build commands — inspect source files directly with git diff/log.',
+    '- Do not install packages or modify lock files.',
+    '## Output format',
+    'Structure your output as: ## Summary, ## Critical Issues, ## Warnings, ## Suggestions.',
+    'Be concise. Skip praise.',
+    '## Verdict (required — machine-parsed)',
+    'The very last line of your response MUST be exactly one of these three lines.',
+    'Do not add bold, italics, punctuation, headers, or any other text after it:',
+    'VERDICT: APPROVE',
+    'VERDICT: NEEDS WORK',
+    'VERDICT: BLOCK',
+    '',
+    'Use APPROVE for no issues or trivial nits only.',
+    'Use NEEDS WORK for addressable issues that are not blocking.',
+    'Use BLOCK for security risks, data loss, broken API contracts, or correctness bugs.',
+].join('\n');
+export const DEFAULT_FIX_INSTRUCTIONS = [
+    'Only fix issues explicitly called out in the review.',
+    'Do not refactor unrelated code, rename variables, or add tests unless specifically requested.',
+    'If a comment requires deeper understanding of business logic, skip it.',
+].join('\n');
+export const DEFAULT_RECHECK_INSTRUCTIONS = [
+    'Check that every issue flagged in the original review has been addressed.',
+    'If all issues are resolved, output VERDICT: APPROVE.',
+    'If issues remain, repeat the original verdict (NEEDS WORK or BLOCK) and list what is still outstanding.',
+    'Do not flag new issues — focus only on resolution of the originals.',
+].join('\n');
+export const DEFAULT_CONFLICT_RESOLVE_INSTRUCTIONS = [
+    'Resolve all merge conflict markers (<<<<<<< HEAD, =======, >>>>>>> branch).',
+    'Keep meaningful changes from both sides when they do not contradict.',
+    'When both sides modify the same line, prefer the incoming branch changes unless they break existing logic.',
+    'Do not change any code outside of conflict regions.',
+].join('\n');
+// Default pipeline: review → fix issues (fix skipped when verdict is APPROVE).
+// Execution always goes through this constant — there is no legacy direct-call path.
+export const DEFAULT_WORKFLOW = [
+    {
+        name: 'review',
+        type: 'review',
+        reviewer: 'auto',
+        max_rounds: 1,
+        instructions: DEFAULT_REVIEW_INSTRUCTIONS,
+    },
+    {
+        name: 'fix',
+        type: 'fix',
+        reviewer: 'origin',
+        when: "review.verdict != 'APPROVE'",
+        max_rounds: 1,
+        instructions: DEFAULT_FIX_INSTRUCTIONS,
+    },
+];
+export function loadWorkflow(operatorDir) {
+    // Only look in operator-controlled directories — never inside the PR checkout.
+    // Loading workflow config from untrusted PR code would let a PR hijack the runner.
+    // Priority: project-local → global user config → DEFAULT_WORKFLOW.
+    const candidates = [
+        ...(operatorDir ? [join(operatorDir, '.crosscheck', 'workflow.yml')] : []),
+        join(homedir(), '.crosscheck', 'workflow.yml'),
+    ];
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        try {
+            const raw = yaml.load(readFileSync(path, 'utf8'));
+            return WorkflowSchema.parse(raw).steps;
+        }
+        catch {
+            // Malformed workflow file — fall through to default
+        }
+    }
+    return DEFAULT_WORKFLOW;
+}
+// Evaluates simple "stepName.field op 'value'" expressions.
+// Unparseable expressions default to true (run the step).
+export function evaluateWhen(expr, results) {
+    const m = expr.trim().match(/^(\w+)\.(\w+)\s*(==|!=|>=|<=|>|<)\s*(?:'([^']*)'|(null|-?\d+(?:\.\d+)?))$/);
+    if (!m)
+        return true;
+    const [, stepName, field, op, strVal, rawVal] = m;
+    const result = results[stepName];
+    if (!result)
+        return true;
+    const actual = result[field];
+    const expected = strVal !== undefined ? strVal : rawVal === 'null' ? null : Number(rawVal);
+    switch (op) {
+        case '==': return actual === expected;
+        case '!=': return actual !== expected;
+        case '>': return Number(actual) > Number(expected);
+        case '<': return Number(actual) < Number(expected);
+        case '>=': return Number(actual) >= Number(expected);
+        case '<=': return Number(actual) <= Number(expected);
+        default: return true;
+    }
+}
+//# sourceMappingURL=workflow.js.map

package/dist/lib/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../src/lib/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,IAAI,MAAM,SAAS,CAAA;AAC1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,uFAAuF;IACvF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAiE;IACrL,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACnC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,gBAAgB;IAChB,iGAAiG;IACjG,iDAAiD;IACjD,kBAAkB;IAClB,wFAAwF;IACxF,0BAA0B;IAC1B,wCAAwC;IACxC,+EAA+E;IAC/E,6EAA6E;IAC7E,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,EAAE;IACF,iDAAiD;IACjD,8DAA8D;IAC9D,qFAAqF;CACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sDAAsD;IACtD,+FAA+F;IAC/F,wEAAwE;CACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,2EAA2E;IAC3E,sDAAsD;IACtD,yGAAyG;IACzG,qEAAqE;CACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,6EAA6E;IAC7E,sEAAsE;IACtE,4GAA4G;IAC5G,qDAAqD;CACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,+EAA+E;AAC/E,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,2BAA2B;KAC1C;IACD;QACE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,wBAAwB;KACvC;CACF,CAAA;AAED,MAAM,UAAU,YAAY,CAAC,WAAoB;IAC/C,+EAA+E;IAC/E,mFAAmF;IACnF,mEAAmE;IACnE,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,CAAC;KAC/C,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;YACjD,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAA;AACzB,CAAC;AAWD,4DAA4D;AAC5D,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAmC;IAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAA;IACxG,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAyB,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAE1F,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAA;QACrC,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAA;QACrC,KAAK,GAAG,CAAC,CAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnD,KAAK,GAAG,CAAC,CAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnD,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpD,KAAK,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpD,OAAO,CAAC,CAAG,OAAO,IAAI,CAAA;IACxB,CAAC;AACH,CAAC"}

package/dist/reviewers/address.d.ts

@@ -0,0 +1,5 @@
+import type { Config } from '../config/schema.js';
+export declare function runAddressStep(tmpDir: string, baseRef: string, prTitle: string, reviewComment: string, instructions: string, config: Config): Promise<{
+    appliedCount: number;
+}>;
+//# sourceMappingURL=address.d.ts.map

package/dist/reviewers/address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../../src/reviewers/address.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAgCjD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDnC"}

package/dist/reviewers/address.js

@@ -0,0 +1,87 @@
+import { execSync, execFileSync } from 'child_process';
+import { writeFileSync } from 'fs';
+import { join } from 'path';
+const PROMPT_TEMPLATE = `You opened a pull request that received the following code review.
+
+PR title: {PR_TITLE}
+
+Code review comment:
+---
+{REVIEW_COMMENT}
+---
+
+Diff of your changes (base..head):
+---
+{DIFF}
+---
+
+{EXTRA_INSTRUCTIONS}
+
+Please address the issues raised in the review. Rules:
+- Only fix what the review explicitly calls out
+- Do not refactor unrelated code, rename variables, or add tests unless asked
+- If a comment requires deeper understanding of business logic, skip it
+- If the review has no actionable code changes, output exactly: NO_CHANGES
+
+For each file you need to change, output the complete new file content using this format:
+
+<file path="relative/path/to/file.ext">
+[complete file content]
+</file>
+
+Output ONLY <file> blocks or NO_CHANGES. No other text.`;
+export async function runAddressStep(tmpDir, baseRef, prTitle, reviewComment, instructions, config) {
+    let diff = '';
+    try {
+        diff = execSync(`git diff ${baseRef}...HEAD`, { cwd: tmpDir, encoding: 'utf8' });
+    }
+    catch {
+        try {
+            diff = execSync('git diff HEAD~1', { cwd: tmpDir, encoding: 'utf8' });
+        }
+        catch { /* proceed with empty diff */ }
+    }
+    const prompt = PROMPT_TEMPLATE
+        .replace('{PR_TITLE}', prTitle)
+        .replace('{REVIEW_COMMENT}', reviewComment.slice(0, 8000))
+        .replace('{DIFF}', diff.slice(0, 16000))
+        .replace('{EXTRA_INSTRUCTIONS}', instructions ? `Additional instructions: ${instructions}` : '');
+    let output = '';
+    try {
+        // Pass prompt via stdin — same pattern as optimize.ts
+        output = execFileSync('claude', ['--print', '--output-format', 'text'], {
+            input: prompt,
+            encoding: 'utf8',
+            timeout: 180_000,
+            env: { ...process.env },
+            maxBuffer: 10 * 1024 * 1024,
+        }).trim();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/not logged in|auth|credential/i.test(msg)) {
+            throw new Error('claude auth failure during address step — run: claude auth login');
+        }
+        throw err;
+    }
+    if (!output || output === 'NO_CHANGES')
+        return { appliedCount: 0 };
+    // Parse <file path="...">content</file> blocks
+    const fileRegex = /<file path="([^"]+)">([\s\S]*?)<\/file>/g;
+    let match;
+    let appliedCount = 0;
+    while ((match = fileRegex.exec(output)) !== null) {
+        const [, filePath, rawContent] = match;
+        // Reject paths that escape the repo (e.g. ../../etc/passwd)
+        if (filePath.includes('..') || filePath.startsWith('/'))
+            continue;
+        const absPath = join(tmpDir, filePath);
+        try {
+            writeFileSync(absPath, rawContent.replace(/^\n/, ''));
+            appliedCount++;
+        }
+        catch { /* skip unwritable paths */ }
+    }
+    return { appliedCount };
+}
+//# sourceMappingURL=address.js.map

package/dist/reviewers/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/reviewers/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA4BgC,CAAA;AAExD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,OAAe,EACf,OAAe,EACf,aAAqB,EACrB,YAAoB,EACpB,MAAc;IAEd,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,YAAY,OAAO,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,eAAe;SAC3B,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;SAC9B,OAAO,CAAC,kBAAkB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SACzD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAElG,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,sDAAsD;QACtD,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE;YACtE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;YAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC,IAAI,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;IAElE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,0CAA0C,CAAA;IAC5D,IAAI,KAA6B,CAAA;IACjC,IAAI,YAAY,GAAG,CAAC,CAAA;IAEpB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,KAAK,CAAA;QACtC,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YACrD,YAAY,EAAE,CAAA;QAChB,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAA;AACzB,CAAC"}

package/dist/reviewers/claude.d.ts

@@ -0,0 +1,12 @@
+import type { QualityConfig, VendorConfig } from '../config/schema.js';
+export interface ReviewResult {
+    review: string;
+    tokensUsed?: number;
+    model: string;
+}
+export declare function runClaudeReview(repoDir: string, baseBranch: string, prTitle: string, quality: QualityConfig, vendor: VendorConfig, perReviewBudget: number, stepInstructions?: string, onLog?: (msg: string) => void): Promise<ReviewResult>;
+export declare function checkClaudeAuth(): Promise<{
+    ok: boolean;
+    detail: string;
+}>;
+//# sourceMappingURL=claude.d.ts.map

package/dist/reviewers/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/reviewers/claude.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAWtE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAUD,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,YAAY,EACpB,eAAe,EAAE,MAAM,EACvB,gBAAgB,CAAC,EAAE,MAAM,EACzB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC5B,OAAO,CAAC,YAAY,CAAC,CA4DvB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQhF"}

package/dist/reviewers/claude.js

@@ -0,0 +1,78 @@
+import { execa } from 'execa';
+import { DEFAULT_REVIEW_INSTRUCTIONS } from '../lib/workflow.js';
+import { resolveClaudeModel } from '../lib/review-models.js';
+const EFFORT_MAP = {
+    low: 'low',
+    medium: 'medium',
+    high: 'high',
+    max: 'max',
+};
+export async function runClaudeReview(repoDir, baseBranch, prTitle, quality, vendor, perReviewBudget, stepInstructions, onLog) {
+    const model = resolveClaudeModel(quality);
+    const effort = EFFORT_MAP[vendor.effort] ?? 'medium';
+    const focusLine = quality.focus.length > 0
+        ? `Focus areas: ${quality.focus.join(', ')}.`
+        : '';
+    const customLine = quality.custom_prompt ?? '';
+    const behaviorInstructions = stepInstructions ?? DEFAULT_REVIEW_INSTRUCTIONS;
+    const prompt = [
+        `You are reviewing a pull request titled: "${prTitle}".`,
+        `The branch \`${baseBranch}\` is the base. Review only the changes introduced in this PR.`,
+        focusLine,
+        customLine,
+        behaviorInstructions,
+    ].filter(Boolean).join('\n');
+    const args = [
+        '--print',
+        '--output-format', 'json',
+        '--model', model,
+        '--effort', effort,
+        '--max-budget-usd', String(perReviewBudget),
+        '--allowedTools', 'Bash(git diff),Bash(git log)',
+    ];
+    onLog?.(`  running: claude --print --model ${model} --effort ${effort}`);
+    try {
+        const { stdout } = await execa('claude', args, {
+            cwd: repoDir,
+            timeout: 180_000,
+            input: prompt,
+            env: { ...process.env },
+        });
+        const raw = stdout.trim();
+        try {
+            const parsed = JSON.parse(raw);
+            const review = typeof parsed.result === 'string' ? parsed.result.trim() : raw;
+            const inTok = parsed.usage?.input_tokens;
+            const outTok = parsed.usage?.output_tokens;
+            const tokensUsed = typeof inTok === 'number' && typeof outTok === 'number'
+                ? inTok + outTok
+                : undefined;
+            return { review, tokensUsed, model };
+        }
+        catch {
+            return { review: raw, model };
+        }
+    }
+    catch (err) {
+        const execa = err;
+        const rawStderr = execa.stderr?.trim() ?? '';
+        const summary = (rawStderr.split('\n').filter(Boolean).at(-1)) ?? execa.message ?? 'unknown error';
+        const thrown = Object.assign(new Error(`claude: ${summary}`), {
+            exitCode: execa.exitCode,
+            timedOut: execa.timedOut,
+            stderr: rawStderr,
+        });
+        throw thrown;
+    }
+}
+export async function checkClaudeAuth() {
+    try {
+        const { stdout } = await execa('claude', ['--version'], { timeout: 10_000 });
+        return { ok: true, detail: stdout.trim() };
+    }
+    catch (err) {
+        const error = err;
+        return { ok: false, detail: error.stderr ?? error.message ?? 'not found' };
+    }
+}
+//# sourceMappingURL=claude.js.map

package/dist/reviewers/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/reviewers/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAE7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,UAAU,GAA2B;IACzC,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAA;AAgBD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,MAAoB,EACpB,eAAuB,EACvB,gBAAyB,EACzB,KAA6B;IAE7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAA;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC7C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAE9C,MAAM,oBAAoB,GAAG,gBAAgB,IAAI,2BAA2B,CAAA;IAE5E,MAAM,MAAM,GAAG;QACb,6CAA6C,OAAO,IAAI;QACxD,gBAAgB,UAAU,gEAAgE;QAC1F,SAAS;QACT,UAAU;QACV,oBAAoB;KACrB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAE5B,MAAM,IAAI,GAAG;QACX,SAAS;QACT,iBAAiB,EAAE,MAAM;QACzB,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,MAAM;QAClB,kBAAkB,EAAE,MAAM,CAAC,eAAe,CAAC;QAC3C,gBAAgB,EAAE,8BAA8B;KACjD,CAAA;IAED,KAAK,EAAE,CAAC,qCAAqC,KAAK,aAAa,MAAM,EAAE,CAAC,CAAA;IAExE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC7C,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;YACb,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;SACxB,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAqB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAChD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;YAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAA;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAA;YAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;gBACxE,CAAC,CAAC,KAAK,GAAG,MAAM;gBAChB,CAAC,CAAC,SAAS,CAAA;YACb,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAoG,CAAA;QAClH,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC5C,MAAM,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,eAAe,CAAA;QAClG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE;YAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,WAAW,EAAE,CAAA;IAC5E,CAAC;AACH,CAAC"}

package/dist/reviewers/codex.d.ts

@@ -0,0 +1,9 @@
+import type { QualityConfig, CodexVendorConfig } from '../config/schema.js';
+import type { ReviewResult } from './claude.js';
+export declare function inferVerdictFromCodexOutput(text: string): string;
+export declare function runCodexReview(repoDir: string, baseBranch: string, prTitle: string, quality: QualityConfig, vendor: CodexVendorConfig, stepInstructions?: string, onLog?: (msg: string) => void): Promise<ReviewResult>;
+export declare function checkCodexAuth(): Promise<{
+    ok: boolean;
+    detail: string;
+}>;
+//# sourceMappingURL=codex.d.ts.map

package/dist/reviewers/codex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../src/reviewers/codex.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAG3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAK/C,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIhE;AAuBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,EACzB,gBAAgB,CAAC,EAAE,MAAM,EACzB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC5B,OAAO,CAAC,YAAY,CAAC,CAyEvB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ/E"}

package/dist/reviewers/codex.js

@@ -0,0 +1,121 @@
+import { execa } from 'execa';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { DEFAULT_REVIEW_INSTRUCTIONS } from '../lib/workflow.js';
+import { resolveCodexModel } from '../lib/review-models.js';
+// Codex review command outputs [P0]/[P1]/[P2]/[P3] priority markers but never a VERDICT line.
+// Infer the verdict from the highest severity present and append it so parseVerdict() can
+// extract it. Only called when the output doesn't already contain a VERDICT: token.
+export function inferVerdictFromCodexOutput(text) {
+    if (/\[P0\]/i.test(text) || /\[P1\]/i.test(text))
+        return 'BLOCK';
+    if (/\[P2\]/i.test(text) || /\[P3\]/i.test(text))
+        return 'NEEDS WORK';
+    return 'APPROVE';
+}
+// Scans stderr bottom-up for the first fatal/error line, skipping Codex header boilerplate.
+function extractErrorSummary(stderr) {
+    const lines = stderr.split('\n').map(l => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const l = lines[i];
+        if (/^(fatal|error):/i.test(l))
+            return l;
+    }
+    // Fall back to last non-boilerplate line
+    return lines.filter(l => !l.startsWith('---') &&
+        !/^(workdir|model|provider|approval|sandbox|reasoning|session\s+id):/i.test(l) &&
+        !/^OpenAI Codex/i.test(l)).at(-1);
+}
+const TIER_TIMEOUT_MS = {
+    fast: 300_000,
+    balanced: 600_000,
+    thorough: 1_200_000,
+};
+export async function runCodexReview(repoDir, baseBranch, prTitle, quality, vendor, stepInstructions, onLog) {
+    const model = resolveCodexModel(quality, vendor);
+    const tmpFile = join(mkdtempSync(join(tmpdir(), 'crosscheck-')), 'review.md');
+    // --base and [PROMPT] are mutually exclusive in codex review;
+    // inject focus instructions via a .codex/instructions file instead
+    const focusNote = quality.focus.length > 0
+        ? `Focus areas: ${quality.focus.join(', ')}. `
+        : '';
+    const customNote = quality.custom_prompt ?? '';
+    const behaviorInstructions = stepInstructions ?? DEFAULT_REVIEW_INSTRUCTIONS;
+    const instructionsNote = [focusNote, customNote, behaviorInstructions].filter(Boolean).join('\n\n');
+    const instructionsPath = `${repoDir}/.codex/instructions`;
+    // Save original content so we can restore it after the review — prevents the
+    // fix step's git add -A from committing crosscheck's instructions as a PR change.
+    let originalInstructions;
+    try {
+        originalInstructions = readFileSync(instructionsPath, 'utf8');
+    }
+    catch { /* didn't exist */ }
+    mkdirSync(`${repoDir}/.codex`, { recursive: true });
+    writeFileSync(instructionsPath, instructionsNote);
+    try {
+        const modelArgs = model !== 'default' ? ['-c', `model="${model}"`] : [];
+        onLog?.(`  running: codex review --base ${baseBranch}${model !== 'default' ? ` -c model="${model}"` : ''}`);
+        const timeoutMs = TIER_TIMEOUT_MS[quality.tier] ?? 600_000;
+        const result = await execa('codex', ['review', '--base', baseBranch, '--title', prTitle, ...modelArgs], {
+            cwd: repoDir,
+            timeout: timeoutMs,
+            env: {
+                ...process.env,
+                // Make local dev tools (tsc, jest, etc.) findable if node_modules exists
+                PATH: `${repoDir}/node_modules/.bin:${process.env.PATH ?? ''}`,
+            },
+        });
+        const rawReview = result.stdout.trim() || result.stderr.trim();
+        const tokensMatch = (result.stderr ?? '').match(/\btokens?:\s*([\d,]+)/i);
+        const tokensUsed = tokensMatch ? parseInt(tokensMatch[1].replace(/,/g, ''), 10) : undefined;
+        // Append inferred VERDICT when Codex didn't include one (its review command
+        // uses [P1]/[P2]/[P3] markers but never emits a VERDICT: line on its own).
+        const review = rawReview.includes('VERDICT:')
+            ? rawReview
+            : `${rawReview}\n\nVERDICT: ${inferVerdictFromCodexOutput(rawReview)}`;
+        return { review, tokensUsed, model };
+    }
+    catch (err) {
+        const execa = err;
+        const rawStderr = execa.stderr ?? '';
+        const timeoutSec = (TIER_TIMEOUT_MS[quality.tier] ?? 600_000) / 1000;
+        const summary = execa.timedOut
+            ? `timed out after ${timeoutSec}s — PR diff may be too large (tier: ${quality.tier})`
+            : (extractErrorSummary(rawStderr) ?? execa.message ?? 'unknown error');
+        const thrown = Object.assign(new Error(`codex: ${summary}`), {
+            exitCode: execa.exitCode,
+            timedOut: execa.timedOut,
+            stderr: rawStderr,
+        });
+        throw thrown;
+    }
+    finally {
+        // Restore .codex/instructions to its pre-review state so the fix step's
+        // git add -A doesn't commit crosscheck's instructions as a PR file change.
+        try {
+            if (originalInstructions !== undefined) {
+                writeFileSync(instructionsPath, originalInstructions);
+            }
+            else {
+                rmSync(instructionsPath, { force: true });
+            }
+        }
+        catch { /* ignore */ }
+        try {
+            rmSync(tmpFile, { force: true, recursive: true });
+        }
+        catch { /* ignore */ }
+    }
+}
+export async function checkCodexAuth() {
+    try {
+        const { stdout } = await execa('codex', ['login', 'status'], { timeout: 10_000 });
+        return { ok: true, detail: stdout.trim() };
+    }
+    catch (err) {
+        const error = err;
+        return { ok: false, detail: error.stderr ?? error.message ?? 'not authenticated' };
+    }
+}
+//# sourceMappingURL=codex.js.map

package/dist/reviewers/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/reviewers/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAG3D,8FAA8F;AAC9F,0FAA0F;AAC1F,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAA;IAChE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAA;IACrE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,yCAAyC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACpB,CAAC,qEAAqE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACV,CAAC;AAED,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,SAAS;CACpB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,MAAyB,EACzB,gBAAyB,EACzB,KAA6B;IAE7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAE7E,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,MAAM,oBAAoB,GAAG,gBAAgB,IAAI,2BAA2B,CAAA;IAC5E,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnG,MAAM,gBAAgB,GAAG,GAAG,OAAO,sBAAsB,CAAA;IACzD,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,oBAAwC,CAAA;IAC5C,IAAI,CAAC;QAAC,oBAAoB,GAAG,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAClG,SAAS,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACvE,KAAK,EAAE,CAAC,kCAAkC,UAAU,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAE3G,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,OAAO,EACP,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,EAClE;YACE,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,yEAAyE;gBACzE,IAAI,EAAE,GAAG,OAAO,sBAAsB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;aAC/D;SACF,CACF,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC9D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACzE,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,GAAG,SAAS,gBAAgB,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAA;QACxE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACtC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAoG,CAAA;QAClH,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAA;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;YAC5B,CAAC,CAAC,mBAAmB,UAAU,uCAAuC,OAAO,CAAC,IAAI,GAAG;YACrF,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,EAAE;YAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,CAAA;IACd,CAAC;YAAS,CAAC;QACT,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,CAAC;YACH,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,aAAa,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,mBAAmB,EAAE,CAAA;IACpF,CAAC;AACH,CAAC"}

package/dist/reviewers/conflict-resolve.d.ts

@@ -0,0 +1,15 @@
+export declare const PROMPT_TEMPLATE = "This pull request has merge conflicts. Resolve all conflict markers in the files listed below.\n\nPR title: {PR_TITLE}\n\nConflicted files:\n{CONFLICTED_FILES}\n\n{EXTRA_INSTRUCTIONS}\n\nContext: the PR's branch is checked out as HEAD, and the base branch was merged into it. That means the `<<<<<<< HEAD` side is the PR author's intended changes and the `>>>>>>>` side is the base branch. Default to preserving the PR author's intent.\n\nRules for resolving each conflict:\n- Keep ALL meaningful changes from both sides if they are not directly contradictory\n- When both sides modify the same line, prefer the PR author's changes (the `<<<<<<< HEAD` side) over the base branch (the `>>>>>>>` side), unless the PR side clearly breaks existing logic on the base\n- Remove ALL conflict markers: <<<<<<<, =======, >>>>>>>\n\nFor each file, output ONLY the resolved conflict regions using this format:\n\n<edit path=\"relative/path/to/file.ext\">\n<old>\nexact conflict region including all markers (copy verbatim from the file)\n</old>\n<new>\nresolved content with no conflict markers\n</new>\n</edit>\n\nRules for <edit> blocks:\n- <old> must match the file content EXACTLY, including conflict markers and surrounding lines\n- <new> must not contain ANY conflict markers\n- Include 2\u20133 context lines around the conflict region to make the match unambiguous\n- One block per conflict region; multiple blocks per file are fine\n- Output ONLY <edit> blocks. No other text.";
+export declare function findConflictedFiles(tmpDir: string): string[];
+export declare function extractConflictWindows(content: string): string;
+export declare function runConflictResolveStep(tmpDir: string, prTitle: string, instructions: string, model?: string): Promise<{
+    appliedCount: number;
+    resolvedPaths: string[];
+    tokensUsed?: number;
+}>;
+export interface ResolverEdit {
+    filePath: string;
+    oldText: string;
+    newText: string;
+}
+export declare function parseResolverEdits(output: string, conflictedFiles: string[]): ResolverEdit[];
+//# sourceMappingURL=conflict-resolve.d.ts.map

package/dist/reviewers/conflict-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conflict-resolve.d.ts","sourceRoot":"","sources":["../../src/reviewers/conflict-resolve.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,eAAe,u8CAgCgB,CAAA;AAG5C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5D;AAQD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuC9D;AAkBD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,KAAK,SAAY,GAChB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEjF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAOD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAqB5F"}