@kylecheng3146/agent-ops 0.1.6 → 0.1.8

package/README.md

@@ -261,6 +261,33 @@ For a full command reference, run `agent-ops --help`. The `task`, `verify`, and
 `review` commands support acceptance tracking and independent verification when
 the project configuration defines those workflows.
 
+### External review
+
+`agent-ops review` can hand the review to another agent CLI, so the work is not
+judged by the agent that produced it. Enable it during `agent-ops init` (the
+default is off). Reviews require an attached task, current required
+verification evidence, and a deterministic worktree (or `--base`) scope. The
+native-schema detailed report is displayed but not persisted.
+
+Each attempt uses a fresh temporary cwd, a small allowlisted environment, and a
+target-native read-only/context-isolation mode. Currently only Claude safe mode
+meets the full isolation contract; configured Codex and Agy entries return
+`capability-unavailable` rather than run with a weaker boundary. `opencode` is
+not a review target.
+
+The first target that actually runs produces the verdict. A `FAIL` is final:
+the chain never retries elsewhere after a real verdict. `--yes` is still
+required for every run, since each run spends another provider's quota.
+
+Authentication is diagnosed, never guessed:
+
+```bash
+agent-ops doctor              # presence only: no tokens, no network
+agent-ops doctor --check-auth # one real print call per configured target
+```
+
+See [Configuration](docs/en/guides/configuration.md) for the full contract.
+
 ## Project principles
 
 - Define verifiable success before making changes.

package/dist/packages/cli/src/args.js

@@ -13,6 +13,8 @@ export const COMMAND_NAMES = [
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
 const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
+// opencode is absent: it has no read-only flag, so it cannot review.
+const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
 export class CliArgumentError extends Error {
     code;
     option;
@@ -64,9 +66,12 @@ export function parseArgs(argv) {
     let targetVersion;
     let title;
     let sessionId;
+    let base;
     const profiles = [];
+    const reviewTargets = [];
     const criteria = [];
     const evidence = [];
+    let checkAuth = false;
     let dryRun = false;
     let json = false;
     let yes = false;
@@ -121,6 +126,18 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--review-target": {
+                const value = readOptionValue(argv, index, token);
+                if (!REVIEW_TARGETS.has(value)) {
+                    invalidValue(token, value);
+                }
+                if (reviewTargets.includes(value)) {
+                    duplicate(`${token} ${value}`);
+                }
+                reviewTargets.push(value);
+                index += 1;
+                break;
+            }
             case "--task": {
                 if (taskId !== undefined) {
                     duplicate(token);
@@ -163,6 +180,20 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--base": {
+                if (base !== undefined) {
+                    duplicate(token);
+                }
+                base = readOptionValue(argv, index, token);
+                index += 1;
+                break;
+            }
+            case "--check-auth":
+                if (checkAuth) {
+                    duplicate(token);
+                }
+                checkAuth = true;
+                break;
             case "--dry-run":
                 if (dryRun) {
                     duplicate(token);
@@ -249,7 +280,10 @@ export function parseArgs(argv) {
             title !== undefined ||
             criteria.length > 0 ||
             evidence.length > 0 ||
+            reviewTargets.length > 0 ||
             sessionId !== undefined ||
+            base !== undefined ||
+            checkAuth ||
             dryRun ||
             yes) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -279,11 +313,20 @@ export function parseArgs(argv) {
     if (command !== "update" && targetVersion !== undefined) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--target-version may be used only with update.");
     }
+    if (base !== undefined && command !== "verify" && command !== "review") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify or review.");
+    }
     if (hookTargets.length > 0 &&
         command !== "init" &&
         command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--hook-target may be used only with init or update.");
     }
+    if (checkAuth && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth may be used only with doctor.");
+    }
+    if (reviewTargets.length > 0 && command !== "init") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--review-target may be used only with init.");
+    }
     if (command === "task") {
         if (harness !== undefined ||
             profiles.length > 0 ||
@@ -325,6 +368,7 @@ export function parseArgs(argv) {
             evidence.length > 0 ||
             dryRun ||
             yes ||
+            base !== undefined ||
             (taskId !== undefined && sessionId !== undefined))) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Verify accepts only scope, task or session, and json options.");
     }
@@ -345,9 +389,12 @@ export function parseArgs(argv) {
         ...(taskId === undefined ? {} : { taskId }),
         ...(targetVersion === undefined ? {} : { targetVersion }),
         ...(title === undefined ? {} : { title }),
+        ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),
+        ...(base === undefined ? {} : { base }),
+        ...(checkAuth ? { checkAuth } : {}),
         dryRun,
         json,
         yes

package/dist/packages/cli/src/bin.js

@@ -29,6 +29,9 @@ import { formatInstallPlan, runInitCommand } from "./commands/init.js";
 import { formatUninstallPlan, runUninstallCommand } from "./commands/uninstall.js";
 import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
+import { createReviewExecutor } from "../../../runtime/src/review/execute.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
+import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { formatUpdatePlan, runUpdateCommand } from "./commands/update.js";
@@ -67,6 +70,29 @@ async function installedManifest(root) {
 async function installedHarness(root) {
     return (await installedManifest(root))?.harness ?? [...HARNESS_IDS];
 }
+function gitRunner(root) {
+    return {
+        run: async (gitArgs) => {
+            try {
+                return {
+                    exitCode: 0,
+                    stdout: execFileSync("git", [...gitArgs], {
+                        cwd: root,
+                        encoding: "buffer",
+                        stdio: ["ignore", "pipe", "ignore"]
+                    })
+                };
+            }
+            catch (error) {
+                const failure = error;
+                return {
+                    exitCode: failure.status ?? 1,
+                    stdout: failure.stdout ?? new Uint8Array()
+                };
+            }
+        }
+    };
+}
 async function confirmInit(plan) {
     writeBanner({
         isTTY: process.stdout.isTTY === true,
@@ -139,8 +165,12 @@ else {
                                 sources: await hookSources(root, args.scope === "user" ? "user" : "project")
                             }),
                             repositoryTrust: async () => repositoryTrustStatus(await repositoryTrust(root, config, CLI_VERSION)),
-                            smokeAvailability: () => smokeAvailabilityStatus(config)
-                        }
+                            smokeAvailability: () => smokeAvailabilityStatus(config),
+                            reviewTarget: async (target, deep) => await probeReviewTarget(target, { cwd: root, deep })
+                        },
+                        ...(args.checkAuth === true
+                            ? { checkReviewTargetAuth: true }
+                            : {})
                     });
                 }
                 if (args.command === "uninstall") {
@@ -172,16 +202,54 @@ else {
                 const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
                 if (args.command === "task") {
                     const sessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const policyConfigHash = args.action === "create"
+                        ? calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config)
+                        : undefined;
                     return await runTaskCommand({
                         args,
                         service: taskService,
+                        ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId })
                     });
                 }
                 if (args.command === "review") {
+                    const reviewSessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const reviewConfig = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
+                    const reviewRole = resolveReviewRole("independent-review", reviewConfig.reviewRoles ?? []);
                     return await runReviewCommand({
                         args,
-                        authorized: args.yes
+                        authorized: args.yes,
+                        tasks: taskService,
+                        ...(reviewSessionId === undefined
+                            ? {}
+                            : { sessionId: reviewSessionId }),
+                        ...(reviewConfig.reviewRoles === undefined
+                            ? {}
+                            : { roles: reviewConfig.reviewRoles }),
+                        root,
+                        gitRunner: gitRunner(root),
+                        policyConfigHash: calculateConfigHash(reviewConfig),
+                        currentPolicyConfigHash: async () => calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config),
+                        config: reviewConfig,
+                        evidenceStore: new FileEvidenceStore(root, root),
+                        execute: createReviewExecutor({
+                            targets: reviewRole?.targets ?? [],
+                            cwd: root,
+                            ...(reviewRole?.model === undefined
+                                ? {}
+                                : { model: reviewRole.model }),
+                            ...(reviewRole?.effort === undefined
+                                ? {}
+                                : { effort: reviewRole.effort }),
+                            ...(reviewRole?.timeoutMs === undefined
+                                ? {}
+                                : { timeoutMs: reviewRole.timeoutMs }),
+                            onProgress: (line) => {
+                                if (!args.json) {
+                                    process.stderr.write(`${line}\n`);
+                                }
+                            }
+                        })
                     });
                 }
                 if (args.command === "config") {
@@ -198,31 +266,12 @@ else {
                             root,
                             scope: args.scope === "user" ? "user" : "project",
                             config,
-                            gitRunner: {
-                                run: async (gitArgs) => {
-                                    try {
-                                        return {
-                                            exitCode: 0,
-                                            stdout: execFileSync("git", [...gitArgs], {
-                                                cwd: root,
-                                                encoding: "buffer",
-                                                stdio: ["ignore", "pipe", "ignore"]
-                                            })
-                                        };
-                                    }
-                                    catch (error) {
-                                        const failure = error;
-                                        return {
-                                            exitCode: failure.status ?? 1,
-                                            stdout: failure.stdout ?? new Uint8Array()
-                                        };
-                                    }
-                                }
-                            },
+                            gitRunner: gitRunner(root),
                             processRunner: new NodeVerificationProcessRunner(),
                             taskService,
                             evidenceStore: new FileEvidenceStore(root, root),
-                            trusted: trustStatus === "TRUSTED"
+                            trusted: trustStatus === "TRUSTED",
+                            ...(args.base === undefined ? {} : { base: args.base })
                         })
                     });
                 }

package/dist/packages/cli/src/cli.js

@@ -2,6 +2,7 @@ import { CliArgumentError, parseArgs } from "./args.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { errorEnvelope, okEnvelope, writeEnvelope } from "./output.js";
 import { completeInitChoices } from "./wizard.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
 import { BANNER } from "./ui.js";
 export function renderWelcome(color) {
     const cyan = color ? "\u001b[36m" : "";
@@ -32,12 +33,17 @@ Options:
   --harness <all|both|claude|codex|opencode|comma-separated>  Init/update
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
   --profile <core|advisory|guardrails|loop>  Repeatable
+  --review-target <codex|agy|claude>  Repeatable init option; external review
+                                      targets in fallback-chain order
+  --check-auth                        Doctor only: probe each review target's
+                                      authentication with one real call
   --task <id>
   --target-version <version>          Update target version (offline-capable)
   --title <text>
   --criterion <json>                    Repeatable
   --evidence <criterion-id=reference>   Repeatable
   --session <id>
+  --base <git-ref>                    Verify/review a clean committed range
   --dry-run
   --json
   --yes
@@ -76,7 +82,13 @@ export async function runCli(argv, io, services) {
     }
     try {
         if (args.command === "init") {
-            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io);
+            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io, {
+                probeReviewTarget: async (target) => (await probeReviewTarget(target, {
+                    cwd: process.cwd(),
+                    deep: true
+                })) === "ok",
+                warn: (message) => io.writeStderr(`${message}\n`)
+            });
         }
         const execute = args.command === "help" || args.command === "version"
             ? services.execute

package/dist/packages/cli/src/commands/init.js

@@ -63,7 +63,10 @@ export async function runInitCommand(options) {
             : { hookRuntimePath: options.hookRuntimePath }),
         ...((options.hookTargets ?? args.hookTargets) === undefined
             ? {}
-            : { hookTargets: options.hookTargets ?? args.hookTargets })
+            : { hookTargets: options.hookTargets ?? args.hookTargets }),
+        ...(args.reviewTargets === undefined
+            ? {}
+            : { reviewTargets: args.reviewTargets })
     });
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {