@makerx/yoke 0.12.0 → 0.13.1

package/README.md

@@ -31,6 +31,7 @@ yoke sync --user   # ~/.claude/skills
 yoke sync [--user] [--force]  # write yoke's skills
 yoke review [number]          # review a PR (used by /review)
 yoke review-ci                # add the CI review workflow (used by /review-ci)
+yoke review-gate <result>     # block merging until the PR's latest review succeeds (used by review.yml)
 yoke models                   # list each provider's models
 ```
 

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.12.0",
+  version: "0.13.1",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -415,6 +415,45 @@ import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname2, join as join3 } from "path";
 
+// src/features/review/shellQuote.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+// src/features/review/ciEntra.ts
+var githubOidcIssuer = "https://token.actions.githubusercontent.com";
+var entraTokenExchangeAudience = "api://AzureADTokenExchange";
+function federatedCredential(repo, environment) {
+  return {
+    issuer: githubOidcIssuer,
+    audience: entraTokenExchangeAudience,
+    subject: environment ? `repo:${repo}:environment:${environment}` : `repo:${repo}:pull_request`
+  };
+}
+function federatedCredentialCommand(clientId, credential) {
+  const parameters = JSON.stringify({
+    name: "yoke-review-ci",
+    issuer: credential.issuer,
+    subject: credential.subject,
+    audiences: [credential.audience]
+  });
+  return `az ad app federated-credential create --id ${shellQuote(clientId)} --parameters ${shellQuote(parameters)}`;
+}
+function entraSetup({ clientId, environment }, repo) {
+  const credential = federatedCredential(repo, environment);
+  return [
+    "",
+    `Instead of an API key, the review signs in to Foundry as Entra app ${clientId}. So that the app trusts this repo's review runs, add a federated credential to it with:`,
+    `  issuer:   ${credential.issuer}`,
+    `  audience: ${credential.audience}`,
+    `  subject:  ${credential.subject}`,
+    "for example with:",
+    `  ${federatedCredentialCommand(clientId, credential)}`,
+    "and give the app the Cognitive Services User role on the Foundry resource.",
+    ...environment ? [`The job runs in the ${environment} environment; create it on the repo if it does not exist.`] : []
+  ];
+}
+
 // src/features/review/pr.ts
 import { execFile } from "child_process";
 import { join as join2 } from "path";
@@ -506,6 +545,9 @@ async function submitPendingReview(pr2, review, body, exec2 = run) {
 async function discardPendingReview(pr2, review, exec2 = run) {
   await exec2("gh", ["api", "--method", "DELETE", `${reviewsPath(pr2)}/${review.id}`]);
 }
+async function githubGet(path, exec2 = run) {
+  return JSON.parse(await exec2("gh", ["api", path]));
+}
 var github = {
   open: (pr2) => openPendingReview(pr2),
   add: (review, comment) => addReviewComment(review, comment),
@@ -629,6 +671,8 @@ var reviewWorkflowRef = "MakerXStudio/yoke/.github/workflows/review.yml@main";
 var callerWorkflowPath = join3(".github", "workflows", "review-pr.yml");
 var baseUrlVariable = "REVIEW_CI_BASE_URL";
 var apiKeySecret = "REVIEW_CI_API_KEY";
+var callerTriggerTypes = ["opened", "synchronize", "reopened", "ready_for_review"];
+var gateCheck = "review / gate";
 function workflowSecrets({ entra }) {
   return entra ? [] : [apiKeySecret];
 }
@@ -692,9 +736,10 @@ function renderCallerWorkflow(workflow) {
     "",
     "on:",
     "  pull_request:",
-    "    types: [opened, reopened, ready_for_review]",
+    `    types: [${callerTriggerTypes.join(", ")}]`,
     "",
     "permissions:",
+    "  actions: read",
     "  contents: read",
     "  pull-requests: write",
     ...workflow.entra ? ["  id-token: write"] : [],
@@ -709,9 +754,6 @@ function renderCallerWorkflow(workflow) {
     ""
   ].join("\n");
 }
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
 function setupCommands(settings, workflow) {
   const baseUrl = settings[`${workflow.provider}.baseUrl`];
   return [
@@ -719,23 +761,20 @@ function setupCommands(settings, workflow) {
     ...workflowSecrets(workflow).map((secret2) => `gh secret set ${secret2}`)
   ];
 }
-var githubOidcIssuer = "https://token.actions.githubusercontent.com";
-var entraTokenExchangeAudience = "api://AzureADTokenExchange";
-function federatedCredential(repo, environment) {
-  return {
-    issuer: githubOidcIssuer,
-    audience: entraTokenExchangeAudience,
-    subject: environment ? `repo:${repo}:environment:${environment}` : `repo:${repo}:pull_request`
-  };
-}
-function federatedCredentialCommand(clientId, credential) {
-  const parameters = JSON.stringify({
-    name: "yoke-review-ci",
-    issuer: credential.issuer,
-    subject: credential.subject,
-    audiences: [credential.audience]
-  });
-  return `az ad app federated-credential create --id ${shellQuote(clientId)} --parameters ${shellQuote(parameters)}`;
+var gateRuleset = {
+  name: "yoke review",
+  target: "branch",
+  enforcement: "active",
+  conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+  rules: [
+    {
+      type: "required_status_checks",
+      parameters: { strict_required_status_checks_policy: false, required_status_checks: [{ context: gateCheck }] }
+    }
+  ]
+};
+function rulesetCommand() {
+  return `echo ${shellQuote(JSON.stringify(gateRuleset))} | gh api --method POST 'repos/{owner}/{repo}/rulesets' --input -`;
 }
 var unknownRepo = "<owner>/<repo>";
 function githubRepo(cwd = process.cwd()) {
@@ -770,20 +809,6 @@ function writeCallerWorkflow(root, content) {
   writeFileSync2(path, content);
   return "wrote";
 }
-function entraSetup({ clientId, environment }, repo) {
-  const credential = federatedCredential(repo, environment);
-  return [
-    "",
-    `Instead of an API key, the review signs in to Foundry as Entra app ${clientId}. So that the app trusts this repo's review runs, add a federated credential to it with:`,
-    `  issuer:   ${credential.issuer}`,
-    `  audience: ${credential.audience}`,
-    `  subject:  ${credential.subject}`,
-    "for example with:",
-    `  ${federatedCredentialCommand(clientId, credential)}`,
-    "and give the app the Cognitive Services User role on the Foundry resource.",
-    ...environment ? [`The job runs in the ${environment} environment; create it on the repo if it does not exist.`] : []
-  ];
-}
 function reportHeading(outcome, workflow) {
   if (outcome === "printed")
     return [`yoke's version of ${callerWorkflowPath}, not saved to the repo:`, "", renderCallerWorkflow(workflow).trimEnd()];
@@ -805,10 +830,90 @@ function reviewCiReport(outcome, settings, workflow, repo) {
     ...variableAndSecretSetup(settings, workflow),
     ...workflow.entra ? entraSetup(workflow.entra, repo()) : [],
     "",
-    outcome === "printed" ? "Once the repo's review workflow runs this review, commit and push it; each PR opened from this repo then gets a review." : `Commit and push ${callerWorkflowPath}; each PR opened from this repo then gets a review.`
+    outcome === "printed" ? "Once the repo's review workflow runs this review, commit and push it; each PR opened from this repo then gets a review." : `Commit and push ${callerWorkflowPath}; each PR opened from this repo then gets a review.`,
+    "",
+    `To block merging while the review fails, require the ${gateCheck} check on the default branch with:`,
+    `  ${rulesetCommand()}`,
+    "Run it only after this workflow is merged to the default branch, or pushes to open PRs get stuck waiting for a status."
   ].join("\n");
 }
 
+// src/features/review/gate.ts
+import { appendFileSync, readFileSync as readFileSync3 } from "fs";
+import { setTimeout } from "timers/promises";
+import { z as z2 } from "zod";
+var eventSchema = z2.object({
+  action: z2.string(),
+  pull_request: z2.object({
+    number: z2.number(),
+    head: z2.object({ ref: z2.string(), repo: z2.object({ full_name: z2.string() }).nullable() }),
+    user: z2.object({ type: z2.string() })
+  })
+});
+var runsSchema = z2.object({
+  workflow_runs: z2.array(z2.object({ id: z2.number(), run_number: z2.number(), pull_requests: z2.array(z2.object({ number: z2.number() })) }))
+});
+var jobsSchema = z2.object({ jobs: z2.array(z2.object({ name: z2.string(), status: z2.string(), conclusion: z2.string().nullable() })) });
+var pollInterval = 3e4;
+var rerunHint = "Mark the PR as draft, then ready for review, to run the review again.";
+var firstRunHint = "Mark the PR as ready for review (from draft if it is not one) to run it.";
+function verdict(conclusion, message) {
+  const pass = conclusion === "success";
+  return { pass, message: pass ? message : `${message} ${rerunHint}` };
+}
+function gateContext(env = process.env) {
+  const { GITHUB_REPOSITORY, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_SERVER_URL, GITHUB_EVENT_PATH } = env;
+  if (!GITHUB_REPOSITORY || !GITHUB_RUN_ID || !GITHUB_RUN_NUMBER || !GITHUB_SERVER_URL || !GITHUB_EVENT_PATH) {
+    throw new ReviewError("yoke review-gate runs only in a GitHub Actions pull_request workflow");
+  }
+  const event = eventSchema.safeParse(JSON.parse(readFileSync3(GITHUB_EVENT_PATH, "utf8")));
+  if (!event.success) throw new ReviewError("yoke review-gate runs only on pull_request events");
+  return {
+    repo: GITHUB_REPOSITORY,
+    runId: GITHUB_RUN_ID,
+    runNumber: Number(GITHUB_RUN_NUMBER),
+    serverUrl: GITHUB_SERVER_URL,
+    event: event.data
+  };
+}
+async function earlierRuns({ repo, runId, runNumber, event }, deps) {
+  const { workflow_id } = z2.object({ workflow_id: z2.number() }).parse(await deps.get(`repos/${repo}/actions/runs/${runId}`));
+  const query = new URLSearchParams({ event: "pull_request", branch: event.pull_request.head.ref, per_page: "100" });
+  const { workflow_runs } = runsSchema.parse(await deps.get(`repos/${repo}/actions/workflows/${workflow_id}/runs?${query.toString()}`));
+  return workflow_runs.filter((run2) => run2.run_number < runNumber && run2.pull_requests.some((pr2) => pr2.number === event.pull_request.number)).toSorted((a, b) => b.run_number - a.run_number).map((run2) => run2.id);
+}
+async function settledReview(repo, run2, deps) {
+  for (; ; ) {
+    const { jobs } = jobsSchema.parse(await deps.get(`repos/${repo}/actions/runs/${run2}/jobs`));
+    const review = jobs.find((job) => job.name.endsWith(" / review"));
+    if (!review || review.conclusion === "skipped") return void 0;
+    if (review.status === "completed") return review.conclusion ?? "unknown";
+    deps.log(`Waiting for the review in run ${run2} to finish (${review.status})`);
+    await deps.sleep(pollInterval);
+  }
+}
+async function reviewGate(reviewResult, context, deps) {
+  if (reviewResult !== "skipped") return verdict(reviewResult, `The review on this event finished with ${reviewResult}.`);
+  const { pull_request } = context.event;
+  if (pull_request.head.repo?.full_name !== context.repo || pull_request.user.type === "Bot") {
+    return verdict("success", "No review runs for PRs from forks or bots.");
+  }
+  for (const run2 of await earlierRuns(context, deps)) {
+    const conclusion = await settledReview(context.repo, run2, deps);
+    const url = `${context.serverUrl}/${context.repo}/actions/runs/${run2}`;
+    if (conclusion) return verdict(conclusion, `The latest review for this PR, in run ${url}, finished with ${conclusion}.`);
+  }
+  return { pass: false, message: `No review has completed for this PR yet. ${firstRunHint}` };
+}
+async function runReviewGate(reviewResult, out, env = process.env) {
+  const deps = { get: (path) => githubGet(path), sleep: (ms) => setTimeout(ms), log: out };
+  const { pass, message } = await reviewGate(reviewResult, gateContext(env), deps);
+  out(pass ? message : `::error::${message}`);
+  if (env.GITHUB_STEP_SUMMARY) appendFileSync(env.GITHUB_STEP_SUMMARY, `${message}
+`);
+  return pass;
+}
+
 // src/features/review/comments.ts
 var markerPrefix = "<!-- yoke-review:";
 function slug(text2) {
@@ -950,7 +1055,9 @@ function selfReviewNote(diff) {
 This change adds or edits a workflow that calls \`MakerXStudio/yoke/.github/workflows/review.yml\`, the CI setup for this review. Review it like any other file, but these are yoke's deliberate design: do not raise them as findings, keep them in a consolidated review, or mention them in a summary.
 
 - Calling the workflow at \`@main\` rather than a tag or SHA.
-- The trigger types, including leaving out \`synchronize\`: a review is re-run by marking the PR as draft and then ready for review.
+- The trigger types, including \`synchronize\`: pushes run only the \`review / gate\` job, and a review is re-run by marking the PR as draft and then ready for review.
+- No \`concurrency:\` block, with or without \`synchronize\`: the reusable workflow's \`review\` job skips \`synchronize\` events, so pushes and force-pushes start only gate jobs and don't overlap full reviews.
+- The \`actions: read\` permission: the gate reads earlier runs of the workflow to find the PR's latest review.
 - Draft PRs being reviewed twice: the reusable workflow already skips drafts.
 
 Real defects in it are still findings, such as:
@@ -1309,7 +1416,7 @@ async function listModels(settings, fetchModels = fetch) {
 }
 
 // src/features/review/review.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
 import { join as join8 } from "path";
 
@@ -1379,10 +1486,10 @@ async function withEntraToken(settings, { env, fetch: fetchFn = fetch, mask }) {
 
 // src/features/review/harness.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 
 // src/features/review/usage.ts
-import { appendFileSync } from "fs";
+import { appendFileSync as appendFileSync2 } from "fs";
 var fields2 = ["input", "output", "cacheRead", "cacheWrite"];
 var rows = [
   ["reviewer1", "Reviewer 1"],
@@ -1445,7 +1552,7 @@ function writeJobSummary(summary, usage, log, env = process.env) {
   const path = env.GITHUB_STEP_SUMMARY;
   if (!path) return;
   try {
-    appendFileSync(path, `${jobSummary(summary, usage)}
+    appendFileSync2(path, `${jobSummary(summary, usage)}
 `);
     log("wrote the review summary and token usage to the job summary");
   } catch (error) {
@@ -1571,7 +1678,7 @@ function exitError(harness, code, output) {
   return [`${harness} exited with code ${code ?? "unknown"}`, ...detail ? [detail] : []].join("\n");
 }
 function hasReview(path) {
-  return existsSync3(path) && readFileSync3(path, "utf8").trim().length > 0;
+  return existsSync3(path) && readFileSync4(path, "utf8").trim().length > 0;
 }
 var runHarness = (run2) => new Promise((resolve) => {
   const shell = process.platform === "win32";
@@ -1625,11 +1732,11 @@ var runHarness = (run2) => new Promise((resolve) => {
 import { execFile as execFile2 } from "child_process";
 
 // src/features/review/run.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync6 } from "fs";
 import { join as join6 } from "path";
 
 // src/features/review/cachedSlots.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { join as join4 } from "path";
 function slotsPath(reviewDir) {
   return join4(reviewDir, "slots.json");
@@ -1640,7 +1747,7 @@ function isCachedSlots(value) {
 function readCachedSlots(reviewDir) {
   const path = slotsPath(reviewDir);
   if (!existsSync4(path)) return {};
-  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  const parsed = JSON.parse(readFileSync5(path, "utf8"));
   return isCachedSlots(parsed) ? parsed : {};
 }
 function cachedSlot(reviewDir, step) {
@@ -1794,7 +1901,7 @@ ${files.join("\n")}
 }
 
 // src/features/review/usedModels.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
 var repoUrl = "https://github.com/MakerXStudio/yoke";
 function modelsPath(reviewDir) {
@@ -1806,7 +1913,7 @@ function isUsedModels(value) {
 function readUsedModels(reviewDir) {
   const path = modelsPath(reviewDir);
   if (!existsSync5(path)) return {};
-  const parsed = JSON.parse(readFileSync5(path, "utf8"));
+  const parsed = JSON.parse(readFileSync6(path, "utf8"));
   return isUsedModels(parsed) ? parsed : {};
 }
 function recordUsedModel(reviewDir, step, harness, model) {
@@ -1877,7 +1984,7 @@ async function runStep({ name, label, slot, ...step }, context) {
 }
 function hasOutput({ name, slot, outputPath }, context) {
   if (cachedSlot(context.reviewDir, name) !== describeSlot(slot)) return false;
-  return existsSync6(outputPath) && readFileSync6(outputPath, "utf8").trim().length > 0;
+  return existsSync6(outputPath) && readFileSync7(outputPath, "utf8").trim().length > 0;
 }
 async function runOrReuse(step, context) {
   if (!hasOutput(step, context)) return { ok: await runStep(step, context), ran: true };
@@ -1904,7 +2011,7 @@ function synthesisResult(markdown) {
 function rawReviews(succeeded, context) {
   const report = succeeded.map((reviewer) => `# ${reviewerLabel(reviewer, context)} review
 
-${readFileSync6(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
+${readFileSync7(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
   return { report, synthesis: null, markdown: null };
 }
 function synthesisSlot(succeeded, context) {
@@ -1921,7 +2028,7 @@ async function synthesise(requestPath, succeeded, reviewersRan, context) {
   }));
   const prompt = buildSynthesisPrompt(requestPath, files);
   if ((await runOrReuse({ name: "synthesis", label: `synthesis (${describeSlot(slot)})`, slot, prompt, outputPath }, context)).ok)
-    return synthesisResult(readFileSync6(outputPath, "utf8"));
+    return synthesisResult(readFileSync7(outputPath, "utf8"));
   if (context.strict) throw new ReviewFailure("synthesis failed", "The synthesis failed; nothing to post.");
   context.log("showing the raw reviews instead");
   return rawReviews(succeeded, context);
@@ -2029,21 +2136,21 @@ async function assertViable(slots2, check = checks) {
 }
 
 // src/features/review/reviewLog.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import { join as join7 } from "path";
 function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */ new Date()) {
   let path;
   let buffered = [];
   return {
     append: (line) => {
-      if (path) appendFileSync2(path, `${line}
+      if (path) appendFileSync3(path, `${line}
 `);
       else buffered.push(line);
     },
     attach: (reviewDir) => {
       mkdirSync3(reviewDir, { recursive: true });
       path = join7(reviewDir, "review.log");
-      appendFileSync2(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
+      appendFileSync3(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
 `);
       buffered = [];
     }
@@ -2102,7 +2209,7 @@ async function reviewAtHead(pr2, reviewDir, request, slots2, ui, strict) {
 }
 function savedReview(path, post) {
   if (!post || !existsSync7(path)) return null;
-  return parseSynthesis(readFileSync7(path, "utf8"));
+  return parseSynthesis(readFileSync8(path, "utf8"));
 }
 function saveReview(path, markdown) {
   if (markdown) writeFileSync7(path, markdown);
@@ -2164,7 +2271,7 @@ async function reviewPr(number, settings, { post, force }, io) {
 }
 
 // src/features/sync/sync.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join9 } from "path";
 
@@ -2216,6 +2323,8 @@ A workflow is an LLM review if it has a model review PRs, whatever tool it uses.
 
 Never ask whether to overwrite a workflow. If \`review-pr.yml\` exists and differs, edit it in place.
 
+The \`review / gate\` merge gate needs the \`synchronize\` trigger and \`actions: read\` permission from \`--print\`; add them to an edited workflow if missing.
+
 If no workflow or setting names the models, ask which model each reviewer runs. For LiteLLM, offer \`yoke models\`. For Foundry, ask for deployment names.
 
 For Foundry with Entra, reuse the client and tenant IDs from the existing workflow; ask only if none is there.
@@ -2229,7 +2338,7 @@ Never ask whether they are set for the organisation, and don't query org setting
 
 With Entra, check \`az ad app federated-credential list --id <client-id>\` and show the printed create command if the credential is missing.
 
-Finish with what changed and what's left: commit and push the workflow.
+Finish with what changed and what's left: commit and push the workflow, then, only once it is merged to the default branch, run the printed \`gh api\` ruleset command requiring \`review / gate\`. Don't run it before then.
 
 If \`yoke\` is not found, run \`npm i -g @makerx/yoke\`.
 `
@@ -2255,7 +2364,7 @@ function skillsRoot(user, cwd = process.cwd(), home = homedir3()) {
   return join9(user ? home : cwd, ".claude", "skills");
 }
 function isOwnedByUser(skillFile) {
-  return existsSync8(skillFile) && !readFileSync8(skillFile, "utf8").includes(ownerMarker);
+  return existsSync8(skillFile) && !readFileSync9(skillFile, "utf8").includes(ownerMarker);
 }
 function syncSkills(destination, userDestination, force = false, skills = bundledSkills) {
   const result = { written: [], skipped: [] };
@@ -2355,6 +2464,15 @@ addSettingOptions(
     process.exitCode = 1;
   }
 });
+program.command("review-gate").description("Block merging until the latest review that ran for the PR succeeds; fork and bot PRs pass. Used by review.yml's gate job").argument("<result>", "result of the review job on this event: success, failure, cancelled or skipped").action(async (result) => {
+  try {
+    if (!await runReviewGate(result, console.log)) process.exitCode = 1;
+  } catch (error) {
+    if (!(error instanceof ReviewError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
 addSettingOptions(
   program.command("models").description("List the models each configured provider serves, for review.*.provider and review.*.model"),
   providerKeys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerx/yoke",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   "license": "MIT",
   "author": "MakerX",