@makerx/yoke 0.4.1 → 0.6.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.4.1",
+  version: "0.6.0",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -41,7 +41,9 @@ var package_default = {
     prepublishOnly: "npm run build"
   },
   dependencies: {
-    commander: "^15.0.0"
+    commander: "^15.0.0",
+    "log-update": "^8.0.0",
+    zod: "^4.6.7"
   },
   devDependencies: {
     "@makerx/verify": "^1.3.0",
@@ -52,13 +54,161 @@ var package_default = {
     "oxlint-tsgolint": "^7.0.2004",
     tsup: "^9.0.0",
     typescript: "^6.0.3",
-    vitest: "^5.0.5"
+    vitest: "^5.0.5",
+    yaml: "^2.9.1"
   },
   engines: {
     node: ">=24"
   }
 };
 
+// src/features/config/settings.ts
+import { z } from "zod";
+function setting(description) {
+  return z.string().optional().meta({ description });
+}
+function secret(description) {
+  return z.string().optional().meta({ description, secret: true });
+}
+var providerHelp = "litellm or foundry. Unset: your own login";
+var modelHelp = "See `yoke models`. Required with a provider";
+var settingsSchema = z.object({
+  "litellm.baseUrl": setting("LiteLLM proxy URL"),
+  "litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
+  "foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
+  "foundry.apiKey": secret("Foundry API key. Env or --user config only"),
+  "review.reviewer1.harness": setting("claude or codex. Default: claude"),
+  "review.reviewer1.provider": setting(providerHelp),
+  "review.reviewer1.model": setting(modelHelp),
+  "review.reviewer2.harness": setting("claude or codex. Default: codex"),
+  "review.reviewer2.provider": setting(providerHelp),
+  "review.reviewer2.model": setting(modelHelp),
+  "review.synthesis.harness": setting("claude or codex. Default: reviewer1 harness"),
+  "review.synthesis.provider": setting(providerHelp),
+  "review.synthesis.model": setting(modelHelp)
+});
+var settingKeys = settingsSchema.keyof().options;
+function isSettingKey(key) {
+  return settingKeys.includes(key);
+}
+function isSecret(key) {
+  return settingsSchema.shape[key].meta()?.secret === true;
+}
+function settingDescription(key) {
+  return settingsSchema.shape[key].meta()?.description ?? "";
+}
+function snake(key) {
+  return key.replace(/([a-z])([A-Z0-9])/g, "$1_$2").replaceAll(".", "_");
+}
+function settingEnv(key) {
+  return `YOKE_${snake(key).toUpperCase()}`;
+}
+function settingFlag(key) {
+  if (isSecret(key)) return void 0;
+  return `--${snake(key.replace(/^review\./, "")).toLowerCase().replaceAll("_", "-")}`;
+}
+function resolveSettings(flags, env, config2) {
+  const resolved = {};
+  for (const key of settingKeys) {
+    const flag = isSecret(key) ? void 0 : flags[key];
+    const value = [flag, env[settingEnv(key)], config2[key]].map((candidate) => candidate?.trim()).find(Boolean);
+    if (value) resolved[key] = value;
+  }
+  return resolved;
+}
+function displayValue(key, value) {
+  if (!value) return "<not set>";
+  return isSecret(key) ? "****" : value;
+}
+var gap = "  ";
+function wrap(text2, width) {
+  const lines = [];
+  let line = "";
+  for (const word of text2.split(" ")) {
+    if (line && line.length + 1 + word.length > width) {
+      lines.push(line);
+      line = word;
+    } else line = line ? `${line} ${word}` : word;
+  }
+  return line ? [...lines, line] : lines;
+}
+function listSettings(settings, columns = Infinity) {
+  const rows = settingKeys.map((key) => ({
+    key,
+    value: displayValue(key, settings[key]),
+    description: settingDescription(key)
+  }));
+  const keyWidth = Math.max(...rows.map(({ key }) => key.length));
+  const indent = " ".repeat(keyWidth + gap.length);
+  const blocks = rows.map(
+    ({ key, value, description }) => [`${key.padEnd(keyWidth)}${gap}${value}`, ...wrap(description, columns - indent.length).map((line) => indent + line)].join("\n")
+  );
+  return blocks.join("\n\n");
+}
+function howToSet(key, placeholder = "<value>") {
+  const flag = settingFlag(key);
+  const ways = [...flag ? [`pass ${flag}`] : [], `set ${settingEnv(key)}`, `run \`yoke config set --user ${key} ${placeholder}\``];
+  return `${ways.slice(0, -1).join(", ")} or ${ways.at(-1)}`;
+}
+
+// src/features/config/userConfig.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function userConfigPath(env = process.env, home = homedir()) {
+  return join(env.XDG_CONFIG_HOME || join(home, ".config"), "yoke", "config.json");
+}
+function isTree(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getPath(tree, path) {
+  return path.reduce((node, name) => isTree(node) ? node[name] : void 0, tree);
+}
+function setPath(tree, [name = "", ...rest], value) {
+  if (!rest.length) return { ...tree, [name]: value };
+  const child = tree[name];
+  return { ...tree, [name]: setPath(isTree(child) ? child : {}, rest, value) };
+}
+function readConfigFile(path) {
+  if (!existsSync(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new ConfigError(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!isTree(parsed)) throw new ConfigError(`${path} must be a JSON object`);
+  return parsed;
+}
+function readUserConfig(path) {
+  const file = readConfigFile(path);
+  const settings = {};
+  for (const key of settingKeys) {
+    const value = getPath(file, key.split("."));
+    if (typeof value === "string") settings[key] = value;
+  }
+  return settings;
+}
+function setSetting(key, value, user, path) {
+  if (!user)
+    throw new ConfigError(
+      "Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-level yoke config."
+    );
+  if (!isSettingKey(key)) throw new ConfigError(`Unknown setting "${key}"; expected one of: ${settingKeys.join(", ")}`);
+  const file = setPath(readConfigFile(path), key.split("."), value);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+  return `set ${key} in ${path}`;
+}
+
 // src/features/pr/guide.ts
 var raiseGuide = `
 Compose a short PR in the format below, get the user's approval in the terminal, push, then create it as a draft with \`yoke pr raise\`, which rejects a title or body that breaks the rules.
@@ -162,9 +312,9 @@ function parseBody(body) {
   let inFence = false;
   for (const line of body.split(/\r?\n/)) {
     if (fencePattern.test(line)) inFence = !inFence;
-    const heading = inFence ? null : headingPattern.exec(line);
-    if (heading?.[1] && heading[2]) {
-      sections.push({ name: heading[2], level: heading[1].length, content: "" });
+    const heading2 = inFence ? null : headingPattern.exec(line);
+    if (heading2?.[1] && heading2[2]) {
+      sections.push({ name: heading2[2], level: heading2[1].length, content: "" });
       continue;
     }
     const current = sections.at(-1);
@@ -242,31 +392,1321 @@ var PrValidationError = class extends Error {
   violations;
 };
 var runGh = (args) => execFileSync("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
-function raisePr({ title, body, base, draft }, run = runGh) {
+function raisePr({ title, body, base, draft }, run2 = runGh) {
   const violations = validatePr(title, body);
   if (violations.length) throw new PrValidationError(violations);
   const args = ["pr", "create", "--title", title.trim(), "--body", body.trim()];
   if (base) args.push("--base", base);
   if (draft) args.push("--draft");
-  const output = run(args).trim().split("\n");
+  const output = run2(args).trim().split("\n");
   return output.at(-1) ?? "";
 }
 
+// src/features/review/pr.ts
+import { execFile } from "child_process";
+import { join as join2 } from "path";
+var ReviewError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReviewError";
+  }
+};
+var maxBuffer = 256 * 1024 * 1024;
+var run = (command, args, cwd, input) => new Promise((resolve, reject) => {
+  const child = execFile(command, args, { cwd, encoding: "utf8", maxBuffer }, (error, stdout, stderr) => {
+    if (!error) return resolve(stdout);
+    const detail = stderr.trim();
+    reject(new ReviewError(`\`${command} ${args.join(" ")}\` failed${detail ? `: ${detail}` : ""}`));
+  });
+  child.stdin?.on("error", () => {
+  });
+  child.stdin?.end(input);
+});
+var fields = "number,url,title,baseRefName,baseRefOid,headRefName,headRefOid,files";
+function isPullRequest(value) {
+  return typeof value === "object" && value !== null && "number" in value && "url" in value && "headRefOid" in value && "files" in value;
+}
+async function fetchPr(number, exec2 = run) {
+  if (number !== void 0 && !/^\d+$/.test(number)) throw new ReviewError(`PR number must be a positive integer, got "${number}"`);
+  const args = ["pr", "view", ...number ? [number] : [], "--json", fields];
+  const pr2 = JSON.parse(await exec2("gh", args));
+  if (!isPullRequest(pr2)) throw new ReviewError("`gh pr view` returned an unexpected response");
+  return pr2;
+}
+async function fetchDiff(pr2, exec2 = run) {
+  const diff = await exec2("gh", ["pr", "diff", String(pr2.number)]);
+  const current = await fetchPr(String(pr2.number), exec2);
+  if (current.headRefOid !== pr2.headRefOid || current.baseRefOid !== pr2.baseRefOid)
+    throw new ReviewError(`#${pr2.number} changed while its diff was being fetched; run the review again`);
+  return diff;
+}
+var commentFields = '{path, line: (.line // .original_line), author: (.user.login // "ghost"), body}';
+var reviewFields = '{path: null, line: null, author: (.user.login // "ghost"), body}';
+function isPriorComment(value) {
+  return typeof value === "object" && value !== null && "body" in value && typeof value.body === "string" && "author" in value;
+}
+function jsonLines(output) {
+  return output.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line)).filter(isPriorComment);
+}
+async function fetchPriorComments(pr2, exec2 = run) {
+  const pulls = `repos/{owner}/{repo}/pulls/${pr2.number}`;
+  const [comments, reviews] = await Promise.all([
+    exec2("gh", ["api", "--paginate", `${pulls}/comments`, "--jq", `.[] | ${commentFields}`]),
+    exec2("gh", ["api", "--paginate", `${pulls}/reviews`, "--jq", `.[] | select(.body != "") | ${reviewFields}`])
+  ]);
+  return [...jsonLines(comments), ...jsonLines(reviews)];
+}
+function reviewsPath(pr2) {
+  return `repos/{owner}/{repo}/pulls/${pr2.number}/reviews`;
+}
+function isPendingReview(value) {
+  return typeof value === "object" && value !== null && "id" in value && typeof value.id === "number" && "node_id" in value && typeof value.node_id === "string";
+}
+async function openPendingReview(pr2, exec2 = run) {
+  const args = ["api", "--method", "POST", reviewsPath(pr2), "--input", "-", "--jq", "{id, node_id}"];
+  const review = JSON.parse(await exec2("gh", args, void 0, JSON.stringify({ commit_id: pr2.headRefOid })));
+  if (!isPendingReview(review)) throw new ReviewError("Opening a pending review returned an unexpected response");
+  return { id: review.id, nodeId: review.node_id };
+}
+var addThread = `mutation($review: ID!, $path: String!, $line: Int!, $body: String!) {
+  addPullRequestReviewThread(input: {pullRequestReviewId: $review, path: $path, line: $line, side: RIGHT, body: $body}) { thread { id } }
+}`;
+async function addReviewComment(review, { path, line, body }, exec2 = run) {
+  const variables = [
+    "-f",
+    `query=${addThread}`,
+    "-f",
+    `review=${review.nodeId}`,
+    "-f",
+    `path=${path}`,
+    "-F",
+    `line=${line}`,
+    "-f",
+    `body=${body}`
+  ];
+  await exec2("gh", ["api", "graphql", ...variables]);
+}
+async function submitPendingReview(pr2, review, body, exec2 = run) {
+  const args = ["api", "--method", "POST", `${reviewsPath(pr2)}/${review.id}/events`, "--input", "-", "--jq", ".html_url"];
+  return (await exec2("gh", args, void 0, JSON.stringify({ event: "COMMENT", body }))).trim();
+}
+async function discardPendingReview(pr2, review, exec2 = run) {
+  await exec2("gh", ["api", "--method", "DELETE", `${reviewsPath(pr2)}/${review.id}`]);
+}
+var github = {
+  open: (pr2) => openPendingReview(pr2),
+  add: (review, comment) => addReviewComment(review, comment),
+  submit: (pr2, review, body) => submitPendingReview(pr2, review, body),
+  discard: (pr2, review) => discardPendingReview(pr2, review)
+};
+function repoSlug(remoteUrl) {
+  return remoteUrl.replace(/\.git$/, "").split(/[/:]/).slice(-2).join("/").toLowerCase();
+}
+async function prRemote(pr2, root, exec2) {
+  const url = new URL(pr2.url);
+  const [, owner = "", repo = ""] = url.pathname.split("/");
+  const slug2 = `${owner}/${repo}`.toLowerCase();
+  const remotes = (await exec2("git", ["remote", "-v"], root)).split("\n").map((line) => line.split(/\s+/));
+  return remotes.find(([, remoteUrl]) => remoteUrl && repoSlug(remoteUrl) === slug2)?.[0] ?? `${url.origin}/${owner}/${repo}.git`;
+}
+async function checkoutHead(pr2, reviewDir, exec2 = run) {
+  const root = (await exec2("git", ["rev-parse", "--show-toplevel"])).trim();
+  const atHead = (await exec2("git", ["rev-parse", "HEAD"], root)).trim() === pr2.headRefOid;
+  if (atHead && !(await exec2("git", ["status", "--porcelain"], root)).trim()) return { cwd: root, remove: async () => {
+  } };
+  const tree = join2(reviewDir, "head");
+  await exec2("git", ["fetch", "--quiet", await prRemote(pr2, root, exec2), `pull/${pr2.number}/head`], root);
+  await exec2("git", ["worktree", "add", "--quiet", "--detach", tree, pr2.headRefOid], root);
+  return {
+    cwd: tree,
+    remove: async () => {
+      await exec2("git", ["worktree", "remove", "--force", tree], root);
+    }
+  };
+}
+
+// src/features/review/provider.ts
+var providerKinds = ["litellm", "foundry"];
+var harnesses = ["claude", "codex"];
+function codexKeyEnv(kind) {
+  return `YOKE_${kind.toUpperCase()}_API_KEY`;
+}
+function isProviderKind(value) {
+  return providerKinds.includes(value);
+}
+function deriveEndpoints(kind, baseUrl) {
+  const base = baseUrl.replace(/\/+$/, "");
+  if (kind === "foundry") return { anthropic: `${base}/anthropic`, responses: `${base}/openai/v1` };
+  return { anthropic: base, responses: `${base}/v1` };
+}
+function isHarness(value) {
+  return harnesses.includes(value);
+}
+function ownAuthOverride({ harness, model }) {
+  return { args: harness === "codex" ? ["-m", model] : ["--model", model], env: {} };
+}
+function buildCodexOverride({ kind, apiKey }, endpoints, model) {
+  const keyEnv = codexKeyEnv(kind);
+  return {
+    args: [
+      "-c",
+      "model_providers.yoke.name=yoke",
+      "-c",
+      `model_providers.yoke.base_url=${endpoints.responses}`,
+      "-c",
+      `model_providers.yoke.env_key=${keyEnv}`,
+      "-c",
+      "model_providers.yoke.wire_api=responses",
+      "-c",
+      "model_provider=yoke",
+      "-m",
+      model
+    ],
+    env: { [keyEnv]: apiKey }
+  };
+}
+function claudeProviderEnv(kind, endpoints, apiKey) {
+  if (kind === "foundry")
+    return { CLAUDE_CODE_USE_FOUNDRY: "1", ANTHROPIC_FOUNDRY_BASE_URL: endpoints.anthropic, ANTHROPIC_FOUNDRY_API_KEY: apiKey };
+  return { ANTHROPIC_BASE_URL: endpoints.anthropic, ANTHROPIC_AUTH_TOKEN: apiKey };
+}
+function buildClaudeOverride(provider, endpoints, model) {
+  return {
+    args: ["--model", model],
+    env: {
+      ...claudeProviderEnv(provider.kind, endpoints, provider.apiKey),
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+      ANTHROPIC_DEFAULT_OPUS_MODEL: model,
+      ANTHROPIC_DEFAULT_SONNET_MODEL: model,
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: model,
+      CLAUDE_CODE_SUBAGENT_MODEL: model
+    }
+  };
+}
+function claudeAuthHeaders({ kind, apiKey }) {
+  if (kind === "foundry") return { "x-api-key": apiKey };
+  return { Authorization: `Bearer ${apiKey}`, "x-api-key": apiKey };
+}
+function buildProbe({ harness, model }, provider) {
+  const endpoints = deriveEndpoints(provider.kind, provider.baseUrl);
+  if (harness === "codex")
+    return {
+      url: `${endpoints.responses}/responses`,
+      headers: { Authorization: `Bearer ${provider.apiKey}` },
+      body: { model, input: "ping", max_output_tokens: 16 }
+    };
+  return {
+    url: `${endpoints.anthropic}/v1/messages`,
+    headers: { ...claudeAuthHeaders(provider), "anthropic-version": "2023-06-01" },
+    body: { model, max_tokens: 1, messages: [{ role: "user", content: "ping" }] }
+  };
+}
+function buildOverride({ harness, model }, provider) {
+  const endpoints = deriveEndpoints(provider.kind, provider.baseUrl);
+  if (harness === "codex") return buildCodexOverride(provider, endpoints, model);
+  return buildClaudeOverride(provider, endpoints, model);
+}
+
+// src/features/review/slots.ts
+var slotNames = ["reviewer1", "reviewer2", "synthesis"];
+function readProvider(settings, kind) {
+  const baseUrlKey = `${kind}.baseUrl`;
+  const apiKeyKey = `${kind}.apiKey`;
+  const baseUrl = settings[baseUrlKey];
+  const apiKey = settings[apiKeyKey];
+  if (baseUrl && apiKey) return { kind, baseUrl, apiKey };
+  return [
+    baseUrl ? null : `${baseUrlKey} is not set; ${howToSet(baseUrlKey, "<url>")}`,
+    apiKey ? null : `${apiKeyKey} is not set; ${howToSet(apiKeyKey, "<key>")}`
+  ].filter((error) => error !== null);
+}
+function readSpec(settings, slot, errors) {
+  const keys = {
+    harness: `review.${slot}.harness`,
+    provider: `review.${slot}.provider`,
+    model: `review.${slot}.model`
+  };
+  const harness = settings[keys.harness];
+  const provider = settings[keys.provider];
+  const model = settings[keys.model];
+  if (!harness && !provider && !model) return void 0;
+  if (harness && !isHarness(harness))
+    errors.push(`${keys.harness} "${harness}" must be claude or codex; ${howToSet(keys.harness, "<claude|codex>")}`);
+  if (provider && !isProviderKind(provider))
+    errors.push(
+      `${keys.provider} "${provider}" must be ${providerKinds.join(" or ")}; ${howToSet(keys.provider, `<${providerKinds.join("|")}>`)}`
+    );
+  if (provider && !model)
+    errors.push(`${keys.model} is required when ${keys.provider} is set; ${howToSet(keys.model, "<model>")} (see \`yoke models\`)`);
+  return {
+    ...harness && isHarness(harness) ? { harness } : {},
+    ...provider && isProviderKind(provider) ? { provider } : {},
+    ...model ? { model } : {}
+  };
+}
+function toSlot({ harness: chosen, model, provider: kind }, fallback, providers) {
+  const harness = chosen ?? fallback;
+  if (!model) return { harness };
+  const slot = { harness, model };
+  const provider = kind && providers[kind];
+  if (provider) return { ...slot, provider: kind, override: buildOverride(slot, provider), probe: buildProbe(slot, provider) };
+  return { ...slot, override: ownAuthOverride(slot) };
+}
+function resolveSlots(settings) {
+  const specs = {};
+  const errors = [];
+  for (const name of slotNames) specs[name] = readSpec(settings, name, errors);
+  const providers = {};
+  for (const kind of new Set(Object.values(specs).flatMap((spec) => spec?.provider ? [spec.provider] : []))) {
+    const read = readProvider(settings, kind);
+    if (Array.isArray(read)) errors.push(...read);
+    else providers[kind] = read;
+  }
+  if (errors.length) throw new ReviewError(["Review settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  const reviewer1 = toSlot(specs.reviewer1 ?? {}, "claude", providers);
+  return {
+    reviewer1,
+    reviewer2: toSlot(specs.reviewer2 ?? {}, "codex", providers),
+    synthesis: specs.synthesis && toSlot(specs.synthesis, reviewer1.harness, providers)
+  };
+}
+
+// src/features/review/models.ts
+var timeout = 6e4;
+var maxBodyChars = 300;
+var providerWidth = Math.max(...providerKinds.map((kind) => kind.length));
+function modelsRequest({ kind, baseUrl, apiKey }) {
+  const url = `${deriveEndpoints(kind, baseUrl).responses}/models`;
+  return { url, headers: kind === "foundry" ? { "api-key": apiKey } : { Authorization: `Bearer ${apiKey}` } };
+}
+function isModelList(value) {
+  return typeof value === "object" && value !== null && "data" in value && Array.isArray(value.data) && value.data.every((model) => typeof model === "object" && model !== null && "id" in model && typeof model.id === "string");
+}
+async function get(url, headers, fetchModels) {
+  try {
+    return await fetchModels(url, { headers, signal: AbortSignal.timeout(timeout) });
+  } catch (error) {
+    throw new ReviewError(`Could not reach ${url}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function providerModels(provider, fetchModels) {
+  const { url, headers } = modelsRequest(provider);
+  const response = await get(url, headers, fetchModels);
+  if (!response.ok)
+    throw new ReviewError(`${url} returned HTTP ${response.status}: ${(await response.text()).trim().slice(0, maxBodyChars)}`);
+  const body = await response.json().catch(() => void 0);
+  if (!isModelList(body)) throw new ReviewError(`${url} returned an unexpected model list`);
+  return body.data.map(({ id }) => `${provider.kind.padEnd(providerWidth)}  ${id}`);
+}
+function isConfigured(settings, kind) {
+  return Boolean(settings[`${kind}.baseUrl`] || settings[`${kind}.apiKey`]);
+}
+async function listModels(settings, fetchModels = fetch) {
+  const kinds = providerKinds.filter((kind) => isConfigured(settings, kind));
+  if (!kinds.length)
+    throw new ReviewError(
+      `No model provider is configured; set ${providerKinds.map((kind) => `${kind}.baseUrl and ${kind}.apiKey`).join(", or ")} (see \`yoke config\`)`
+    );
+  const providers = kinds.map((kind) => readProvider(settings, kind));
+  const errors = providers.flatMap((provider) => Array.isArray(provider) ? provider : []);
+  if (errors.length) throw new ReviewError(["Model provider settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  const ready = providers.filter((provider) => !Array.isArray(provider));
+  const lists = await Promise.all(ready.map((provider) => providerModels(provider, fetchModels)));
+  return lists.flat().toSorted();
+}
+
+// src/features/review/review.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join7 } from "path";
+
+// src/features/review/findings.ts
+var severities = ["blocker", "major", "minor", "nit"];
+var sources = ["confirmed", "disputed", "reviewer1-only", "reviewer2-only", "already-raised"];
+function oneOf(values, raw) {
+  const value = raw.toLowerCase();
+  return values.find((v) => v === value) ?? null;
+}
+function field(block, name) {
+  return block.match(new RegExp(`^-\\s+${name}:\\s*(.*)$`, "im"))?.[1]?.trim() ?? "";
+}
+function parseLocation(raw) {
+  const location = raw.replace(/^`+|`+$/g, "").trim();
+  if (!location || location.toLowerCase() === "n/a") return { file: null, line: null };
+  const match = location.match(/^(.+?):(\d+)(?:-\d+)?$/);
+  if (!match?.[1] || !match[2]) return { file: location, line: null };
+  return { file: match[1], line: Number(match[2]) };
+}
+function parseFinding(block) {
+  const [heading2 = "", ...rest] = block.split("\n");
+  const body = rest.join("\n");
+  return {
+    title: heading2.trim(),
+    severity: oneOf(severities, field(body, "Severity")),
+    source: oneOf(sources, field(body, "Source")),
+    ...parseLocation(field(body, "Location")),
+    impact: field(body, "Impact"),
+    recommendation: field(body, "Recommendation")
+  };
+}
+function parseSummary(markdown) {
+  return markdown.match(/^##\s+Summary\s*$([\s\S]*?)(?=^##\s|(?![\s\S]))/m)?.[1]?.trim() ?? "";
+}
+function rank(finding) {
+  const severity = finding.severity ? severities.indexOf(finding.severity) : severities.length;
+  const source = finding.source ? sources.indexOf(finding.source) : sources.length;
+  return severity * (sources.length + 1) + source;
+}
+function parseSynthesis(markdown) {
+  const findings = markdown.split(/^###\s+Finding:\s*/m).slice(1).map(parseFinding);
+  return { summary: parseSummary(markdown), findings: findings.toSorted((a, b) => rank(a) - rank(b)) };
+}
+function formatLocation({ file, line }) {
+  if (!file) return "no location";
+  return line === null ? file : `${file}:${line}`;
+}
+function formatSynthesis({ summary, findings }) {
+  const lines = [summary || "No summary.", ""];
+  if (!findings.length) lines.push("No findings.");
+  for (const finding of findings) {
+    lines.push(`[${finding.severity ?? "unrated"}] ${formatLocation(finding)} \u2014 ${finding.title}`);
+    if (finding.source) lines.push(`  Source: ${finding.source}`);
+    if (finding.impact) lines.push(`  Impact: ${finding.impact}`);
+    if (finding.recommendation) lines.push(`  Recommendation: ${finding.recommendation}`);
+    lines.push("");
+  }
+  return lines.join("\n").trimEnd();
+}
+
+// src/features/review/harness.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+
+// src/features/review/progress.ts
+var maxSummary = 80;
+function isJson(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function truncate(value) {
+  const collapsed = value.replace(/\s+/g, " ").trim();
+  return collapsed.length <= maxSummary ? collapsed : `${collapsed.slice(0, maxSummary - 1)}\u2026`;
+}
+function text(input, key) {
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function toolSummary(input) {
+  if (!isJson(input)) return "";
+  const pattern = text(input, "pattern");
+  if (pattern) {
+    const scope = text(input, "path");
+    return scope ? `${pattern} in ${scope}` : pattern;
+  }
+  const found = text(input, "file_path") ?? text(input, "path") ?? text(input, "url");
+  if (found) return found;
+  const described = text(input, "command") ?? text(input, "query") ?? text(input, "description");
+  return described ? truncate(described) : "";
+}
+function describeTool(tool, summary) {
+  return summary ? `${tool} ${summary}` : tool;
+}
+function claudeEvent(event) {
+  if (event.type === "result" && typeof event.result === "string") return { kind: "final", text: event.result };
+  if (event.type === "system" && event.subtype === "init" && typeof event.model === "string") return { kind: "model", model: event.model };
+  const content = isJson(event.message) ? event.message.content : void 0;
+  if (event.type !== "assistant" || !Array.isArray(content)) return { kind: "ignore" };
+  const uses = content.filter((block) => isJson(block) && block.type === "tool_use");
+  if (!uses.length) return { kind: "ignore" };
+  return { kind: "activity", text: uses.map((use) => describeTool(text(use, "name") ?? "tool", toolSummary(use.input))).join(", ") };
+}
+function unwrapShell(command) {
+  const wrapped = command.match(/^\/bin\/(?:ba|z)?sh\s+-lc\s+["'](.*)["']\s*$/s);
+  return truncate(wrapped?.[1]?.replace(/\\"/g, '"') ?? command);
+}
+function codexError(event) {
+  if (event.type === "error") return text(event, "message");
+  if (event.type === "turn.failed" && isJson(event.error)) return text(event.error, "message");
+  return void 0;
+}
+function codexEvent(event) {
+  const message = codexError(event);
+  if (message) return { kind: "error", message };
+  const item = event.item;
+  if (event.type !== "item.started" || !isJson(item)) return { kind: "ignore" };
+  const command = text(item, "command");
+  if (item.type === "command_execution" && command) return { kind: "activity", text: describeTool("shell", unwrapShell(command)) };
+  return { kind: "ignore" };
+}
+function parseHarnessEvent(harness, line) {
+  let event;
+  try {
+    event = JSON.parse(line);
+  } catch {
+    return { kind: "ignore" };
+  }
+  if (!isJson(event)) return { kind: "ignore" };
+  return harness === "claude" ? claudeEvent(event) : codexEvent(event);
+}
+
+// src/features/review/harness.ts
+var tailLines = 20;
+function harnessArgs({ harness, reviewDir, outputPath, override }) {
+  const extra = override?.args ?? [];
+  if (harness === "codex") return ["exec", "--sandbox", "read-only", "--json", "--output-last-message", outputPath, ...extra, "-"];
+  return [
+    "-p",
+    "--add-dir",
+    reviewDir,
+    "--disallowedTools",
+    "Edit,Write,NotebookEdit",
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    ...extra
+  ];
+}
+function windowsQuote(arg) {
+  return /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
+}
+function tail(text2) {
+  return text2.trim().split("\n").slice(-tailLines).join("\n");
+}
+function spawnError(harness, error) {
+  if (error.code === "ENOENT") return `${harness} CLI not found on PATH; install it or sign in, then retry`;
+  return `${harness} failed to start: ${error.message}`;
+}
+function exitError(harness, code, output) {
+  const detail = tail(output);
+  return [`${harness} exited with code ${code ?? "unknown"}`, ...detail ? [detail] : []].join("\n");
+}
+function hasReview(path) {
+  return existsSync2(path) && readFileSync2(path, "utf8").trim().length > 0;
+}
+var runHarness = (run2) => new Promise((resolve) => {
+  const shell = process.platform === "win32";
+  const args = harnessArgs(run2);
+  const child = spawn(run2.harness, shell ? args.map(windowsQuote) : args, {
+    cwd: run2.cwd,
+    env: { ...process.env, ...run2.override?.env },
+    stdio: ["pipe", "pipe", "pipe"],
+    shell
+  });
+  let pending = "";
+  let finalText = "";
+  let model;
+  let lastError = "";
+  let stderr = "";
+  const onLine = (line) => {
+    const event = parseHarnessEvent(run2.harness, line);
+    if (event.kind === "activity") run2.onProgress?.(event.text);
+    if (event.kind === "final") finalText = event.text;
+    if (event.kind === "model") model = event.model;
+    if (event.kind === "error") lastError = event.message;
+  };
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    const lines = (pending + chunk).split("\n");
+    pending = lines.pop() ?? "";
+    lines.forEach(onLine);
+  });
+  child.stderr.on("data", (chunk) => stderr += chunk);
+  child.stdin.on("error", () => {
+  });
+  child.stdin.end(run2.prompt);
+  child.on("error", (error) => resolve({ ok: false, error: spawnError(run2.harness, error) }));
+  child.on("close", (code) => {
+    onLine(pending);
+    if (code !== 0)
+      return resolve({ ok: false, error: exitError(run2.harness, code, [stderr || finalText, lastError].filter(Boolean).join("\n")) });
+    if (run2.harness === "claude") writeFileSync2(run2.outputPath, finalText);
+    if (!hasReview(run2.outputPath)) return resolve({ ok: false, error: `${run2.harness} returned an empty review` });
+    resolve(model ? { ok: true, model } : { ok: true });
+  });
+});
+
+// src/features/review/comments.ts
+var markerPrefix = "<!-- yoke-review:";
+function slug(text2) {
+  return text2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function findingMarker({ file, title }) {
+  return `${markerPrefix} ${file ?? "n/a"}#${slug(title)} -->`;
+}
+function hasMarker(prior, marker) {
+  return prior.some((comment) => comment.body.includes(marker));
+}
+function withoutMarkers(body) {
+  return body.split("\n").filter((line) => !line.trimStart().startsWith(markerPrefix)).join("\n").trim();
+}
+function heading({ path, line }) {
+  if (!path) return "### PR review";
+  return line === null ? `### ${path}` : `### ${path}:${line}`;
+}
+function formatPriorComments(prior) {
+  if (!prior.length) return "";
+  const blocks = prior.map((comment) => `${heading(comment)}
+
+**${comment.author}**: ${withoutMarkers(comment.body)}`);
+  return `## Prior review comments
+
+The PR already has the review comments below, including resolved and outdated threads. Do not re-raise a finding a prior comment substantively covers.
+
+${blocks.join("\n\n")}
+`;
+}
+
+// src/features/review/request.ts
+var fileHeader = /^\+\+\+ (.+)$/;
+var hunkHeader = /^@@ -\d+(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+var gutterWidth = 6;
+function hunkLine(text2, hunk) {
+  if (text2.startsWith("-")) hunk.oldLeft--;
+  else if (text2.startsWith("+")) hunk.newLeft--;
+  else if (text2.startsWith(" ")) {
+    hunk.oldLeft--;
+    hunk.newLeft--;
+  } else return null;
+  return text2.startsWith("-") ? null : hunk.next++;
+}
+var escapes = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13 };
+function escapedBytes(escape) {
+  const code = escape.slice(1);
+  if (/^[0-7]{3}$/.test(code)) return Buffer.from([parseInt(code, 8)]);
+  return Buffer.from([escapes[code] ?? code.charCodeAt(0)]);
+}
+function unquote(quoted) {
+  const parts = quoted.split(/(\\[0-7]{3}|\\.)/);
+  return Buffer.concat(parts.map((part, i) => i % 2 ? escapedBytes(part) : Buffer.from(part))).toString("utf8");
+}
+function diffPath(raw) {
+  const quoted = raw.match(/^"(.*)"$/)?.[1];
+  const path = quoted === void 0 ? raw : unquote(quoted);
+  return path.startsWith("b/") ? path.slice(2) : path;
+}
+function parseDiff(diff) {
+  let file = null;
+  const hunk = { next: 0, oldLeft: 0, newLeft: 0 };
+  return diff.split("\n").map((text2) => {
+    if (hunk.oldLeft > 0 || hunk.newLeft > 0) return { text: text2, file, line: hunkLine(text2, hunk) };
+    const header = text2.match(fileHeader)?.[1];
+    if (header) file = header === "/dev/null" ? null : diffPath(header);
+    const range = text2.match(hunkHeader);
+    if (range) Object.assign(hunk, { oldLeft: Number(range[1] ?? 1), next: Number(range[2]), newLeft: Number(range[3] ?? 1) });
+    return { text: text2, file, line: null };
+  });
+}
+function gutter(line) {
+  return `${(line === null ? "" : String(line)).padStart(gutterWidth)}  `;
+}
+function withNewFileLineNumbers(diff) {
+  return parseDiff(diff).map(({ text: text2, line }) => gutter(line) + text2).join("\n");
+}
+function commentableLines(diff) {
+  const lines = /* @__PURE__ */ new Map();
+  for (const { file, line } of parseDiff(diff)) {
+    if (file === null || line === null) continue;
+    const numbers = lines.get(file) ?? /* @__PURE__ */ new Set();
+    lines.set(file, numbers.add(line));
+  }
+  return lines;
+}
+function buildRequest(pr2, diff, prior = []) {
+  const files = pr2.files.map((f) => `- ${f.path}`).join("\n") || "(none)";
+  const priorSection = formatPriorComments(prior);
+  return `# Code review request
+
+- PR: #${pr2.number} ${pr2.title}
+- Head: \`${pr2.headRefName}\` (\`${pr2.headRefOid}\`)
+- Base: \`${pr2.baseRefName}\` (\`${pr2.baseRefOid}\`)
+
+## Changed files
+
+${files}
+
+## Diff
+
+Each added or context line is prefixed with a left gutter showing its line number in the new file. When citing a finding as \`file:line\`, use that gutter number \u2014 do **not** count lines in this document. Removed lines (\`-\`) and headers have a blank gutter and cannot be commented on.
+
+\`\`\`diff
+${withNewFileLineNumbers(diff.trimEnd())}
+\`\`\`
+${priorSection && `
+${priorSection}`}`;
+}
+
+// src/features/review/post.ts
+function isAlreadyRaised(finding, prior) {
+  return finding.source === "already-raised" || hasMarker(prior, findingMarker(finding));
+}
+function details(finding) {
+  return [
+    ...finding.impact ? [`Impact: ${finding.impact}`] : [],
+    ...finding.recommendation ? [`Recommendation: ${finding.recommendation}`] : []
+  ];
+}
+function commentBody(finding) {
+  return [`**${finding.severity ?? "finding"}: ${finding.title}**`, ...details(finding), findingMarker(finding)].join("\n\n");
+}
+function planPost({ findings }, diff, prior) {
+  const lines = commentableLines(diff);
+  const plan = { comments: [], outside: [], skipped: [] };
+  for (const finding of findings) {
+    const { file, line } = finding;
+    if (isAlreadyRaised(finding, prior)) plan.skipped.push(finding);
+    else if (file && line !== null && lines.get(file)?.has(line))
+      plan.comments.push({ path: file, line, body: commentBody(finding), finding });
+    else plan.outside.push(finding);
+  }
+  return plan;
+}
+function outsideEntry(finding) {
+  const location = finding.file ? `\`${formatLocation(finding)}\`` : "no location";
+  const entry = [`- **${finding.severity ?? "finding"}** ${location} \u2014 ${finding.title}`, ...details(finding).map((d) => `  ${d}`)];
+  return [...entry, `  ${findingMarker(finding)}`].join("\n");
+}
+function reviewBody(summary, outside, footer = "") {
+  const sections = ["## Adversarial review", ...summary ? [summary] : []];
+  if (outside.length) sections.push(`### Findings outside the diff
+
+${outside.map(outsideEntry).join("\n")}`);
+  if (footer) sections.push(footer);
+  return sections.join("\n\n");
+}
+async function addComments(review, comments, { api, log }) {
+  const rejected = [];
+  for (const { finding, ...comment } of comments) {
+    try {
+      await api.add(review, comment);
+    } catch (error) {
+      if (!(error instanceof ReviewError)) throw error;
+      rejected.push(finding);
+      log(`GitHub rejected the comment on ${comment.path}:${comment.line}, so it goes in the review body: ${error.message}`);
+    }
+  }
+  return rejected;
+}
+async function postFindings(pr2, synthesis, diff, prior, deps) {
+  const { api, log } = deps;
+  const { comments, outside, skipped } = planPost(synthesis, diff, prior);
+  if (skipped.length) log(`skipped ${skipped.length} finding(s) already raised on the PR`);
+  if (!comments.length && !outside.length) return log("nothing new to post");
+  const review = await api.open(pr2);
+  try {
+    const rejected = await addComments(review, comments, deps);
+    const url = await api.submit(pr2, review, reviewBody(synthesis.summary, [...outside, ...rejected], deps.footer));
+    log(`posted ${comments.length - rejected.length} inline comment(s) and ${outside.length + rejected.length} in the review body: ${url}`);
+  } catch (error) {
+    try {
+      await api.discard(pr2, review);
+    } catch (discardError) {
+      log(`could not discard the pending review: ${discardError instanceof Error ? discardError.message : String(discardError)}`);
+    }
+    throw error;
+  }
+}
+
+// src/features/review/preflight.ts
+import { execFile as execFile2 } from "child_process";
+var commandTimeout = 3e4;
+var probeTimeout = 6e4;
+var maxBodyChars2 = 300;
+function exec(harness, args) {
+  return new Promise((resolve) => {
+    const options = { encoding: "utf8", timeout: commandTimeout, shell: process.platform === "win32" };
+    execFile2(harness, args, options, (error, stdout) => resolve({ ok: !error, stdout }));
+  });
+}
+async function claudeSignedIn() {
+  const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
+  if (!ok) return false;
+  try {
+    const parsed = JSON.parse(stdout);
+    return typeof parsed === "object" && parsed !== null && "loggedIn" in parsed && parsed.loggedIn === true;
+  } catch {
+    return false;
+  }
+}
+async function reach({ url, headers, body }) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...headers },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(probeTimeout)
+    });
+    if (response.ok) return void 0;
+    const text2 = (await response.text()).trim().slice(0, maxBodyChars2);
+    return `HTTP ${response.status}${text2 ? `: ${text2}` : ""}`;
+  } catch (error) {
+    if (!(error instanceof Error)) return String(error);
+    const cause = error.cause instanceof Error ? error.cause.message : "";
+    return cause ? `${error.message} (${cause})` : error.message;
+  }
+}
+var checks = {
+  onPath: async (harness) => (await exec(harness, ["--version"])).ok,
+  signedIn: async (harness) => harness === "claude" ? claudeSignedIn() : (await exec("codex", ["login", "status"])).ok,
+  reach
+};
+var loginCommand = { claude: "claude auth login", codex: "codex login" };
+function signedOut({ slot: { harness }, keys }) {
+  const settings = keys.map((key) => `${key}.provider and ${key}.model`).join(", and ");
+  return `${harness} is not signed in (${keys.join(", ")}); run \`${loginCommand[harness]}\`, or run it through LiteLLM or Foundry by setting ${settings} (see \`yoke models\`)`;
+}
+async function slotProblem(use, check) {
+  const { harness, model, probe } = use.slot;
+  if (!await check.onPath(harness)) return `${harness} CLI not found on PATH; install it`;
+  if (!probe) return await check.signedIn(harness) ? void 0 : signedOut(use);
+  const error = await check.reach(probe);
+  return error && `${harness} model "${model}" at ${probe.url}: ${error}`;
+}
+function slotsToRun(slots) {
+  const uses = [
+    ["review.reviewer1", slots.reviewer1],
+    ["review.reviewer2", slots.reviewer2],
+    ["review.synthesis", slots.synthesis ?? { harness: slots.reviewer1.harness }]
+  ];
+  const distinct = /* @__PURE__ */ new Map();
+  for (const [key, slot] of uses) {
+    const id = `${slot.harness}:${slot.provider ?? "own"}:${slot.model ?? ""}`;
+    const use = distinct.get(id);
+    if (use) use.keys.push(key);
+    else distinct.set(id, { slot, keys: [key] });
+  }
+  return [...distinct.values()];
+}
+async function assertViable(slots, check = checks) {
+  const problems = await Promise.all(slotsToRun(slots).map((use) => slotProblem(use, check)));
+  const errors = problems.filter((problem) => problem !== void 0);
+  if (errors.length) throw new ReviewError(["Cannot review:", ...errors.map((error) => `- ${error}`)].join("\n"));
+}
+
+// src/features/review/reviewLog.ts
+import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { join as join3 } from "path";
+function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */ new Date()) {
+  let path;
+  let buffered = [];
+  return {
+    append: (line) => {
+      if (path) appendFileSync(path, `${line}
+`);
+      else buffered.push(line);
+    },
+    attach: (reviewDir) => {
+      mkdirSync2(reviewDir, { recursive: true });
+      path = join3(reviewDir, "review.log");
+      appendFileSync(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
+`);
+      buffered = [];
+    }
+  };
+}
+function logged(ui, append) {
+  const both = (show) => (line) => {
+    append(line);
+    show(line);
+  };
+  return {
+    log: both(ui.log),
+    track: (label) => {
+      append(`${label}\u2026`);
+      const status = ui.track(label);
+      return {
+        update: (activity) => {
+          append(`${label}: ${activity}`);
+          status.update(activity);
+        },
+        succeed: both(status.succeed),
+        fail: both(status.fail)
+      };
+    },
+    stop: ui.stop
+  };
+}
+
+// src/features/review/run.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+
+// src/features/review/cachedSlots.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
+function slotsPath(reviewDir) {
+  return join4(reviewDir, "slots.json");
+}
+function isCachedSlots(value) {
+  return typeof value === "object" && value !== null && Object.values(value).every((slot) => typeof slot === "string");
+}
+function readCachedSlots(reviewDir) {
+  const path = slotsPath(reviewDir);
+  if (!existsSync3(path)) return {};
+  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  return isCachedSlots(parsed) ? parsed : {};
+}
+function cachedSlot(reviewDir, step) {
+  return readCachedSlots(reviewDir)[step];
+}
+function recordSlot(reviewDir, step, slot) {
+  const slots = readCachedSlots(reviewDir);
+  slots[step] = slot;
+  writeFileSync3(slotsPath(reviewDir), `${JSON.stringify(slots, null, 2)}
+`);
+}
+
+// src/features/review/prompts.ts
+var severityRubric = `Severity rubric:
+- **blocker** \u2014 ships broken behaviour: crash, data loss, security hole, breaks the build or existing tests, or violates a stated requirement.
+- **major** \u2014 likely bug, missing error handling on a real failure mode, or a regression in existing behaviour. Not "this could be cleaner" or "this might be slow."
+- **minor** \u2014 narrow correctness or clarity issue with limited blast radius; worth fixing but not urgent.
+- **nit** \u2014 style, naming, micro-refactors, comment wording; reviewer would not block on it.
+
+Default to the lower tier when uncertain. Code-style preferences, refactor suggestions, and "I would have written it differently" belong in nit \u2014 not major. A finding is only major if you can name a concrete failure mode or regression.`;
+var reviewerPrompt = `You are acting as a reviewer for a proposed code change made by another engineer. The full review request \u2014 PR, base, changed files, and unified diff \u2014 is in the request file whose absolute path is given below.
+
+Your working directory is the repository under review at the PR's head, so you can read any file in it for context beyond the diff. Do not modify any file.
+
+Read the request file, then produce a thorough code review in Markdown.
+
+## When to flag a finding
+
+A finding is worth raising only if all of the following hold:
+
+1. It meaningfully impacts the accuracy, performance, security, or maintainability of the code.
+2. The issue is discrete and actionable \u2014 not a vague observation about the codebase or a tangle of several things.
+3. Fixing it does not demand more rigour than the rest of the codebase already shows (e.g. don't ask for exhaustive input validation in a repo of one-off scripts).
+4. The issue was introduced by this change. Do not flag pre-existing bugs.
+5. The original author would likely fix it if made aware.
+6. It does not rely on unstated assumptions about the codebase or author's intent.
+7. You can name the concretely affected code path. Speculation that a change *might* disrupt something elsewhere is not enough \u2014 identify the other code that is provably affected.
+8. It is clearly not an intentional change by the author.
+
+## Never recommend adding a code comment
+
+Never raise a finding whose recommendation is to add a code comment \u2014 including a comment that restates what the code does, labels a block, or narrates why the change was made. The absence of comments is never a defect: do not ask for explanatory comments, doc comments, or TODOs, and do not list "missing comments" as an observation.
+
+Two cases are still legitimate findings:
+
+1. A comment this change made stale or wrong. Recommend removing or correcting it.
+2. Genuinely misleading code. You may raise it, but the recommendation must be a clearer name, a smaller function, or a test.
+
+## Tautological and vacuous tests
+
+Flag tests added or changed by this change that cannot fail when the behaviour they claim to cover breaks. Do not flag pre-existing tests the change left untouched. Patterns:
+
+1. Asserting a mock returns what it was stubbed to return.
+2. Computing the expected value with the code under test, or with a copy of its logic.
+3. Asserting only that a mocked function was called, when that mock is the whole subject of the test.
+4. Any test that would still pass if the implementation were broken.
+5. No assertions, or only \`toBeDefined\`/truthy checks.
+6. Snapshots of mocked output.
+
+Recommendation: assert against an independent expected value (a literal or a hand-derived result) or real behaviour, or delete the test. Severity is **minor** by default; **major** when the test is the sole coverage of a behaviour this change introduces or modifies, since that behaviour is then effectively untested.
+
+## How to write the comment (Impact + Recommendation)
+
+1. Make clear *why* the issue is a bug.
+2. Communicate severity accurately \u2014 do not inflate.
+3. Keep it brief: at most one paragraph of prose. Avoid line breaks inside the natural-language flow unless needed for a code fragment.
+4. Do not paste code chunks longer than 3 lines. Wrap short snippets in inline code or a fenced block.
+5. State explicitly the scenarios, environments, or inputs needed for the bug to manifest \u2014 and signal up front that severity depends on those factors.
+6. Tone is matter-of-fact: not accusatory, not gushing. Read as a helpful assistant, not a performative human reviewer.
+7. Write so the author grasps the point on first read.
+8. Avoid flattery and filler ("Great job\u2026", "Thanks for\u2026"). They are not useful to the author.
+
+Ignore trivial style unless it obscures meaning or violates a documented standard. One finding per distinct issue.
+
+## How many findings to return
+
+List every finding that the original author would want to know about and fix. Do not stop at the first qualifying one. If nothing clears the bar above, return no findings \u2014 empty is better than padded.
+
+## Output format
+
+For each finding include:
+- Severity (blocker, major, minor, nit) \u2014 see rubric below
+- File and line (e.g. \`src/foo.ts:42\`) when the finding is tied to a specific location. Take the line number from the diff's left gutter (its line in the new file); never count lines in the request file.
+- Impact: what could go wrong, including the conditions under which it manifests
+- Recommendation: a concrete change
+
+${severityRubric}
+
+Group findings by severity. If you have no findings in a category, omit it. End with a short overall summary.
+
+Output only the review Markdown. Do not include any preamble or commentary about the process.`;
+var synthesisPrompt = `You are consolidating independent code reviews of the same change. The original review request and the reviews are in the files listed below.
+
+If a review is listed as missing, that reviewer failed. Work from the reviews you have; treat every finding as coming only from the reviewer that succeeded, do not mark anything \`confirmed\` or \`disputed\`, and say in the Summary that one review is missing.
+
+Never name a reviewer by its model or tool in a title, Summary, Impact or Recommendation; write "one reviewer" or "both reviewers". Tool and command names that are part of the code under review are fine.
+
+Read the request and the available reviews, deduplicate findings, and produce a single consolidated review in Markdown with this exact structure:
+
+# Code review synthesis
+
+## Summary
+
+A 2-3 sentence overall summary of the change's quality and the most important risks.
+
+## Findings
+
+For each finding, emit one block in this exact format:
+
+### Finding: <short title>
+- Severity: blocker | major | minor | nit
+- Source: confirmed | disputed | reviewer1-only | reviewer2-only | already-raised
+- Location: \`path/to/file.ext:LINE\` or \`n/a\` when not tied to a specific line
+- Impact: one sentence on what could go wrong
+- Recommendation: one or two sentences with a concrete change
+
+${severityRubric} If a reviewer marked something major but the impact reads as taste or hypothetical, downgrade it.
+
+## Keep tautological-test findings
+
+A finding that a test added or changed by this change is tautological or vacuous \u2014 it asserts a mock returns its stub, computes its expected value with the code under test, only checks a mock was called, has no real assertions, snapshots mocked output, or would still pass if the implementation broke \u2014 is a legitimate defect, not taste. Keep it even when only one reviewer raised it, and do not downgrade it below minor. Keep major when the test is the sole coverage of a behaviour the change introduces or modifies.
+
+## Drop comment-adding findings
+
+Omit entirely any finding whose recommendation is to add a code comment, and any finding whose defect is that comments are absent \u2014 even when both reviewers agreed on it. Keep a finding about a comment this change made stale or wrong, and a finding about genuinely misleading code whose recommendation is a clearer name, a smaller function, or a test.
+
+Rules:
+- \`confirmed\` = both reviewers raised it.
+- \`disputed\` = the reviewers disagreed on the diagnosis or fix.
+- \`reviewer1-only\` / \`reviewer2-only\` = only that reviewer raised it.
+- \`already-raised\` = a comment under "Prior review comments" in the request substantively covers this finding \u2014 same file, same defect or recommendation \u2014 even when that thread is resolved or outdated. Cosmetic overlap is not enough. Prefer \`already-raised\` over the other source values when it applies.
+- Order findings by severity (blocker, major, minor, nit), then by source (confirmed first).
+- If a finding has no specific file:line, set Location to \`n/a\` exactly.
+- Do not invent findings beyond what the reviews support.
+
+Output only the consolidated Markdown. No preamble, no commentary about your process.`;
+function buildReviewerPrompt(requestPath) {
+  return `${reviewerPrompt}
+
+The review request is at: ${requestPath}
+`;
+}
+function buildSynthesisPrompt(requestPath, reviews) {
+  const files = reviews.map(({ reviewer, path }) => `- ${reviewer} review: ${path ?? "missing"}`);
+  return `${synthesisPrompt}
+
+Files:
+- Request: ${requestPath}
+${files.join("\n")}
+`;
+}
+
+// src/features/review/usedModels.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
+var repoUrl = "https://github.com/MakerXStudio/yoke";
+function modelsPath(reviewDir) {
+  return join5(reviewDir, "models.json");
+}
+function isUsedModels(value) {
+  return typeof value === "object" && value !== null && Object.values(value).every((model) => typeof model === "string");
+}
+function readUsedModels(reviewDir) {
+  const path = modelsPath(reviewDir);
+  if (!existsSync4(path)) return {};
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  return isUsedModels(parsed) ? parsed : {};
+}
+function recordUsedModel(reviewDir, step, harness, model) {
+  const models = readUsedModels(reviewDir);
+  models[step] = model ? model.split("/").at(-1) ?? model : `${harness} default`;
+  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+`);
+}
+function forgetUsedModel(reviewDir, step) {
+  const models = readUsedModels(reviewDir);
+  if (!(step in models)) return;
+  delete models[step];
+  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+`);
+}
+function list(items) {
+  return items.length > 1 ? `${items.slice(0, -1).join(", ")} and ${items.at(-1)}` : items[0] ?? "";
+}
+function modelsFooter({ reviewer1, reviewer2, synthesis }) {
+  const reviewers2 = [reviewer1, reviewer2].filter((model) => model !== void 0);
+  const used = [...reviewers2.length ? [`reviewed with ${list(reviewers2)}`] : [], ...synthesis ? [`combined with ${synthesis}`] : []];
+  return `---
+_Adversarial review by [yoke](${repoUrl})${used.length ? `: ${used.join("; ")}` : ""}._`;
+}
+
+// src/features/review/run.ts
+var reviewers = ["reviewer1", "reviewer2"];
+function seconds(since) {
+  return `${Math.round((Date.now() - since) / 1e3)}s`;
+}
+function describeSlot({ harness, model, provider }) {
+  return `${harness}: ${provider ? `${provider}/` : ""}${model ?? "default model"}`;
+}
+async function runStep({ name, label, slot, ...step }, context) {
+  const started = Date.now();
+  const status = context.track(label);
+  const { harness, override } = slot;
+  const result = await context.runHarness({
+    ...step,
+    harness,
+    override,
+    cwd: context.cwd,
+    reviewDir: context.reviewDir,
+    onProgress: status.update
+  });
+  if (result.ok) {
+    status.succeed(`${label} done in ${seconds(started)}`);
+    recordUsedModel(context.reviewDir, name, harness, slot.model ?? result.model);
+    recordSlot(context.reviewDir, name, describeSlot(slot));
+    return true;
+  }
+  status.fail(`${label} failed after ${seconds(started)}: ${result.error}`);
+  rmSync(step.outputPath, { force: true });
+  forgetUsedModel(context.reviewDir, name);
+  return false;
+}
+function hasOutput({ name, slot, outputPath }, context) {
+  if (cachedSlot(context.reviewDir, name) !== describeSlot(slot)) return false;
+  return existsSync5(outputPath) && readFileSync5(outputPath, "utf8").trim().length > 0;
+}
+async function runOrReuse(step, context) {
+  if (!hasOutput(step, context)) return { ok: await runStep(step, context), ran: true };
+  context.log(`${step.label}: cached`);
+  return { ok: true, ran: false };
+}
+function reviewPath(context, reviewer) {
+  return join6(context.reviewDir, `${reviewer}.md`);
+}
+function reviewerLabel(reviewer, context) {
+  return `${reviewer} (${describeSlot(context.slots[reviewer])})`;
+}
+function withReviewers(result, context) {
+  const line = reviewers.map((reviewer) => reviewerLabel(reviewer, context)).join(", ");
+  return { ...result, report: `Reviewers: ${line}
+
+${result.report}` };
+}
+function synthesisResult(markdown) {
+  const synthesis = parseSynthesis(markdown);
+  if (!synthesis.summary && !synthesis.findings.length) return { report: markdown.trim(), synthesis: null, markdown: null };
+  return { report: formatSynthesis(synthesis), synthesis, markdown };
+}
+function rawReviews(succeeded, context) {
+  const report = succeeded.map((reviewer) => `# ${reviewerLabel(reviewer, context)} review
+
+${readFileSync5(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
+  return { report, synthesis: null, markdown: null };
+}
+function synthesisSlot(succeeded, context) {
+  const [first = "reviewer1"] = succeeded;
+  return context.slots.synthesis ?? { harness: context.slots[first].harness };
+}
+async function synthesise(requestPath, succeeded, reviewersRan, context) {
+  const slot = synthesisSlot(succeeded, context);
+  const outputPath = join6(context.reviewDir, "synthesis.md");
+  if (reviewersRan) rmSync(outputPath, { force: true });
+  const files = reviewers.map((reviewer) => ({
+    reviewer: reviewerLabel(reviewer, context),
+    path: succeeded.includes(reviewer) ? reviewPath(context, reviewer) : null
+  }));
+  const prompt = buildSynthesisPrompt(requestPath, files);
+  if ((await runOrReuse({ name: "synthesis", label: `synthesis (${describeSlot(slot)})`, slot, prompt, outputPath }, context)).ok)
+    return synthesisResult(readFileSync5(outputPath, "utf8"));
+  context.log("showing the raw reviews instead");
+  return rawReviews(succeeded, context);
+}
+async function runReview(request, context) {
+  const requestPath = join6(context.reviewDir, "request.md");
+  writeFileSync5(requestPath, request);
+  const prompt = buildReviewerPrompt(requestPath);
+  const results = await Promise.all(
+    reviewers.map((reviewer) => {
+      const slot = context.slots[reviewer];
+      const outputPath = reviewPath(context, reviewer);
+      return runOrReuse({ name: reviewer, label: reviewerLabel(reviewer, context), slot, prompt, outputPath }, context);
+    })
+  );
+  const succeeded = reviewers.filter((_, i) => results[i]?.ok);
+  if (!succeeded.length) throw new ReviewError("Every reviewer failed; nothing to report.");
+  const synthesised = await synthesise(
+    requestPath,
+    succeeded,
+    results.some((result) => result.ran),
+    context
+  );
+  return withReviewers(synthesised, context);
+}
+
+// src/features/review/status.ts
+import { styleText } from "util";
+import { createLogUpdate } from "log-update";
+async function timed(ui, label, work) {
+  const started = Date.now();
+  const status = ui.track(label);
+  const elapsed = () => `${Math.round((Date.now() - started) / 1e3)}s`;
+  try {
+    const result = await work();
+    status.succeed(`${label} (${elapsed()})`);
+    return result;
+  } catch (error) {
+    status.fail(`${label} failed after ${elapsed()}`);
+    throw error;
+  }
+}
+function lineUi(log, { activity }) {
+  return {
+    log,
+    track: (label) => {
+      log(`${label}\u2026`);
+      const update = (text2) => activity ? log(`${label}: ${text2}`) : void 0;
+      return { update, succeed: log, fail: log };
+    },
+    stop: () => {
+    }
+  };
+}
+var frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var tickMs = 80;
+function spinnerUi(stream) {
+  const update = createLogUpdate(stream);
+  const running = [];
+  let frame = 0;
+  let timer;
+  const paint = (colour, text2) => styleText(colour, text2, { stream });
+  const render = () => update(running.map((entry) => `${paint("cyan", frames[frame] ?? "")} ${entry.text}`).join("\n"));
+  const persist = (line) => {
+    update.clear();
+    update.persist(line);
+    render();
+  };
+  const settle = (entry, line) => {
+    running.splice(running.indexOf(entry), 1);
+    persist(line);
+    if (running.length || !timer) return;
+    clearInterval(timer);
+    timer = void 0;
+  };
+  return {
+    log: persist,
+    track: (label) => {
+      const entry = { label, text: label };
+      running.push(entry);
+      timer ??= setInterval(() => {
+        frame = (frame + 1) % frames.length;
+        render();
+      }, tickMs);
+      render();
+      return {
+        update: (activity) => entry.text = `${label} \u2014 ${activity}`,
+        succeed: (text2) => settle(entry, `${paint("green", "\u2713")} ${text2}`),
+        fail: (text2) => settle(entry, `${paint("red", "\u2717")} ${text2}`)
+      };
+    },
+    stop: () => {
+      if (timer) clearInterval(timer);
+      update.done();
+    }
+  };
+}
+
+// src/features/review/review.ts
+function reviewRunDir(pr2, env = process.env, home = homedir2()) {
+  const [, owner = "", repo = ""] = new URL(pr2.url).pathname.split("/");
+  const run2 = `${pr2.number}-${pr2.baseRefOid}-${pr2.headRefOid}`;
+  return join7(env.XDG_CACHE_HOME || join7(home, ".cache"), "yoke", "reviews", owner, repo, run2);
+}
+var cachedOutputs = ["reviewer1.md", "reviewer2.md", "synthesis.md", "review.md", "models.json", "slots.json"];
+function prepareRunDir(reviewDir, force) {
+  mkdirSync3(reviewDir, { recursive: true });
+  if (force) for (const name of cachedOutputs) rmSync2(join7(reviewDir, name), { force: true });
+}
+async function reviewAtHead(pr2, reviewDir, request, slots, ui) {
+  const checkoutDir = mkdtempSync(join7(tmpdir(), "yoke-review-"));
+  try {
+    const checkout = await timed(ui, `checking out ${pr2.headRefOid.slice(0, 7)}`, () => checkoutHead(pr2, checkoutDir));
+    try {
+      return await runReview(request, { cwd: checkout.cwd, reviewDir, slots, runHarness, log: ui.log, track: ui.track });
+    } finally {
+      await checkout.remove();
+    }
+  } finally {
+    rmSync2(checkoutDir, { recursive: true, force: true });
+  }
+}
+function savedReview(path, post) {
+  if (!post || !existsSync6(path)) return null;
+  return parseSynthesis(readFileSync6(path, "utf8"));
+}
+function saveReview(path, markdown) {
+  if (markdown) writeFileSync6(path, markdown);
+  else rmSync2(path, { force: true });
+}
+async function reviewPr(number, settings, { post, force }, io) {
+  const file = reviewLog();
+  const ui = logged(io.ui, file.append);
+  const out = (text2) => {
+    file.append(text2);
+    io.out(text2);
+  };
+  const { log } = ui;
+  const slots = resolveSlots(settings);
+  const pr2 = await timed(ui, number ? `fetching PR #${number}` : "fetching this branch's PR", () => fetchPr(number));
+  log(`#${pr2.number} ${pr2.title}`);
+  const [diff, prior] = await timed(
+    ui,
+    "fetching the diff and earlier review comments",
+    () => Promise.all([fetchDiff(pr2), fetchPriorComments(pr2)])
+  );
+  const reviewDir = reviewRunDir(pr2);
+  prepareRunDir(reviewDir, force);
+  file.attach(reviewDir);
+  const path = join7(reviewDir, "review.md");
+  let synthesis = savedReview(path, post);
+  if (synthesis) {
+    log(`posting the saved review of #${pr2.number} at ${pr2.headRefOid.slice(0, 7)}`);
+    out(formatSynthesis(synthesis));
+  } else {
+    await timed(ui, "checking each reviewer can run", () => assertViable(slots));
+    log(`review folder: ${reviewDir}`);
+    const result = await reviewAtHead(pr2, reviewDir, buildRequest(pr2, diff, prior), slots, ui);
+    out(result.report);
+    synthesis = result.synthesis;
+    saveReview(path, result.markdown);
+  }
+  if (!post) return;
+  if (!synthesis) throw new ReviewError("Not posting: the synthesis did not produce findings in the expected format.");
+  const findings = synthesis;
+  const footer = modelsFooter(readUsedModels(reviewDir));
+  await timed(ui, `posting to #${pr2.number}`, () => postFindings(pr2, findings, diff, prior, { api: github, log, footer }));
+}
+
 // src/features/sync/sync.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join8 } from "path";
 
 // src/skill.ts
 var ownerMarker = 'owner: "@makerx/yoke"';
-function renderSkill({ name, description, body }) {
-  return ["---", `name: ${name}`, `description: ${description}`, "metadata:", `  ${ownerMarker}`, "---", "", body.trim(), ""].join("\n");
+function renderSkill({ name, description, body, disableModelInvocation }) {
+  const invocation = disableModelInvocation ? ["disable-model-invocation: true"] : [];
+  return [
+    "---",
+    `name: ${name}`,
+    `description: ${JSON.stringify(`[yoke] ${description}`)}`,
+    ...invocation,
+    "metadata:",
+    `  ${ownerMarker}`,
+    "---",
+    "",
+    body.trim(),
+    ""
+  ].join("\n");
 }
 
 // src/features/pr/skill.ts
 var prSkill = {
   name: "pr",
-  description: "Raise a PR with a concise What/Why/(How) description. Use when asked to raise, open or create a pull request, or to rewrite a PR description.",
+  description: "Raise or rewrite a PR with a concise What/Why/(How) description.",
   body: `
 Run \`yoke pr raise --help\` and follow it exactly. Do not use \`gh pr create\`.
 
@@ -274,25 +1714,39 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 `
 };
 
+// src/features/review/skill.ts
+var reviewSkill = {
+  name: "review",
+  description: "Adversarially review a PR with Claude and Codex, then combine their findings.",
+  disableModelInvocation: true,
+  body: `
+Run \`yoke review $ARGUMENTS\` in the foreground, not as a background task, with the longest timeout your shell tool allows, so the user sees each reviewer's progress as it streams; two reviewers and a synthesis pass take several minutes. Then relay the findings it printed. Do not add findings of your own or re-review the code. Each reviewer's tool calls go to \`review.log\` in the review folder it prints, not to the output; read that log only if the user asks what a reviewer did.
+
+If \`$ARGUMENTS\` does not already include \`--post\`, ask whether to post the findings to the PR. If the user agrees, run \`yoke review $ARGUMENTS --post\` with any \`--force\` removed from \`$ARGUMENTS\`; it posts the review it just saved rather than reviewing again, as one GitHub review with an inline comment per finding on a diff line, and skips findings already raised on the PR. Relay what it reports.
+
+If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
+`
+};
+
 // src/features/sync/sync.ts
-var bundledSkills = [prSkill];
-function skillsRoot(user, cwd = process.cwd(), home = homedir()) {
-  return join(user ? home : cwd, ".claude", "skills");
+var bundledSkills = [prSkill, reviewSkill];
+function skillsRoot(user, cwd = process.cwd(), home = homedir3()) {
+  return join8(user ? home : cwd, ".claude", "skills");
 }
 function isOwnedByUser(skillFile) {
-  return existsSync(skillFile) && !readFileSync(skillFile, "utf8").includes(ownerMarker);
+  return existsSync7(skillFile) && !readFileSync7(skillFile, "utf8").includes(ownerMarker);
 }
 function syncSkills(destination, skills = bundledSkills) {
   const result = { written: [], skipped: [] };
   for (const skill of skills) {
-    const target = join(destination, skill.name);
-    const skillFile = join(target, "SKILL.md");
+    const target = join8(destination, skill.name);
+    const skillFile = join8(target, "SKILL.md");
     if (isOwnedByUser(skillFile)) {
       result.skipped.push(target);
       continue;
     }
-    mkdirSync(target, { recursive: true });
-    writeFileSync(skillFile, renderSkill(skill));
+    mkdirSync4(target, { recursive: true });
+    writeFileSync7(skillFile, renderSkill(skill));
     result.written.push(skillFile);
   }
   return result;
@@ -318,4 +1772,75 @@ pr.command("raise").description("Validate a PR title and body, then create the P
     process.exitCode = 1;
   }
 });
-program.parse();
+var providerKeys = settingKeys.filter((key) => !key.startsWith("review."));
+function addSettingOptions(command, keys) {
+  for (const key of keys) {
+    const flag = settingFlag(key);
+    if (flag) command.option(`${flag} <value>`, settingDescription(key));
+  }
+  return command;
+}
+function optionName(flag) {
+  return flag.slice(2).replace(/-(.)/g, (_, next) => next.toUpperCase());
+}
+function flagSettings(options, keys) {
+  const flags = {};
+  for (const key of keys) {
+    const flag = settingFlag(key);
+    const value = flag && options[optionName(flag)];
+    if (typeof value === "string") flags[key] = value;
+  }
+  return flags;
+}
+var settingsHelp = "\nEach setting falls back to its YOKE_* env var, then `yoke config set --user`; API keys come from env or config only. Run `yoke config` to see them all.";
+addSettingOptions(
+  program.command("review").description("Review the current branch's PR, or PR <number>, with Claude and Codex in parallel, then combine their findings").argument("[number]", "PR number; reviewed without checking it out").option("--post", "post the findings to the PR as one review, reusing the saved review of the PR head when there is one").option("--force", "discard this PR head's cached reviews and run every pass again").option("--verbose", "print every step and each reviewer's tool calls as log lines instead of live spinners"),
+  settingKeys
+).addHelpText("after", settingsHelp).action(async (number, options) => {
+  const verbose = options.verbose ?? false;
+  const ui = process.stderr.isTTY && !verbose ? spinnerUi(process.stderr) : lineUi(console.error, { activity: verbose });
+  try {
+    const settings = resolveSettings(flagSettings(options, settingKeys), process.env, readUserConfig(userConfigPath()));
+    const run2 = { post: options.post ?? false, force: options.force ?? false };
+    await reviewPr(number, settings, run2, { out: console.log, ui });
+  } catch (error) {
+    if (!(error instanceof ReviewError || error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  } finally {
+    ui.stop();
+  }
+});
+addSettingOptions(
+  program.command("models").description("List the models each configured provider serves, for review.*.provider and review.*.model"),
+  providerKeys
+).addHelpText("after", settingsHelp).action(async (options) => {
+  try {
+    const models = await listModels(resolveSettings(flagSettings(options, providerKeys), process.env, readUserConfig(userConfigPath())));
+    console.log(models.join("\n"));
+  } catch (error) {
+    if (!(error instanceof ReviewError || error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
+var config = program.command("config").description("yoke settings");
+config.command("list", { isDefault: true }).description("List every setting and its value from YOKE_* env vars, then the user-level yoke config; secrets are masked").action(() => {
+  try {
+    console.log(listSettings(resolveSettings({}, process.env, readUserConfig(userConfigPath())), process.stdout.columns));
+  } catch (error) {
+    if (!(error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
+config.command("set").description(`Write a setting to the user-level yoke config (${settingKeys.join(", ")})`).argument("<key>", "setting key").argument("<value>", "setting value").option("--user", "write to the user-level config; required, since repo-level config is not supported").action((key, value, options) => {
+  try {
+    console.log(setSetting(key, value, options.user ?? false, userConfigPath()));
+  } catch (error) {
+    if (!(error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
+await program.parseAsync();