@makerx/yoke 0.6.0 → 0.7.0

package/README.md

@@ -23,12 +23,14 @@ yoke sync --user   # ~/.claude/skills
 
 - `/pr` raises a PR with a short What/Why/(How) description.
 - `/review [number]` reviews a PR with Claude and Codex, combines their findings and offers to post them. [Configure](src/features/review/README.md#settings).
+- `/review-ci` adds a workflow that reviews each PR in CI and helps set its secrets. [Details](src/features/review/README.md#ci).
 
 ## CLI
 
 ```bash
 yoke sync [--user]      # write yoke's skills
 yoke review [number]    # review a PR (used by /review)
+yoke review-ci          # add the CI review workflow (used by /review-ci)
 yoke models             # list each provider's models
 ```
 

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.6.0",
+  version: "0.7.0",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -57,6 +57,9 @@ var package_default = {
     vitest: "^5.0.5",
     yaml: "^2.9.1"
   },
+  overrides: {
+    minimatch: "^11.0.3"
+  },
   engines: {
     node: ">=24"
   }
@@ -402,6 +405,11 @@ function raisePr({ title, body, base, draft }, run2 = runGh) {
   return output.at(-1) ?? "";
 }
 
+// src/features/review/ci.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+
 // src/features/review/pr.ts
 import { execFile } from "child_process";
 import { join as join2 } from "path";
@@ -607,6 +615,101 @@ function buildOverride({ harness, model }, provider) {
   return buildClaudeOverride(provider, endpoints, model);
 }
 
+// src/features/review/ci.ts
+var reviewWorkflowRef = "MakerXStudio/yoke/.github/workflows/review.yml@main";
+var callerWorkflowPath = join3(".github", "workflows", "review-pr.yml");
+var ciSecrets = ["REVIEW_CI_BASE_URL", "REVIEW_CI_API_KEY"];
+var slots = [
+  { slot: "reviewer1", defaultHarness: "claude", required: true },
+  { slot: "reviewer2", defaultHarness: "codex", required: true },
+  { slot: "synthesis", defaultHarness: void 0, required: false }
+];
+function slotInputs(settings, errors) {
+  const inputs = [];
+  for (const { slot, defaultHarness, required } of slots) {
+    const harnessKey = `review.${slot}.harness`;
+    const modelKey = `review.${slot}.model`;
+    const harness = settings[harnessKey] ?? defaultHarness;
+    const model = settings[modelKey];
+    if (harness && !isHarness(harness))
+      errors.push(`${harnessKey} "${harness}" must be claude or codex; ${howToSet(harnessKey, "<claude|codex>")}`);
+    if (required && !model) errors.push(`${modelKey} is required; ${howToSet(modelKey, "<model>")} (see \`yoke models\`)`);
+    if (!required && harness && !model)
+      errors.push(`${modelKey} is required when ${harnessKey} is set; ${howToSet(modelKey, "<model>")} (see \`yoke models\`)`);
+    if (harness) inputs.push([`${slot}-harness`, harness]);
+    if (model) inputs.push([`${slot}-model`, model]);
+  }
+  return inputs;
+}
+function callerWorkflow(settings, providerFlag) {
+  const errors = [];
+  const provider = providerFlag ?? settings["review.reviewer1.provider"] ?? "litellm";
+  if (!isProviderKind(provider)) errors.push(`provider "${provider}" must be ${providerKinds.join(" or ")}; pass --provider`);
+  const inputs = slotInputs(settings, errors);
+  if (errors.length || !isProviderKind(provider))
+    throw new ReviewError(["Cannot write the review workflow:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  return { provider, inputs: [["provider", provider], ...inputs] };
+}
+function yamlValue(value) {
+  return /^[\w./:@-]+$/.test(value) && !/^([-+.\d_eE]+|0[xo][\da-f]+|true|false|yes|no|on|off|y|n|null|~)$/i.test(value) ? value : JSON.stringify(value);
+}
+function renderCallerWorkflow({ inputs }) {
+  return [
+    "name: Review PR",
+    "",
+    "on:",
+    "  pull_request:",
+    "    types: [opened, reopened, ready_for_review]",
+    "",
+    "permissions:",
+    "  contents: read",
+    "  pull-requests: write",
+    "",
+    "jobs:",
+    "  review:",
+    `    uses: ${reviewWorkflowRef}`,
+    "    with:",
+    ...inputs.map(([name, value]) => `      ${name}: ${yamlValue(value)}`),
+    "    secrets: inherit",
+    ""
+  ].join("\n");
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function secretCommands(settings, provider) {
+  const baseUrl = settings[`${provider}.baseUrl`];
+  return [`gh secret set REVIEW_CI_BASE_URL${baseUrl ? ` --body ${shellQuote(baseUrl)}` : ""}`, "gh secret set REVIEW_CI_API_KEY"];
+}
+function repoRoot(cwd = process.cwd()) {
+  try {
+    return execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    throw new ReviewError("Not in a git repository; run `yoke review-ci` from the repo to review.");
+  }
+}
+function writeCallerWorkflow(root, content, force) {
+  const path = join3(root, callerWorkflowPath);
+  if (existsSync2(path)) {
+    if (readFileSync2(path, "utf8") === content) return "unchanged";
+    if (!force) throw new ReviewError(`${callerWorkflowPath} already exists and differs; pass --force to overwrite it.`);
+  }
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, content);
+  return "wrote";
+}
+function reviewCiReport(outcome, commands) {
+  const action = outcome === "wrote" ? "wrote" : "kept";
+  return [
+    `${action} ${callerWorkflowPath}`,
+    "",
+    `The workflow reads ${ciSecrets.join(" and ")}. Set them on the repo (or the org) with:`,
+    ...commands.map((command) => `  ${command}`),
+    "",
+    "Commit and push the workflow; each PR opened from this repo then gets a review."
+  ].join("\n");
+}
+
 // src/features/review/slots.ts
 var slotNames = ["reviewer1", "reviewer2", "synthesis"];
 function readProvider(settings, kind) {
@@ -716,9 +819,9 @@ async function listModels(settings, fetchModels = fetch) {
 }
 
 // src/features/review/review.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/features/review/findings.ts
 var severities = ["blocker", "major", "minor", "nit"];
@@ -780,7 +883,7 @@ function formatSynthesis({ summary, findings }) {
 
 // src/features/review/harness.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 
 // src/features/review/progress.ts
 var maxSummary = 80;
@@ -880,7 +983,7 @@ function exitError(harness, code, output) {
   return [`${harness} exited with code ${code ?? "unknown"}`, ...detail ? [detail] : []].join("\n");
 }
 function hasReview(path) {
-  return existsSync2(path) && readFileSync2(path, "utf8").trim().length > 0;
+  return existsSync3(path) && readFileSync3(path, "utf8").trim().length > 0;
 }
 var runHarness = (run2) => new Promise((resolve) => {
   const shell = process.platform === "win32";
@@ -919,7 +1022,7 @@ var runHarness = (run2) => new Promise((resolve) => {
     onLine(pending);
     if (code !== 0)
       return resolve({ ok: false, error: exitError(run2.harness, code, [stderr || finalText, lastError].filter(Boolean).join("\n")) });
-    if (run2.harness === "claude") writeFileSync2(run2.outputPath, finalText);
+    if (run2.harness === "claude") writeFileSync3(run2.outputPath, finalText);
     if (!hasReview(run2.outputPath)) return resolve({ ok: false, error: `${run2.harness} returned an empty review` });
     resolve(model ? { ok: true, model } : { ok: true });
   });
@@ -1161,11 +1264,11 @@ async function slotProblem(use, check) {
   const error = await check.reach(probe);
   return error && `${harness} model "${model}" at ${probe.url}: ${error}`;
 }
-function slotsToRun(slots) {
+function slotsToRun(slots2) {
   const uses = [
-    ["review.reviewer1", slots.reviewer1],
-    ["review.reviewer2", slots.reviewer2],
-    ["review.synthesis", slots.synthesis ?? { harness: slots.reviewer1.harness }]
+    ["review.reviewer1", slots2.reviewer1],
+    ["review.reviewer2", slots2.reviewer2],
+    ["review.synthesis", slots2.synthesis ?? { harness: slots2.reviewer1.harness }]
   ];
   const distinct = /* @__PURE__ */ new Map();
   for (const [key, slot] of uses) {
@@ -1176,15 +1279,15 @@ function slotsToRun(slots) {
   }
   return [...distinct.values()];
 }
-async function assertViable(slots, check = checks) {
-  const problems = await Promise.all(slotsToRun(slots).map((use) => slotProblem(use, check)));
+async function assertViable(slots2, check = checks) {
+  const problems = await Promise.all(slotsToRun(slots2).map((use) => slotProblem(use, check)));
   const errors = problems.filter((problem) => problem !== void 0);
   if (errors.length) throw new ReviewError(["Cannot review:", ...errors.map((error) => `- ${error}`)].join("\n"));
 }
 
 // src/features/review/reviewLog.ts
-import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join3 } from "path";
+import { appendFileSync, mkdirSync as mkdirSync3 } from "fs";
+import { join as join4 } from "path";
 function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */ new Date()) {
   let path;
   let buffered = [];
@@ -1195,8 +1298,8 @@ function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */
       else buffered.push(line);
     },
     attach: (reviewDir) => {
-      mkdirSync2(reviewDir, { recursive: true });
-      path = join3(reviewDir, "review.log");
+      mkdirSync3(reviewDir, { recursive: true });
+      path = join4(reviewDir, "review.log");
       appendFileSync(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
 `);
       buffered = [];
@@ -1227,31 +1330,31 @@ function logged(ui, append) {
 }
 
 // src/features/review/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
 
 // src/features/review/cachedSlots.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 function slotsPath(reviewDir) {
-  return join4(reviewDir, "slots.json");
+  return join5(reviewDir, "slots.json");
 }
 function isCachedSlots(value) {
   return typeof value === "object" && value !== null && Object.values(value).every((slot) => typeof slot === "string");
 }
 function readCachedSlots(reviewDir) {
   const path = slotsPath(reviewDir);
-  if (!existsSync3(path)) return {};
-  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  if (!existsSync4(path)) return {};
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
   return isCachedSlots(parsed) ? parsed : {};
 }
 function cachedSlot(reviewDir, step) {
   return readCachedSlots(reviewDir)[step];
 }
 function recordSlot(reviewDir, step, slot) {
-  const slots = readCachedSlots(reviewDir);
-  slots[step] = slot;
-  writeFileSync3(slotsPath(reviewDir), `${JSON.stringify(slots, null, 2)}
+  const slots2 = readCachedSlots(reviewDir);
+  slots2[step] = slot;
+  writeFileSync4(slotsPath(reviewDir), `${JSON.stringify(slots2, null, 2)}
 `);
 }
 
@@ -1396,32 +1499,32 @@ ${files.join("\n")}
 }
 
 // src/features/review/usedModels.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 var repoUrl = "https://github.com/MakerXStudio/yoke";
 function modelsPath(reviewDir) {
-  return join5(reviewDir, "models.json");
+  return join6(reviewDir, "models.json");
 }
 function isUsedModels(value) {
   return typeof value === "object" && value !== null && Object.values(value).every((model) => typeof model === "string");
 }
 function readUsedModels(reviewDir) {
   const path = modelsPath(reviewDir);
-  if (!existsSync4(path)) return {};
-  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  if (!existsSync5(path)) return {};
+  const parsed = JSON.parse(readFileSync5(path, "utf8"));
   return isUsedModels(parsed) ? parsed : {};
 }
 function recordUsedModel(reviewDir, step, harness, model) {
   const models = readUsedModels(reviewDir);
   models[step] = model ? model.split("/").at(-1) ?? model : `${harness} default`;
-  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+  writeFileSync5(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
 `);
 }
 function forgetUsedModel(reviewDir, step) {
   const models = readUsedModels(reviewDir);
   if (!(step in models)) return;
   delete models[step];
-  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+  writeFileSync5(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
 `);
 }
 function list(items) {
@@ -1467,7 +1570,7 @@ async function runStep({ name, label, slot, ...step }, context) {
 }
 function hasOutput({ name, slot, outputPath }, context) {
   if (cachedSlot(context.reviewDir, name) !== describeSlot(slot)) return false;
-  return existsSync5(outputPath) && readFileSync5(outputPath, "utf8").trim().length > 0;
+  return existsSync6(outputPath) && readFileSync6(outputPath, "utf8").trim().length > 0;
 }
 async function runOrReuse(step, context) {
   if (!hasOutput(step, context)) return { ok: await runStep(step, context), ran: true };
@@ -1475,7 +1578,7 @@ async function runOrReuse(step, context) {
   return { ok: true, ran: false };
 }
 function reviewPath(context, reviewer) {
-  return join6(context.reviewDir, `${reviewer}.md`);
+  return join7(context.reviewDir, `${reviewer}.md`);
 }
 function reviewerLabel(reviewer, context) {
   return `${reviewer} (${describeSlot(context.slots[reviewer])})`;
@@ -1494,7 +1597,7 @@ function synthesisResult(markdown) {
 function rawReviews(succeeded, context) {
   const report = succeeded.map((reviewer) => `# ${reviewerLabel(reviewer, context)} review
 
-${readFileSync5(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
+${readFileSync6(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
   return { report, synthesis: null, markdown: null };
 }
 function synthesisSlot(succeeded, context) {
@@ -1503,7 +1606,7 @@ function synthesisSlot(succeeded, context) {
 }
 async function synthesise(requestPath, succeeded, reviewersRan, context) {
   const slot = synthesisSlot(succeeded, context);
-  const outputPath = join6(context.reviewDir, "synthesis.md");
+  const outputPath = join7(context.reviewDir, "synthesis.md");
   if (reviewersRan) rmSync(outputPath, { force: true });
   const files = reviewers.map((reviewer) => ({
     reviewer: reviewerLabel(reviewer, context),
@@ -1511,13 +1614,13 @@ async function synthesise(requestPath, succeeded, reviewersRan, context) {
   }));
   const prompt = buildSynthesisPrompt(requestPath, files);
   if ((await runOrReuse({ name: "synthesis", label: `synthesis (${describeSlot(slot)})`, slot, prompt, outputPath }, context)).ok)
-    return synthesisResult(readFileSync5(outputPath, "utf8"));
+    return synthesisResult(readFileSync6(outputPath, "utf8"));
   context.log("showing the raw reviews instead");
   return rawReviews(succeeded, context);
 }
 async function runReview(request, context) {
-  const requestPath = join6(context.reviewDir, "request.md");
-  writeFileSync5(requestPath, request);
+  const requestPath = join7(context.reviewDir, "request.md");
+  writeFileSync6(requestPath, request);
   const prompt = buildReviewerPrompt(requestPath);
   const results = await Promise.all(
     reviewers.map((reviewer) => {
@@ -1613,19 +1716,19 @@ function spinnerUi(stream) {
 function reviewRunDir(pr2, env = process.env, home = homedir2()) {
   const [, owner = "", repo = ""] = new URL(pr2.url).pathname.split("/");
   const run2 = `${pr2.number}-${pr2.baseRefOid}-${pr2.headRefOid}`;
-  return join7(env.XDG_CACHE_HOME || join7(home, ".cache"), "yoke", "reviews", owner, repo, run2);
+  return join8(env.XDG_CACHE_HOME || join8(home, ".cache"), "yoke", "reviews", owner, repo, run2);
 }
 var cachedOutputs = ["reviewer1.md", "reviewer2.md", "synthesis.md", "review.md", "models.json", "slots.json"];
 function prepareRunDir(reviewDir, force) {
-  mkdirSync3(reviewDir, { recursive: true });
-  if (force) for (const name of cachedOutputs) rmSync2(join7(reviewDir, name), { force: true });
+  mkdirSync4(reviewDir, { recursive: true });
+  if (force) for (const name of cachedOutputs) rmSync2(join8(reviewDir, name), { force: true });
 }
-async function reviewAtHead(pr2, reviewDir, request, slots, ui) {
-  const checkoutDir = mkdtempSync(join7(tmpdir(), "yoke-review-"));
+async function reviewAtHead(pr2, reviewDir, request, slots2, ui) {
+  const checkoutDir = mkdtempSync(join8(tmpdir(), "yoke-review-"));
   try {
     const checkout = await timed(ui, `checking out ${pr2.headRefOid.slice(0, 7)}`, () => checkoutHead(pr2, checkoutDir));
     try {
-      return await runReview(request, { cwd: checkout.cwd, reviewDir, slots, runHarness, log: ui.log, track: ui.track });
+      return await runReview(request, { cwd: checkout.cwd, reviewDir, slots: slots2, runHarness, log: ui.log, track: ui.track });
     } finally {
       await checkout.remove();
     }
@@ -1634,11 +1737,11 @@ async function reviewAtHead(pr2, reviewDir, request, slots, ui) {
   }
 }
 function savedReview(path, post) {
-  if (!post || !existsSync6(path)) return null;
-  return parseSynthesis(readFileSync6(path, "utf8"));
+  if (!post || !existsSync7(path)) return null;
+  return parseSynthesis(readFileSync7(path, "utf8"));
 }
 function saveReview(path, markdown) {
-  if (markdown) writeFileSync6(path, markdown);
+  if (markdown) writeFileSync7(path, markdown);
   else rmSync2(path, { force: true });
 }
 async function reviewPr(number, settings, { post, force }, io) {
@@ -1649,7 +1752,7 @@ async function reviewPr(number, settings, { post, force }, io) {
     io.out(text2);
   };
   const { log } = ui;
-  const slots = resolveSlots(settings);
+  const slots2 = resolveSlots(settings);
   const pr2 = await timed(ui, number ? `fetching PR #${number}` : "fetching this branch's PR", () => fetchPr(number));
   log(`#${pr2.number} ${pr2.title}`);
   const [diff, prior] = await timed(
@@ -1660,15 +1763,15 @@ async function reviewPr(number, settings, { post, force }, io) {
   const reviewDir = reviewRunDir(pr2);
   prepareRunDir(reviewDir, force);
   file.attach(reviewDir);
-  const path = join7(reviewDir, "review.md");
+  const path = join8(reviewDir, "review.md");
   let synthesis = savedReview(path, post);
   if (synthesis) {
     log(`posting the saved review of #${pr2.number} at ${pr2.headRefOid.slice(0, 7)}`);
     out(formatSynthesis(synthesis));
   } else {
-    await timed(ui, "checking each reviewer can run", () => assertViable(slots));
+    await timed(ui, "checking each reviewer can run", () => assertViable(slots2));
     log(`review folder: ${reviewDir}`);
-    const result = await reviewAtHead(pr2, reviewDir, buildRequest(pr2, diff, prior), slots, ui);
+    const result = await reviewAtHead(pr2, reviewDir, buildRequest(pr2, diff, prior), slots2, ui);
     out(result.report);
     synthesis = result.synthesis;
     saveReview(path, result.markdown);
@@ -1681,9 +1784,9 @@ async function reviewPr(number, settings, { post, force }, io) {
 }
 
 // src/features/sync/sync.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/skill.ts
 var ownerMarker = 'owner: "@makerx/yoke"';
@@ -1714,6 +1817,24 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 `
 };
 
+// src/features/review/ciSkill.ts
+var reviewCiSkill = {
+  name: "review-ci",
+  description: "Add yoke's adversarial PR review workflow to this repo and set the secrets it needs.",
+  disableModelInvocation: true,
+  body: `
+Run \`yoke review-ci $ARGUMENTS\`. If it reports that a model is required, run \`yoke models\` to list what the provider serves, ask the user which model each reviewer should run, and rerun with \`--reviewer-1-model\` and \`--reviewer-2-model\`. If it reports the workflow already exists and differs, show the user the difference and ask before rerunning with \`--force\`.
+
+Then set the two secrets it printed. Run \`gh secret list\` first; if either secret is missing, ask whether it is already set at the org level before setting it on the repo.
+- \`REVIEW_CI_BASE_URL\` is not secret: confirm the URL with the user and run the printed command.
+- \`REVIEW_CI_API_KEY\` must never enter this conversation: ask the user to run \`gh secret set REVIEW_CI_API_KEY\` in their own terminal, outside this session, and paste the key at its prompt.
+
+Finish by running \`gh secret list\` and telling the user to commit and push the workflow file.
+
+If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
+`
+};
+
 // src/features/review/skill.ts
 var reviewSkill = {
   name: "review",
@@ -1729,24 +1850,24 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 };
 
 // src/features/sync/sync.ts
-var bundledSkills = [prSkill, reviewSkill];
+var bundledSkills = [prSkill, reviewSkill, reviewCiSkill];
 function skillsRoot(user, cwd = process.cwd(), home = homedir3()) {
-  return join8(user ? home : cwd, ".claude", "skills");
+  return join9(user ? home : cwd, ".claude", "skills");
 }
 function isOwnedByUser(skillFile) {
-  return existsSync7(skillFile) && !readFileSync7(skillFile, "utf8").includes(ownerMarker);
+  return existsSync8(skillFile) && !readFileSync8(skillFile, "utf8").includes(ownerMarker);
 }
 function syncSkills(destination, skills = bundledSkills) {
   const result = { written: [], skipped: [] };
   for (const skill of skills) {
-    const target = join8(destination, skill.name);
-    const skillFile = join8(target, "SKILL.md");
+    const target = join9(destination, skill.name);
+    const skillFile = join9(target, "SKILL.md");
     if (isOwnedByUser(skillFile)) {
       result.skipped.push(target);
       continue;
     }
-    mkdirSync4(target, { recursive: true });
-    writeFileSync7(skillFile, renderSkill(skill));
+    mkdirSync5(target, { recursive: true });
+    writeFileSync8(skillFile, renderSkill(skill));
     result.written.push(skillFile);
   }
   return result;
@@ -1811,6 +1932,22 @@ addSettingOptions(
     ui.stop();
   }
 });
+var ciKeys = settingKeys.filter((key) => /^review\.\w+\.(harness|model)$/.test(key));
+addSettingOptions(
+  program.command("review-ci").description(`Write ${callerWorkflowPath} so each PR in this repo is reviewed in CI, then print the gh secret set commands it needs`).option("--provider <provider>", "litellm or foundry; every slot uses it in CI. Default: review.reviewer1.provider, else litellm").option("--force", `overwrite an existing ${callerWorkflowPath} that differs`),
+  ciKeys
+).addHelpText("after", settingsHelp).action((options) => {
+  try {
+    const settings = resolveSettings(flagSettings(options, ciKeys), process.env, readUserConfig(userConfigPath()));
+    const workflow = callerWorkflow(settings, options.provider);
+    const outcome = writeCallerWorkflow(repoRoot(), renderCallerWorkflow(workflow), options.force ?? false);
+    console.log(reviewCiReport(outcome, secretCommands(settings, workflow.provider)));
+  } catch (error) {
+    if (!(error instanceof ReviewError || error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
 addSettingOptions(
   program.command("models").description("List the models each configured provider serves, for review.*.provider and review.*.model"),
   providerKeys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerx/yoke",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   "license": "MIT",
   "author": "MakerX",
@@ -50,6 +50,9 @@
     "vitest": "^5.0.5",
     "yaml": "^2.9.1"
   },
+  "overrides": {
+    "minimatch": "^11.0.3"
+  },
   "engines": {
     "node": ">=24"
   }