@makerx/yoke 0.6.0 → 0.8.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.6.0",
+  version: "0.8.0",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -57,6 +57,9 @@ var package_default = {
     vitest: "^5.0.5",
     yaml: "^2.9.1"
   },
+  overrides: {
+    minimatch: "^11.0.3"
+  },
   engines: {
     node: ">=24"
   }
@@ -133,14 +136,14 @@ function wrap(text2, width) {
   return line ? [...lines, line] : lines;
 }
 function listSettings(settings, columns = Infinity) {
-  const rows = settingKeys.map((key) => ({
+  const rows2 = settingKeys.map((key) => ({
     key,
     value: displayValue(key, settings[key]),
     description: settingDescription(key)
   }));
-  const keyWidth = Math.max(...rows.map(({ key }) => key.length));
+  const keyWidth = Math.max(...rows2.map(({ key }) => key.length));
   const indent = " ".repeat(keyWidth + gap.length);
-  const blocks = rows.map(
+  const blocks = rows2.map(
     ({ key, value, description }) => [`${key.padEnd(keyWidth)}${gap}${value}`, ...wrap(description, columns - indent.length).map((line) => indent + line)].join("\n")
   );
   return blocks.join("\n\n");
@@ -402,6 +405,11 @@ function raisePr({ title, body, base, draft }, run2 = runGh) {
   return output.at(-1) ?? "";
 }
 
+// src/features/review/ci.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+
 // src/features/review/pr.ts
 import { execFile } from "child_process";
 import { join as join2 } from "path";
@@ -607,6 +615,101 @@ function buildOverride({ harness, model }, provider) {
   return buildClaudeOverride(provider, endpoints, model);
 }
 
+// src/features/review/ci.ts
+var reviewWorkflowRef = "MakerXStudio/yoke/.github/workflows/review.yml@main";
+var callerWorkflowPath = join3(".github", "workflows", "review-pr.yml");
+var ciSecrets = ["REVIEW_CI_BASE_URL", "REVIEW_CI_API_KEY"];
+var slots = [
+  { slot: "reviewer1", defaultHarness: "claude", required: true },
+  { slot: "reviewer2", defaultHarness: "codex", required: true },
+  { slot: "synthesis", defaultHarness: void 0, required: false }
+];
+function slotInputs(settings, errors) {
+  const inputs = [];
+  for (const { slot, defaultHarness, required } of slots) {
+    const harnessKey = `review.${slot}.harness`;
+    const modelKey = `review.${slot}.model`;
+    const harness = settings[harnessKey] ?? defaultHarness;
+    const model = settings[modelKey];
+    if (harness && !isHarness(harness))
+      errors.push(`${harnessKey} "${harness}" must be claude or codex; ${howToSet(harnessKey, "<claude|codex>")}`);
+    if (required && !model) errors.push(`${modelKey} is required; ${howToSet(modelKey, "<model>")} (see \`yoke models\`)`);
+    if (!required && harness && !model)
+      errors.push(`${modelKey} is required when ${harnessKey} is set; ${howToSet(modelKey, "<model>")} (see \`yoke models\`)`);
+    if (harness) inputs.push([`${slot}-harness`, harness]);
+    if (model) inputs.push([`${slot}-model`, model]);
+  }
+  return inputs;
+}
+function callerWorkflow(settings, providerFlag) {
+  const errors = [];
+  const provider = providerFlag ?? settings["review.reviewer1.provider"] ?? "litellm";
+  if (!isProviderKind(provider)) errors.push(`provider "${provider}" must be ${providerKinds.join(" or ")}; pass --provider`);
+  const inputs = slotInputs(settings, errors);
+  if (errors.length || !isProviderKind(provider))
+    throw new ReviewError(["Cannot write the review workflow:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  return { provider, inputs: [["provider", provider], ...inputs] };
+}
+function yamlValue(value) {
+  return /^[\w./:@-]+$/.test(value) && !/^([-+.\d_eE]+|0[xo][\da-f]+|true|false|yes|no|on|off|y|n|null|~)$/i.test(value) ? value : JSON.stringify(value);
+}
+function renderCallerWorkflow({ inputs }) {
+  return [
+    "name: Review PR",
+    "",
+    "on:",
+    "  pull_request:",
+    "    types: [opened, reopened, ready_for_review]",
+    "",
+    "permissions:",
+    "  contents: read",
+    "  pull-requests: write",
+    "",
+    "jobs:",
+    "  review:",
+    `    uses: ${reviewWorkflowRef}`,
+    "    with:",
+    ...inputs.map(([name, value]) => `      ${name}: ${yamlValue(value)}`),
+    "    secrets: inherit",
+    ""
+  ].join("\n");
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function secretCommands(settings, provider) {
+  const baseUrl = settings[`${provider}.baseUrl`];
+  return [`gh secret set REVIEW_CI_BASE_URL${baseUrl ? ` --body ${shellQuote(baseUrl)}` : ""}`, "gh secret set REVIEW_CI_API_KEY"];
+}
+function repoRoot(cwd = process.cwd()) {
+  try {
+    return execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    throw new ReviewError("Not in a git repository; run `yoke review-ci` from the repo to review.");
+  }
+}
+function writeCallerWorkflow(root, content, force) {
+  const path = join3(root, callerWorkflowPath);
+  if (existsSync2(path)) {
+    if (readFileSync2(path, "utf8") === content) return "unchanged";
+    if (!force) throw new ReviewError(`${callerWorkflowPath} already exists and differs; pass --force to overwrite it.`);
+  }
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, content);
+  return "wrote";
+}
+function reviewCiReport(outcome, commands) {
+  const action = outcome === "wrote" ? "wrote" : "kept";
+  return [
+    `${action} ${callerWorkflowPath}`,
+    "",
+    `The workflow reads ${ciSecrets.join(" and ")}. Set them on the repo (or the org) with:`,
+    ...commands.map((command) => `  ${command}`),
+    "",
+    "Commit and push the workflow; each PR opened from this repo then gets a review."
+  ].join("\n");
+}
+
 // src/features/review/slots.ts
 var slotNames = ["reviewer1", "reviewer2", "synthesis"];
 function readProvider(settings, kind) {
@@ -716,9 +819,40 @@ async function listModels(settings, fetchModels = fetch) {
 }
 
 // src/features/review/review.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
+
+// src/features/review/comments.ts
+var markerPrefix = "<!-- yoke-review:";
+function slug(text2) {
+  return text2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function findingMarker({ file, title }) {
+  return `${markerPrefix} ${file ?? "n/a"}#${slug(title)} -->`;
+}
+function hasMarker(prior, marker) {
+  return prior.some((comment) => comment.body.includes(marker));
+}
+function withoutMarkers(body) {
+  return body.split("\n").filter((line) => !line.trimStart().startsWith(markerPrefix)).join("\n").trim();
+}
+function heading({ path, line }) {
+  if (!path) return "### PR review";
+  return line === null ? `### ${path}` : `### ${path}:${line}`;
+}
+function formatPriorComments(prior) {
+  if (!prior.length) return "";
+  const blocks = prior.map((comment) => `${heading(comment)}
+
+**${comment.author}**: ${withoutMarkers(comment.body)}`);
+  return `## Prior review comments
+
+The PR already has the review comments below, including resolved and outdated threads. Do not re-raise a finding a prior comment substantively covers.
+
+${blocks.join("\n\n")}
+`;
+}
 
 // src/features/review/findings.ts
 var severities = ["blocker", "major", "minor", "nit"];
@@ -778,184 +912,6 @@ function formatSynthesis({ summary, findings }) {
   return lines.join("\n").trimEnd();
 }
 
-// src/features/review/harness.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-
-// src/features/review/progress.ts
-var maxSummary = 80;
-function isJson(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function truncate(value) {
-  const collapsed = value.replace(/\s+/g, " ").trim();
-  return collapsed.length <= maxSummary ? collapsed : `${collapsed.slice(0, maxSummary - 1)}\u2026`;
-}
-function text(input, key) {
-  const value = input[key];
-  return typeof value === "string" ? value : void 0;
-}
-function toolSummary(input) {
-  if (!isJson(input)) return "";
-  const pattern = text(input, "pattern");
-  if (pattern) {
-    const scope = text(input, "path");
-    return scope ? `${pattern} in ${scope}` : pattern;
-  }
-  const found = text(input, "file_path") ?? text(input, "path") ?? text(input, "url");
-  if (found) return found;
-  const described = text(input, "command") ?? text(input, "query") ?? text(input, "description");
-  return described ? truncate(described) : "";
-}
-function describeTool(tool, summary) {
-  return summary ? `${tool} ${summary}` : tool;
-}
-function claudeEvent(event) {
-  if (event.type === "result" && typeof event.result === "string") return { kind: "final", text: event.result };
-  if (event.type === "system" && event.subtype === "init" && typeof event.model === "string") return { kind: "model", model: event.model };
-  const content = isJson(event.message) ? event.message.content : void 0;
-  if (event.type !== "assistant" || !Array.isArray(content)) return { kind: "ignore" };
-  const uses = content.filter((block) => isJson(block) && block.type === "tool_use");
-  if (!uses.length) return { kind: "ignore" };
-  return { kind: "activity", text: uses.map((use) => describeTool(text(use, "name") ?? "tool", toolSummary(use.input))).join(", ") };
-}
-function unwrapShell(command) {
-  const wrapped = command.match(/^\/bin\/(?:ba|z)?sh\s+-lc\s+["'](.*)["']\s*$/s);
-  return truncate(wrapped?.[1]?.replace(/\\"/g, '"') ?? command);
-}
-function codexError(event) {
-  if (event.type === "error") return text(event, "message");
-  if (event.type === "turn.failed" && isJson(event.error)) return text(event.error, "message");
-  return void 0;
-}
-function codexEvent(event) {
-  const message = codexError(event);
-  if (message) return { kind: "error", message };
-  const item = event.item;
-  if (event.type !== "item.started" || !isJson(item)) return { kind: "ignore" };
-  const command = text(item, "command");
-  if (item.type === "command_execution" && command) return { kind: "activity", text: describeTool("shell", unwrapShell(command)) };
-  return { kind: "ignore" };
-}
-function parseHarnessEvent(harness, line) {
-  let event;
-  try {
-    event = JSON.parse(line);
-  } catch {
-    return { kind: "ignore" };
-  }
-  if (!isJson(event)) return { kind: "ignore" };
-  return harness === "claude" ? claudeEvent(event) : codexEvent(event);
-}
-
-// src/features/review/harness.ts
-var tailLines = 20;
-function harnessArgs({ harness, reviewDir, outputPath, override }) {
-  const extra = override?.args ?? [];
-  if (harness === "codex") return ["exec", "--sandbox", "read-only", "--json", "--output-last-message", outputPath, ...extra, "-"];
-  return [
-    "-p",
-    "--add-dir",
-    reviewDir,
-    "--disallowedTools",
-    "Edit,Write,NotebookEdit",
-    "--output-format",
-    "stream-json",
-    "--verbose",
-    ...extra
-  ];
-}
-function windowsQuote(arg) {
-  return /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
-}
-function tail(text2) {
-  return text2.trim().split("\n").slice(-tailLines).join("\n");
-}
-function spawnError(harness, error) {
-  if (error.code === "ENOENT") return `${harness} CLI not found on PATH; install it or sign in, then retry`;
-  return `${harness} failed to start: ${error.message}`;
-}
-function exitError(harness, code, output) {
-  const detail = tail(output);
-  return [`${harness} exited with code ${code ?? "unknown"}`, ...detail ? [detail] : []].join("\n");
-}
-function hasReview(path) {
-  return existsSync2(path) && readFileSync2(path, "utf8").trim().length > 0;
-}
-var runHarness = (run2) => new Promise((resolve) => {
-  const shell = process.platform === "win32";
-  const args = harnessArgs(run2);
-  const child = spawn(run2.harness, shell ? args.map(windowsQuote) : args, {
-    cwd: run2.cwd,
-    env: { ...process.env, ...run2.override?.env },
-    stdio: ["pipe", "pipe", "pipe"],
-    shell
-  });
-  let pending = "";
-  let finalText = "";
-  let model;
-  let lastError = "";
-  let stderr = "";
-  const onLine = (line) => {
-    const event = parseHarnessEvent(run2.harness, line);
-    if (event.kind === "activity") run2.onProgress?.(event.text);
-    if (event.kind === "final") finalText = event.text;
-    if (event.kind === "model") model = event.model;
-    if (event.kind === "error") lastError = event.message;
-  };
-  child.stdout.setEncoding("utf8");
-  child.stderr.setEncoding("utf8");
-  child.stdout.on("data", (chunk) => {
-    const lines = (pending + chunk).split("\n");
-    pending = lines.pop() ?? "";
-    lines.forEach(onLine);
-  });
-  child.stderr.on("data", (chunk) => stderr += chunk);
-  child.stdin.on("error", () => {
-  });
-  child.stdin.end(run2.prompt);
-  child.on("error", (error) => resolve({ ok: false, error: spawnError(run2.harness, error) }));
-  child.on("close", (code) => {
-    onLine(pending);
-    if (code !== 0)
-      return resolve({ ok: false, error: exitError(run2.harness, code, [stderr || finalText, lastError].filter(Boolean).join("\n")) });
-    if (run2.harness === "claude") writeFileSync2(run2.outputPath, finalText);
-    if (!hasReview(run2.outputPath)) return resolve({ ok: false, error: `${run2.harness} returned an empty review` });
-    resolve(model ? { ok: true, model } : { ok: true });
-  });
-});
-
-// src/features/review/comments.ts
-var markerPrefix = "<!-- yoke-review:";
-function slug(text2) {
-  return text2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function findingMarker({ file, title }) {
-  return `${markerPrefix} ${file ?? "n/a"}#${slug(title)} -->`;
-}
-function hasMarker(prior, marker) {
-  return prior.some((comment) => comment.body.includes(marker));
-}
-function withoutMarkers(body) {
-  return body.split("\n").filter((line) => !line.trimStart().startsWith(markerPrefix)).join("\n").trim();
-}
-function heading({ path, line }) {
-  if (!path) return "### PR review";
-  return line === null ? `### ${path}` : `### ${path}:${line}`;
-}
-function formatPriorComments(prior) {
-  if (!prior.length) return "";
-  const blocks = prior.map((comment) => `${heading(comment)}
-
-**${comment.author}**: ${withoutMarkers(comment.body)}`);
-  return `## Prior review comments
-
-The PR already has the review comments below, including resolved and outdated threads. Do not re-raise a finding a prior comment substantively covers.
-
-${blocks.join("\n\n")}
-`;
-}
-
 // src/features/review/request.ts
 var fileHeader = /^\+\+\+ (.+)$/;
 var hunkHeader = /^@@ -\d+(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
@@ -1065,14 +1021,19 @@ function outsideEntry(finding) {
   const entry = [`- **${finding.severity ?? "finding"}** ${location} \u2014 ${finding.title}`, ...details(finding).map((d) => `  ${d}`)];
   return [...entry, `  ${findingMarker(finding)}`].join("\n");
 }
-function reviewBody(summary, outside, footer = "") {
-  const sections = ["## Adversarial review", ...summary ? [summary] : []];
+var noFindingsNote = "No new findings were raised.";
+var rerunNote = "To re-run this review, mark the PR as draft and then ready for review again.";
+function reviewBody(summary, outside, footer = "", note = "") {
+  const sections = ["## Adversarial review", ...summary ? [summary] : [], ...note ? [note] : []];
   if (outside.length) sections.push(`### Findings outside the diff
 
 ${outside.map(outsideEntry).join("\n")}`);
   if (footer) sections.push(footer);
   return sections.join("\n\n");
 }
+function postFooter(footer, ci) {
+  return [...footer ? [footer] : [], ...ci ? [`_${rerunNote}_`] : []].join("\n\n");
+}
 async function addComments(review, comments, { api, log }) {
   const rejected = [];
   for (const { finding, ...comment } of comments) {
@@ -1086,152 +1047,393 @@ async function addComments(review, comments, { api, log }) {
   }
   return rejected;
 }
+function failedReviewBody(reason, runUrl, footer = "") {
+  const sections = ["## Code review failed", `The review did not complete: ${reason}. No findings were posted.`];
+  if (runUrl) sections.push(`See the [workflow run](${runUrl}) for details.`);
+  if (footer) sections.push(footer);
+  return sections.join("\n\n");
+}
+async function postFailure(pr2, reason, runUrl, deps) {
+  const review = await deps.api.open(pr2);
+  try {
+    const url = await deps.api.submit(pr2, review, failedReviewBody(reason, runUrl, postFooter(deps.footer, true)));
+    deps.log(`posted the failed review: ${url}`);
+  } catch (error) {
+    await discard(pr2, review, deps);
+    throw error;
+  }
+}
+async function discard(pr2, review, { api, log }) {
+  try {
+    await api.discard(pr2, review);
+  } catch (discardError) {
+    log(`could not discard the pending review: ${discardError instanceof Error ? discardError.message : String(discardError)}`);
+  }
+}
 async function postFindings(pr2, synthesis, diff, prior, deps) {
-  const { api, log } = deps;
+  const { api, log, ci = false } = deps;
   const { comments, outside, skipped } = planPost(synthesis, diff, prior);
   if (skipped.length) log(`skipped ${skipped.length} finding(s) already raised on the PR`);
-  if (!comments.length && !outside.length) return log("nothing new to post");
+  const nothingNew = !comments.length && !outside.length;
+  if (nothingNew && !ci) return log("nothing new to post");
+  const footer = postFooter(deps.footer, ci);
   const review = await api.open(pr2);
   try {
+    if (nothingNew) {
+      const url2 = await api.submit(pr2, review, reviewBody(synthesis.summary, [], footer, noFindingsNote));
+      return log(`nothing new to post, so posted a review without findings: ${url2}`);
+    }
     const rejected = await addComments(review, comments, deps);
-    const url = await api.submit(pr2, review, reviewBody(synthesis.summary, [...outside, ...rejected], deps.footer));
+    const url = await api.submit(pr2, review, reviewBody(synthesis.summary, [...outside, ...rejected], footer));
     log(`posted ${comments.length - rejected.length} inline comment(s) and ${outside.length + rejected.length} in the review body: ${url}`);
   } catch (error) {
-    try {
-      await api.discard(pr2, review);
-    } catch (discardError) {
-      log(`could not discard the pending review: ${discardError instanceof Error ? discardError.message : String(discardError)}`);
-    }
+    await discard(pr2, review, deps);
     throw error;
   }
 }
 
-// src/features/review/preflight.ts
-import { execFile as execFile2 } from "child_process";
-var commandTimeout = 3e4;
-var probeTimeout = 6e4;
-var maxBodyChars2 = 300;
-function exec(harness, args) {
-  return new Promise((resolve) => {
-    const options = { encoding: "utf8", timeout: commandTimeout, shell: process.platform === "win32" };
-    execFile2(harness, args, options, (error, stdout) => resolve({ ok: !error, stdout }));
-  });
-}
-async function claudeSignedIn() {
-  const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
-  if (!ok) return false;
-  try {
-    const parsed = JSON.parse(stdout);
-    return typeof parsed === "object" && parsed !== null && "loggedIn" in parsed && parsed.loggedIn === true;
-  } catch {
-    return false;
-  }
-}
-async function reach({ url, headers, body }) {
+// src/features/review/status.ts
+import { styleText } from "util";
+import { createLogUpdate } from "log-update";
+async function timed(ui, label, work) {
+  const started = Date.now();
+  const status = ui.track(label);
+  const elapsed = () => `${Math.round((Date.now() - started) / 1e3)}s`;
   try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...headers },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(probeTimeout)
-    });
-    if (response.ok) return void 0;
-    const text2 = (await response.text()).trim().slice(0, maxBodyChars2);
-    return `HTTP ${response.status}${text2 ? `: ${text2}` : ""}`;
+    const result = await work();
+    status.succeed(`${label} (${elapsed()})`);
+    return result;
   } catch (error) {
-    if (!(error instanceof Error)) return String(error);
-    const cause = error.cause instanceof Error ? error.cause.message : "";
-    return cause ? `${error.message} (${cause})` : error.message;
-  }
-}
-var checks = {
-  onPath: async (harness) => (await exec(harness, ["--version"])).ok,
-  signedIn: async (harness) => harness === "claude" ? claudeSignedIn() : (await exec("codex", ["login", "status"])).ok,
-  reach
-};
-var loginCommand = { claude: "claude auth login", codex: "codex login" };
-function signedOut({ slot: { harness }, keys }) {
-  const settings = keys.map((key) => `${key}.provider and ${key}.model`).join(", and ");
-  return `${harness} is not signed in (${keys.join(", ")}); run \`${loginCommand[harness]}\`, or run it through LiteLLM or Foundry by setting ${settings} (see \`yoke models\`)`;
-}
-async function slotProblem(use, check) {
-  const { harness, model, probe } = use.slot;
-  if (!await check.onPath(harness)) return `${harness} CLI not found on PATH; install it`;
-  if (!probe) return await check.signedIn(harness) ? void 0 : signedOut(use);
-  const error = await check.reach(probe);
-  return error && `${harness} model "${model}" at ${probe.url}: ${error}`;
-}
-function slotsToRun(slots) {
-  const uses = [
-    ["review.reviewer1", slots.reviewer1],
-    ["review.reviewer2", slots.reviewer2],
-    ["review.synthesis", slots.synthesis ?? { harness: slots.reviewer1.harness }]
-  ];
-  const distinct = /* @__PURE__ */ new Map();
-  for (const [key, slot] of uses) {
-    const id = `${slot.harness}:${slot.provider ?? "own"}:${slot.model ?? ""}`;
-    const use = distinct.get(id);
-    if (use) use.keys.push(key);
-    else distinct.set(id, { slot, keys: [key] });
+    status.fail(`${label} failed after ${elapsed()}`);
+    throw error;
   }
-  return [...distinct.values()];
 }
-async function assertViable(slots, check = checks) {
-  const problems = await Promise.all(slotsToRun(slots).map((use) => slotProblem(use, check)));
-  const errors = problems.filter((problem) => problem !== void 0);
-  if (errors.length) throw new ReviewError(["Cannot review:", ...errors.map((error) => `- ${error}`)].join("\n"));
-}
-
-// src/features/review/reviewLog.ts
-import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join3 } from "path";
-function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */ new Date()) {
-  let path;
-  let buffered = [];
+function lineUi(log, { activity }) {
   return {
-    append: (line) => {
-      if (path) appendFileSync(path, `${line}
-`);
-      else buffered.push(line);
+    log,
+    track: (label) => {
+      log(`${label}\u2026`);
+      const update = (text2) => activity ? log(`${label}: ${text2}`) : void 0;
+      return { update, succeed: log, fail: log };
     },
-    attach: (reviewDir) => {
-      mkdirSync2(reviewDir, { recursive: true });
-      path = join3(reviewDir, "review.log");
-      appendFileSync(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
-`);
-      buffered = [];
+    stop: () => {
     }
   };
 }
-function logged(ui, append) {
-  const both = (show) => (line) => {
-    append(line);
-    show(line);
+var frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var tickMs = 80;
+function spinnerUi(stream) {
+  const update = createLogUpdate(stream);
+  const running = [];
+  let frame = 0;
+  let timer;
+  const paint = (colour, text2) => styleText(colour, text2, { stream });
+  const render = () => update(running.map((entry) => `${paint("cyan", frames[frame] ?? "")} ${entry.text}`).join("\n"));
+  const persist = (line) => {
+    update.clear();
+    update.persist(line);
+    render();
+  };
+  const settle = (entry, line) => {
+    running.splice(running.indexOf(entry), 1);
+    persist(line);
+    if (running.length || !timer) return;
+    clearInterval(timer);
+    timer = void 0;
   };
   return {
-    log: both(ui.log),
+    log: persist,
     track: (label) => {
-      append(`${label}\u2026`);
-      const status = ui.track(label);
+      const entry = { label, text: label };
+      running.push(entry);
+      timer ??= setInterval(() => {
+        frame = (frame + 1) % frames.length;
+        render();
+      }, tickMs);
+      render();
       return {
-        update: (activity) => {
-          append(`${label}: ${activity}`);
-          status.update(activity);
-        },
-        succeed: both(status.succeed),
-        fail: both(status.fail)
+        update: (activity) => entry.text = `${label} \u2014 ${activity}`,
+        succeed: (text2) => settle(entry, `${paint("green", "\u2713")} ${text2}`),
+        fail: (text2) => settle(entry, `${paint("red", "\u2717")} ${text2}`)
       };
     },
-    stop: ui.stop
+    stop: () => {
+      if (timer) clearInterval(timer);
+      update.done();
+    }
   };
 }
 
+// src/features/review/ciRun.ts
+function isCi(env = process.env) {
+  return env.GITHUB_ACTIONS === "true";
+}
+function ciRunUrl(env = process.env) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = env;
+  if (!GITHUB_SERVER_URL || !GITHUB_REPOSITORY || !GITHUB_RUN_ID) return void 0;
+  return `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+}
+async function reportFailure(pr2, reason, ui, deps) {
+  try {
+    await timed(ui, `posting the failed review to #${pr2.number}`, () => postFailure(pr2, reason, ciRunUrl(), deps));
+  } catch (error) {
+    ui.log(`could not post the failed review: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/features/review/harness.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+
+// src/features/review/usage.ts
+import { appendFileSync } from "fs";
+var fields2 = ["input", "output", "cacheRead", "cacheWrite"];
+var rows = [
+  ["reviewer1", "Reviewer 1"],
+  ["reviewer2", "Reviewer 2"],
+  ["synthesis", "Synthesis"]
+];
+var dash = "\u2014";
+function count(source, key) {
+  const value = key ? source[key] : void 0;
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseUsage(raw, keys) {
+  if (!isRecord(raw)) return void 0;
+  const usage = {};
+  for (const field2 of fields2) {
+    const value = count(raw, keys[field2]);
+    if (value !== void 0) usage[field2] = value;
+  }
+  return Object.keys(usage).length ? usage : void 0;
+}
+function sum(values) {
+  const reported = values.filter((value) => value !== void 0);
+  return reported.length ? reported.reduce((a, b) => a + b, 0) : void 0;
+}
+function sumUsage(usages) {
+  const total = {};
+  for (const field2 of fields2) {
+    const value = sum(usages.map((usage) => usage?.[field2]));
+    if (value !== void 0) total[field2] = value;
+  }
+  return total;
+}
+function addUsage(a, b) {
+  return sumUsage([a, b]);
+}
+function cell(value) {
+  return value === void 0 ? dash : value.toLocaleString("en-US");
+}
+function row(label, usage) {
+  return `| ${label} | ${fields2.map((field2) => cell(usage?.[field2])).join(" | ")} |`;
+}
+function usageTable(usage) {
+  const total = sumUsage(rows.map(([step]) => usage[step]));
+  return [
+    "## Token usage",
+    "",
+    "| Slot | Input | Output | Cache read | Cache write |",
+    "| --- | ---: | ---: | ---: | ---: |",
+    ...rows.map(([step, label]) => row(label, usage[step])),
+    row("**Total**", total)
+  ].join("\n");
+}
+function jobSummary(summary, usage) {
+  return ["## Adversarial review", summary || "No summary was given.", usageTable(usage)].join("\n\n");
+}
+function writeJobSummary(summary, usage, log, env = process.env) {
+  const path = env.GITHUB_STEP_SUMMARY;
+  if (!path) return;
+  try {
+    appendFileSync(path, `${jobSummary(summary, usage)}
+`);
+    log("wrote the review summary and token usage to the job summary");
+  } catch (error) {
+    log(`could not write the job summary: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/features/review/progress.ts
+var maxSummary = 80;
+function isJson(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function truncate(value) {
+  const collapsed = value.replace(/\s+/g, " ").trim();
+  return collapsed.length <= maxSummary ? collapsed : `${collapsed.slice(0, maxSummary - 1)}\u2026`;
+}
+function text(input, key) {
+  const value = input[key];
+  return typeof value === "string" ? value : void 0;
+}
+function toolSummary(input) {
+  if (!isJson(input)) return "";
+  const pattern = text(input, "pattern");
+  if (pattern) {
+    const scope = text(input, "path");
+    return scope ? `${pattern} in ${scope}` : pattern;
+  }
+  const found = text(input, "file_path") ?? text(input, "path") ?? text(input, "url");
+  if (found) return found;
+  const described = text(input, "command") ?? text(input, "query") ?? text(input, "description");
+  return described ? truncate(described) : "";
+}
+function describeTool(tool, summary) {
+  return summary ? `${tool} ${summary}` : tool;
+}
+function claudeUsage(raw) {
+  return parseUsage(raw, {
+    input: "input_tokens",
+    output: "output_tokens",
+    cacheRead: "cache_read_input_tokens",
+    cacheWrite: "cache_creation_input_tokens"
+  });
+}
+function codexUsage(raw) {
+  const usage = parseUsage(raw, { input: "input_tokens", output: "output_tokens", cacheRead: "cached_input_tokens" });
+  if (usage?.input !== void 0 && usage.cacheRead !== void 0) usage.input = Math.max(0, usage.input - usage.cacheRead);
+  return usage;
+}
+function claudeResult(event) {
+  const usage = claudeUsage(event.usage);
+  if (typeof event.result === "string") return usage ? { kind: "final", text: event.result, usage } : { kind: "final", text: event.result };
+  return usage ? { kind: "usage", usage } : { kind: "ignore" };
+}
+function claudeEvent(event) {
+  if (event.type === "result") return claudeResult(event);
+  if (event.type === "system" && event.subtype === "init" && typeof event.model === "string") return { kind: "model", model: event.model };
+  const content = isJson(event.message) ? event.message.content : void 0;
+  if (event.type !== "assistant" || !Array.isArray(content)) return { kind: "ignore" };
+  const uses = content.filter((block) => isJson(block) && block.type === "tool_use");
+  if (!uses.length) return { kind: "ignore" };
+  return { kind: "activity", text: uses.map((use) => describeTool(text(use, "name") ?? "tool", toolSummary(use.input))).join(", ") };
+}
+function unwrapShell(command) {
+  const wrapped = command.match(/^\/bin\/(?:ba|z)?sh\s+-lc\s+["'](.*)["']\s*$/s);
+  return truncate(wrapped?.[1]?.replace(/\\"/g, '"') ?? command);
+}
+function codexError(event) {
+  if (event.type === "error") return text(event, "message");
+  if (event.type === "turn.failed" && isJson(event.error)) return text(event.error, "message");
+  return void 0;
+}
+function codexEvent(event) {
+  const message = codexError(event);
+  if (message) return { kind: "error", message };
+  const usage = event.type === "turn.completed" ? codexUsage(event.usage) : void 0;
+  if (usage) return { kind: "usage", usage };
+  const item = event.item;
+  if (event.type !== "item.started" || !isJson(item)) return { kind: "ignore" };
+  const command = text(item, "command");
+  if (item.type === "command_execution" && command) return { kind: "activity", text: describeTool("shell", unwrapShell(command)) };
+  return { kind: "ignore" };
+}
+function parseHarnessEvent(harness, line) {
+  let event;
+  try {
+    event = JSON.parse(line);
+  } catch {
+    return { kind: "ignore" };
+  }
+  if (!isJson(event)) return { kind: "ignore" };
+  return harness === "claude" ? claudeEvent(event) : codexEvent(event);
+}
+
+// src/features/review/harness.ts
+var tailLines = 20;
+function harnessArgs({ harness, reviewDir, outputPath, override }) {
+  const extra = override?.args ?? [];
+  if (harness === "codex") return ["exec", "--sandbox", "read-only", "--json", "--output-last-message", outputPath, ...extra, "-"];
+  return [
+    "-p",
+    "--add-dir",
+    reviewDir,
+    "--disallowedTools",
+    "Edit,Write,NotebookEdit",
+    "--output-format",
+    "stream-json",
+    "--verbose",
+    ...extra
+  ];
+}
+function windowsQuote(arg) {
+  return /[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg;
+}
+function tail(text2) {
+  return text2.trim().split("\n").slice(-tailLines).join("\n");
+}
+function spawnError(harness, error) {
+  if (error.code === "ENOENT") return `${harness} CLI not found on PATH; install it or sign in, then retry`;
+  return `${harness} failed to start: ${error.message}`;
+}
+function exitError(harness, code, output) {
+  const detail = tail(output);
+  return [`${harness} exited with code ${code ?? "unknown"}`, ...detail ? [detail] : []].join("\n");
+}
+function hasReview(path) {
+  return existsSync3(path) && readFileSync3(path, "utf8").trim().length > 0;
+}
+var runHarness = (run2) => new Promise((resolve) => {
+  const shell = process.platform === "win32";
+  const args = harnessArgs(run2);
+  const child = spawn(run2.harness, shell ? args.map(windowsQuote) : args, {
+    cwd: run2.cwd,
+    env: { ...process.env, ...run2.override?.env },
+    stdio: ["pipe", "pipe", "pipe"],
+    shell
+  });
+  let pending = "";
+  let finalText = "";
+  let model;
+  let usage;
+  let lastError = "";
+  let stderr = "";
+  const onLine = (line) => {
+    const event = parseHarnessEvent(run2.harness, line);
+    if (event.kind === "activity") run2.onProgress?.(event.text);
+    if (event.kind === "final") {
+      finalText = event.text;
+      if (event.usage) usage = event.usage;
+    }
+    if (event.kind === "usage") usage = addUsage(usage, event.usage);
+    if (event.kind === "model") model = event.model;
+    if (event.kind === "error") lastError = event.message;
+  };
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  child.stdout.on("data", (chunk) => {
+    const lines = (pending + chunk).split("\n");
+    pending = lines.pop() ?? "";
+    lines.forEach(onLine);
+  });
+  child.stderr.on("data", (chunk) => stderr += chunk);
+  child.stdin.on("error", () => {
+  });
+  child.stdin.end(run2.prompt);
+  child.on("error", (error) => resolve({ ok: false, error: spawnError(run2.harness, error) }));
+  child.on("close", (code) => {
+    onLine(pending);
+    if (code !== 0)
+      return resolve({ ok: false, error: exitError(run2.harness, code, [stderr || finalText, lastError].filter(Boolean).join("\n")) });
+    if (run2.harness === "claude") writeFileSync3(run2.outputPath, finalText);
+    if (!hasReview(run2.outputPath)) return resolve({ ok: false, error: `${run2.harness} returned an empty review` });
+    resolve({ ok: true, ...model ? { model } : {}, ...usage ? { usage } : {} });
+  });
+});
+
+// src/features/review/preflight.ts
+import { execFile as execFile2 } from "child_process";
+
 // src/features/review/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync6 } from "fs";
 import { join as join6 } from "path";
 
 // src/features/review/cachedSlots.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { join as join4 } from "path";
 function slotsPath(reviewDir) {
   return join4(reviewDir, "slots.json");
@@ -1241,17 +1443,17 @@ function isCachedSlots(value) {
 }
 function readCachedSlots(reviewDir) {
   const path = slotsPath(reviewDir);
-  if (!existsSync3(path)) return {};
-  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  if (!existsSync4(path)) return {};
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
   return isCachedSlots(parsed) ? parsed : {};
 }
 function cachedSlot(reviewDir, step) {
   return readCachedSlots(reviewDir)[step];
 }
 function recordSlot(reviewDir, step, slot) {
-  const slots = readCachedSlots(reviewDir);
-  slots[step] = slot;
-  writeFileSync3(slotsPath(reviewDir), `${JSON.stringify(slots, null, 2)}
+  const slots2 = readCachedSlots(reviewDir);
+  slots2[step] = slot;
+  writeFileSync4(slotsPath(reviewDir), `${JSON.stringify(slots2, null, 2)}
 `);
 }
 
@@ -1396,7 +1598,7 @@ ${files.join("\n")}
 }
 
 // src/features/review/usedModels.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
 var repoUrl = "https://github.com/MakerXStudio/yoke";
 function modelsPath(reviewDir) {
@@ -1407,21 +1609,21 @@ function isUsedModels(value) {
 }
 function readUsedModels(reviewDir) {
   const path = modelsPath(reviewDir);
-  if (!existsSync4(path)) return {};
-  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  if (!existsSync5(path)) return {};
+  const parsed = JSON.parse(readFileSync5(path, "utf8"));
   return isUsedModels(parsed) ? parsed : {};
 }
 function recordUsedModel(reviewDir, step, harness, model) {
   const models = readUsedModels(reviewDir);
   models[step] = model ? model.split("/").at(-1) ?? model : `${harness} default`;
-  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+  writeFileSync5(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
 `);
 }
 function forgetUsedModel(reviewDir, step) {
   const models = readUsedModels(reviewDir);
   if (!(step in models)) return;
   delete models[step];
-  writeFileSync4(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
+  writeFileSync5(modelsPath(reviewDir), `${JSON.stringify(models, null, 2)}
 `);
 }
 function list(items) {
@@ -1435,6 +1637,17 @@ _Adversarial review by [yoke](${repoUrl})${used.length ? `: ${used.join("; ")}`
 }
 
 // src/features/review/run.ts
+var ReviewFailure = class extends ReviewError {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+    this.name = "ReviewFailure";
+  }
+  reason;
+};
+function stepNames(steps) {
+  return steps.map((step) => step.replace(/(\d)$/, " $1")).join(" and ");
+}
 var reviewers = ["reviewer1", "reviewer2"];
 function seconds(since) {
   return `${Math.round((Date.now() - since) / 1e3)}s`;
@@ -1458,6 +1671,7 @@ async function runStep({ name, label, slot, ...step }, context) {
     status.succeed(`${label} done in ${seconds(started)}`);
     recordUsedModel(context.reviewDir, name, harness, slot.model ?? result.model);
     recordSlot(context.reviewDir, name, describeSlot(slot));
+    if (result.usage) context.usage[name] = result.usage;
     return true;
   }
   status.fail(`${label} failed after ${seconds(started)}: ${result.error}`);
@@ -1467,7 +1681,7 @@ async function runStep({ name, label, slot, ...step }, context) {
 }
 function hasOutput({ name, slot, outputPath }, context) {
   if (cachedSlot(context.reviewDir, name) !== describeSlot(slot)) return false;
-  return existsSync5(outputPath) && readFileSync5(outputPath, "utf8").trim().length > 0;
+  return existsSync6(outputPath) && readFileSync6(outputPath, "utf8").trim().length > 0;
 }
 async function runOrReuse(step, context) {
   if (!hasOutput(step, context)) return { ok: await runStep(step, context), ran: true };
@@ -1484,7 +1698,7 @@ function withReviewers(result, context) {
   const line = reviewers.map((reviewer) => reviewerLabel(reviewer, context)).join(", ");
   return { ...result, report: `Reviewers: ${line}
 
-${result.report}` };
+${result.report}`, usage: context.usage };
 }
 function synthesisResult(markdown) {
   const synthesis = parseSynthesis(markdown);
@@ -1494,7 +1708,7 @@ function synthesisResult(markdown) {
 function rawReviews(succeeded, context) {
   const report = succeeded.map((reviewer) => `# ${reviewerLabel(reviewer, context)} review
 
-${readFileSync5(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
+${readFileSync6(reviewPath(context, reviewer), "utf8").trim()}`).join("\n\n");
   return { report, synthesis: null, markdown: null };
 }
 function synthesisSlot(succeeded, context) {
@@ -1511,13 +1725,15 @@ async function synthesise(requestPath, succeeded, reviewersRan, context) {
   }));
   const prompt = buildSynthesisPrompt(requestPath, files);
   if ((await runOrReuse({ name: "synthesis", label: `synthesis (${describeSlot(slot)})`, slot, prompt, outputPath }, context)).ok)
-    return synthesisResult(readFileSync5(outputPath, "utf8"));
+    return synthesisResult(readFileSync6(outputPath, "utf8"));
+  if (context.strict) throw new ReviewFailure("synthesis failed", "The synthesis failed; nothing to post.");
   context.log("showing the raw reviews instead");
   return rawReviews(succeeded, context);
 }
-async function runReview(request, context) {
+async function runReview(request, reviewContext) {
+  const context = { ...reviewContext, usage: {} };
   const requestPath = join6(context.reviewDir, "request.md");
-  writeFileSync5(requestPath, request);
+  writeFileSync6(requestPath, request);
   const prompt = buildReviewerPrompt(requestPath);
   const results = await Promise.all(
     reviewers.map((reviewer) => {
@@ -1527,7 +1743,10 @@ async function runReview(request, context) {
     })
   );
   const succeeded = reviewers.filter((_, i) => results[i]?.ok);
-  if (!succeeded.length) throw new ReviewError("Every reviewer failed; nothing to report.");
+  const failed = reviewers.filter((reviewer) => !succeeded.includes(reviewer));
+  if (!succeeded.length) throw new ReviewFailure(`${stepNames(failed)} failed`, "Every reviewer failed; nothing to report.");
+  if (context.strict && failed.length)
+    throw new ReviewFailure(`${stepNames(failed)} failed`, `${stepNames(failed)} failed; not synthesising a partial review.`);
   const synthesised = await synthesise(
     requestPath,
     succeeded,
@@ -1537,75 +1756,123 @@ async function runReview(request, context) {
   return withReviewers(synthesised, context);
 }
 
-// src/features/review/status.ts
-import { styleText } from "util";
-import { createLogUpdate } from "log-update";
-async function timed(ui, label, work) {
-  const started = Date.now();
-  const status = ui.track(label);
-  const elapsed = () => `${Math.round((Date.now() - started) / 1e3)}s`;
+// src/features/review/preflight.ts
+var commandTimeout = 3e4;
+var probeTimeout = 6e4;
+var maxBodyChars2 = 300;
+function exec(harness, args) {
+  return new Promise((resolve) => {
+    const options = { encoding: "utf8", timeout: commandTimeout, shell: process.platform === "win32" };
+    execFile2(harness, args, options, (error, stdout) => resolve({ ok: !error, stdout }));
+  });
+}
+async function claudeSignedIn() {
+  const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
+  if (!ok) return false;
   try {
-    const result = await work();
-    status.succeed(`${label} (${elapsed()})`);
-    return result;
+    const parsed = JSON.parse(stdout);
+    return typeof parsed === "object" && parsed !== null && "loggedIn" in parsed && parsed.loggedIn === true;
+  } catch {
+    return false;
+  }
+}
+async function reach({ url, headers, body }) {
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...headers },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(probeTimeout)
+    });
+    if (response.ok) return void 0;
+    const text2 = (await response.text()).trim().slice(0, maxBodyChars2);
+    return `HTTP ${response.status}${text2 ? `: ${text2}` : ""}`;
   } catch (error) {
-    status.fail(`${label} failed after ${elapsed()}`);
-    throw error;
+    if (!(error instanceof Error)) return String(error);
+    const cause = error.cause instanceof Error ? error.cause.message : "";
+    return cause ? `${error.message} (${cause})` : error.message;
   }
 }
-function lineUi(log, { activity }) {
+var checks = {
+  onPath: async (harness) => (await exec(harness, ["--version"])).ok,
+  signedIn: async (harness) => harness === "claude" ? claudeSignedIn() : (await exec("codex", ["login", "status"])).ok,
+  reach
+};
+var loginCommand = { claude: "claude auth login", codex: "codex login" };
+function signedOut({ slot: { harness }, keys }) {
+  const settings = keys.map((key) => `${key}.provider and ${key}.model`).join(", and ");
+  return `${harness} is not signed in (${keys.join(", ")}); run \`${loginCommand[harness]}\`, or run it through LiteLLM or Foundry by setting ${settings} (see \`yoke models\`)`;
+}
+async function slotProblem(use, check) {
+  const { harness, model, probe } = use.slot;
+  if (!await check.onPath(harness)) return `${harness} CLI not found on PATH; install it`;
+  if (!probe) return await check.signedIn(harness) ? void 0 : signedOut(use);
+  const error = await check.reach(probe);
+  return error && `${harness} model "${model}" at ${probe.url}: ${error}`;
+}
+function slotsToRun(slots2) {
+  const uses = [
+    ["review.reviewer1", slots2.reviewer1],
+    ["review.reviewer2", slots2.reviewer2],
+    ["review.synthesis", slots2.synthesis ?? { harness: slots2.reviewer1.harness }]
+  ];
+  const distinct = /* @__PURE__ */ new Map();
+  for (const [key, slot] of uses) {
+    const id = `${slot.harness}:${slot.provider ?? "own"}:${slot.model ?? ""}`;
+    const use = distinct.get(id);
+    if (use) use.keys.push(key);
+    else distinct.set(id, { slot, keys: [key] });
+  }
+  return [...distinct.values()];
+}
+async function assertViable(slots2, check = checks) {
+  const problems = await Promise.all(slotsToRun(slots2).map((use) => slotProblem(use, check)));
+  const errors = problems.filter((problem) => problem !== void 0);
+  if (errors.length)
+    throw new ReviewFailure("a reviewer could not run", ["Cannot review:", ...errors.map((error) => `- ${error}`)].join("\n"));
+}
+
+// src/features/review/reviewLog.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join7 } from "path";
+function reviewLog(command = process.argv.slice(2), now = () => /* @__PURE__ */ new Date()) {
+  let path;
+  let buffered = [];
   return {
-    log,
-    track: (label) => {
-      log(`${label}\u2026`);
-      const update = (text2) => activity ? log(`${label}: ${text2}`) : void 0;
-      return { update, succeed: log, fail: log };
+    append: (line) => {
+      if (path) appendFileSync2(path, `${line}
+`);
+      else buffered.push(line);
     },
-    stop: () => {
+    attach: (reviewDir) => {
+      mkdirSync3(reviewDir, { recursive: true });
+      path = join7(reviewDir, "review.log");
+      appendFileSync2(path, `${["", `=== ${now().toISOString()} ===`, `$ yoke ${command.join(" ")}`, ...buffered].join("\n")}
+`);
+      buffered = [];
     }
   };
 }
-var frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-var tickMs = 80;
-function spinnerUi(stream) {
-  const update = createLogUpdate(stream);
-  const running = [];
-  let frame = 0;
-  let timer;
-  const paint = (colour, text2) => styleText(colour, text2, { stream });
-  const render = () => update(running.map((entry) => `${paint("cyan", frames[frame] ?? "")} ${entry.text}`).join("\n"));
-  const persist = (line) => {
-    update.clear();
-    update.persist(line);
-    render();
-  };
-  const settle = (entry, line) => {
-    running.splice(running.indexOf(entry), 1);
-    persist(line);
-    if (running.length || !timer) return;
-    clearInterval(timer);
-    timer = void 0;
+function logged(ui, append) {
+  const both = (show) => (line) => {
+    append(line);
+    show(line);
   };
   return {
-    log: persist,
+    log: both(ui.log),
     track: (label) => {
-      const entry = { label, text: label };
-      running.push(entry);
-      timer ??= setInterval(() => {
-        frame = (frame + 1) % frames.length;
-        render();
-      }, tickMs);
-      render();
+      append(`${label}\u2026`);
+      const status = ui.track(label);
       return {
-        update: (activity) => entry.text = `${label} \u2014 ${activity}`,
-        succeed: (text2) => settle(entry, `${paint("green", "\u2713")} ${text2}`),
-        fail: (text2) => settle(entry, `${paint("red", "\u2717")} ${text2}`)
+        update: (activity) => {
+          append(`${label}: ${activity}`);
+          status.update(activity);
+        },
+        succeed: both(status.succeed),
+        fail: both(status.fail)
       };
     },
-    stop: () => {
-      if (timer) clearInterval(timer);
-      update.done();
-    }
+    stop: ui.stop
   };
 }
 
@@ -1613,19 +1880,19 @@ function spinnerUi(stream) {
 function reviewRunDir(pr2, env = process.env, home = homedir2()) {
   const [, owner = "", repo = ""] = new URL(pr2.url).pathname.split("/");
   const run2 = `${pr2.number}-${pr2.baseRefOid}-${pr2.headRefOid}`;
-  return join7(env.XDG_CACHE_HOME || join7(home, ".cache"), "yoke", "reviews", owner, repo, run2);
+  return join8(env.XDG_CACHE_HOME || join8(home, ".cache"), "yoke", "reviews", owner, repo, run2);
 }
 var cachedOutputs = ["reviewer1.md", "reviewer2.md", "synthesis.md", "review.md", "models.json", "slots.json"];
 function prepareRunDir(reviewDir, force) {
-  mkdirSync3(reviewDir, { recursive: true });
-  if (force) for (const name of cachedOutputs) rmSync2(join7(reviewDir, name), { force: true });
+  mkdirSync4(reviewDir, { recursive: true });
+  if (force) for (const name of cachedOutputs) rmSync2(join8(reviewDir, name), { force: true });
 }
-async function reviewAtHead(pr2, reviewDir, request, slots, ui) {
-  const checkoutDir = mkdtempSync(join7(tmpdir(), "yoke-review-"));
+async function reviewAtHead(pr2, reviewDir, request, slots2, ui, strict) {
+  const checkoutDir = mkdtempSync(join8(tmpdir(), "yoke-review-"));
   try {
     const checkout = await timed(ui, `checking out ${pr2.headRefOid.slice(0, 7)}`, () => checkoutHead(pr2, checkoutDir));
     try {
-      return await runReview(request, { cwd: checkout.cwd, reviewDir, slots, runHarness, log: ui.log, track: ui.track });
+      return await runReview(request, { cwd: checkout.cwd, reviewDir, slots: slots2, runHarness, log: ui.log, track: ui.track, strict });
     } finally {
       await checkout.remove();
     }
@@ -1634,11 +1901,11 @@ async function reviewAtHead(pr2, reviewDir, request, slots, ui) {
   }
 }
 function savedReview(path, post) {
-  if (!post || !existsSync6(path)) return null;
-  return parseSynthesis(readFileSync6(path, "utf8"));
+  if (!post || !existsSync7(path)) return null;
+  return parseSynthesis(readFileSync7(path, "utf8"));
 }
 function saveReview(path, markdown) {
-  if (markdown) writeFileSync6(path, markdown);
+  if (markdown) writeFileSync7(path, markdown);
   else rmSync2(path, { force: true });
 }
 async function reviewPr(number, settings, { post, force }, io) {
@@ -1649,7 +1916,7 @@ async function reviewPr(number, settings, { post, force }, io) {
     io.out(text2);
   };
   const { log } = ui;
-  const slots = resolveSlots(settings);
+  const slots2 = resolveSlots(settings);
   const pr2 = await timed(ui, number ? `fetching PR #${number}` : "fetching this branch's PR", () => fetchPr(number));
   log(`#${pr2.number} ${pr2.title}`);
   const [diff, prior] = await timed(
@@ -1660,30 +1927,46 @@ async function reviewPr(number, settings, { post, force }, io) {
   const reviewDir = reviewRunDir(pr2);
   prepareRunDir(reviewDir, force);
   file.attach(reviewDir);
-  const path = join7(reviewDir, "review.md");
-  let synthesis = savedReview(path, post);
-  if (synthesis) {
-    log(`posting the saved review of #${pr2.number} at ${pr2.headRefOid.slice(0, 7)}`);
-    out(formatSynthesis(synthesis));
-  } else {
-    await timed(ui, "checking each reviewer can run", () => assertViable(slots));
+  const ci = post && isCi();
+  const review = async () => {
+    const path = join8(reviewDir, "review.md");
+    const saved = savedReview(path, post);
+    if (saved) {
+      log(`posting the saved review of #${pr2.number} at ${pr2.headRefOid.slice(0, 7)}`);
+      out(formatSynthesis(saved));
+      return { synthesis: saved, usage: {} };
+    }
+    await timed(ui, "checking each reviewer can run", () => assertViable(slots2));
     log(`review folder: ${reviewDir}`);
-    const result = await reviewAtHead(pr2, reviewDir, buildRequest(pr2, diff, prior), slots, ui);
+    const result = await reviewAtHead(pr2, reviewDir, buildRequest(pr2, diff, prior), slots2, ui, ci);
     out(result.report);
-    synthesis = result.synthesis;
     saveReview(path, result.markdown);
+    if (post && !result.synthesis)
+      throw new ReviewFailure(
+        "the synthesis could not be parsed",
+        "Not posting: the synthesis did not produce findings in the expected format."
+      );
+    return result;
+  };
+  const footer = () => modelsFooter(readUsedModels(reviewDir));
+  let findings;
+  try {
+    const { synthesis: synthesis2, usage } = await review();
+    findings = synthesis2;
+    if (ci && synthesis2) writeJobSummary(synthesis2.summary, usage, log);
+  } catch (error) {
+    if (ci && error instanceof ReviewFailure) await reportFailure(pr2, error.reason, ui, { api: github, log, footer: footer() });
+    throw error;
   }
-  if (!post) return;
-  if (!synthesis) throw new ReviewError("Not posting: the synthesis did not produce findings in the expected format.");
-  const findings = synthesis;
-  const footer = modelsFooter(readUsedModels(reviewDir));
-  await timed(ui, `posting to #${pr2.number}`, () => postFindings(pr2, findings, diff, prior, { api: github, log, footer }));
+  if (!post || !findings) return;
+  const synthesis = findings;
+  await timed(ui, `posting to #${pr2.number}`, () => postFindings(pr2, synthesis, diff, prior, { api: github, log, footer: footer(), ci }));
 }
 
 // src/features/sync/sync.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/skill.ts
 var ownerMarker = 'owner: "@makerx/yoke"';
@@ -1714,6 +1997,25 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 `
 };
 
+// src/features/review/ciSkill.ts
+var reviewCiSkill = {
+  name: "review-ci",
+  description: "Add yoke's adversarial PR review workflow to this repo and set the secrets it needs.",
+  disableModelInvocation: true,
+  userLevel: true,
+  body: `
+Run \`yoke review-ci $ARGUMENTS\`. If it reports that a model is required, run \`yoke models\` to list what the provider serves, ask the user which model each reviewer should run, and rerun with \`--reviewer-1-model\` and \`--reviewer-2-model\`. If it reports the workflow already exists and differs, show the user the difference and ask before rerunning with \`--force\`.
+
+Then set the two secrets it printed. Run \`gh secret list\` first; if either secret is missing, ask whether it is already set at the org level before setting it on the repo.
+- \`REVIEW_CI_BASE_URL\` is not secret: confirm the URL with the user and run the printed command.
+- \`REVIEW_CI_API_KEY\` must never enter this conversation: ask the user to run \`gh secret set REVIEW_CI_API_KEY\` in their own terminal, outside this session, and paste the key at its prompt.
+
+Finish by running \`gh secret list\` and telling the user to commit and push the workflow file.
+
+If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
+`
+};
+
 // src/features/review/skill.ts
 var reviewSkill = {
   name: "review",
@@ -1729,24 +2031,24 @@ If \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
 };
 
 // src/features/sync/sync.ts
-var bundledSkills = [prSkill, reviewSkill];
+var bundledSkills = [prSkill, reviewSkill, reviewCiSkill];
 function skillsRoot(user, cwd = process.cwd(), home = homedir3()) {
-  return join8(user ? home : cwd, ".claude", "skills");
+  return join9(user ? home : cwd, ".claude", "skills");
 }
 function isOwnedByUser(skillFile) {
-  return existsSync7(skillFile) && !readFileSync7(skillFile, "utf8").includes(ownerMarker);
+  return existsSync8(skillFile) && !readFileSync8(skillFile, "utf8").includes(ownerMarker);
 }
-function syncSkills(destination, skills = bundledSkills) {
+function syncSkills(destination, userDestination, skills = bundledSkills) {
   const result = { written: [], skipped: [] };
   for (const skill of skills) {
-    const target = join8(destination, skill.name);
-    const skillFile = join8(target, "SKILL.md");
+    const target = join9(skill.userLevel ? userDestination : destination, skill.name);
+    const skillFile = join9(target, "SKILL.md");
     if (isOwnedByUser(skillFile)) {
       result.skipped.push(target);
       continue;
     }
-    mkdirSync4(target, { recursive: true });
-    writeFileSync7(skillFile, renderSkill(skill));
+    mkdirSync5(target, { recursive: true });
+    writeFileSync8(skillFile, renderSkill(skill));
     result.written.push(skillFile);
   }
   return result;
@@ -1757,8 +2059,9 @@ var { version } = package_default;
 var program = new Command("yoke").description("Lean Claude Code skills and the CLI they call.").version(version);
 program.command("sync").description("Write yoke's skills into this repo's .claude/skills, or ~/.claude/skills with --user").option("--user", "write to ~/.claude/skills instead, for every repo").action((options) => {
   const user = options.user ?? false;
-  const display = (path) => user ? path : relative(process.cwd(), path);
-  const { written, skipped } = syncSkills(skillsRoot(user));
+  const cwd = process.cwd();
+  const display = (path) => path.startsWith(cwd) ? relative(cwd, path) : path;
+  const { written, skipped } = syncSkills(skillsRoot(user), skillsRoot(true));
   for (const file of written) console.log(`wrote ${display(file)}`);
   for (const dir of skipped) console.log(`skipped ${display(dir)} (your own skill; delete it to take yoke's)`);
 });
@@ -1811,6 +2114,22 @@ addSettingOptions(
     ui.stop();
   }
 });
+var ciKeys = settingKeys.filter((key) => /^review\.\w+\.(harness|model)$/.test(key));
+addSettingOptions(
+  program.command("review-ci").description(`Write ${callerWorkflowPath} so each PR in this repo is reviewed in CI, then print the gh secret set commands it needs`).option("--provider <provider>", "litellm or foundry; every slot uses it in CI. Default: review.reviewer1.provider, else litellm").option("--force", `overwrite an existing ${callerWorkflowPath} that differs`),
+  ciKeys
+).addHelpText("after", settingsHelp).action((options) => {
+  try {
+    const settings = resolveSettings(flagSettings(options, ciKeys), process.env, readUserConfig(userConfigPath()));
+    const workflow = callerWorkflow(settings, options.provider);
+    const outcome = writeCallerWorkflow(repoRoot(), renderCallerWorkflow(workflow), options.force ?? false);
+    console.log(reviewCiReport(outcome, secretCommands(settings, workflow.provider)));
+  } catch (error) {
+    if (!(error instanceof ReviewError || error instanceof ConfigError)) throw error;
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+});
 addSettingOptions(
   program.command("models").description("List the models each configured provider serves, for review.*.provider and review.*.model"),
   providerKeys