@makerx/yoke 0.8.1 → 0.9.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.8.1",
+  version: "0.9.0",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -80,6 +80,11 @@ var settingsSchema = z.object({
   "litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
   "foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
   "foundry.apiKey": secret("Foundry API key. Env or --user config only"),
+  "foundry.token": secret("Foundry Entra access token, sent as a bearer token in place of foundry.apiKey. Env or --user config only"),
+  "foundry.azureClientId": setting(
+    "Entra app (client) ID. In GitHub Actions, when a slot uses foundry, yoke exchanges the job OIDC token for foundry.token"
+  ),
+  "foundry.azureTenantId": setting("Entra tenant ID of foundry.azureClientId"),
   "review.reviewer1.harness": setting("claude or codex. Default: claude"),
   "review.reviewer1.provider": setting(providerHelp),
   "review.reviewer1.model": setting(modelHelp),
@@ -536,8 +541,11 @@ async function checkoutHead(pr2, reviewDir, exec2 = run) {
 // src/features/review/provider.ts
 var providerKinds = ["litellm", "foundry"];
 var harnesses = ["claude", "codex"];
-function codexKeyEnv(kind) {
-  return `YOKE_${kind.toUpperCase()}_API_KEY`;
+function codexKeyEnv(provider) {
+  return `YOKE_${provider.kind.toUpperCase()}_${"token" in provider ? "TOKEN" : "API_KEY"}`;
+}
+function credentialOf(provider) {
+  return "token" in provider ? provider.token : provider.apiKey;
 }
 function isProviderKind(value) {
   return providerKinds.includes(value);
@@ -553,8 +561,8 @@ function isHarness(value) {
 function ownAuthOverride({ harness, model }) {
   return { args: harness === "codex" ? ["-m", model] : ["--model", model], env: {} };
 }
-function buildCodexOverride({ kind, apiKey }, endpoints, model) {
-  const keyEnv = codexKeyEnv(kind);
+function buildCodexOverride(provider, endpoints, model) {
+  const keyEnv = codexKeyEnv(provider);
   return {
     args: [
       "-c",
@@ -570,19 +578,19 @@ function buildCodexOverride({ kind, apiKey }, endpoints, model) {
       "-m",
       model
     ],
-    env: { [keyEnv]: apiKey }
+    env: { [keyEnv]: credentialOf(provider) }
   };
 }
-function claudeProviderEnv(kind, endpoints, apiKey) {
-  if (kind === "foundry")
-    return { CLAUDE_CODE_USE_FOUNDRY: "1", ANTHROPIC_FOUNDRY_BASE_URL: endpoints.anthropic, ANTHROPIC_FOUNDRY_API_KEY: apiKey };
-  return { ANTHROPIC_BASE_URL: endpoints.anthropic, ANTHROPIC_AUTH_TOKEN: apiKey };
+function claudeProviderEnv(provider, endpoints) {
+  if (provider.kind === "foundry" && "apiKey" in provider)
+    return { CLAUDE_CODE_USE_FOUNDRY: "1", ANTHROPIC_FOUNDRY_BASE_URL: endpoints.anthropic, ANTHROPIC_FOUNDRY_API_KEY: provider.apiKey };
+  return { ANTHROPIC_BASE_URL: endpoints.anthropic, ANTHROPIC_AUTH_TOKEN: credentialOf(provider) };
 }
 function buildClaudeOverride(provider, endpoints, model) {
   return {
     args: ["--model", model],
     env: {
-      ...claudeProviderEnv(provider.kind, endpoints, provider.apiKey),
+      ...claudeProviderEnv(provider, endpoints),
       CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
       ANTHROPIC_DEFAULT_OPUS_MODEL: model,
       ANTHROPIC_DEFAULT_SONNET_MODEL: model,
@@ -591,16 +599,17 @@ function buildClaudeOverride(provider, endpoints, model) {
     }
   };
 }
-function claudeAuthHeaders({ kind, apiKey }) {
-  if (kind === "foundry") return { "x-api-key": apiKey };
-  return { Authorization: `Bearer ${apiKey}`, "x-api-key": apiKey };
+function claudeAuthHeaders(provider) {
+  if ("token" in provider) return { Authorization: `Bearer ${provider.token}` };
+  if (provider.kind === "foundry") return { "x-api-key": provider.apiKey };
+  return { Authorization: `Bearer ${provider.apiKey}`, "x-api-key": provider.apiKey };
 }
 function buildProbe({ harness, model }, provider) {
   const endpoints = deriveEndpoints(provider.kind, provider.baseUrl);
   if (harness === "codex")
     return {
       url: `${endpoints.responses}/responses`,
-      headers: { Authorization: `Bearer ${provider.apiKey}` },
+      headers: { Authorization: `Bearer ${credentialOf(provider)}` },
       body: { model, input: "ping", max_output_tokens: 16 }
     };
   return {
@@ -618,7 +627,24 @@ function buildOverride({ harness, model }, provider) {
 // src/features/review/ci.ts
 var reviewWorkflowRef = "MakerXStudio/yoke/.github/workflows/review.yml@main";
 var callerWorkflowPath = join3(".github", "workflows", "review-pr.yml");
-var ciSecrets = ["REVIEW_CI_BASE_URL", "REVIEW_CI_API_KEY"];
+var baseUrlSecret = "REVIEW_CI_BASE_URL";
+var apiKeySecret = "REVIEW_CI_API_KEY";
+function workflowSecrets({ entra }) {
+  return entra ? [baseUrlSecret] : [baseUrlSecret, apiKeySecret];
+}
+function entraInputs({ azureClientId, azureTenantId, environment }, provider, errors) {
+  const clientId = azureClientId?.trim();
+  const tenantId = azureTenantId?.trim();
+  const env = environment?.trim();
+  if (!clientId && !tenantId) {
+    if (env) errors.push("--environment needs --azure-client-id and --azure-tenant-id");
+    return [];
+  }
+  if (!clientId) errors.push("--azure-client-id is required with --azure-tenant-id");
+  if (!tenantId) errors.push("--azure-tenant-id is required with --azure-client-id");
+  if (provider !== "foundry") errors.push("--azure-client-id and --azure-tenant-id need --provider foundry");
+  return [["azure-client-id", clientId ?? ""], ["azure-tenant-id", tenantId ?? ""], ...env ? [["environment", env]] : []];
+}
 var slots = [
   { slot: "reviewer1", defaultHarness: "claude", required: true },
   { slot: "reviewer2", defaultHarness: "codex", required: true },
@@ -641,19 +667,25 @@ function slotInputs(settings, errors) {
   }
   return inputs;
 }
-function callerWorkflow(settings, providerFlag) {
+function callerWorkflow(settings, providerFlag, entraFlags = {}) {
   const errors = [];
   const provider = providerFlag ?? settings["review.reviewer1.provider"] ?? "litellm";
   if (!isProviderKind(provider)) errors.push(`provider "${provider}" must be ${providerKinds.join(" or ")}; pass --provider`);
   const inputs = slotInputs(settings, errors);
+  const entra = entraInputs(entraFlags, provider, errors);
   if (errors.length || !isProviderKind(provider))
     throw new ReviewError(["Cannot write the review workflow:", ...errors.map((error) => `- ${error}`)].join("\n"));
-  return { provider, inputs: [["provider", provider], ...inputs] };
+  const environment = entraFlags.environment?.trim();
+  return {
+    provider,
+    inputs: [["provider", provider], ...inputs, ...entra],
+    ...entra.length > 0 && { entra: { clientId: entraFlags.azureClientId?.trim() ?? "", ...environment && { environment } } }
+  };
 }
 function yamlValue(value) {
   return /^[\w./:@-]+$/.test(value) && !/^([-+.\d_eE]+|0[xo][\da-f]+|true|false|yes|no|on|off|y|n|null|~)$/i.test(value) ? value : JSON.stringify(value);
 }
-function renderCallerWorkflow({ inputs }) {
+function renderCallerWorkflow(workflow) {
   return [
     "name: Review PR",
     "",
@@ -664,23 +696,56 @@ function renderCallerWorkflow({ inputs }) {
     "permissions:",
     "  contents: read",
     "  pull-requests: write",
+    ...workflow.entra ? ["  id-token: write"] : [],
     "",
     "jobs:",
     "  review:",
     `    uses: ${reviewWorkflowRef}`,
     "    with:",
-    ...inputs.map(([name, value]) => `      ${name}: ${yamlValue(value)}`),
+    ...workflow.inputs.map(([name, value]) => `      ${name}: ${yamlValue(value)}`),
     "    secrets:",
-    ...ciSecrets.map((secret2) => `      ${secret2}: \${{ secrets.${secret2} }}`),
+    ...workflowSecrets(workflow).map((secret2) => `      ${secret2}: \${{ secrets.${secret2} }}`),
     ""
   ].join("\n");
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function secretCommands(settings, provider) {
-  const baseUrl = settings[`${provider}.baseUrl`];
-  return [`gh secret set REVIEW_CI_BASE_URL${baseUrl ? ` --body ${shellQuote(baseUrl)}` : ""}`, "gh secret set REVIEW_CI_API_KEY"];
+function secretCommands(settings, workflow) {
+  const baseUrl = settings[`${workflow.provider}.baseUrl`];
+  return workflowSecrets(workflow).map(
+    (secret2) => secret2 === baseUrlSecret && baseUrl ? `gh secret set ${secret2} --body ${shellQuote(baseUrl)}` : `gh secret set ${secret2}`
+  );
+}
+var githubOidcIssuer = "https://token.actions.githubusercontent.com";
+var entraTokenExchangeAudience = "api://AzureADTokenExchange";
+function federatedCredential(repo, environment) {
+  return {
+    issuer: githubOidcIssuer,
+    audience: entraTokenExchangeAudience,
+    subject: environment ? `repo:${repo}:environment:${environment}` : `repo:${repo}:pull_request`
+  };
+}
+function federatedCredentialCommand(clientId, credential) {
+  const parameters = JSON.stringify({
+    name: "yoke-review-ci",
+    issuer: credential.issuer,
+    subject: credential.subject,
+    audiences: [credential.audience]
+  });
+  return `az ad app federated-credential create --id ${shellQuote(clientId)} --parameters ${shellQuote(parameters)}`;
+}
+var unknownRepo = "<owner>/<repo>";
+function githubRepo(cwd = process.cwd()) {
+  try {
+    return execFileSync2("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || unknownRepo;
+  } catch {
+    return unknownRepo;
+  }
 }
 function repoRoot(cwd = process.cwd()) {
   try {
@@ -699,131 +764,34 @@ function writeCallerWorkflow(root, content, force) {
   writeFileSync2(path, content);
   return "wrote";
 }
-function reviewCiReport(outcome, commands) {
+function entraSetup({ clientId, environment }, repo) {
+  const credential = federatedCredential(repo, environment);
+  return [
+    "",
+    `Instead of REVIEW_CI_API_KEY, the job signs in to Foundry as Entra app ${clientId} with its GitHub OIDC token. On that app, create a federated credential with:`,
+    `  issuer:   ${credential.issuer}`,
+    `  audience: ${credential.audience}`,
+    `  subject:  ${credential.subject}`,
+    "for example with:",
+    `  ${federatedCredentialCommand(clientId, credential)}`,
+    "and give the app the Cognitive Services User role on the Foundry resource.",
+    ...environment ? [`The job runs in the ${environment} environment; create it on the repo if it does not exist.`] : []
+  ];
+}
+function reviewCiReport(outcome, settings, workflow, repo) {
   const action = outcome === "wrote" ? "wrote" : "kept";
+  const secrets = workflowSecrets(workflow);
   return [
     `${action} ${callerWorkflowPath}`,
     "",
-    `The workflow reads ${ciSecrets.join(" and ")}. Set them on the repo (or the org) with:`,
-    ...commands.map((command) => `  ${command}`),
+    `The workflow reads ${secrets.join(" and ")}. Set ${secrets.length > 1 ? "them" : "it"} on the repo (or the org) with:`,
+    ...secretCommands(settings, workflow).map((command) => `  ${command}`),
+    ...workflow.entra ? entraSetup(workflow.entra, repo()) : [],
     "",
     "Commit and push the workflow; each PR opened from this repo then gets a review."
   ].join("\n");
 }
 
-// src/features/review/slots.ts
-var slotNames = ["reviewer1", "reviewer2", "synthesis"];
-function readProvider(settings, kind) {
-  const baseUrlKey = `${kind}.baseUrl`;
-  const apiKeyKey = `${kind}.apiKey`;
-  const baseUrl = settings[baseUrlKey];
-  const apiKey = settings[apiKeyKey];
-  if (baseUrl && apiKey) return { kind, baseUrl, apiKey };
-  return [
-    baseUrl ? null : `${baseUrlKey} is not set; ${howToSet(baseUrlKey, "<url>")}`,
-    apiKey ? null : `${apiKeyKey} is not set; ${howToSet(apiKeyKey, "<key>")}`
-  ].filter((error) => error !== null);
-}
-function readSpec(settings, slot, errors) {
-  const keys = {
-    harness: `review.${slot}.harness`,
-    provider: `review.${slot}.provider`,
-    model: `review.${slot}.model`
-  };
-  const harness = settings[keys.harness];
-  const provider = settings[keys.provider];
-  const model = settings[keys.model];
-  if (!harness && !provider && !model) return void 0;
-  if (harness && !isHarness(harness))
-    errors.push(`${keys.harness} "${harness}" must be claude or codex; ${howToSet(keys.harness, "<claude|codex>")}`);
-  if (provider && !isProviderKind(provider))
-    errors.push(
-      `${keys.provider} "${provider}" must be ${providerKinds.join(" or ")}; ${howToSet(keys.provider, `<${providerKinds.join("|")}>`)}`
-    );
-  if (provider && !model)
-    errors.push(`${keys.model} is required when ${keys.provider} is set; ${howToSet(keys.model, "<model>")} (see \`yoke models\`)`);
-  return {
-    ...harness && isHarness(harness) ? { harness } : {},
-    ...provider && isProviderKind(provider) ? { provider } : {},
-    ...model ? { model } : {}
-  };
-}
-function toSlot({ harness: chosen, model, provider: kind }, fallback, providers) {
-  const harness = chosen ?? fallback;
-  if (!model) return { harness };
-  const slot = { harness, model };
-  const provider = kind && providers[kind];
-  if (provider) return { ...slot, provider: kind, override: buildOverride(slot, provider), probe: buildProbe(slot, provider) };
-  return { ...slot, override: ownAuthOverride(slot) };
-}
-function resolveSlots(settings) {
-  const specs = {};
-  const errors = [];
-  for (const name of slotNames) specs[name] = readSpec(settings, name, errors);
-  const providers = {};
-  for (const kind of new Set(Object.values(specs).flatMap((spec) => spec?.provider ? [spec.provider] : []))) {
-    const read = readProvider(settings, kind);
-    if (Array.isArray(read)) errors.push(...read);
-    else providers[kind] = read;
-  }
-  if (errors.length) throw new ReviewError(["Review settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
-  const reviewer1 = toSlot(specs.reviewer1 ?? {}, "claude", providers);
-  return {
-    reviewer1,
-    reviewer2: toSlot(specs.reviewer2 ?? {}, "codex", providers),
-    synthesis: specs.synthesis && toSlot(specs.synthesis, reviewer1.harness, providers)
-  };
-}
-
-// src/features/review/models.ts
-var timeout = 6e4;
-var maxBodyChars = 300;
-var providerWidth = Math.max(...providerKinds.map((kind) => kind.length));
-function modelsRequest({ kind, baseUrl, apiKey }) {
-  const url = `${deriveEndpoints(kind, baseUrl).responses}/models`;
-  return { url, headers: kind === "foundry" ? { "api-key": apiKey } : { Authorization: `Bearer ${apiKey}` } };
-}
-function isModelList(value) {
-  return typeof value === "object" && value !== null && "data" in value && Array.isArray(value.data) && value.data.every((model) => typeof model === "object" && model !== null && "id" in model && typeof model.id === "string");
-}
-async function get(url, headers, fetchModels) {
-  try {
-    return await fetchModels(url, { headers, signal: AbortSignal.timeout(timeout) });
-  } catch (error) {
-    throw new ReviewError(`Could not reach ${url}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function providerModels(provider, fetchModels) {
-  const { url, headers } = modelsRequest(provider);
-  const response = await get(url, headers, fetchModels);
-  if (!response.ok)
-    throw new ReviewError(`${url} returned HTTP ${response.status}: ${(await response.text()).trim().slice(0, maxBodyChars)}`);
-  const body = await response.json().catch(() => void 0);
-  if (!isModelList(body)) throw new ReviewError(`${url} returned an unexpected model list`);
-  return body.data.map(({ id }) => `${provider.kind.padEnd(providerWidth)}  ${id}`);
-}
-function isConfigured(settings, kind) {
-  return Boolean(settings[`${kind}.baseUrl`] || settings[`${kind}.apiKey`]);
-}
-async function listModels(settings, fetchModels = fetch) {
-  const kinds = providerKinds.filter((kind) => isConfigured(settings, kind));
-  if (!kinds.length)
-    throw new ReviewError(
-      `No model provider is configured; set ${providerKinds.map((kind) => `${kind}.baseUrl and ${kind}.apiKey`).join(", or ")} (see \`yoke config\`)`
-    );
-  const providers = kinds.map((kind) => readProvider(settings, kind));
-  const errors = providers.flatMap((provider) => Array.isArray(provider) ? provider : []);
-  if (errors.length) throw new ReviewError(["Model provider settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
-  const ready = providers.filter((provider) => !Array.isArray(provider));
-  const lists = await Promise.all(ready.map((provider) => providerModels(provider, fetchModels)));
-  return lists.flat().toSorted();
-}
-
-// src/features/review/review.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join8 } from "path";
-
 // src/features/review/comments.ts
 var markerPrefix = "<!-- yoke-review:";
 function slug(text2) {
@@ -968,7 +936,11 @@ This change adds or edits a workflow that calls \`MakerXStudio/yoke/.github/work
 - The trigger types, including leaving out \`synchronize\`: a review is re-run by marking the PR as draft and then ready for review.
 - Draft PRs being reviewed twice: the reusable workflow already skips drafts.
 
-Real defects in it are still findings, such as passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_BASE_URL\` and \`REVIEW_CI_API_KEY\`, or an input the reusable workflow does not declare.
+Real defects in it are still findings, such as:
+
+- Passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_BASE_URL\` and \`REVIEW_CI_API_KEY\`.
+- An input the reusable workflow does not declare.
+- No \`permissions:\` block limiting the token to \`contents: read\` and \`pull-requests: write\`, plus \`id-token: write\` with \`azure-client-id\`. The reusable workflow sets no permissions of its own, so the caller's block is the only limit on the token its agents run with.
 `;
 }
 
@@ -1205,6 +1177,189 @@ async function reportFailure(pr2, reason, ui, deps) {
   }
 }
 
+// src/features/review/slots.ts
+var slotNames = ["reviewer1", "reviewer2", "synthesis"];
+function notSet(key, secret2, placeholder, env) {
+  return isCi(env) ? `Secret ${secret2} is not set` : `${key} is not set; ${howToSet(key, placeholder)}`;
+}
+function readProvider(settings, kind, env = process.env) {
+  const baseUrlKey = `${kind}.baseUrl`;
+  const apiKeyKey = `${kind}.apiKey`;
+  const baseUrl = settings[baseUrlKey];
+  const apiKey = settings[apiKeyKey];
+  const token = kind === "foundry" ? settings["foundry.token"] : void 0;
+  if (baseUrl && token) return { kind, baseUrl, token };
+  if (baseUrl && apiKey) return { kind, baseUrl, apiKey };
+  return [
+    baseUrl ? null : notSet(baseUrlKey, baseUrlSecret, "<url>", env),
+    apiKey || token ? null : notSet(apiKeyKey, apiKeySecret, "<key>", env)
+  ].filter((error) => error !== null);
+}
+function readSpec(settings, slot, errors) {
+  const keys = {
+    harness: `review.${slot}.harness`,
+    provider: `review.${slot}.provider`,
+    model: `review.${slot}.model`
+  };
+  const harness = settings[keys.harness];
+  const provider = settings[keys.provider];
+  const model = settings[keys.model];
+  if (!harness && !provider && !model) return void 0;
+  if (harness && !isHarness(harness))
+    errors.push(`${keys.harness} "${harness}" must be claude or codex; ${howToSet(keys.harness, "<claude|codex>")}`);
+  if (provider && !isProviderKind(provider))
+    errors.push(
+      `${keys.provider} "${provider}" must be ${providerKinds.join(" or ")}; ${howToSet(keys.provider, `<${providerKinds.join("|")}>`)}`
+    );
+  if (provider && !model)
+    errors.push(`${keys.model} is required when ${keys.provider} is set; ${howToSet(keys.model, "<model>")} (see \`yoke models\`)`);
+  return {
+    ...harness && isHarness(harness) ? { harness } : {},
+    ...provider && isProviderKind(provider) ? { provider } : {},
+    ...model ? { model } : {}
+  };
+}
+function toSlot({ harness: chosen, model, provider: kind }, fallback, providers) {
+  const harness = chosen ?? fallback;
+  if (!model) return { harness };
+  const slot = { harness, model };
+  const provider = kind && providers[kind];
+  if (provider) return { ...slot, provider: kind, override: buildOverride(slot, provider), probe: buildProbe(slot, provider) };
+  return { ...slot, override: ownAuthOverride(slot) };
+}
+function resolveSlots(settings) {
+  const specs = {};
+  const errors = [];
+  for (const name of slotNames) specs[name] = readSpec(settings, name, errors);
+  const providers = {};
+  for (const kind of new Set(Object.values(specs).flatMap((spec) => spec?.provider ? [spec.provider] : []))) {
+    const read = readProvider(settings, kind);
+    if (Array.isArray(read)) errors.push(...read);
+    else providers[kind] = read;
+  }
+  if (errors.length) throw new ReviewError(["Review settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  const reviewer1 = toSlot(specs.reviewer1 ?? {}, "claude", providers);
+  return {
+    reviewer1,
+    reviewer2: toSlot(specs.reviewer2 ?? {}, "codex", providers),
+    synthesis: specs.synthesis && toSlot(specs.synthesis, reviewer1.harness, providers)
+  };
+}
+
+// src/features/review/models.ts
+var timeout = 6e4;
+var maxBodyChars = 300;
+var providerWidth = Math.max(...providerKinds.map((kind) => kind.length));
+function modelsRequest(provider) {
+  const url = `${deriveEndpoints(provider.kind, provider.baseUrl).responses}/models`;
+  if (provider.kind === "foundry" && "apiKey" in provider) return { url, headers: { "api-key": provider.apiKey } };
+  return { url, headers: { Authorization: `Bearer ${credentialOf(provider)}` } };
+}
+function isModelList(value) {
+  return typeof value === "object" && value !== null && "data" in value && Array.isArray(value.data) && value.data.every((model) => typeof model === "object" && model !== null && "id" in model && typeof model.id === "string");
+}
+async function get(url, headers, fetchModels) {
+  try {
+    return await fetchModels(url, { headers, signal: AbortSignal.timeout(timeout) });
+  } catch (error) {
+    throw new ReviewError(`Could not reach ${url}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function providerModels(provider, fetchModels) {
+  const { url, headers } = modelsRequest(provider);
+  const response = await get(url, headers, fetchModels);
+  if (!response.ok)
+    throw new ReviewError(`${url} returned HTTP ${response.status}: ${(await response.text()).trim().slice(0, maxBodyChars)}`);
+  const body = await response.json().catch(() => void 0);
+  if (!isModelList(body)) throw new ReviewError(`${url} returned an unexpected model list`);
+  return body.data.map(({ id }) => `${provider.kind.padEnd(providerWidth)}  ${id}`);
+}
+function isConfigured(settings, kind) {
+  return Boolean(settings[`${kind}.baseUrl`] || settings[`${kind}.apiKey`] || kind === "foundry" && settings["foundry.token"]);
+}
+async function listModels(settings, fetchModels = fetch) {
+  const kinds = providerKinds.filter((kind) => isConfigured(settings, kind));
+  if (!kinds.length)
+    throw new ReviewError(
+      `No model provider is configured; set ${providerKinds.map((kind) => `${kind}.baseUrl and ${kind}.apiKey`).join(", or ")} (see \`yoke config\`)`
+    );
+  const providers = kinds.map((kind) => readProvider(settings, kind));
+  const errors = providers.flatMap((provider) => Array.isArray(provider) ? provider : []);
+  if (errors.length) throw new ReviewError(["Model provider settings are incomplete:", ...errors.map((error) => `- ${error}`)].join("\n"));
+  const ready = providers.filter((provider) => !Array.isArray(provider));
+  const lists = await Promise.all(ready.map((provider) => providerModels(provider, fetchModels)));
+  return lists.flat().toSorted();
+}
+
+// src/features/review/review.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join8 } from "path";
+
+// src/features/review/entra.ts
+var tokenExchangeAudience = "api://AzureADTokenExchange";
+var cognitiveServicesScope = "https://cognitiveservices.azure.com/.default";
+var timeout2 = 3e4;
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function errorDetail(json, text2) {
+  const detail = [json.error_description, json.error, json.message].find((value) => typeof value === "string");
+  return typeof detail === "string" ? detail : text2.trim();
+}
+async function readJson(response, failure) {
+  const text2 = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text2);
+  } catch {
+    throw new ReviewError(`${failure}: HTTP ${response.status}: ${text2.trim().slice(0, 300)}`);
+  }
+  const json = isRecord(body) ? body : {};
+  if (response.ok) return json;
+  throw new ReviewError(`${failure}: HTTP ${response.status}: ${errorDetail(json, text2).slice(0, 300)}`);
+}
+async function githubOidcToken(env, fetchFn) {
+  const { ACTIONS_ID_TOKEN_REQUEST_URL: url, ACTIONS_ID_TOKEN_REQUEST_TOKEN: bearer } = env;
+  if (!url || !bearer) throw new ReviewError("No GitHub OIDC token endpoint; grant id-token: write in the calling workflow's permissions");
+  const request = new URL(url);
+  request.searchParams.set("audience", tokenExchangeAudience);
+  const response = await fetchFn(request, { headers: { Authorization: `bearer ${bearer}` }, signal: AbortSignal.timeout(timeout2) });
+  const { value } = await readJson(response, "GitHub OIDC token request failed");
+  if (typeof value !== "string" || !value) throw new ReviewError("GitHub OIDC token response had no value");
+  return value;
+}
+async function exchangeForEntraToken(clientId, tenantId, env, fetchFn = fetch) {
+  const assertion = await githubOidcToken(env, fetchFn);
+  const response = await fetchFn(`https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`, {
+    method: "POST",
+    body: new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: clientId,
+      scope: cognitiveServicesScope,
+      client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+      client_assertion: assertion
+    }),
+    signal: AbortSignal.timeout(timeout2)
+  });
+  const { access_token: token } = await readJson(response, `Entra token exchange for client ${clientId} failed`);
+  if (typeof token !== "string" || !token) throw new ReviewError("Entra token response had no access_token");
+  return token;
+}
+function usesFoundry(settings) {
+  return ["reviewer1", "reviewer2", "synthesis"].some((slot) => settings[`review.${slot}.provider`] === "foundry");
+}
+async function withEntraToken(settings, { env, fetch: fetchFn = fetch, mask }) {
+  const clientId = settings["foundry.azureClientId"];
+  const tenantId = settings["foundry.azureTenantId"];
+  if (!clientId && !tenantId) return settings;
+  if (!clientId || !tenantId) throw new ReviewError("Entra auth needs both foundry.azureClientId and foundry.azureTenantId");
+  if (settings["foundry.token"] || !usesFoundry(settings) || !isCi(env)) return settings;
+  const token = await exchangeForEntraToken(clientId, tenantId, env, fetchFn);
+  mask(token);
+  return { ...settings, "foundry.token": token };
+}
+
 // src/features/review/harness.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
@@ -1222,11 +1377,11 @@ function count(source, key) {
   const value = key ? source[key] : void 0;
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseUsage(raw, keys) {
-  if (!isRecord(raw)) return void 0;
+  if (!isRecord2(raw)) return void 0;
   const usage = {};
   for (const field2 of fields2) {
     const value = count(raw, keys[field2]);
@@ -1901,6 +2056,10 @@ function logged(ui, append) {
 }
 
 // src/features/review/review.ts
+function maskInCi(secret2) {
+  if (isCi()) process.stdout.write(`::add-mask::${secret2}
+`);
+}
 function reviewRunDir(pr2, env = process.env, home = homedir2()) {
   const [, owner = "", repo = ""] = new URL(pr2.url).pathname.split("/");
   const run2 = `${pr2.number}-${pr2.baseRefOid}-${pr2.headRefOid}`;
@@ -1940,7 +2099,7 @@ async function reviewPr(number, settings, { post, force }, io) {
     io.out(text2);
   };
   const { log } = ui;
-  const slots2 = resolveSlots(settings);
+  const slots2 = resolveSlots(await withEntraToken(settings, { env: process.env, mask: maskInCi }));
   const pr2 = await timed(ui, number ? `fetching PR #${number}` : "fetching this branch's PR", () => fetchPr(number));
   log(`#${pr2.number} ${pr2.title}`);
   const [diff, prior] = await timed(
@@ -2030,9 +2189,13 @@ var reviewCiSkill = {
   body: `
 Run \`yoke review-ci $ARGUMENTS\`. If it reports that a model is required, run \`yoke models\` to list what the provider serves, ask the user which model each reviewer should run, and rerun with \`--reviewer-1-model\` and \`--reviewer-2-model\`. If it reports the workflow already exists and differs, show the user the difference and ask before rerunning with \`--force\`.
 
-Then set the two secrets it printed. Run \`gh secret list\` first; if either secret is missing, ask whether it is already set at the org level before setting it on the repo.
+With \`--provider foundry\`, if the Foundry resource has local (API key) auth disabled or the user prefers Entra, rerun with \`--azure-client-id\` and \`--azure-tenant-id\` of the Entra app the job signs in as, plus \`--environment\` if the job should run in a GitHub environment. Ask the user for these values; don't guess them.
+
+Then set the secrets it printed. Run \`gh secret list\` first; if a secret is missing, ask whether it is already set at the org level before setting it on the repo.
 - \`REVIEW_CI_BASE_URL\` is not secret: confirm the URL with the user and run the printed command.
-- \`REVIEW_CI_API_KEY\` must never enter this conversation: ask the user to run \`gh secret set REVIEW_CI_API_KEY\` in their own terminal, outside this session, and paste the key at its prompt.
+- \`REVIEW_CI_API_KEY\` must never enter this conversation: ask the user to run \`gh secret set REVIEW_CI_API_KEY\` in their own terminal, outside this session, and paste the key at its prompt. With Entra auth there is no API key to set.
+
+With Entra auth, show the user the federated credential it printed (issuer, audience, subject) and the \`az ad app federated-credential create\` command, and ask whether to run it or whether they will add the credential in the Azure portal. The app also needs the Cognitive Services User role on the Foundry resource, and the environment, if given, must exist on the repo.
 
 Finish by running \`gh secret list\` and telling the user to commit and push the workflow file.
 
@@ -2140,14 +2303,20 @@ addSettingOptions(
 });
 var ciKeys = settingKeys.filter((key) => /^review\.\w+\.(harness|model)$/.test(key));
 addSettingOptions(
-  program.command("review-ci").description(`Write ${callerWorkflowPath} so each PR in this repo is reviewed in CI, then print the gh secret set commands it needs`).option("--provider <provider>", "litellm or foundry; every slot uses it in CI. Default: review.reviewer1.provider, else litellm").option("--force", `overwrite an existing ${callerWorkflowPath} that differs`),
+  program.command("review-ci").description(
+    `Write ${callerWorkflowPath} so each PR in this repo is reviewed in CI, then print the secrets, or Entra federated credential, it needs`
+  ).option("--provider <provider>", "litellm or foundry; every slot uses it in CI. Default: review.reviewer1.provider, else litellm").option(
+    "--azure-client-id <id>",
+    "Entra app (client) ID to sign in to Foundry with GitHub OIDC instead of an API key; needs --provider foundry"
+  ).option("--azure-tenant-id <id>", "Entra tenant ID of that app").option("--environment <name>", "GitHub environment the review job runs in, matching the app's federated credential subject").option("--force", `overwrite an existing ${callerWorkflowPath} that differs`),
   ciKeys
 ).addHelpText("after", settingsHelp).action((options) => {
   try {
     const settings = resolveSettings(flagSettings(options, ciKeys), process.env, readUserConfig(userConfigPath()));
-    const workflow = callerWorkflow(settings, options.provider);
-    const outcome = writeCallerWorkflow(repoRoot(), renderCallerWorkflow(workflow), options.force ?? false);
-    console.log(reviewCiReport(outcome, secretCommands(settings, workflow.provider)));
+    const workflow = callerWorkflow(settings, options.provider, options);
+    const root = repoRoot();
+    const outcome = writeCallerWorkflow(root, renderCallerWorkflow(workflow), options.force ?? false);
+    console.log(reviewCiReport(outcome, settings, workflow, () => githubRepo(root)));
   } catch (error) {
     if (!(error instanceof ReviewError || error instanceof ConfigError)) throw error;
     console.error(error.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerx/yoke",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   "license": "MIT",
   "author": "MakerX",