@mstar-harness/cli 3.6.0-alpha.3 → 3.6.0-alpha.4

package/dist/mstar-harness.js

@@ -2415,6 +2415,7 @@ var require_picocolors2 = __commonJS((exports, module) => {
 
 // src/index.ts
 import { execFileSync as execFileSync10 } from "child_process";
+import { createHash, randomUUID as randomUUID3 } from "crypto";
 import fs8 from "fs";
 import path12 from "path";
 
@@ -8544,6 +8545,9 @@ function prReviewSeatPrompt(opts) {
   if (!isAbsolute9(worktreePath)) {
     throw new TypeError(`prReviewSeatPrompt: worktreePath must be an absolute path - got ${JSON.stringify(opts.worktreePath)}`);
   }
+  if (opts.diffFile !== undefined && opts.diffFile !== "" && !isAbsolute9(opts.diffFile)) {
+    throw new TypeError(`prReviewSeatPrompt: diffFile must be an absolute path - got ${JSON.stringify(opts.diffFile)}`);
+  }
   const slug = `${domain}-${seat}`;
   const lines = [];
   lines.push(`# PR review audit seat \u2014 Stage ${opts.stage}${opts.securitySeat === true ? " (security)" : ""}`);
@@ -8569,6 +8573,9 @@ function prReviewSeatPrompt(opts) {
   const sections = opts.stage === 1 ? tier === "quick" ? "Scoping, Evidence rules" : "Review pipeline, Worktree isolation, Scoping, Evidence rules" : "Merge class, Attack and vet, Evidence rules, Sizing & change shape";
   lines.push(`1. \`${prReviewRef}\` \u2014 read at least these sections: ${sections}.`);
   lines.push(`2. The review worktree: \`${worktreePath}\` \u2014 your ONLY working directory this session; read-only (no edits, no fixes, no stash, no commits, no posts).`);
+  if (opts.diffFile) {
+    lines.push(`- Read the pinned diff snapshot FIRST: \`${opts.diffFile}\` \u2014 it is the review's diff basis (already computed at setup); read it before opening files.`);
+  }
   if (opts.stage === 2) {
     lines.push(`3. \`${join15(skillRoot, "references", "finding-format.md")}\` \u2014 the template every finding follows.`);
     if (opts.securitySeat === true) {
@@ -14136,6 +14143,9 @@ prReviewCommand.command("validate-report").description("Validate a saved local P
 function gitSync(args, cwd) {
   return execFileSync10("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
+function gitRaw(args, cwd) {
+  return execFileSync10("git", args, { cwd, stdio: ["ignore", "pipe", "pipe"], maxBuffer: GIT_CAPTURE_MAX_BYTES });
+}
 function ghSync(args, input) {
   return execFileSync10("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], ...input !== undefined ? { input } : {} }).trim();
 }
@@ -14161,7 +14171,11 @@ function refResolves(ref, cwd) {
 }
 function probeChangesetEmpty(diffCmdArgs, cwd, worktreePath) {
   if (diffCmdArgs[0] === "__working_tree__") {
-    const dirty = gitIf(["diff"], worktreePath).length > 0 || gitIf(["diff", "--cached"], worktreePath).length > 0;
+    const diffOut = gitProbe(["diff"], worktreePath);
+    const cachedOut = gitProbe(["diff", "--cached"], worktreePath);
+    if (diffOut === null || cachedOut === null)
+      return false;
+    const dirty = diffOut.length > 0 || cachedOut.length > 0;
     if (dirty)
       return false;
     let untracked = "";
@@ -14178,17 +14192,26 @@ function probeChangesetEmpty(diffCmdArgs, cwd, worktreePath) {
     const sha = diffCmdArgs[1];
     const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
     const diffFrom = refResolves(`${sha}^`, worktreePath) ? `${sha}^` : EMPTY_TREE;
-    return gitIf(["diff", diffFrom, sha], worktreePath).trim().length === 0;
+    const probe2 = gitProbe(["diff", diffFrom, sha], worktreePath);
+    return probe2 === null ? false : probe2.trim().length === 0;
   }
-  return gitIf(diffCmdArgs, worktreePath).length === 0;
+  const probe = gitProbe(diffCmdArgs, worktreePath);
+  return probe === null ? false : probe.length === 0;
 }
 function gitIf(args, cwd) {
   try {
-    return execFileSync10("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return execFileSync10("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: GIT_CAPTURE_MAX_BYTES });
   } catch {
     return "";
   }
 }
+function gitProbe(args, cwd) {
+  try {
+    return execFileSync10("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: GIT_CAPTURE_MAX_BYTES });
+  } catch {
+    return null;
+  }
+}
 function probeChangesetEmptyPreworktree(mode, headSpec, cwd) {
   if (mode === "working-tree")
     return probeChangesetEmpty(["__working_tree__"], cwd, cwd);
@@ -14315,7 +14338,7 @@ function ghApi(apiPath, payload) {
     input: payload
   });
 }
-prReviewCommand.command("worktree-setup").description("Create the isolated review worktree per pr-review.md \xA7 Worktree isolation: resolves the real base, picks a " + "collision-free branch name, fetches with explicit refspecs, creates the worktree, computes the diff basis INSIDE it, " + "and records a sidecar json consumed by worktree-cleanup; prints {reviewBranch, worktreePath, base, mergeBase, diffCmd} " + "(input modes: --pr <n> | --branch <b> | --diff | --working-tree | --commit <sha>)").option("--pr <n>", "PR number input mode (pull/<n>/head via gh)").option("--branch <name>", "Bare remote-branch input mode").option("--diff", "Arbitrary diff input mode \u2014 no worktree, no refs").option("--working-tree", "Uncommitted working-tree input mode \u2014 no worktree, no refs").option("--commit <sha>", "Single-commit input mode").option("--path <dir>", "Worktree target directory (default: ../<repo-name>.review-pr<N> beside the repo)").action((options) => {
+prReviewCommand.command("worktree-setup").description("Create the isolated review worktree per pr-review.md \xA7 Worktree isolation: resolves the real base, picks a " + "collision-free branch name, fetches with explicit refspecs, creates the worktree, computes the diff basis INSIDE it, " + "and records a sidecar json consumed by worktree-cleanup; prints {reviewBranch, worktreePath, base, mergeBase, diffCmd, diffFile} " + "(input modes: --pr <n> | --branch <b> | --diff | --working-tree | --commit <sha>)").option("--pr <n>", "PR number input mode (pull/<n>/head via gh)").option("--branch <name>", "Bare remote-branch input mode").option("--diff", "Arbitrary diff input mode \u2014 no worktree, no refs").option("--working-tree", "Uncommitted working-tree input mode \u2014 no worktree, no refs").option("--commit <sha>", "Single-commit input mode").option("--path <dir>", "Worktree target directory (default: <repo>/.worktrees/review-<branch>)").action((options) => {
   try {
     const modesDeclared = [
       options.pr !== undefined,
@@ -14355,7 +14378,7 @@ prReviewCommand.command("worktree-setup").description("Create the isolated revie
         process.exitCode = 1;
         return;
       }
-      console.log(JSON.stringify({ reviewBranch: null, worktreePath: repoRoot, base: null, mergeBase: null, diffCmd: mode === "diff" ? "(provided changeset)" : "git diff + git diff --cached + ls-files --others" }, null, 2));
+      console.log(JSON.stringify({ reviewBranch: null, worktreePath: repoRoot, base: null, mergeBase: null, diffCmd: mode === "diff" ? "(provided changeset)" : "git diff + git diff --cached + ls-files --others", diffFile: null }, null, 2));
       return;
     }
     let prNumber = 0;
@@ -14405,7 +14428,21 @@ prReviewCommand.command("worktree-setup").description("Create the isolated revie
     const baseCandidate = mode === "pr" ? namePrNumber : Number(String(Math.abs([...headSpec].reduce((h, ch) => (h * 31 + ch.charCodeAt(0)) % 1000003, 7))));
     const reviewBranch = pickReviewBranchName(existing, baseCandidate === 0 ? 1 : baseCandidate, cliToday().replace(/-/g, ""));
     const branchSuffix = mode === "pr" ? "" : `-${headSpec.slice(0, 8)}`;
-    const worktreePath = path12.resolve(options.path ?? joinDirnameBeside(repoRoot, `.review-${reviewBranch}${branchSuffix}`));
+    const worktreePath = path12.resolve(options.path ?? path12.join(repoRoot, ".worktrees", `review-${reviewBranch}${branchSuffix}`));
+    if (options.path === undefined) {
+      fs8.mkdirSync(path12.join(repoRoot, ".worktrees"), { recursive: true });
+      if (gitIf(["check-ignore", ".worktrees/"], repoRoot) === "") {
+        const excludePath = path12.join(repoRoot, ".git", "info", "exclude");
+        const existing2 = fs8.existsSync(excludePath) ? fs8.readFileSync(excludePath, "utf8") : "";
+        if (!existing2.split(`
+`).some((line) => line.trim() === ".worktrees/")) {
+          fs8.appendFileSync(excludePath, `${existing2 === "" || existing2.endsWith(`
+`) ? "" : `
+`}.worktrees/
+`);
+        }
+      }
+    }
     const originUrl = gitIf(["remote", "get-url", "origin"], repoRoot);
     let fetched = true;
     try {
@@ -14421,7 +14458,11 @@ prReviewCommand.command("worktree-setup").description("Create the isolated revie
     } catch {
       fetched = false;
     }
-    const rollbackNewWorktree = (branchToDelete) => {
+    let wroteSnapshot = false;
+    let wroteSidecar = false;
+    let pendingSidecar;
+    let sidecarFd;
+    const cleanupOnFailure = (branchToDelete) => {
       try {
         if (fs8.existsSync(worktreePath))
           gitSync(["worktree", "remove", "--force", worktreePath], repoRoot);
@@ -14429,6 +14470,12 @@ prReviewCommand.command("worktree-setup").description("Create the isolated revie
         if (branchToDelete !== "" && !existing.has(branchToDelete)) {
           gitSync(["branch", "-D", branchToDelete], repoRoot);
         }
+        if (wroteSidecar && sidecarFd !== undefined) {
+          removeOwnedFreshSidecarFile(sidecarFd, worktreePath);
+          sidecarFd = undefined;
+        }
+        if (wroteSnapshot && pendingSidecar !== undefined)
+          removeOwnedSnapshotFile(worktreePath, pendingSidecar);
       } catch {}
     };
     const fetchedHeadResolves = mode === "pr" ? refResolves(reviewBranch, repoRoot) : mode === "branch" ? originUrl !== "" && refResolves(`origin/${options.branch}`, repoRoot) : mode === "commit" ? Boolean(gitIf(["rev-parse", "--verify", "--quiet", `${headSpec}^{commit}`], repoRoot).trim()) : refResolves(headSpec, repoRoot);
@@ -14461,48 +14508,222 @@ prReviewCommand.command("worktree-setup").description("Create the isolated revie
     const changesetEmpty = probeChangesetEmpty(diffArgs, worktreePath, worktreePath);
     const emptyGate = preflightChangeset(mode, { refsResolve: true, changesetEmpty });
     if (changesetEmpty) {
-      rollbackNewWorktree(mode === "pr" ? reviewBranch : "");
+      cleanupOnFailure(mode === "pr" ? reviewBranch : "");
     }
     if (!emptyGate.ok && emptyGate.violations.some((v) => v.code === "prreview.preflight.changeset-empty")) {
       printChecklist("pr-review worktree-setup preflight", emptyGate);
       process.exitCode = 1;
       return;
     }
-    const recordedBase = mode === "pr" || mode !== "commit" && !baseRef.startsWith("origin/") ? `origin/${baseRef}` : baseRef;
-    const sidecar = {
-      reviewBranch: mode === "pr" ? reviewBranch : "",
-      worktreePath,
-      base: recordedBase,
-      mergeBase,
-      diffCmd,
-      reportSaved: false,
-      createdAt: new Date().toISOString(),
-      repoRoot
+    const captureAndRecordSnapshot = () => {
+      const diffFile = prReviewArtifactPathFor(worktreePath, "diff");
+      const sidecarPath = prReviewArtifactPathFor(worktreePath, "json");
+      const snapshotParts = [];
+      if (mode === "commit") {
+        snapshotParts.push(Buffer.from(`# Review package: ${baseRef} (single commit)
+
+## Commits
+`), gitRaw(["log", "--oneline", "-1", headSpec], worktreePath), Buffer.from(`
+## Files changed
+`), gitRaw(["show", "--stat", headSpec], worktreePath), Buffer.from(`
+## Diff
+`), gitRaw(["show", "-U10", headSpec], worktreePath));
+      } else {
+        const range = diffArgs[1];
+        const [rangeBase, rangeHead] = range.split("...");
+        snapshotParts.push(Buffer.from(`# Review package: ${baseRef}..${headSpec}
+
+## Commits
+`), gitRaw(["log", "--oneline", `${rangeBase}..${rangeHead}`], worktreePath), Buffer.from(`
+## Files changed
+`), gitRaw(["diff", "--stat", range], worktreePath), Buffer.from(`
+## Diff
+`), gitRaw(["diff", "-U10", range], worktreePath));
+      }
+      const snapshot = Buffer.concat(snapshotParts);
+      const recordedBase = mode === "pr" || mode !== "commit" && !baseRef.startsWith("origin/") ? `origin/${baseRef}` : baseRef;
+      const sidecar2 = {
+        reviewBranch: mode === "pr" ? reviewBranch : "",
+        worktreePath,
+        base: recordedBase,
+        mergeBase,
+        diffCmd,
+        reportSaved: false,
+        createdAt: new Date().toISOString(),
+        repoRoot,
+        diffFile,
+        diffFileSha256: createHash("sha256").update(snapshot).digest("hex")
+      };
+      try {
+        sidecarFd = fs8.openSync(sidecarPath, "wx+");
+      } catch (error) {
+        if (error.code !== "EEXIST" && error.code !== "EISDIR")
+          throw error;
+        throw new Error(`cannot record setup sidecar at ${sidecarPath} - run mstar pr-review worktree-cleanup first (never cleaning a foreign review)`);
+      }
+      writeFdSync(sidecarFd, Buffer.from(JSON.stringify(sidecar2, null, 2), "utf8"));
+      wroteSidecar = true;
+      try {
+        fs8.writeFileSync(diffFile, snapshot, { flag: "wx" });
+      } catch (error) {
+        if (error.code !== "EEXIST" && error.code !== "EISDIR")
+          throw error;
+        throw new Error(`refusing to overwrite pre-existing non-snapshot path ${diffFile}`);
+      }
+      wroteSnapshot = true;
+      const snapshotStat = fs8.lstatSync(diffFile);
+      sidecar2.diffFileDev = snapshotStat.dev;
+      sidecar2.diffFileIno = String(snapshotStat.ino);
+      sidecar2.diffFileMtimeMs = snapshotStat.mtimeMs;
+      pendingSidecar = sidecar2;
+      fs8.ftruncateSync(sidecarFd, 0);
+      writeFdSync(sidecarFd, Buffer.from(JSON.stringify(sidecar2, null, 2), "utf8"));
+      fs8.closeSync(sidecarFd);
+      sidecarFd = undefined;
+      return sidecar2;
     };
-    fs8.writeFileSync(sidecarPathFor(worktreePath), JSON.stringify(sidecar, null, 2));
+    let sidecar;
+    try {
+      sidecar = captureAndRecordSnapshot();
+    } catch (error) {
+      cleanupOnFailure(mode === "pr" ? reviewBranch : "");
+      throw error;
+    }
     console.log(JSON.stringify({
       reviewBranch: sidecar.reviewBranch === "" ? null : sidecar.reviewBranch,
       worktreePath: sidecar.worktreePath,
       base: sidecar.base,
       mergeBase: sidecar.mergeBase === "" ? null : sidecar.mergeBase,
-      diffCmd: sidecar.diffCmd
+      diffCmd: sidecar.diffCmd,
+      diffFile: sidecar.diffFile
     }, null, 2));
   } catch (error) {
     failScript(error, "pr-review worktree-setup");
   }
 });
-function sidecarPathFor(worktreePath) {
+function prReviewArtifactPathFor(worktreePath, suffix) {
   const parent = path12.dirname(path12.resolve(worktreePath));
   const name = path12.basename(path12.resolve(worktreePath));
-  return path12.join(parent, `.${name}.prreview.json`);
+  return path12.join(parent, `.${name}.prreview.${suffix}`);
+}
+function writeFdSync(fd, buf) {
+  let written = 0;
+  while (written < buf.length)
+    written += fs8.writeSync(fd, buf, written, buf.length - written, written);
+}
+function removeOwnedSnapshotFile(worktreePath, sidecar) {
+  const snapshotPath = prReviewArtifactPathFor(worktreePath, "diff");
+  let fd;
+  try {
+    fd = fs8.openSync(snapshotPath, "r");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot at ${snapshotPath} left in place (cannot open: ${error.message})`));
+    return;
+  }
+  try {
+    const st = fs8.fstatSync(fd);
+    if (!st.isFile())
+      return;
+    const recordedIno = sidecar.diffFileIno;
+    const recordedDev = sidecar.diffFileDev;
+    const recordedMtimeMs = sidecar.diffFileMtimeMs;
+    const owned = typeof recordedIno === "string" && recordedIno !== "" && typeof recordedDev === "number" && Number.isFinite(recordedDev) && typeof recordedMtimeMs === "number" && Number.isFinite(recordedMtimeMs) && String(st.ino) === recordedIno && st.dev === recordedDev && st.mtimeMs === recordedMtimeMs;
+    if (!owned) {
+      console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot at ${snapshotPath} left in place (file identity does not match the recorded snapshot)`));
+      return;
+    }
+    if (st.nlink !== 1) {
+      console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot at ${snapshotPath} left in place (link count does not match the recorded snapshot)`));
+      return;
+    }
+    const tmp = `${snapshotPath}.cleanup.${process.pid}.${randomUUID3()}`;
+    try {
+      fs8.renameSync(snapshotPath, tmp);
+    } catch (error) {
+      console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot at ${snapshotPath} left in place (cannot detach: ${error.message})`));
+      return;
+    }
+    const st2 = fs8.fstatSync(fd);
+    let tmpStat;
+    try {
+      tmpStat = fs8.lstatSync(tmp);
+    } catch {
+      tmpStat = undefined;
+    }
+    if (tmpStat !== undefined && tmpStat.ino === st2.ino && tmpStat.dev === st2.dev && st2.nlink === 1 && tmpStat.nlink === 1) {
+      fs8.unlinkSync(tmp);
+      const st3 = fs8.fstatSync(fd);
+      if (st3.nlink !== 0) {
+        console.error(import_picocolors2.default.yellow(`worktree-cleanup: unlink at ${tmp} detached a pathname replacement, not the verified snapshot inode (${snapshotPath} still holds ${st3.nlink} link(s)) - the replacement is gone, the verified snapshot was NOT deleted`));
+      }
+    } else {
+      try {
+        fs8.linkSync(tmp, snapshotPath);
+        fs8.unlinkSync(tmp);
+      } catch (error) {
+        if (error.code === "EEXIST") {
+          console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot replacement left at ${tmp} (snapshot path was recreated concurrently)`));
+        } else {
+          console.error(import_picocolors2.default.yellow(`worktree-cleanup: snapshot replacement left at ${tmp} (restore failed: ${error.message})`));
+        }
+      }
+    }
+  } finally {
+    fs8.closeSync(fd);
+  }
 }
-function joinDirnameBeside(repoRoot, leaf) {
-  return path12.join(path12.dirname(path12.resolve(repoRoot)), leaf);
+function removeOwnedFreshSidecarFile(sidecarFd, worktreePath) {
+  const sidecarPath = prReviewArtifactPathFor(worktreePath, "json");
+  try {
+    const st = fs8.fstatSync(sidecarFd);
+    if (!st.isFile() || st.nlink !== 1) {
+      console.error(import_picocolors2.default.yellow(`worktree-setup rollback: sidecar at ${sidecarPath} left in place (identity no longer held)`));
+      return;
+    }
+    const tmp = `${sidecarPath}.cleanup.${process.pid}.${randomUUID3()}`;
+    try {
+      fs8.renameSync(sidecarPath, tmp);
+    } catch (error) {
+      console.error(import_picocolors2.default.yellow(`worktree-setup rollback: sidecar at ${sidecarPath} left in place (cannot detach: ${error.message})`));
+      return;
+    }
+    const st2 = fs8.fstatSync(sidecarFd);
+    let tmpStat;
+    try {
+      tmpStat = fs8.lstatSync(tmp);
+    } catch {
+      tmpStat = undefined;
+    }
+    if (tmpStat !== undefined && tmpStat.ino === st2.ino && tmpStat.dev === st2.dev) {
+      fs8.unlinkSync(tmp);
+      const st3 = fs8.fstatSync(sidecarFd);
+      if (st3.nlink !== 0) {
+        console.error(import_picocolors2.default.yellow(`worktree-setup rollback: unlink at ${tmp} detached a pathname replacement, not the verified sidecar inode (${sidecarPath} still holds ${st3.nlink} link(s)) - the replacement is gone, the verified sidecar was NOT deleted`));
+      }
+    } else {
+      try {
+        fs8.linkSync(tmp, sidecarPath);
+        fs8.unlinkSync(tmp);
+      } catch (error) {
+        if (error.code === "EEXIST") {
+          console.error(import_picocolors2.default.yellow(`worktree-setup rollback: sidecar replacement left at ${tmp} (sidecar path was recreated concurrently)`));
+        } else {
+          console.error(import_picocolors2.default.yellow(`worktree-setup rollback: sidecar replacement left at ${tmp} (restore failed: ${error.message})`));
+        }
+      }
+    }
+  } finally {
+    try {
+      fs8.closeSync(sidecarFd);
+    } catch {}
+  }
 }
 prReviewCommand.command("worktree-cleanup").description("Remove the review worktree per pr-review.md \xA7 Worktree isolation cleanup: refuses unless --report-saved is given OR the " + "setup sidecar records report-saved; removes the worktree, prunes, and deletes EXACTLY the recorded review branch \u2014 a " + "--branch argument that disagrees with the sidecar is refused (never delete a foreign/pre-existing branch)").requiredOption("--path <dir>", "Worktree directory created by worktree-setup").requiredOption("--branch <name>", "The recorded review branch (must match the setup sidecar for PR mode)").option("--report-saved", "Assert the local report has been saved before removal").action((options) => {
   try {
     const worktreePath = path12.resolve(resolveCliPath(options.path));
-    const sidecarPath = sidecarPathFor(worktreePath);
+    const sidecarPath = prReviewArtifactPathFor(worktreePath, "json");
     if (!fs8.existsSync(sidecarPath)) {
       throw new Error(`no setup sidecar found at ${sidecarPath} - run pr-review worktree-setup first (foreign worktrees are never cleaned here)`);
     }
@@ -14534,6 +14755,7 @@ prReviewCommand.command("worktree-cleanup").description("Remove the review workt
       }
       gitSync(["branch", "-D", sidecar.reviewBranch], gitRoot);
     }
+    removeOwnedSnapshotFile(worktreePath, sidecar);
     fs8.rmSync(sidecarPath, { force: true });
     console.log(import_picocolors2.default.green(`worktree-cleanup: removed ${worktreePath}${sidecar.reviewBranch !== "" ? ` + deleted ${sidecar.reviewBranch}` : " (no local branch to delete)"}`));
   } catch (error) {
@@ -14583,7 +14805,7 @@ function measureLargestTouchedTotal(diffOutput, headRef, cwd) {
   }
   return maxTotal;
 }
-prReviewCommand.command("seat-prompt").description("Generate the read-only audit-seat prompt per pr-review.md \xA7 Seat prompts (Hard Rules 4/5 verbatim, payload-return contract, " + "no-verdict/no-post clauses, slug <domain>-<seat>, Merge-class instruction on stage 2); prints the prompt").requiredOption("--stage <1|2>", "Pipeline stage (1 = collect, 2 = domain/security)").requiredOption("--domain <d>", "Review domain for this seat").requiredOption("--seat <id>", "Seat id (slug becomes <domain>-<seat>)").requiredOption("--worktree <path>", "Absolute review worktree path").option("--security", "Mark this seat as the security-lens seat (stage 2)").option("--skill-root <dir>", "Skill root containing references/pr-review.md (default: resolved skills/mstar-audit)").option("--recon <facts...>", "Recon facts (variadic: --recon fact1 fact2 ...)").option("--tier <quick|default|deep>", "Prompt tier (SP-A): quick shrinks read-first + folds the security lens in-seat; deep adds cross-domain security seat + stage-as-wave (default: default)").action((options) => {
+prReviewCommand.command("seat-prompt").description("Generate the read-only audit-seat prompt per pr-review.md \xA7 Seat prompts (Hard Rules 4/5 verbatim, payload-return contract, " + "no-verdict/no-post clauses, slug <domain>-<seat>, Merge-class instruction on stage 2); prints the prompt").requiredOption("--stage <1|2>", "Pipeline stage (1 = collect, 2 = domain/security)").requiredOption("--domain <d>", "Review domain for this seat").requiredOption("--seat <id>", "Seat id (slug becomes <domain>-<seat>)").requiredOption("--worktree <path>", "Absolute review worktree path").option("--security", "Mark this seat as the security-lens seat (stage 2)").option("--skill-root <dir>", "Skill root containing references/pr-review.md (default: resolved skills/mstar-audit)").option("--recon <facts...>", "Recon facts (variadic: --recon fact1 fact2 ...)").option("--tier <quick|default|deep>", "Prompt tier (SP-A): quick shrinks read-first + folds the security lens in-seat; deep adds cross-domain security seat + stage-as-wave (default: default)").option("--diff-file <path>", "Absolute path to the pinned diff snapshot written by worktree-setup (read-first ingredient)").action((options) => {
   try {
     if (options.stage !== "1" && options.stage !== "2") {
       throw new SddScriptError(`usage: pr-review seat-prompt \u2014 --stage must be 1 or 2, got ${JSON.stringify(options.stage)}`, 2);
@@ -14601,7 +14823,8 @@ prReviewCommand.command("seat-prompt").description("Generate the read-only audit
       worktreePath: path12.resolve(options.worktree),
       reconFacts: options.recon ?? [],
       ...options.security === true ? { securitySeat: true } : {},
-      ...tier !== undefined ? { tier } : {}
+      ...tier !== undefined ? { tier } : {},
+      ...options.diffFile !== undefined && options.diffFile !== "" ? { diffFile: path12.resolve(resolveCliPath(options.diffFile)) } : {}
     });
     console.log(prompt);
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mstar-harness/cli",
-  "version": "3.6.0-alpha.3",
+  "version": "3.6.0-alpha.4",
   "description": "Morning Star harness CLI — installer bootstrap + mstar workflow verbs (path/status/lease/sdd/iteration/dispatch/worktree/lint/design-md/audit/compound/host/skill).",
   "license": "MIT",
   "repository": {