@open-agent-toolkit/cli 0.2.79 → 0.3.1

package/dist/commands/gate/review-verdict.js

@@ -2,17 +2,12 @@ import { createHash } from 'node:crypto';
 import { readFile, writeFile } from 'node:fs/promises';
 import { getFrontmatterBlock } from '../shared/frontmatter.js';
 import YAML from 'yaml';
-const SEVERITIES = [
-    'critical',
-    'important',
-    'medium',
-    'minor',
-];
+const SEVERITIES = ['critical', 'high', 'medium', 'low'];
 const FRONTMATTER_COUNT_KEYS = {
     critical: ['oat_review_critical_count', 'critical'],
-    important: ['oat_review_important_count', 'important'],
+    high: ['oat_review_high_count', 'high'],
     medium: ['oat_review_medium_count', 'medium'],
-    minor: ['oat_review_minor_count', 'minor'],
+    low: ['oat_review_low_count', 'low'],
 };
 function artifactContentSignature(content) {
     return createHash('sha256').update(content).digest('hex');
@@ -59,6 +54,9 @@ function readGateInvocation(frontmatter) {
     };
 }
 function parseCountValue(value) {
+    if (typeof value === 'string' && value.trim().length === 0) {
+        return null;
+    }
     const numberValue = typeof value === 'number'
         ? value
         : typeof value === 'string'
@@ -69,40 +67,58 @@ function parseCountValue(value) {
     }
     return numberValue;
 }
-function readFrontmatterCounts(frontmatter) {
+function readFrontmatterCounts(frontmatter, artifactPath) {
+    const hasNestedCounts = Object.hasOwn(frontmatter, 'oat_review_counts');
+    if (hasNestedCounts &&
+        (typeof frontmatter['oat_review_counts'] !== 'object' ||
+            frontmatter['oat_review_counts'] === null ||
+            Array.isArray(frontmatter['oat_review_counts']))) {
+        throw new Error(`Review artifact at ${artifactPath} declares an invalid oat_review_counts block; it must be an object of non-negative integer counts.`);
+    }
     const nestedCounts = typeof frontmatter['oat_review_counts'] === 'object' &&
         frontmatter['oat_review_counts'] !== null &&
         !Array.isArray(frontmatter['oat_review_counts'])
         ? frontmatter['oat_review_counts']
         : null;
-    const counts = {
-        critical: 0,
-        important: 0,
-        medium: 0,
-        minor: 0,
-    };
+    const parsed = new Map();
+    // Validate every supplied alias before deciding whether the block is
+    // complete. A partial block must not be able to hide a conflicting pair and
+    // fall through to a summary line that reports fewer findings.
     for (const severity of SEVERITIES) {
         const candidateValues = [
-            ...FRONTMATTER_COUNT_KEYS[severity].map((key) => frontmatter[key]),
+            ...FRONTMATTER_COUNT_KEYS[severity].flatMap((key) => Object.hasOwn(frontmatter, key) ? [frontmatter[key]] : []),
             ...(nestedCounts
-                ? FRONTMATTER_COUNT_KEYS[severity].map((key) => nestedCounts[key])
+                ? FRONTMATTER_COUNT_KEYS[severity].flatMap((key) => Object.hasOwn(nestedCounts, key) ? [nestedCounts[key]] : [])
                 : []),
-        ].filter((value) => value !== undefined && value !== null);
-        if (candidateValues.length === 0) {
-            return null;
+        ];
+        const hasInvalidValue = candidateValues.some((value) => parseCountValue(value) === null);
+        if (hasInvalidValue) {
+            throw new Error(`Review artifact at ${artifactPath} declares an invalid ${severity} count; counts must be non-negative integers.`);
         }
-        const parsedCount = candidateValues.reduce((parsed, value) => {
-            if (parsed !== null) {
-                return parsed;
-            }
-            return parseCountValue(value);
-        }, null);
-        if (parsedCount === null) {
-            return null;
+        const distinct = [
+            ...new Set(candidateValues
+                .map((value) => parseCountValue(value))
+                .filter((value) => value !== null)),
+        ];
+        if (distinct.length > 1) {
+            throw new Error(`Review artifact at ${artifactPath} declares conflicting ${severity} counts (${distinct.join(', ')}); resolve the frontmatter before the gate can evaluate the review.`);
+        }
+        if (distinct.length === 1) {
+            parsed.set(severity, distinct[0]);
         }
-        counts[severity] = parsedCount;
     }
-    return counts;
+    if (parsed.size === 0) {
+        return null;
+    }
+    return {
+        counts: {
+            critical: parsed.get('critical') ?? 0,
+            high: parsed.get('high') ?? 0,
+            medium: parsed.get('medium') ?? 0,
+            low: parsed.get('low') ?? 0,
+        },
+        tiers: [...parsed.keys()],
+    };
 }
 function sectionContentIsEmpty(content) {
     const cleaned = content
@@ -113,6 +129,17 @@ function sectionContentIsEmpty(content) {
         .trim();
     return cleaned.length === 0 || /^none\.?$/i.test(cleaned);
 }
+/**
+ * Count the findings a severity section declares.
+ *
+ * Only top-level markdown list items count. Prose shapes are deliberately not
+ * counted — a bold lead-in paragraph, a wrapped continuation line, and a nested
+ * detail bullet are indistinguishable from a finding title without parsing the
+ * prose, so counting them would miscount and double-count. The cost of that
+ * choice is that a reviewer who writes findings as paragraphs gets a zero
+ * tally, so every diagnostic built on this count must name the list-item
+ * requirement (see `FINDING_LIST_ITEM_CONTRACT_HINT`).
+ */
 function countFindingsInSection(content) {
     if (sectionContentIsEmpty(content)) {
         return 0;
@@ -146,15 +173,25 @@ function markdownLines(content) {
     return lines;
 }
 function fenceMarker(line) {
-    const match = line.match(/^\s*(`{3,}|~{3,})/);
+    const match = line.match(/^\s*(`{3,}|~{3,})(.*)$/);
     if (!match?.[1]) {
         return null;
     }
     return {
         marker: match[1].startsWith('`') ? '`' : '~',
         length: match[1].length,
+        trailing: match[2] ?? '',
     };
 }
+/**
+ * Lines outside fenced code blocks.
+ *
+ * An opening fence may carry an info string (```ts), but a closing fence may
+ * not: a marker run followed by other text is fence content, not a delimiter.
+ * Treating such a line as a closer ends the fence early and exposes quoted
+ * examples to the count scans, which is the failure the fence-awareness is
+ * there to prevent.
+ */
 function linesOutsideFences(content) {
     const outsideFenceLines = [];
     let activeFence = null;
@@ -165,7 +202,8 @@ function linesOutsideFences(content) {
                 activeFence = marker;
             }
             else if (marker.marker === activeFence.marker &&
-                marker.length >= activeFence.length) {
+                marker.length >= activeFence.length &&
+                marker.trailing.trim() === '') {
                 activeFence = null;
             }
             continue;
@@ -211,39 +249,114 @@ function missingSeverityHeadings(severityHeadings) {
     const seenSeverities = new Set(severityHeadings.map((heading) => heading.severity));
     return SEVERITIES.filter((severity) => !seenSeverities.has(severity));
 }
-function parseFindingsSummaryCounts(content) {
-    const match = content.match(/^Findings:\s*(\d+)\s+critical,\s*(\d+)\s+important,\s*(\d+)\s+medium,\s*(\d+)\s+minor\s*$/im);
-    if (!match) {
+const FINDINGS_SUMMARY_PATTERN = /^Findings by severity:\s*(\d+)\s+critical,\s*(\d+)\s+high,\s*(\d+)\s+medium,\s*(\d+)\s+low\s*$/i;
+/**
+ * Read the canonical count line. Only lines outside fenced code blocks count,
+ * so a quoted example cannot be mistaken for the artifact's own counts, and two
+ * disagreeing count lines are rejected rather than silently resolved in favor
+ * of whichever appears first.
+ */
+function parseFindingsSummaryCounts(content, artifactPath) {
+    const found = [];
+    for (const line of linesOutsideFences(content)) {
+        const match = FINDINGS_SUMMARY_PATTERN.exec(line.text.trim());
+        if (!match) {
+            continue;
+        }
+        found.push({
+            critical: Number.parseInt(match[1] ?? '0', 10),
+            high: Number.parseInt(match[2] ?? '0', 10),
+            medium: Number.parseInt(match[3] ?? '0', 10),
+            low: Number.parseInt(match[4] ?? '0', 10),
+        });
+    }
+    if (found.length === 0) {
         return null;
     }
-    return {
-        critical: Number.parseInt(match[1] ?? '0', 10),
-        important: Number.parseInt(match[2] ?? '0', 10),
-        medium: Number.parseInt(match[3] ?? '0', 10),
-        minor: Number.parseInt(match[4] ?? '0', 10),
-    };
+    const distinct = new Map(found.map((counts) => [JSON.stringify(counts), counts]));
+    if (distinct.size > 1) {
+        throw new Error(`Review artifact at ${artifactPath} contains ${found.length} conflicting "Findings by severity" count lines; keep exactly one so the gate can evaluate the review.`);
+    }
+    return found[0];
 }
-function parseFindingsSectionCounts(content, artifactPath) {
+/**
+ * Tier spellings retired by the severity rename. They are no longer read, and
+ * detecting them fails the artifact with a migration error rather than letting
+ * it parse. A retired heading that parsed alongside canonical ones would have
+ * its findings attributed to whichever canonical section precedes it, which can
+ * move a finding below the blocking threshold.
+ */
+function describeLegacySeverityUsage(content, frontmatter) {
+    const found = new Set();
+    const findingsSection = findFindingsSection(content);
+    for (const line of linesOutsideFences(findingsSection?.content ?? '')) {
+        if (/^#{1,6}\s+Important\s*#*\s*$/i.test(line.text)) {
+            found.add('a `### Important` heading');
+        }
+        if (/^#{1,6}\s+Minor\s*#*\s*$/i.test(line.text)) {
+            found.add('a `### Minor` heading');
+        }
+    }
+    for (const line of linesOutsideFences(content)) {
+        if (/^Findings:\s*\d+\s+critical,/i.test(line.text.trim())) {
+            found.add('a legacy `Findings:` count line');
+        }
+    }
+    const nested = typeof frontmatter['oat_review_counts'] === 'object' &&
+        frontmatter['oat_review_counts'] !== null &&
+        !Array.isArray(frontmatter['oat_review_counts'])
+        ? frontmatter['oat_review_counts']
+        : {};
+    for (const key of [...Object.keys(frontmatter), ...Object.keys(nested)]) {
+        if (/^(oat_review_)?(important|minor)(_count)?$/.test(key)) {
+            found.add(`the \`${key}\` count key`);
+        }
+    }
+    return [...found];
+}
+function legacySeverityError(artifactPath, legacyUsage) {
+    if (legacyUsage.length === 0) {
+        return null;
+    }
+    return new Error(`Review artifact at ${artifactPath} uses retired severity tiers (${legacyUsage.join(', ')}). The tiers are now Critical, High, Medium, and Low: rename \`### Important\` to \`### High\` and \`### Minor\` to \`### Low\`, and \`oat_review_important_count\`/\`oat_review_minor_count\` to \`oat_review_high_count\`/\`oat_review_low_count\`, or re-run the review. If the reviewer that wrote this artifact still emits the retired tiers, its installed instructions are stale: run \`oat tools update\` to refresh the installed tools and their provider projections.`);
+}
+/**
+ * Per-tier counts for every severity heading the body actually has.
+ *
+ * Deliberately tolerant: it counts what is present without requiring the full
+ * canonical heading set, so it can cross-check explicit counts without changing
+ * how a body-only artifact is validated.
+ */
+function tallySeveritySections(content) {
     const findingsSection = findFindingsSection(content);
     const severityHeadings = findSeverityHeadings(content);
     if (severityHeadings.length === 0) {
         return null;
     }
-    const missingSeverities = missingSeverityHeadings(severityHeadings);
-    if (missingSeverities.length > 0) {
-        throw new Error(`Review artifact at ${artifactPath} has an incomplete Findings section; expected headings for Critical, Important, Medium, and Minor. Missing: ${missingSeverities.join(', ')}.`);
-    }
     const counts = {
         critical: 0,
-        important: 0,
+        high: 0,
         medium: 0,
-        minor: 0,
+        low: 0,
     };
     for (const [offset, heading] of severityHeadings.entries()) {
         const nextHeading = severityHeadings[offset + 1];
         const sectionStart = heading.index + heading.headingLength;
         const sectionEnd = nextHeading?.index ?? findingsSection?.end ?? content.length;
-        counts[heading.severity] = countFindingsInSection(content.slice(sectionStart, sectionEnd));
+        // Accumulate rather than assign: a repeated heading for one tier must not
+        // erase findings already counted under an earlier occurrence.
+        counts[heading.severity] += countFindingsInSection(content.slice(sectionStart, sectionEnd));
+    }
+    return counts;
+}
+function parseFindingsSectionCounts(content, artifactPath) {
+    const counts = tallySeveritySections(content);
+    if (counts === null) {
+        return null;
+    }
+    const missingSeverities = missingSeverityHeadings(findSeverityHeadings(content));
+    if (missingSeverities.length > 0) {
+        throw new Error(`Review artifact at ${artifactPath} has an incomplete Findings section; expected headings for ${SEVERITIES.map(severityDisplayName).join(', ')}. Missing: ${missingSeverities.join(', ')}.`);
     }
     return counts;
 }
@@ -263,7 +376,7 @@ function parseFrontmatterObject(frontmatter, artifactPath) {
     }
 }
 function hasBlockingFindings(counts) {
-    return counts.critical > 0 || counts.important > 0;
+    return counts.critical > 0 || counts.high > 0;
 }
 function insertionTextForSeverity(severity) {
     return `\n### ${severityDisplayName(severity)}\n\nNone\n`;
@@ -307,16 +420,83 @@ async function normalizeMissingEmptySeveritySections(artifactPath, content, coun
         persisted: insertedSeverities.length > 0 && persist,
     };
 }
-function resolveCounts(content, frontmatter) {
-    const frontmatterCounts = readFrontmatterCounts(frontmatter);
+/**
+ * The one fact a reviewer cannot recover from the raw contradiction report.
+ *
+ * A section whose findings are written as bold paragraphs tallies zero, so the
+ * gate reports a contradiction that looks like a counting mistake. Without this
+ * sentence the reviewer has no way to learn that the shape of the finding, not
+ * the arithmetic, is what the parser objected to.
+ */
+const FINDING_LIST_ITEM_CONTRACT_HINT = 'Only markdown list items count as findings in a Findings section: a line starting with `- `, `* `, `+ `, or `1. `. A finding written as a bold paragraph, a heading, or any other prose shape counts as zero, which is the usual reason a section tallies lower than the declared counts. Rewrite each finding as a list item, or correct the declared counts to match.';
+function formatCounts(counts) {
+    return SEVERITIES.map((severity) => `${counts[severity]} ${severity}`).join(', ');
+}
+/**
+ * Fail closed when two count sources disagree.
+ *
+ * No single source may win by precedence: a stale all-zero frontmatter block or
+ * count line would otherwise mask real findings written in the body, and the
+ * gate would pass a review that clearly reports a blocking finding.
+ */
+function assertAgreeingCounts(artifactPath, left, right, tiers = SEVERITIES) {
+    const differing = tiers.filter((severity) => left.counts[severity] !== right.counts[severity]);
+    if (differing.length === 0) {
+        return;
+    }
+    const sectionsInvolved = left.fromSections === true || right.fromSections === true;
+    throw new Error(`Review artifact at ${artifactPath} contradicts itself about finding counts (${differing.join(', ')}): declared counts are ${formatCounts(left.counts)} (${left.name}) but ${formatCounts(right.counts)} (${right.name}). Reconcile them before the gate can evaluate the review.${sectionsInvolved ? ` ${FINDING_LIST_ITEM_CONTRACT_HINT}` : ''}`);
+}
+/**
+ * Resolve the artifact's counts, cross-checking every source that is present.
+ *
+ * Returns `null` when only the body carries counts, so the caller keeps the
+ * completeness-checked body path for body-only artifacts.
+ */
+function resolveCounts(content, frontmatter, artifactPath) {
+    const explicitSources = [];
+    const frontmatterCounts = readFrontmatterCounts(frontmatter, artifactPath);
     if (frontmatterCounts) {
-        return frontmatterCounts;
+        explicitSources.push({
+            name: 'the frontmatter count fields',
+            counts: frontmatterCounts.counts,
+            tiers: frontmatterCounts.tiers,
+        });
     }
-    const summaryCounts = parseFindingsSummaryCounts(content);
+    const summaryCounts = parseFindingsSummaryCounts(content, artifactPath);
     if (summaryCounts) {
-        return summaryCounts;
+        explicitSources.push({
+            name: 'the "Findings by severity" count line',
+            counts: summaryCounts,
+            tiers: SEVERITIES,
+        });
     }
-    return null;
+    const [primarySource, ...otherSources] = explicitSources;
+    for (const source of otherSources) {
+        const comparableTiers = primarySource.tiers.filter((severity) => source.tiers.includes(severity));
+        assertAgreeingCounts(artifactPath, primarySource, source, comparableTiers);
+    }
+    const bodyCounts = tallySeveritySections(content);
+    if (bodyCounts) {
+        // Only tiers the body actually has a heading for are comparable. A missing
+        // heading is not a claim of zero findings, it is a malformed body, and the
+        // completeness and normalization checks own that diagnosis.
+        const bodyTiers = [
+            ...new Set(findSeverityHeadings(content).map((heading) => heading.severity)),
+        ];
+        const bodySource = {
+            name: 'the Findings sections',
+            counts: bodyCounts,
+            tiers: bodyTiers,
+            fromSections: true,
+        };
+        for (const source of explicitSources) {
+            const comparableTiers = source.tiers.filter((severity) => bodyTiers.includes(severity));
+            assertAgreeingCounts(artifactPath, source, bodySource, comparableTiers);
+        }
+    }
+    return (explicitSources.find((source) => source.tiers.length === SEVERITIES.length)
+        ?.counts ?? null);
 }
 export async function parseReviewGateVerdict(artifactPath, options = {}) {
     let content;
@@ -340,7 +520,15 @@ export async function parseReviewGateVerdict(artifactPath, options = {}) {
     const frontmatter = frontmatterBlock
         ? parseFrontmatterObject(frontmatterBlock, artifactPath)
         : {};
-    let counts = resolveCounts(content, frontmatter);
+    // Retired tiers fail the artifact outright rather than being ignored, and do
+    // so before normalization can rewrite the file. Ignoring them is not safe: a
+    // retired heading that parses alongside canonical ones has its findings
+    // attributed to whichever canonical section precedes it.
+    const retiredTierError = legacySeverityError(artifactPath, describeLegacySeverityUsage(content, frontmatter));
+    if (retiredTierError) {
+        throw retiredTierError;
+    }
+    let counts = resolveCounts(content, frontmatter, artifactPath);
     let insertedSeverities = [];
     let normalizationPersisted = false;
     if (counts && options.normalizeMissingEmptySeveritySections) {

package/dist/review-remote/body-builder.d.ts

@@ -5,12 +5,12 @@
  *
  * The body is the durable handoff to `*-receive-remote`: a leading
  * HTML-comment marker block (parsed back by {@link parseMarkerBlock}) followed
- * by human-readable prose (summary, severity counts, optional minor-fix nudge,
+ * by human-readable prose (summary, severity counts, optional low-fix nudge,
  * optional verification commands).
  */
 import { type ReviewInvocation } from './marker-parser.js';
 export type ReviewVerdict = 'REQUEST_CHANGES' | 'COMMENT';
-export type FindingSeverity = 'critical' | 'important' | 'medium' | 'minor';
+export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low';
 /** Minimal finding shape the builder needs — only severity is required. */
 export interface BuilderFinding {
     severity: FindingSeverity;
@@ -73,7 +73,7 @@ interface GateBuildInput {
 export type BuildInput = BuildInputBase & (LifecycleBuildInput | GateBuildInput);
 /**
  * Map a finding set to the GitHub review verdict: `REQUEST_CHANGES` when any
- * critical or important finding is present, otherwise `COMMENT` (including the
+ * critical or high finding is present, otherwise `COMMENT` (including the
  * zero-findings clean-review case). Never auto-`APPROVE`.
  */
 export declare function mapVerdict(findings: BuilderFinding[]): ReviewVerdict;

package/dist/review-remote/body-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-builder.d.ts","sourceRoot":"","sources":["../../src/review-remote/body-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,cAAc;IACtB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,UAAU,mBAAmB;IAC3B,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC9C,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GACrC,CAAC,mBAAmB,GAAG,cAAc,CAAC,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,aAAa,CAKpE;AAgFD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;CACxB,CAkCA"}
+{"version":3,"file":"body-builder.d.ts","sourceRoot":"","sources":["../../src/review-remote/body-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErE,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,cAAc;IACtB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,UAAU,mBAAmB;IAC3B,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC9C,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GACrC,CAAC,mBAAmB,GAAG,cAAc,CAAC,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,aAAa,CAKpE;AAgFD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;CACxB,CAkCA"}

package/dist/review-remote/body-builder.js

@@ -5,25 +5,25 @@
  *
  * The body is the durable handoff to `*-receive-remote`: a leading
  * HTML-comment marker block (parsed back by {@link parseMarkerBlock}) followed
- * by human-readable prose (summary, severity counts, optional minor-fix nudge,
+ * by human-readable prose (summary, severity counts, optional low-fix nudge,
  * optional verification commands).
  */
 import { MARKER_BLOCK_OPEN } from './marker-parser.js';
 /**
  * Map a finding set to the GitHub review verdict: `REQUEST_CHANGES` when any
- * critical or important finding is present, otherwise `COMMENT` (including the
+ * critical or high finding is present, otherwise `COMMENT` (including the
  * zero-findings clean-review case). Never auto-`APPROVE`.
  */
 export function mapVerdict(findings) {
-    const hasBlocking = findings.some((f) => f.severity === 'critical' || f.severity === 'important');
+    const hasBlocking = findings.some((f) => f.severity === 'critical' || f.severity === 'high');
     return hasBlocking ? 'REQUEST_CHANGES' : 'COMMENT';
 }
 function countSeverities(findings) {
     const counts = {
         critical: 0,
-        important: 0,
+        high: 0,
         medium: 0,
-        minor: 0,
+        low: 0,
     };
     for (const f of findings) {
         counts[f.severity] += 1;
@@ -76,9 +76,9 @@ function buildOutOfDiffSection(findings) {
     });
     return ['## Findings outside the PR diff', '', ...entries].join('\n');
 }
-const MINOR_FIX_NUDGE = 'Minor findings are included inline. We recommend fixing minors during ' +
-    'this cycle rather than tracking them as backlog items — they are usually ' +
-    'faster to just resolve than to manage.';
+const LOW_FIX_NUDGE = 'Low findings are included inline. We recommend fixing low-severity ' +
+    'findings during this cycle rather than tracking them as backlog items — ' +
+    'they are usually faster to just resolve than to manage.';
 /**
  * Build the posted-review body and compute its verdict.
  */
@@ -92,17 +92,17 @@ export function buildReviewBody(input) {
             '## Severity Counts',
             '',
             `- Critical: ${counts.critical}`,
-            `- Important: ${counts.important}`,
+            `- High: ${counts.high}`,
             `- Medium: ${counts.medium}`,
-            `- Minor: ${counts.minor}`,
+            `- Low: ${counts.low}`,
         ].join('\n'),
     ];
     const outOfDiffSection = buildOutOfDiffSection(input.outOfDiffFindings);
     if (outOfDiffSection !== null) {
         sections.push(outOfDiffSection);
     }
-    if (counts.minor > 0) {
-        sections.push(`## Notes\n\n${MINOR_FIX_NUDGE}`);
+    if (counts.low > 0) {
+        sections.push(`## Notes\n\n${LOW_FIX_NUDGE}`);
     }
     if (input.verificationCommands && input.verificationCommands.length > 0) {
         const commands = input.verificationCommands

package/dist/review-remote/reviewer-dispatch.d.ts

@@ -33,10 +33,10 @@ import type { NarrowingResult } from './narrowing.js';
 export declare const STRUCTURED_OUTPUT_MODE_FLAG: 'oat_output_mode';
 /** The single accepted value of {@link STRUCTURED_OUTPUT_MODE_FLAG}. */
 export declare const STRUCTURED_OUTPUT_MODE_VALUE: 'structured';
-export type FindingSeverity = 'critical' | 'important' | 'medium' | 'minor';
+export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low';
 /** A single structured finding (see design.md → Data Models). */
 export interface StructuredFinding {
-    /** Stable per-dispatch ID with a C/I/M/m prefix. */
+    /** Stable per-dispatch ID with a C/H/M/L prefix. */
     id: string;
     severity: FindingSeverity;
     title: string;

package/dist/review-remote/reviewer-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reviewer-dispatch.d.ts","sourceRoot":"","sources":["../../src/review-remote/reviewer-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAG,iBAA0B,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,4BAA4B,EAAG,YAAqB,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;AAS5E,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,qBAAqB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAgED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA2B7E;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAK7B"}
+{"version":3,"file":"reviewer-dispatch.d.ts","sourceRoot":"","sources":["../../src/review-remote/reviewer-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAG,iBAA0B,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,4BAA4B,EAAG,YAAqB,CAAC;AAElE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAgBrE,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpE;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,qBAAqB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB;AAsED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA2B7E;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAK7B"}

package/dist/review-remote/reviewer-dispatch.js

@@ -34,10 +34,16 @@ export const STRUCTURED_OUTPUT_MODE_FLAG = 'oat_output_mode';
 export const STRUCTURED_OUTPUT_MODE_VALUE = 'structured';
 const SEVERITIES = new Set([
     'critical',
-    'important',
+    'high',
     'medium',
-    'minor',
+    'low',
 ]);
+const SEVERITY_ID_PREFIX = {
+    critical: 'C',
+    high: 'H',
+    medium: 'M',
+    low: 'L',
+};
 /** Typed error raised when the reviewer returns a malformed structured shape. */
 export class StructuredFindingsError extends Error {
     constructor(message) {
@@ -72,12 +78,14 @@ function validateFinding(value, index) {
     if (!isObject(value)) {
         throw new StructuredFindingsError(`${at} must be an object.`);
     }
-    if (typeof value['id'] !== 'string' || value['id'] === '') {
-        throw new StructuredFindingsError(`${at}.id must be a non-empty string.`);
-    }
     if (typeof value['severity'] !== 'string' ||
         !SEVERITIES.has(value['severity'])) {
-        throw new StructuredFindingsError(`${at}.severity must be one of critical|important|medium|minor.`);
+        throw new StructuredFindingsError(`${at}.severity must be one of critical|high|medium|low.`);
+    }
+    const severity = value['severity'];
+    const expectedIdPattern = new RegExp(`^${SEVERITY_ID_PREFIX[severity]}[1-9]\\d*$`);
+    if (typeof value['id'] !== 'string' || !expectedIdPattern.test(value['id'])) {
+        throw new StructuredFindingsError(`${at}.id must use the ${SEVERITY_ID_PREFIX[severity]} prefix for ${severity} severity followed by a positive integer.`);
     }
     if (typeof value['title'] !== 'string') {
         throw new StructuredFindingsError(`${at}.title must be a string.`);
@@ -104,7 +112,7 @@ function validateFinding(value, index) {
     }
     return {
         id: value['id'],
-        severity: value['severity'],
+        severity,
         title: value['title'],
         file: fileSet ? file : null,
         line: lineSet ? line : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.79",
+  "version": "0.3.1",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.79"
+    "@open-agent-toolkit/control-plane": "0.3.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",