@openscaffold/cli 0.1.2 → 0.1.4

package/README.md

@@ -7,7 +7,6 @@ start, in any repo, loads the right customer deployment's briefing, and the Open
 ```sh
 npx @openscaffold/cli setup acme.com ./customer-docs   # sign in if needed, create the deployment, upload the folder, print the cited plan
 npx @openscaffold/cli login    # opens your browser: click Approve. That's it.
-npx @openscaffold/cli review --title "…" --req req_1   # review this folder's change against the customer's plan (agents run it)
 npx @openscaffold/cli status   # what's set up and the next step (--json for coding agents)
 npx @openscaffold/cli logout   # removes everything it installed and revokes the login
 npx @openscaffold/cli help     # commands and environment variables
@@ -27,9 +26,6 @@ MCP server and `/openscaffold:*` commands).
 - `~/.config/openscaffold/credentials.json` (your login, mode 0600)
 - the `openscaffold` MCP server in Claude Code (user scope)
 - a SessionStart hook in `~/.claude/settings.json` that prints the briefing
-- two guardrail hooks in the same file: before a `git commit`, the customer's rules and must-haves as context; at Stop,
-  once per session, if Claude edited files without a review, it's asked to run `openscaffold review` (or `request_review`) and then
-  call `report_session`
 - `/os-requirements`, `/os-what-changed`, `/os-check-plan`, `/os-demo-check` in `~/.claude/skills/`
 
 Requires Node 22+ and Claude Code. Set `OPENSCAFFOLD_URL` to point at a self-hosted OpenScaffold. Set

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 // `npx @openscaffold/cli setup | login | status | session-start | logout` (SPEC §8.4). Node 22+, standard library only.
 import { execFileSync, spawn } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { briefingFacts, briefingStatus, browserCommand, collectDiff, gitInfo, hasOpenScaffoldPlugin, hookBase, HOSTED, installedHooks, loadedEntry, loginResultLine, MCP_NAME, mcpText, nameFromDomain, parseReviewArgs, parseSetupArgs, planSummary, pluginServes, preCommitOutput, selectFiles, SETUP_EXTENSIONS, setupPrompt, setupResultLine, skillFile, statusReport, stopOutput, transcriptActivity, windowsCommandLine, withHooks, withoutHooks, withSession, } from "./install.js";
+import { briefingStatus, browserCommand, gitInfo, hasOpenScaffoldPlugin, hookBase, HOSTED, installedHooks, loadedEntry, loginResultLine, MCP_NAME, mcpText, nameFromDomain, parseSetupArgs, planSummary, pluginServes, preCommitOutput, selectFiles, SETUP_EXTENSIONS, setupPrompt, setupResultLine, skillFile, statusReport, stopOutput, transcriptActivity, windowsCommandLine, withHooks, withoutHooks, withSession, } from "./install.js";
 const CONFIG = join(homedir(), ".config", "openscaffold");
 const CREDENTIALS = join(CONFIG, "credentials.json");
 const CACHE = join(CONFIG, "cache");
@@ -113,8 +113,8 @@ async function login({ next = true } = {}) {
         throw new Error(`Couldn't reach OpenScaffold at ${url} (${start.status}).`);
     const { code, login_url, poll } = start.body;
     console.log(BY_AGENT
-        ? `Tell the person: open ${login_url}, check the workspace on the page, then click Approve. The page shows the code ${code}. Signing up, if they need to, happens on that page too.`
-        : `Opening ${login_url}\nCheck the workspace on the page, then click Approve. The page should show the code ${code}.`);
+        ? `Tell the person: open ${login_url} and click Approve. The page shows the code ${code}. Signing up, if they need to, happens on that page too.`
+        : `Opening ${login_url}\nClick Approve in your browser. The page should show the code ${code}.`);
     openBrowser(login_url);
     let creds = null;
     const deadline = Date.now() + 10 * 60_000;
@@ -282,7 +282,6 @@ async function setup() {
     console.log("\nReading the sources, then writing the plan (usually 2–4 minutes).");
     const deadline = Date.now() + 20 * 60_000;
     let last = "";
-    const shown = new Set(); // facts already printed, so each prints once as it's found
     let idle = 0;
     let nudged = false;
     for (;;) {
@@ -297,13 +296,6 @@ async function setup() {
         }
         if (status && status !== last)
             console.log(`  ${(last = status)}`);
-        const facts = briefing ? briefingFacts(briefing).filter((f) => !shown.has(f)) : [];
-        if (facts.length && !shown.size)
-            console.log("  Found so far, quoted from their sources:");
-        for (const f of facts) {
-            console.log(`    ${f}`);
-            shown.add(f);
-        }
         idle = status?.startsWith("No plan yet") ? idle + 1 : 0;
         if (idle >= 2) {
             if (nudged)
@@ -396,14 +388,14 @@ async function preCommit() {
     if (out)
         console.log(out);
 }
-/** Stop: once per session, if it edited files and never called request_review (or report_session), ask for it. */
+/** Stop: once per session, if it edited files and never called report_session, ask the agent to report. */
 async function stop() {
     const hook = await hookInput();
     if (!hook.session_id || hook.stop_hook_active)
         return;
     const marker = join(CACHE, `reminded-${hook.session_id.replace(/[^\w-]/g, "")}`);
     const transcript = hook.transcript_path?.replace(/^~(?=[\\/])/, homedir());
-    const activity = transcript && existsSync(transcript) ? transcriptActivity(readFileSync(transcript, "utf8")) : { edited: false, reported: false, reviewed: false };
+    const activity = transcript && existsSync(transcript) ? transcriptActivity(readFileSync(transcript, "utf8")) : { edited: false, reported: false };
     const out = stopOutput({ stopHookActive: false, reminded: existsSync(marker), loaded: Boolean(loadedHere(hook.session_id, hook.cwd ?? process.cwd())), ...activity });
     if (!out)
         return;
@@ -411,42 +403,6 @@ async function stop() {
     writeFileSync(marker, new Date().toISOString());
     console.log(out);
 }
-// --- review -------------------------------------------------------------------------------------
-/**
- * `review --title "…" [--req ids] [--deployment dep_…] [files…]`: the coding agent's one command for a review. It
- * collects the change itself (git, or the listed files where git sees none), calls request_review, waits on
- * get_review (which holds up to 50 s per call) and prints the verdict. Nothing to paste, nothing to poll.
- */
-async function review() {
-    const args = parseReviewArgs(process.argv.slice(3));
-    if ("error" in args)
-        throw new Error(args.error);
-    const creds = credentials();
-    if (!creds)
-        throw new Error("Not signed in here: run `npx -y @openscaffold/cli@latest login` (one click), or send the diff with the request_review tool.");
-    const deployment = args.deployment ?? loadedHere(undefined, process.cwd())?.deployment;
-    if (!deployment)
-        throw new Error("Which customer? Add --deployment dep_… (the id in the OpenScaffold briefing).");
-    const git = (a) => execFileSync("git", a, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
-    const got = collectDiff(args.files, git, (f) => (lstatSync(f).isSymbolicLink() ? { link: readlinkSync(f) } : readFileSync(f, "utf8")));
-    if ("error" in got)
-        throw new Error(got.error);
-    try {
-        const queued = JSON.parse(await tool(creds, "request_review", { deployment_id: deployment, title: args.title, requirement_ids: args.reqs, diff: got.diff }, 60_000));
-        if (!queued.review_id)
-            return console.log(queued.note ?? "Nothing to review.");
-        let out = "";
-        // Each get_review waits up to 50 s on the server; a review that outlasts four of them is reported as still running.
-        for (let i = 0; i < 4 && (!out || out.includes("Still reviewing")); i++)
-            out = await tool(creds, "get_review", { deployment_id: deployment, review_id: queued.review_id }, 90_000);
-        console.log(out);
-    }
-    catch (e) {
-        if (e instanceof LoggedOut)
-            throw new Error(`${e.message} Run \`npx -y @openscaffold/cli@latest login\`, then review again.`);
-        throw e;
-    }
-}
 // --- status -------------------------------------------------------------------------------------
 /** Read-only: what's set up on this machine and the next step. `--json` for agents. Always exits 0. */
 async function status() {
@@ -508,9 +464,6 @@ Usage: npx @openscaffold/cli@latest <command>
                    Everything in one go: sign in if needed, create the customer's deployment, upload
                    every .vtt .srt .txt .md .csv .json in the folder (default .), wait for the plan, print it
   login            Sign in (one browser click on Approve) and connect Claude Code
-  review --title "<what it does>" [--req req_1,req_2] [--deployment dep_…] [files…]
-                   Review this folder's change against the customer's plan and rules: sends the git diff
-                   (or the listed files, where git sees no change) and prints the verdict
   status [--json]  What's set up on this machine, and the next step
   logout           Remove everything login added and revoke this machine's login
   help             This text
@@ -536,7 +489,7 @@ if (Number(process.versions.node.split(".")[0]) < 22) {
         console.log(msg);
     process.exit(HOOKS.has(cmd ?? "") ? 0 : 1);
 }
-const commands = { setup, login: () => login(), review, status, "session-start": sessionStart, "pre-commit": preCommit, stop, logout };
+const commands = { setup, login: () => login(), status, "session-start": sessionStart, "pre-commit": preCommit, stop, logout };
 const run = commands[cmd ?? ""];
 if (!run) {
     console.error(HELP);

package/dist/install.js

@@ -8,7 +8,7 @@ const isOurs = (h) => typeof h.command === "string" && isOurCommand(h.command);
 /**
  * The hooks login installs (Claude Code docs, hooks, 2026-10-27): the briefing at session start; before a
  * `git commit` (the handler's `if` is one permission rule, `Bash(git commit *)` also matches a bare `git commit`),
- * the deployment's constraints and must-haves as context; at Stop, a one-time ask to review the changes (request_review) and report_session.
+ * the deployment's constraints and must-haves as context; at Stop, a one-time report_session reminder.
  * Timeouts are seconds. None ever blocks a tool call.
  */
 export const OUR_HOOKS = [
@@ -209,14 +209,10 @@ export function preCommitOutput(briefing, plugin) {
 const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
 /** Our report_session tool, from the user-scope server or the plugin's (`mcp__plugin_openscaffold_openscaffold__…`). */
 const REPORT = /^mcp__.*openscaffold.*__report_session$/;
-const REVIEW = /^mcp__.*openscaffold.*__request_review$/;
-/** `npx @openscaffold/cli review …` run through Bash counts as requesting a review. */
-const CLI_REVIEW = /(@openscaffold\/cli(@\S+)?|\bopenscaffold)\s+review\b/;
-/** From a session transcript (JSONL): did the agent edit files, call request_review, call report_session? */
+/** From a session transcript (JSONL): did the agent edit files, and did it call report_session? */
 export function transcriptActivity(jsonl) {
     let edited = false;
     let reported = false;
-    let reviewed = false;
     for (const line of jsonl.split("\n")) {
         if (!line.includes('"tool_use"'))
             continue;
@@ -236,27 +232,19 @@ export function transcriptActivity(jsonl) {
                 edited = true;
             if (REPORT.test(c.name))
                 reported = true;
-            if (REVIEW.test(c.name) || (c.name === "Bash" && typeof c.input?.command === "string" && CLI_REVIEW.test(c.input.command)))
-                reviewed = true;
         }
     }
-    return { edited, reported, reviewed };
+    return { edited, reported };
 }
 export const STOP_REASON = "Before you finish, call report_session with what you did.";
-export const STOP_REVIEW_REASON = "Before you finish, review your changes against the customer's plan: run `npx -y @openscaffold/cli@latest review --title \"<what the change does>\" --req <requirement ids>` (it sends the diff and prints the verdict), then report_session.";
 /**
- * The Stop hook's stdout: the documented block decision, once per session, when this session loaded a deployment and
- * edited files: first ask for a review (§8.4) if it never called request_review, else for report_session if it never
- * reported; else "". Never twice, and never while Claude is already continuing for a stop hook.
+ * The Stop hook's stdout: the documented block decision, once per session, when this session loaded a deployment,
+ * edited files and hasn't reported; else "". Never while Claude is already continuing for a stop hook.
  */
 export function stopOutput(s) {
-    if (s.stopHookActive || s.reminded || !s.loaded || !s.edited)
+    if (s.stopHookActive || s.reminded || !s.loaded || !s.edited || s.reported)
         return "";
-    if (!s.reviewed)
-        return JSON.stringify({ decision: "block", reason: STOP_REVIEW_REASON });
-    if (!s.reported)
-        return JSON.stringify({ decision: "block", reason: STOP_REASON });
-    return "";
+    return JSON.stringify({ decision: "block", reason: STOP_REASON });
 }
 // --- setup: one command from a folder of customer files to a cited plan (SPEC §8.4) -------------
 /** What `setup` uploads: the upload panel's file types (§6.1). CSV/JSON become one ticket per row. */
@@ -330,10 +318,6 @@ export function briefingStatus(briefing) {
     // Written for an agent: drop the sentences that tell it which tool to call next.
     return line.split(/(?<=[.;])\s+/).filter((x) => !/`|tell the FDE/i.test(x)).join(" ").replace(/;$/, ".");
 }
-/** The verified facts a pre-plan briefing's Status lists ("- Goal: … [title · doc_… “quote”]"), without the document ids. */
-export function briefingFacts(briefing) {
-    return section(briefing, "Status").filter((l) => l.startsWith("- ")).map((l) => l.replace(/ · doc_\w+/, ""));
-}
 /**
  * One MCP `tools/call` response body (JSON, or a streamable-HTTP SSE frame) → the tool's text, or its error. The first
  * content block only: a second one may carry the "Since your briefing" freshness line.
@@ -352,89 +336,3 @@ export function mcpText(raw) {
     const text = msg.result?.content?.[0]?.text ?? "";
     return msg.result?.isError ? { error: text || "OpenScaffold refused the call." } : { text };
 }
-// --- review: send this folder's change to OpenScaffold's reviewer (SPEC §8.1 request_review) ------
-/** request_review's limit (web/lib/pipeline/review.ts MAX_DIFF_BYTES). */
-export const MAX_DIFF_BYTES = 400 * 1024;
-const REVIEW_USAGE = 'Usage: npx @openscaffold/cli@latest review --title "<what the change does>" [--req req_1,req_2] [--deployment dep_…] [files…]';
-/** `review` arguments; files are optional (git finds the change) and needed only where git sees none. */
-export function parseReviewArgs(args) {
-    const out = { title: "", reqs: [], deployment: undefined, files: [] };
-    for (let i = 0; i < args.length; i++) {
-        const eq = args[i].startsWith("--") ? args[i].indexOf("=") : -1;
-        const [flag, inline] = eq < 0 ? [args[i], undefined] : [args[i].slice(0, eq), args[i].slice(eq + 1)];
-        const value = () => inline ?? args[++i];
-        if (flag === "--title")
-            out.title = value() ?? "";
-        else if (flag === "--req" || flag === "--requirements")
-            out.reqs.push(...(value() ?? "").split(/[,\s]+/).filter(Boolean));
-        else if (flag === "--deployment")
-            out.deployment = value();
-        else if (args[i].startsWith("--"))
-            return { error: `Unknown option ${flag}. ${REVIEW_USAGE}` };
-        else
-            out.files.push(args[i]);
-    }
-    if (!out.title.trim())
-        return { error: `Give the change a one-line title. ${REVIEW_USAGE}` };
-    return { ...out, title: out.title.trim(), reqs: [...new Set(out.reqs)] };
-}
-/**
- * A whole file as an added-file diff, as `git diff --no-index /dev/null <file>` prints it. Empty or binary: "". A
- * symbolic link is a link (mode 120000, its target path as the content), as git records it.
- */
-export function newFileDiff(path, file) {
-    const link = typeof file === "object";
-    const text = link ? file.link : file;
-    if (!text || text.includes("\0"))
-        return "";
-    const lines = link ? [text] : text.replace(/\r\n/g, "\n").split("\n");
-    const newline = !link && lines.at(-1) === "";
-    if (newline)
-        lines.pop();
-    return [`diff --git a/${path} b/${path}`, `new file mode ${link ? "120000" : "100644"}`, "--- /dev/null", `+++ b/${path}`, `@@ -0,0 +1,${lines.length} @@`,
-        ...lines.map((l) => `+${l}`), ...(newline ? [] : ["\"]), ""].join("\n");
-}
-/**
- * The change to review, from where the agent works: in a git repo, everything since HEAD (staged, unstaged, and
- * untracked files as new files), narrowed to `files` when given. Where git sees nothing (not a repo, a git-ignored
- * folder, a repo with no commit), the listed files are sent whole as new files. `git` runs one git command in the
- * folder and throws when git fails; `read` reads a file.
- */
-export function collectDiff(files, git, read) {
-    let diff = "";
-    let repo = false;
-    try {
-        repo = git(["rev-parse", "--is-inside-work-tree"]).trim() === "true";
-    }
-    catch { }
-    if (repo) {
-        const only = files.length ? ["--", ...files] : [];
-        let head = true;
-        try {
-            git(["rev-parse", "--verify", "-q", "HEAD"]);
-        }
-        catch {
-            head = false;
-        }
-        // No commit yet: compare with the empty tree, so staged and unstaged files both show.
-        const base = head ? "HEAD" : git(["hash-object", "-t", "tree", "/dev/null"]).trim();
-        // --no-ext-diff / --no-textconv: a repo's configured diff drivers and converters are commands; we never run them.
-        diff = git(["diff", "--no-color", "--no-ext-diff", "--no-textconv", base, ...only]);
-        const untracked = git(["ls-files", "--others", "--exclude-standard", "-z", ...only]).split("\0").filter(Boolean);
-        // Files the agent named that git ignores still get reviewed, even when other files changed.
-        if (files.length)
-            untracked.push(...git(["ls-files", "--others", "--ignored", "--exclude-standard", "-z", ...only]).split("\0").filter(Boolean));
-        const prefix = git(["rev-parse", "--show-prefix"]).trim();
-        diff += untracked.map((f) => newFileDiff(prefix + f, read(f))).join(""); // ls-files paths are from this folder; diff paths from the root
-    }
-    if (!diff.trim() && files.length)
-        diff = files.map((f) => newFileDiff(f.replace(/^\.\//, ""), read(f))).join("");
-    if (!diff.trim()) {
-        return { error: repo
-                ? `Nothing to review: git sees no change here. If your files are in a git-ignored folder, list them: ${REVIEW_USAGE}`
-                : `This folder isn't a git repo, so list the files you changed: ${REVIEW_USAGE}` };
-    }
-    if (Buffer.byteLength(diff) > MAX_DIFF_BYTES)
-        return { error: `This change is ${Math.ceil(Buffer.byteLength(diff) / 1024)} KB; a review takes up to 400 KB. Review it in parts: list the files for one work item at a time.` };
-    return { diff };
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openscaffold/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Connect Claude Code to your OpenScaffold workspace: each session loads the right customer deployment.",
   "type": "module",
   "bin": {