@plannotator/opencode 0.16.7 → 0.17.0

package/dist/index.js

@@ -24374,16 +24374,29 @@ var init_opencode_sdk = __esm(() => {
 
 // index.ts
 import { tool } from "@opencode-ai/plugin";
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
 import path3 from "path";
 
 // ../../packages/server/remote.ts
 var DEFAULT_REMOTE_PORT = 19432;
-function isRemoteSession() {
+function getRemoteOverride() {
   const remote = process.env.PLANNOTATOR_REMOTE;
+  if (remote === undefined) {
+    return null;
+  }
   if (remote === "1" || remote?.toLowerCase() === "true") {
     return true;
   }
+  if (remote === "0" || remote?.toLowerCase() === "false") {
+    return false;
+  }
+  return null;
+}
+function isRemoteSession() {
+  const remoteOverride = getRemoteOverride();
+  if (remoteOverride !== null) {
+    return remoteOverride;
+  }
   if (process.env.SSH_TTY || process.env.SSH_CONNECTION) {
     return true;
   }
@@ -25077,9 +25090,18 @@ async function isWSL() {
   } catch {}
   return false;
 }
-async function openBrowser(url) {
+function shouldTryRemoteBrowserFallback(isRemote) {
+  return isRemote && !process.env.PLANNOTATOR_BROWSER && !process.env.BROWSER;
+}
+async function openBrowser(url, options) {
   try {
     const browser = process.env.PLANNOTATOR_BROWSER || process.env.BROWSER;
+    if (shouldTryRemoteBrowserFallback(options?.isRemote ?? false)) {
+      const openedViaIpc = await tryVscodeIpc(url);
+      if (openedViaIpc) {
+        return true;
+      }
+    }
     const platform = process.platform;
     const wsl = await isWSL();
     if (browser) {
@@ -25293,7 +25315,7 @@ function handleFavicon() {
   });
 }
 async function handleServerReady(url, isRemote, _port) {
-  await openBrowser(url);
+  await openBrowser(url, { isRemote });
 }
 
 // ../../packages/server/reference-handlers.ts
@@ -25409,6 +25431,17 @@ function resolveAbsolutePath(input, platform = process.platform) {
 function isSearchableMarkdownPath(input) {
   return MARKDOWN_PATH_REGEX.test(input.trim());
 }
+function stripWrappingQuotes(input) {
+  if (input.length < 2) {
+    return input;
+  }
+  const first = input[0];
+  const last = input[input.length - 1];
+  if (first === '"' && last === '"' || first === "'" && last === "'") {
+    return input.slice(1, -1);
+  }
+  return input;
+}
 function hasWindowsDriveLetter(input) {
   return /^[a-zA-Z]:[/\\]/.test(input);
 }
@@ -25458,8 +25491,7 @@ function isAbsoluteMarkdownPath(input, platform = process.platform) {
   }
   return platform === "win32" ? win32.isAbsolute(normalizedInput) : isAbsolute(normalizedInput);
 }
-function resolveMarkdownFile(input, projectRoot) {
-  input = input.trim();
+function resolveMarkdownFileCore(input, projectRoot) {
   const normalizedInput = normalizeMarkdownPathInput(input);
   const searchInput = normalizeSeparators(normalizedInput);
   const isBareFilename = !searchInput.includes("/");
@@ -25501,6 +25533,32 @@ function resolveMarkdownFile(input, projectRoot) {
   }
   return { kind: "not_found", input };
 }
+function resolveMarkdownFile(input, projectRoot) {
+  const originalInput = input.trim();
+  const unquotedInput = stripWrappingQuotes(originalInput);
+  const primary = resolveMarkdownFileCore(unquotedInput, projectRoot);
+  if (primary.kind === "found") {
+    return primary;
+  }
+  if (primary.kind === "ambiguous") {
+    return { ...primary, input: originalInput };
+  }
+  if (!unquotedInput.startsWith("@")) {
+    return { kind: "not_found", input: originalInput };
+  }
+  const normalizedInput = unquotedInput.replace(/^@+/, "");
+  if (!normalizedInput) {
+    return { kind: "not_found", input: originalInput };
+  }
+  const fallback = resolveMarkdownFileCore(normalizedInput, projectRoot);
+  if (fallback.kind === "found") {
+    return fallback;
+  }
+  if (fallback.kind === "ambiguous") {
+    return { ...fallback, input: originalInput };
+  }
+  return { kind: "not_found", input: originalInput };
+}
 
 // ../../packages/server/reference-handlers.ts
 async function handleDoc(req) {
@@ -25828,7 +25886,9 @@ function transformReviewInput(body) {
       originalCode: typeof obj.originalCode === "string" ? obj.originalCode : undefined,
       createdAt: Date.now(),
       author: typeof obj.author === "string" ? obj.author : undefined,
-      source
+      source,
+      ...typeof obj.severity === "string" && { severity: obj.severity },
+      ...typeof obj.reasoning === "string" && { reasoning: obj.reasoning }
     });
   }
   return { annotations };
@@ -25931,6 +25991,13 @@ function createExternalAnnotationHandler(mode) {
     }
   });
   return {
+    addAnnotations(body) {
+      const parsed = transform(body);
+      if ("error" in parsed)
+        return { error: parsed.error };
+      const created = store.add(parsed.annotations);
+      return { ids: created.map((a) => a.id) };
+    },
     async handle(req, url, options) {
       if (url.pathname === STREAM && req.method === "GET") {
         options?.disableIdleTimeout?.();
@@ -26436,6 +26503,7 @@ async function getGitContext(runtime, cwd) {
   ];
   if (currentBranch !== defaultBranch) {
     diffOptions.push({ id: "branch", label: `vs ${defaultBranch}` });
+    diffOptions.push({ id: "merge-base", label: `Current PR Diff` });
   }
   const [worktrees, currentTreePathResult] = await Promise.all([
     getWorktrees(runtime, cwd),
@@ -26577,6 +26645,21 @@ async function runGitDiff(runtime, diffType, defaultBranch = "main", externalCwd
         label = `Changes vs ${defaultBranch}`;
         break;
       }
+      case "merge-base": {
+        const mergeBaseResult = assertGitSuccess(await runtime.runGit(["merge-base", defaultBranch, "HEAD"], { cwd }), ["merge-base", defaultBranch, "HEAD"]);
+        const mergeBase = mergeBaseResult.stdout.trim();
+        const mergeBaseDiffArgs = [
+          "diff",
+          "--no-ext-diff",
+          `${mergeBase}..HEAD`,
+          "--src-prefix=a/",
+          "--dst-prefix=b/"
+        ];
+        const mergeBaseDiff = assertGitSuccess(await runtime.runGit(mergeBaseDiffArgs, { cwd }), mergeBaseDiffArgs);
+        patch = mergeBaseDiff.stdout;
+        label = `PR diff vs ${defaultBranch}`;
+        break;
+      }
       default:
         return { patch: "", label: "Unknown diff type" };
     }
@@ -26644,6 +26727,14 @@ async function getFileContentsForDiff(runtime, diffType, defaultBranch, filePath
         oldContent: await gitShow(defaultBranch, oldFilePath),
         newContent: await gitShow("HEAD", filePath)
       };
+    case "merge-base": {
+      const mbResult = await runtime.runGit(["merge-base", defaultBranch, "HEAD"], { cwd });
+      const mb = mbResult.exitCode === 0 ? mbResult.stdout.trim() : defaultBranch;
+      return {
+        oldContent: await gitShow(mb, oldFilePath),
+        newContent: await gitShow("HEAD", filePath)
+      };
+    }
     default:
       return { oldContent: null, newContent: null };
   }
@@ -26994,7 +27085,7 @@ async function getP4FileContentsForDiff(diffType, filePath, cwd) {
 }
 
 // ../../packages/server/vcs.ts
-var GIT_DIFF_TYPES = new Set(["uncommitted", "staged", "unstaged", "last-commit", "branch"]);
+var GIT_DIFF_TYPES = new Set(["uncommitted", "staged", "unstaged", "last-commit", "branch", "merge-base"]);
 var gitProvider = {
   id: "git",
   async detect(cwd) {
@@ -27082,6 +27173,284 @@ function resolveVcsCwd(diffType, fallbackCwd) {
   return provider.resolveCwd?.(diffType, fallbackCwd) ?? fallbackCwd;
 }
 
+// ../../packages/server/path-utils.ts
+import { relative } from "path";
+function toRelativePath2(absolutePath, cwd) {
+  if (!cwd)
+    return absolutePath;
+  const rel = relative(cwd, absolutePath);
+  if (rel.startsWith(".."))
+    return absolutePath;
+  return rel.replace(/\\/g, "/");
+}
+
+// ../../packages/server/claude-review.ts
+var CLAUDE_REVIEW_SCHEMA_JSON = JSON.stringify({
+  type: "object",
+  properties: {
+    findings: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          severity: { type: "string", enum: ["important", "nit", "pre_existing"] },
+          file: { type: "string" },
+          line: { type: "integer" },
+          end_line: { type: "integer" },
+          description: { type: "string" },
+          reasoning: { type: "string" }
+        },
+        required: ["severity", "file", "line", "end_line", "description", "reasoning"],
+        additionalProperties: false
+      }
+    },
+    summary: {
+      type: "object",
+      properties: {
+        important: { type: "integer" },
+        nit: { type: "integer" },
+        pre_existing: { type: "integer" }
+      },
+      required: ["important", "nit", "pre_existing"],
+      additionalProperties: false
+    }
+  },
+  required: ["findings", "summary"],
+  additionalProperties: false
+});
+var CLAUDE_REVIEW_PROMPT = `# Claude Code Review System Prompt
+
+## Identity
+You are a code review system. Your job is to find bugs that would break
+production. You are not a linter, formatter, or style checker unless
+project guidance files explicitly expand your scope.
+
+## Pipeline
+
+Step 1: Gather context
+  - Retrieve the PR diff (gh pr diff or git diff)
+  - Read CLAUDE.md and REVIEW.md at the repo root and in every directory
+    containing modified files
+  - Build a map of which rules apply to which file paths
+  - Identify any skip rules (paths, patterns, or file types to ignore)
+
+Step 2: Launch 4 parallel review agents
+
+  Agent 1 \u2014 Bug + Regression (Opus-level reasoning)
+    Scan for logic errors, regressions, broken edge cases, build failures,
+    and code that will produce wrong results. Focus on the diff but read
+    surrounding code to understand call sites and data flow. Flag only
+    issues where the code is demonstrably wrong \u2014 not stylistic concerns,
+    not missing tests, not "could be cleaner."
+
+  Agent 2 \u2014 Security + Deep Analysis (Opus-level reasoning)
+    Look for security vulnerabilities with concrete exploit paths, race
+    conditions, incorrect assumptions about trust boundaries, and subtle
+    issues in introduced code. Read surrounding code for context. Do not
+    flag theoretical risks without a plausible path to harm.
+
+  Agent 3 \u2014 Code Quality + Reusability (Sonnet-level reasoning)
+    Look for code smells, unnecessary duplication, missed opportunities to
+    reuse existing utilities or patterns in the codebase, overly complex
+    implementations that could be simpler, and elegance issues. Read the
+    surrounding codebase to understand existing patterns before flagging.
+    Only flag issues a senior engineer would care about.
+
+  Agent 4 \u2014 Guideline Compliance (Haiku-level reasoning)
+    Audit changes against rules from CLAUDE.md and REVIEW.md gathered in
+    Step 1. Only flag clear, unambiguous violations where you can cite the
+    exact rule broken. If a PR makes a CLAUDE.md statement outdated, flag
+    that the docs need updating. Respect all skip rules \u2014 never flag files
+    or patterns that guidance says to ignore.
+
+  All agents:
+  - Do not duplicate each other's findings
+  - Do not flag issues in paths excluded by guidance files
+  - Provide file, line number, and a concise description for each candidate
+
+Step 3: Validate each candidate finding
+  For each candidate, launch a validation agent. The validator:
+  - Traces the actual code path to confirm the issue is real
+  - Checks whether the issue is handled elsewhere (try/catch, upstream
+    guard, fallback logic, type system guarantees)
+  - Confirms the finding is not a false positive with high confidence
+  - If validation fails, drop the finding silently
+  - If validation passes, write a clear reasoning chain explaining how
+    the issue was confirmed \u2014 this becomes the \`reasoning\` field
+
+Step 4: Classify each validated finding
+  Assign exactly one severity:
+
+  important \u2014 A bug that should be fixed before merging. Build failures,
+    clear logic errors, security vulnerabilities with exploit paths, data
+    loss risks, race conditions with observable consequences.
+
+  nit \u2014 A minor issue worth fixing but non-blocking. Style deviations
+    from project guidelines, code quality concerns, edge cases that are
+    unlikely but worth noting, convention violations that don't affect
+    correctness.
+
+  pre_existing \u2014 A bug that exists in the surrounding codebase but was
+    NOT introduced by this PR. Only flag when directly relevant to the
+    changed code path.
+
+Step 5: Deduplicate and rank
+  - Merge findings that describe the same underlying issue from different
+    agents \u2014 keep the most specific description and the highest severity
+  - Sort by severity: important \u2192 nit \u2192 pre_existing
+  - Within each severity, sort by file path and line number
+
+Step 6: Return structured JSON output matching the schema.
+  If no issues are found, return an empty findings array with zeroed summary.
+
+## Hard constraints
+- Never approve or block the PR
+- Never comment on formatting or code style unless guidance files say to
+- Never flag missing test coverage unless guidance files say to
+- Never invent rules \u2014 only enforce what CLAUDE.md or REVIEW.md state
+- Never flag issues in skipped paths or generated files unless guidance
+  explicitly includes them
+- Prefer silence over false positives \u2014 when in doubt, drop the finding
+- Do NOT post any comments to GitHub or GitLab
+- Do NOT use gh pr comment or any commenting tool
+- Your only output is the structured JSON findings`;
+function buildClaudeCommand(prompt) {
+  const allowedTools = [
+    "Agent",
+    "Read",
+    "Glob",
+    "Grep",
+    "Bash(gh pr view:*)",
+    "Bash(gh pr diff:*)",
+    "Bash(gh pr list:*)",
+    "Bash(gh issue view:*)",
+    "Bash(gh issue list:*)",
+    "Bash(gh api repos/*/*/pulls/*)",
+    "Bash(gh api repos/*/*/pulls/*/files*)",
+    "Bash(gh api repos/*/*/pulls/*/comments*)",
+    "Bash(gh api repos/*/*/issues/*/comments*)",
+    "Bash(glab mr view:*)",
+    "Bash(glab mr diff:*)",
+    "Bash(glab mr list:*)",
+    "Bash(glab api:*)",
+    "Bash(git status:*)",
+    "Bash(git diff:*)",
+    "Bash(git log:*)",
+    "Bash(git show:*)",
+    "Bash(git blame:*)",
+    "Bash(git branch:*)",
+    "Bash(git grep:*)",
+    "Bash(git ls-remote:*)",
+    "Bash(git ls-tree:*)",
+    "Bash(git merge-base:*)",
+    "Bash(git remote:*)",
+    "Bash(git rev-parse:*)",
+    "Bash(git show-ref:*)",
+    "Bash(wc:*)"
+  ].join(",");
+  const disallowedTools = [
+    "Edit",
+    "Write",
+    "NotebookEdit",
+    "WebFetch",
+    "WebSearch",
+    "Bash(python:*)",
+    "Bash(python3:*)",
+    "Bash(node:*)",
+    "Bash(npx:*)",
+    "Bash(bun:*)",
+    "Bash(bunx:*)",
+    "Bash(sh:*)",
+    "Bash(bash:*)",
+    "Bash(zsh:*)",
+    "Bash(curl:*)",
+    "Bash(wget:*)"
+  ].join(",");
+  return {
+    command: [
+      "claude",
+      "-p",
+      "--permission-mode",
+      "dontAsk",
+      "--output-format",
+      "stream-json",
+      "--verbose",
+      "--json-schema",
+      CLAUDE_REVIEW_SCHEMA_JSON,
+      "--no-session-persistence",
+      "--model",
+      "sonnet",
+      "--tools",
+      "Agent,Bash,Read,Glob,Grep",
+      "--allowedTools",
+      allowedTools,
+      "--disallowedTools",
+      disallowedTools
+    ],
+    stdinPrompt: prompt
+  };
+}
+function parseClaudeStreamOutput(stdout) {
+  if (!stdout.trim())
+    return null;
+  const lines = stdout.trim().split(`
+`);
+  for (let i = lines.length - 1;i >= 0; i--) {
+    const line = lines[i].trim();
+    if (!line)
+      continue;
+    try {
+      const event = JSON.parse(line);
+      if (event.type === "result") {
+        if (event.is_error)
+          return null;
+        const output = event.structured_output;
+        if (!output || !Array.isArray(output.findings))
+          return null;
+        return output;
+      }
+    } catch {}
+  }
+  return null;
+}
+function transformClaudeFindings(findings, source, cwd) {
+  return findings.filter((f) => f.file && typeof f.line === "number").map((f) => ({
+    source,
+    filePath: toRelativePath2(f.file, cwd),
+    lineStart: f.line,
+    lineEnd: f.end_line ?? f.line,
+    type: "comment",
+    side: "new",
+    scope: "line",
+    text: `[${f.severity}] ${f.description}`,
+    severity: f.severity,
+    reasoning: f.reasoning,
+    author: "Claude Code"
+  }));
+}
+function formatClaudeLogEvent(line) {
+  try {
+    const event = JSON.parse(line);
+    if (event.type === "result")
+      return null;
+    if (event.type === "assistant" && event.message?.content) {
+      const parts = Array.isArray(event.message.content) ? event.message.content : [event.message.content];
+      const texts = parts.filter((p) => p.type === "text" && p.text).map((p) => p.text);
+      if (texts.length > 0)
+        return texts.join(`
+`);
+      const tools = parts.filter((p) => p.type === "tool_use");
+      if (tools.length > 0) {
+        return tools.map((t) => `[${t.name}] ${typeof t.input === "string" ? t.input.slice(0, 100) : JSON.stringify(t.input).slice(0, 100)}`).join(`
+`);
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // ../../packages/shared/agent-jobs.ts
 var AGENT_HEARTBEAT_COMMENT = `:
 
@@ -27107,13 +27476,13 @@ var CAPABILITIES = `${BASE2}/capabilities`;
 function createAgentJobHandler(options) {
   const { mode, getServerUrl, getCwd } = options;
   const jobs = new Map;
+  const jobOutputPaths = new Map;
   const subscribers = new Set;
   const encoder = new TextEncoder;
   let version = 0;
   const capabilities = [
     { id: "claude", name: "Claude Code", available: !!Bun.which("claude") },
-    { id: "codex", name: "Codex CLI", available: !!Bun.which("codex") },
-    { id: "shell", name: "Shell Command", available: true }
+    { id: "codex", name: "Codex CLI", available: !!Bun.which("codex") }
   ];
   const capabilitiesResponse = {
     mode,
@@ -27131,7 +27500,7 @@ function createAgentJobHandler(options) {
       }
     }
   }
-  function spawnJob(provider, command, label) {
+  function spawnJob(provider, command, label, outputPath, spawnOptions) {
     const id = crypto.randomUUID();
     const source = jobSource(id);
     const info = {
@@ -27141,13 +27510,18 @@ function createAgentJobHandler(options) {
       label,
       status: "starting",
       startedAt: Date.now(),
-      command
+      command,
+      cwd: getCwd()
     };
     let proc = null;
     try {
+      const spawnCwd = spawnOptions?.cwd ?? getCwd();
+      const captureStdout = spawnOptions?.captureStdout ?? false;
+      const hasStdinPrompt = !!spawnOptions?.stdinPrompt;
       proc = Bun.spawn(command, {
-        cwd: getCwd(),
-        stdout: "ignore",
+        cwd: spawnCwd,
+        stdin: hasStdinPrompt ? "pipe" : undefined,
+        stdout: captureStdout ? "pipe" : "ignore",
         stderr: "pipe",
         env: {
           ...process.env,
@@ -27155,10 +27529,24 @@ function createAgentJobHandler(options) {
           PLANNOTATOR_API_URL: getServerUrl()
         }
       });
+      if (hasStdinPrompt && proc.stdin) {
+        const sink = proc.stdin;
+        sink.write(spawnOptions.stdinPrompt);
+        sink.end();
+      }
       info.status = "running";
+      info.cwd = spawnCwd;
+      if (spawnOptions?.prompt)
+        info.prompt = spawnOptions.prompt;
       jobs.set(id, { info, proc });
+      if (outputPath)
+        jobOutputPaths.set(id, outputPath);
+      if (spawnOptions?.cwd)
+        jobOutputPaths.set(`${id}:cwd`, spawnOptions.cwd);
       broadcast({ type: "job:started", job: { ...info } });
       let stderrBuf = "";
+      let logPending = "";
+      let logFlushTimer = null;
       if (proc.stderr && typeof proc.stderr !== "number") {
         (async () => {
           try {
@@ -27166,11 +27554,61 @@ function createAgentJobHandler(options) {
             for await (const chunk of reader) {
               const text = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
               stderrBuf = (stderrBuf + text).slice(-500);
+              logPending += text;
+              if (!logFlushTimer) {
+                logFlushTimer = setTimeout(() => {
+                  if (logPending) {
+                    broadcast({ type: "job:log", jobId: id, delta: logPending });
+                    logPending = "";
+                  }
+                  logFlushTimer = null;
+                }, 200);
+              }
+            }
+            if (logFlushTimer) {
+              clearTimeout(logFlushTimer);
+              logFlushTimer = null;
+            }
+            if (logPending) {
+              broadcast({ type: "job:log", jobId: id, delta: logPending });
+              logPending = "";
             }
           } catch {}
         })();
       }
-      proc.exited.then((exitCode) => {
+      let stdoutBuf = "";
+      const stdoutDone = captureStdout && proc.stdout && typeof proc.stdout !== "number" ? (async () => {
+        try {
+          const reader = proc.stdout;
+          for await (const chunk of reader) {
+            const text = typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk);
+            stdoutBuf += text;
+            const lines = text.split(`
+`);
+            for (const line of lines) {
+              if (!line.trim())
+                continue;
+              if (provider === "claude") {
+                const formatted = formatClaudeLogEvent(line);
+                if (formatted !== null) {
+                  broadcast({ type: "job:log", jobId: id, delta: formatted + `
+` });
+                }
+                continue;
+              }
+              try {
+                const event = JSON.parse(line);
+                if (event.type === "result")
+                  continue;
+              } catch {}
+              broadcast({ type: "job:log", jobId: id, delta: line + `
+` });
+            }
+          }
+        } catch {}
+      })() : Promise.resolve();
+      proc.exited.then(async (exitCode) => {
+        await Promise.race([stdoutDone, new Promise((r) => setTimeout(r, 2000))]);
         const entry = jobs.get(id);
         if (!entry || isTerminalStatus(entry.info.status))
           return;
@@ -27180,8 +27618,21 @@ function createAgentJobHandler(options) {
         if (exitCode !== 0 && stderrBuf) {
           entry.info.error = stderrBuf;
         }
+        const outputPath2 = jobOutputPaths.get(id);
+        const jobCwd = jobOutputPaths.get(`${id}:cwd`);
+        if (exitCode === 0 && options.onJobComplete) {
+          try {
+            await options.onJobComplete(entry.info, {
+              outputPath: outputPath2,
+              stdout: captureStdout ? stdoutBuf : undefined,
+              cwd: jobCwd
+            });
+          } catch {}
+        }
+        jobOutputPaths.delete(id);
+        jobOutputPaths.delete(`${id}:cwd`);
         broadcast({ type: "job:completed", job: { ...entry.info } });
-      });
+      }).catch(() => {});
     } catch (err) {
       jobs.set(id, { info, proc: null });
       broadcast({ type: "job:started", job: { ...info } });
@@ -27203,6 +27654,8 @@ function createAgentJobHandler(options) {
     }
     entry.info.status = "killed";
     entry.info.endedAt = Date.now();
+    jobOutputPaths.delete(id);
+    jobOutputPaths.delete(`${id}:cwd`);
     broadcast({ type: "job:completed", job: { ...entry.info } });
     return true;
   }
@@ -27275,18 +27728,41 @@ function createAgentJobHandler(options) {
       if (url.pathname === JOBS && req.method === "POST") {
         try {
           const body = await req.json();
-          const provider = typeof body.provider === "string" ? body.provider : "shell";
-          const rawCommand = Array.isArray(body.command) ? body.command : [];
-          const command = rawCommand.filter((c) => typeof c === "string");
-          const label = typeof body.label === "string" ? body.label : `${provider} agent`;
+          const provider = typeof body.provider === "string" ? body.provider : "";
+          let rawCommand = Array.isArray(body.command) ? body.command : [];
+          let command = rawCommand.filter((c) => typeof c === "string");
+          let label = typeof body.label === "string" ? body.label : `${provider} agent`;
+          let outputPath;
           const cap = capabilities.find((c) => c.id === provider);
           if (!cap || !cap.available) {
             return Response.json({ error: `Unknown or unavailable provider: ${provider}` }, { status: 400 });
           }
+          let captureStdout = false;
+          let stdinPrompt;
+          let spawnCwd;
+          let promptText;
+          if (options.buildCommand) {
+            const built = await options.buildCommand(provider);
+            if (built) {
+              command = built.command;
+              outputPath = built.outputPath;
+              captureStdout = built.captureStdout ?? false;
+              stdinPrompt = built.stdinPrompt;
+              spawnCwd = built.cwd;
+              promptText = built.prompt;
+              if (built.label)
+                label = built.label;
+            }
+          }
           if (command.length === 0) {
             return Response.json({ error: 'Missing "command" array' }, { status: 400 });
           }
-          const job = spawnJob(provider, command, label);
+          const job = spawnJob(provider, command, label, outputPath, {
+            captureStdout,
+            stdinPrompt,
+            cwd: spawnCwd,
+            prompt: promptText
+          });
           return Response.json({ job }, { status: 201 });
         } catch {
           return Response.json({ error: "Invalid JSON" }, { status: 400 });
@@ -27312,6 +27788,262 @@ function createAgentJobHandler(options) {
   };
 }
 
+// ../../packages/server/codex-review.ts
+import { join as join8 } from "path";
+import { homedir as homedir4, tmpdir as tmpdir2 } from "os";
+import { appendFile, mkdir, unlink, writeFile, readFile } from "fs/promises";
+import { existsSync as existsSync8 } from "fs";
+var DEBUG_ENABLED = !!process.env.PLANNOTATOR_DEBUG;
+var DEBUG_LOG_PATH = join8(homedir4(), ".plannotator", "codex-review-debug.log");
+async function debugLog(label, data) {
+  if (!DEBUG_ENABLED)
+    return;
+  try {
+    await mkdir(join8(homedir4(), ".plannotator"), { recursive: true });
+    const timestamp = new Date().toISOString();
+    const line = data !== undefined ? `[${timestamp}] ${label}: ${typeof data === "string" ? data : JSON.stringify(data, null, 2)}
+` : `[${timestamp}] ${label}
+`;
+    await appendFile(DEBUG_LOG_PATH, line);
+  } catch {}
+}
+var CODEX_REVIEW_SCHEMA = JSON.stringify({
+  type: "object",
+  properties: {
+    findings: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          title: { type: "string" },
+          body: { type: "string" },
+          confidence_score: { type: "number" },
+          priority: { type: ["integer", "null"] },
+          code_location: {
+            type: "object",
+            properties: {
+              absolute_file_path: { type: "string" },
+              line_range: {
+                type: "object",
+                properties: {
+                  start: { type: "integer" },
+                  end: { type: "integer" }
+                },
+                required: ["start", "end"],
+                additionalProperties: false
+              }
+            },
+            required: ["absolute_file_path", "line_range"],
+            additionalProperties: false
+          }
+        },
+        required: ["title", "body", "confidence_score", "priority", "code_location"],
+        additionalProperties: false
+      }
+    },
+    overall_correctness: { type: "string" },
+    overall_explanation: { type: "string" },
+    overall_confidence_score: { type: "number" }
+  },
+  required: ["findings", "overall_correctness", "overall_explanation", "overall_confidence_score"],
+  additionalProperties: false
+});
+var SCHEMA_DIR = join8(homedir4(), ".plannotator");
+var SCHEMA_FILE = join8(SCHEMA_DIR, "codex-review-schema.json");
+var schemaMaterialized = false;
+async function ensureSchemaFile() {
+  if (!schemaMaterialized) {
+    await mkdir(SCHEMA_DIR, { recursive: true });
+    await writeFile(SCHEMA_FILE, CODEX_REVIEW_SCHEMA);
+    schemaMaterialized = true;
+  }
+  return SCHEMA_FILE;
+}
+var CODEX_REVIEW_SYSTEM_PROMPT = `# Review guidelines:
+
+You are acting as a reviewer for a proposed code change made by another engineer.
+
+Below are some default guidelines for determining whether the original author would appreciate the issue being flagged.
+
+These are not the final word in determining whether an issue is a bug. In many cases, you will encounter other, more specific guidelines. These may be present elsewhere in a developer message, a user message, a file, or even elsewhere in this system message.
+Those guidelines should be considered to override these general instructions.
+
+Here are the general guidelines for determining whether something is a bug and should be flagged.
+
+1. It meaningfully impacts the accuracy, performance, security, or maintainability of the code.
+2. The bug is discrete and actionable (i.e. not a general issue with the codebase or a combination of multiple issues).
+3. Fixing the bug does not demand a level of rigor that is not present in the rest of the codebase (e.g. one doesn't need very detailed comments and input validation in a repository of one-off scripts in personal projects)
+4. The bug was introduced in the commit (pre-existing bugs should not be flagged).
+5. The author of the original PR would likely fix the issue if they were made aware of it.
+6. The bug does not rely on unstated assumptions about the codebase or author's intent.
+7. It is not enough to speculate that a change may disrupt another part of the codebase, to be considered a bug, one must identify the other parts of the code that are provably affected.
+8. The bug is clearly not just an intentional change by the original author.
+
+When flagging a bug, you will also provide an accompanying comment. Once again, these guidelines are not the final word on how to construct a comment -- defer to any subsequent guidelines that you encounter.
+
+1. The comment should be clear about why the issue is a bug.
+2. The comment should appropriately communicate the severity of the issue. It should not claim that an issue is more severe than it actually is.
+3. The comment should be brief. The body should be at most 1 paragraph. It should not introduce line breaks within the natural language flow unless it is necessary for the code fragment.
+4. The comment should not include any chunks of code longer than 3 lines. Any code chunks should be wrapped in markdown inline code tags or a code block.
+5. The comment should clearly and explicitly communicate the scenarios, environments, or inputs that are necessary for the bug to arise. The comment should immediately indicate that the issue's severity depends on these factors.
+6. The comment's tone should be matter-of-fact and not accusatory or overly positive. It should read as a helpful AI assistant suggestion without sounding too much like a human reviewer.
+7. The comment should be written such that the original author can immediately grasp the idea without close reading.
+8. The comment should avoid excessive flattery and comments that are not helpful to the original author. The comment should avoid phrasing like "Great job ...", "Thanks for ...".
+
+Below are some more detailed guidelines that you should apply to this specific review.
+
+HOW MANY FINDINGS TO RETURN:
+
+Output all findings that the original author would fix if they knew about it. If there is no finding that a person would definitely love to see and fix, prefer outputting no findings. Do not stop at the first qualifying finding. Continue until you've listed every qualifying finding.
+
+GUIDELINES:
+
+- Ignore trivial style unless it obscures meaning or violates documented standards.
+- Use one comment per distinct issue (or a multi-line range if necessary).
+- Use \`\`\`suggestion blocks ONLY for concrete replacement code (minimal lines; no commentary inside the block).
+- In every \`\`\`suggestion block, preserve the exact leading whitespace of the replaced lines (spaces vs tabs, number of spaces).
+- Do NOT introduce or remove outer indentation levels unless that is the actual fix.
+
+The comments will be presented in the code review as inline comments. You should avoid providing unnecessary location details in the comment body. Always keep the line range as short as possible for interpreting the issue. Avoid ranges longer than 5\u201310 lines; instead, choose the most suitable subrange that pinpoints the problem.
+
+At the beginning of the finding title, tag the bug with priority level. For example "[P1] Un-padding slices along wrong tensor dimensions". [P0] \u2013 Drop everything to fix.  Blocking release, operations, or major usage. Only use for universal issues that do not depend on any assumptions about the inputs. \xB7 [P1] \u2013 Urgent. Should be addressed in the next cycle \xB7 [P2] \u2013 Normal. To be fixed eventually \xB7 [P3] \u2013 Low. Nice to have.
+
+Additionally, include a numeric priority field in the JSON output for each finding: set "priority" to 0 for P0, 1 for P1, 2 for P2, or 3 for P3. If a priority cannot be determined, omit the field or use null.
+
+At the end of your findings, output an "overall correctness" verdict of whether or not the patch should be considered "correct".
+Correct implies that existing code and tests will not break, and the patch is free of bugs and other blocking issues.
+Ignore non-blocking issues such as style, formatting, typos, documentation, and other nits.
+
+FORMATTING GUIDELINES:
+The finding description should be one paragraph.`;
+function buildCodexReviewUserMessage(patch, diffType, options, prMetadata) {
+  if (prMetadata) {
+    if (options?.hasLocalAccess) {
+      return [
+        prMetadata.url,
+        "",
+        "You are in a local worktree checked out at the PR head. The code is available locally.",
+        `To see the PR changes, diff against the remote base branch: git diff origin/${prMetadata.baseBranch}...HEAD`,
+        "Do NOT diff against the local `main` branch \u2014 it may be stale. Always use origin/."
+      ].join(`
+`);
+    }
+    return prMetadata.url;
+  }
+  const effectiveDiffType = diffType.startsWith("worktree:") ? diffType.split(":").pop() || "uncommitted" : diffType;
+  switch (effectiveDiffType) {
+    case "uncommitted":
+      return "Review the current code changes (staged, unstaged, and untracked files) and provide prioritized findings.";
+    case "staged":
+      return "Review the currently staged code changes (`git diff --staged`) and provide prioritized findings.";
+    case "unstaged":
+      return "Review the unstaged code changes (tracked modifications and untracked files) and provide prioritized findings.";
+    case "last-commit":
+      return "Review the code changes introduced in the last commit (`git diff HEAD~1..HEAD`) and provide prioritized findings.";
+    case "branch": {
+      const base = options?.defaultBranch || "main";
+      return `Review the code changes against the base branch '${base}'. Run \`git diff ${base}..HEAD\` to inspect the changes. Provide prioritized, actionable findings.`;
+    }
+    default:
+      return [
+        "Review the following code changes and provide prioritized findings.",
+        "",
+        "```diff",
+        patch,
+        "```"
+      ].join(`
+`);
+  }
+}
+async function buildCodexCommand(options) {
+  const { cwd, outputPath, prompt } = options;
+  const schemaPath = await ensureSchemaFile();
+  const command = [
+    "codex",
+    "exec",
+    "--output-schema",
+    schemaPath,
+    "-o",
+    outputPath,
+    "--full-auto",
+    "--ephemeral",
+    "-C",
+    cwd,
+    prompt
+  ];
+  debugLog("BUILD_COMMAND", {
+    cwd,
+    outputPath,
+    schemaPath,
+    promptLength: prompt.length,
+    command: command.map((c, i) => i === command.length - 1 ? `<prompt: ${c.length} chars>` : c)
+  });
+  return command;
+}
+function generateOutputPath() {
+  return join8(tmpdir2(), `plannotator-codex-${crypto.randomUUID()}.json`);
+}
+async function parseCodexOutput(outputPath) {
+  await debugLog("PARSE_OUTPUT_START", { outputPath });
+  try {
+    if (!existsSync8(outputPath)) {
+      await debugLog("PARSE_OUTPUT_FILE_MISSING", outputPath);
+      return null;
+    }
+    const text = await readFile(outputPath, "utf-8");
+    try {
+      await unlink(outputPath);
+    } catch {}
+    if (!text.trim()) {
+      await debugLog("PARSE_OUTPUT_EMPTY");
+      return null;
+    }
+    const parsed = JSON.parse(text);
+    if (!parsed || !Array.isArray(parsed.findings)) {
+      await debugLog("PARSE_OUTPUT_INVALID_SHAPE", { hasFindings: !!parsed?.findings });
+      return null;
+    }
+    await debugLog("PARSE_OUTPUT_SUCCESS", {
+      findingsCount: parsed.findings.length,
+      overall_correctness: parsed.overall_correctness,
+      overall_confidence_score: parsed.overall_confidence_score
+    });
+    return parsed;
+  } catch (err) {
+    await debugLog("PARSE_OUTPUT_ERROR", err instanceof Error ? err.message : String(err));
+    try {
+      await unlink(outputPath);
+    } catch {}
+    return null;
+  }
+}
+function transformReviewFindings(findings, source, cwd, author) {
+  const annotations = findings.filter((f) => f.code_location?.absolute_file_path && typeof f.code_location?.line_range?.start === "number" && typeof f.code_location?.line_range?.end === "number").map((f) => ({
+    source,
+    filePath: toRelativePath2(f.code_location.absolute_file_path, cwd),
+    lineStart: f.code_location.line_range.start,
+    lineEnd: f.code_location.line_range.end,
+    type: "comment",
+    side: "new",
+    scope: "line",
+    text: `${f.title}
+
+${f.body}`.trim(),
+    author: author ?? "Review Agent"
+  }));
+  debugLog("TRANSFORM_FINDINGS", {
+    inputCount: findings.length,
+    outputCount: annotations.length,
+    annotations: annotations.map((a) => ({
+      filePath: a.filePath,
+      lineStart: a.lineStart,
+      lineEnd: a.lineEnd,
+      textPreview: a.text.slice(0, 80)
+    }))
+  });
+  return annotations;
+}
+
 // ../../packages/shared/pr-github.ts
 function repoFlag(ref) {
   if (ref.host !== "github.com") {
@@ -27372,6 +28104,18 @@ async function fetchGhPR(runtime2, ref) {
     throw new Error(`Failed to fetch PR metadata: ${viewResult.stderr.trim() || `exit code ${viewResult.exitCode}`}`);
   }
   const raw = JSON.parse(viewResult.stdout);
+  let mergeBaseSha;
+  try {
+    const compareResult = await runtime2.runCommand("gh", hostnameArgs(ref.host, [
+      "api",
+      `repos/${ref.owner}/${ref.repo}/compare/${raw.baseRefOid}...${raw.headRefOid}`,
+      "--jq",
+      ".merge_base_commit.sha"
+    ]));
+    if (compareResult.exitCode === 0 && compareResult.stdout.trim()) {
+      mergeBaseSha = compareResult.stdout.trim();
+    }
+  } catch {}
   const metadata = {
     platform: "github",
     host: ref.host,
@@ -27385,6 +28129,7 @@ async function fetchGhPR(runtime2, ref) {
     headBranch: raw.headRefName,
     baseSha: raw.baseRefOid,
     headSha: raw.headRefOid,
+    mergeBaseSha,
     url: raw.url
   };
   return { metadata, rawPatch: diffResult.stdout };
@@ -27429,8 +28174,10 @@ function parseGhPRContext(raw) {
       author: login(r?.author),
       state: str(r?.state),
       body: str(r?.body),
-      submittedAt: str(r?.submittedAt)
+      submittedAt: str(r?.submittedAt),
+      ...r?.url ? { url: str(r.url) } : {}
     })),
+    reviewThreads: [],
     checks: arr(raw.statusCheckRollup).map((c) => ({
       name: str(c?.name),
       status: str(c?.status),
@@ -27460,7 +28207,78 @@ async function fetchGhPRContext(runtime2, ref) {
     throw new Error(`Failed to fetch PR context: ${result.stderr.trim() || `exit code ${result.exitCode}`}`);
   }
   const raw = JSON.parse(result.stdout);
-  return parseGhPRContext(raw);
+  const context = parseGhPRContext(raw);
+  try {
+    context.reviewThreads = await fetchGhReviewThreads(runtime2, ref);
+  } catch {
+    context.reviewThreads = [];
+  }
+  return context;
+}
+var REVIEW_THREADS_QUERY = `
+query($owner: String!, $repo: String!, $number: Int!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $number) {
+      reviewThreads(first: 100) {
+        nodes {
+          id
+          isResolved
+          isOutdated
+          line
+          startLine
+          path
+          diffSide
+          comments(first: 50) {
+            nodes {
+              id
+              body
+              author { login }
+              createdAt
+              url
+              diffHunk
+            }
+          }
+        }
+      }
+    }
+  }
+}`;
+async function fetchGhReviewThreads(runtime2, ref) {
+  const result = await runtime2.runCommand("gh", hostnameArgs(ref.host, [
+    "api",
+    "graphql",
+    "-f",
+    `query=${REVIEW_THREADS_QUERY}`,
+    "-f",
+    `owner=${ref.owner}`,
+    "-f",
+    `repo=${ref.repo}`,
+    "-F",
+    `number=${ref.number}`
+  ]));
+  if (result.exitCode !== 0)
+    return [];
+  const data = JSON.parse(result.stdout);
+  const threads = data?.data?.repository?.pullRequest?.reviewThreads?.nodes;
+  if (!Array.isArray(threads))
+    return [];
+  return threads.map((t) => ({
+    id: String(t.id ?? ""),
+    isResolved: t.isResolved === true,
+    isOutdated: t.isOutdated === true,
+    path: String(t.path ?? ""),
+    line: typeof t.line === "number" ? t.line : null,
+    startLine: typeof t.startLine === "number" ? t.startLine : null,
+    diffSide: t.diffSide === "LEFT" || t.diffSide === "RIGHT" ? t.diffSide : null,
+    comments: Array.isArray(t.comments?.nodes) ? t.comments.nodes.map((c) => ({
+      id: String(c.id ?? ""),
+      author: c.author?.login ? String(c.author.login) : "",
+      body: String(c.body ?? ""),
+      createdAt: String(c.createdAt ?? ""),
+      url: String(c.url ?? ""),
+      ...c.diffHunk ? { diffHunk: String(c.diffHunk) } : {}
+    })) : []
+  }));
 }
 async function fetchGhPRFileContent(runtime2, ref, sha, filePath) {
   const result = await runtime2.runCommand("gh", hostnameArgs(ref.host, [
@@ -27822,6 +28640,7 @@ async function fetchGlMRContext(runtime2, ref) {
     mergeStateStatus,
     comments: notes,
     reviews,
+    reviewThreads: [],
     checks,
     linkedIssues
   };
@@ -28322,6 +29141,7 @@ var RETRY_DELAY_MS2 = 500;
 async function startReviewServer(options) {
   const { htmlContent, origin, gitContext, sharingEnabled = true, shareBaseUrl, onReady, prMetadata } = options;
   const isPRMode = !!prMetadata;
+  const hasLocalAccess = !!gitContext;
   const draftKey = contentHash(options.rawPatch);
   const editorAnnotations = createEditorAnnotationHandler();
   const externalAnnotations = createExternalAnnotationHandler("review");
@@ -28334,7 +29154,75 @@ async function startReviewServer(options) {
     mode: "review",
     getServerUrl: () => serverUrl,
     getCwd: () => {
+      if (options.agentCwd)
+        return options.agentCwd;
       return resolveVcsCwd(currentDiffType, gitContext?.cwd) ?? process.cwd();
+    },
+    async buildCommand(provider) {
+      const cwd = options.agentCwd ?? resolveVcsCwd(currentDiffType, gitContext?.cwd) ?? process.cwd();
+      const hasAgentLocalAccess = !!options.agentCwd || !!gitContext;
+      const userMessage = buildCodexReviewUserMessage(currentPatch, currentDiffType, { defaultBranch: gitContext?.defaultBranch, hasLocalAccess: hasAgentLocalAccess }, prMetadata);
+      if (provider === "codex") {
+        const outputPath = generateOutputPath();
+        const prompt = CODEX_REVIEW_SYSTEM_PROMPT + `
+
+---
+
+` + userMessage;
+        const command = await buildCodexCommand({ cwd, outputPath, prompt });
+        return { command, outputPath, prompt, label: "Codex Review" };
+      }
+      if (provider === "claude") {
+        const prompt = CLAUDE_REVIEW_PROMPT + `
+
+---
+
+` + userMessage;
+        const { command, stdinPrompt } = buildClaudeCommand(prompt);
+        return { command, stdinPrompt, prompt, cwd, label: "Claude Code Review", captureStdout: true };
+      }
+      return null;
+    },
+    async onJobComplete(job, meta) {
+      const cwd = options.agentCwd ?? resolveVcsCwd(currentDiffType, gitContext?.cwd) ?? process.cwd();
+      if (job.provider === "codex" && meta.outputPath) {
+        const output = await parseCodexOutput(meta.outputPath);
+        if (!output)
+          return;
+        const hasBlockingFindings = output.findings.some((f7) => f7.priority !== null && f7.priority <= 1);
+        job.summary = {
+          correctness: hasBlockingFindings ? "Issues Found" : output.overall_correctness,
+          explanation: output.overall_explanation,
+          confidence: output.overall_confidence_score
+        };
+        if (output.findings.length > 0) {
+          const annotations = transformReviewFindings(output.findings, job.source, cwd, "Codex");
+          const result = externalAnnotations.addAnnotations({ annotations });
+          if ("error" in result)
+            console.error(`[codex-review] addAnnotations error:`, result.error);
+        }
+        return;
+      }
+      if (job.provider === "claude" && meta.stdout) {
+        const output = parseClaudeStreamOutput(meta.stdout);
+        if (!output) {
+          console.error(`[claude-review] Failed to parse output (${meta.stdout.length} bytes, last 200: ${meta.stdout.slice(-200)})`);
+          return;
+        }
+        const total = output.summary.important + output.summary.nit + output.summary.pre_existing;
+        job.summary = {
+          correctness: output.summary.important === 0 ? "Correct" : "Issues Found",
+          explanation: `${output.summary.important} important, ${output.summary.nit} nit, ${output.summary.pre_existing} pre-existing`,
+          confidence: total === 0 ? 1 : Math.max(0, 1 - output.summary.important * 0.2)
+        };
+        if (output.findings.length > 0) {
+          const annotations = transformClaudeFindings(output.findings, job.source, cwd);
+          const result = externalAnnotations.addAnnotations({ annotations });
+          if ("error" in result)
+            console.error(`[claude-review] addAnnotations error:`, result.error);
+        }
+        return;
+      }
     }
   });
   const aiRegistry = new ProviderRegistry;
@@ -28395,6 +29283,8 @@ async function startReviewServer(options) {
       registry: aiRegistry,
       sessionManager: aiSessionManager,
       getCwd: () => {
+        if (options.agentCwd)
+          return options.agentCwd;
         return resolveVcsCwd(currentDiffType, gitContext?.cwd) ?? process.cwd();
       }
     });
@@ -28429,12 +29319,13 @@ async function startReviewServer(options) {
               rawPatch: currentPatch,
               gitRef: currentGitRef,
               origin,
-              diffType: isPRMode ? undefined : currentDiffType,
-              gitContext: isPRMode ? undefined : gitContext,
+              diffType: hasLocalAccess ? currentDiffType : undefined,
+              gitContext: hasLocalAccess ? gitContext : undefined,
               sharingEnabled,
               shareBaseUrl,
               repoInfo,
               isWSL: wslFlag,
+              ...options.agentCwd && { agentCwd: options.agentCwd },
               ...isPRMode && { prMetadata, platformUser },
               ...isPRMode && initialViewedFiles.length > 0 && { viewedFiles: initialViewedFiles },
               ...currentError && { error: currentError },
@@ -28442,8 +29333,8 @@ async function startReviewServer(options) {
             });
           }
           if (url.pathname === "/api/diff/switch" && req.method === "POST") {
-            if (isPRMode) {
-              return Response.json({ error: "Not available for PR reviews" }, { status: 400 });
+            if (!hasLocalAccess) {
+              return Response.json({ error: "Not available without local file access" }, { status: 400 });
             }
             try {
               const body = await req.json();
@@ -28499,17 +29390,21 @@ async function startReviewServer(options) {
                 return Response.json({ error: "Invalid path" }, { status: 400 });
               }
             }
+            if (hasLocalAccess) {
+              const defaultBranch = gitContext?.defaultBranch || "main";
+              const defaultCwd = gitContext?.cwd;
+              const result = await getVcsFileContentsForDiff(currentDiffType, defaultBranch, filePath, oldPath, defaultCwd);
+              return Response.json(result);
+            }
             if (isPRMode) {
+              const oldSha = prMetadata.mergeBaseSha ?? prMetadata.baseSha;
               const [oldContent, newContent] = await Promise.all([
-                fetchPRFileContent2(prRef, prMetadata.baseSha, oldPath || filePath),
+                fetchPRFileContent2(prRef, oldSha, oldPath || filePath),
                 fetchPRFileContent2(prRef, prMetadata.headSha, filePath)
               ]);
               return Response.json({ oldContent, newContent });
             }
-            const defaultBranch = gitContext?.defaultBranch || "main";
-            const defaultCwd = gitContext?.cwd;
-            const result = await getVcsFileContentsForDiff(currentDiffType, defaultBranch, filePath, oldPath, defaultCwd);
-            return Response.json(result);
+            return Response.json({ error: "No file access available" }, { status: 400 });
           }
           if (url.pathname === "/api/git-add" && req.method === "POST") {
             if (isPRMode || !canStageFiles(currentDiffType)) {
@@ -28598,10 +29493,13 @@ async function startReviewServer(options) {
             }
             try {
               const body = await req.json();
+              console.error(`[pr-action] ${body.action} with ${body.fileComments.length} file comment(s), headSha=${prMetadata.headSha}`);
               await submitPRReview2(prRef, prMetadata.headSha, body.action, body.body, body.fileComments);
+              console.error(`[pr-action] Success`);
               return Response.json({ ok: true, prUrl: prMetadata.url });
             } catch (err) {
               const message = err instanceof Error ? err.message : "Failed to submit PR review";
+              console.error(`[pr-action] Failed: ${message}`);
               return Response.json({ error: message }, { status: 500 });
             }
           }
@@ -28674,6 +29572,13 @@ async function startReviewServer(options) {
       aiSessionManager.disposeAll();
       aiRegistry.disposeAll();
       server2.stop();
+      if (options.onCleanup) {
+        try {
+          const result = options.onCleanup();
+          if (result instanceof Promise)
+            result.catch(() => {});
+        } catch {}
+      }
     }
   };
 }
@@ -29084,7 +29989,7 @@ function getReviewHtml() {
 }
 var DEFAULT_PLAN_TIMEOUT_SECONDS = 345600;
 function isFilePath(value) {
-  return path3.isAbsolute(value) && value.endsWith(".md") && existsSync9(value);
+  return path3.isAbsolute(value) && value.endsWith(".md") && existsSync10(value);
 }
 function resolvePlanContent(plan) {
   if (isFilePath(plan)) {