@prism-d1/cli 1.1.2 → 1.2.0

package/dist/src/codewatch/results.js

@@ -0,0 +1,121 @@
+/**
+ * Codewatch result schema and writer (local git-hook gate runs).
+ *
+ * Every local gate run (the pre-commit secret scan, the pre-push review, and a
+ * detected skip of either) is written as one JSON file under `.prism/results/`.
+ * The schema lives here, not in the hook code, so `prism-cli dashboard` and CI
+ * can read the same files without re-deriving the shape.
+ *
+ * Results are local developer evidence, never committed: the installer adds
+ * `.prism/results/` to .gitignore.
+ */
+import { mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { appendFileSync, existsSync as fileExists } from 'node:fs';
+import { run } from '../utils/exec.js';
+export const RESULT_SCHEMA_VERSION = 1;
+export const RESULTS_DIR = '.prism/results';
+/** Pre-commit ran with no gitleaks on PATH: the commit was allowed but not secret-scanned. */
+export const REASON_GITLEAKS_MISSING = 'gitleaks-missing';
+export function makeResult(init) {
+    return {
+        schema_version: RESULT_SCHEMA_VERSION,
+        tool_version: null,
+        model: null,
+        commit: null,
+        tree: null,
+        branch: null,
+        upstream: null,
+        base: null,
+        summary: null,
+        score: null,
+        reason: null,
+        findings: [],
+        ...init,
+    };
+}
+/** Keeps only characters safe in a file name, so no value can escape the results dir. */
+function safePart(s) {
+    return s.replace(/[^A-Za-z0-9_-]/g, '').slice(0, 40) || 'x';
+}
+/** `20261104T202000123Z` -- sortable, colon-free. */
+export function compactTimestamp(iso) {
+    return iso.replace(/[-:]/g, '').replace('.', '');
+}
+/**
+ * `<commit12>-<time>-<hook>-<kind>.json`, or `tree-<tree12>-...` when there is
+ * no commit yet (pre-commit).
+ */
+export function resultFileName(r) {
+    const id = r.commit ? safePart(r.commit.slice(0, 12)) : r.tree ? `tree-${safePart(r.tree.slice(0, 12))}` : 'nocommit';
+    return `${id}-${compactTimestamp(r.started_at)}-${safePart(r.hook)}-${safePart(r.kind)}.json`;
+}
+/**
+ * Writes a result atomically (temp file + rename), so a dashboard reading the
+ * directory never sees a half-written file. Returns the absolute path.
+ */
+/**
+ * Makes sure `.prism/results/` is ignored in this clone. Under the global
+ * hooks a repo may never have had codewatch installed, so it has no .gitignore
+ * entry; `.git/info/exclude` is local to the clone and keeps the working tree
+ * clean without touching any tracked file. Outside a git repo it does nothing.
+ */
+export function ensureResultsExcluded(repoRoot) {
+    const probe = run('git', ['-C', repoRoot, 'check-ignore', '-q', `${RESULTS_DIR}/probe.json`]);
+    if (probe.ok)
+        return false;
+    const p = run('git', ['-C', repoRoot, 'rev-parse', '--path-format=absolute', '--git-path', 'info/exclude']);
+    if (!p.ok || !p.stdout)
+        return false;
+    mkdirSync(dirname(p.stdout), { recursive: true });
+    const prefix = fileExists(p.stdout) && !readFileSync(p.stdout, 'utf8').endsWith('\n') ? '\n' : '';
+    appendFileSync(p.stdout, `${prefix}# prism-cli codewatch results (local)\n/${RESULTS_DIR}/\n`);
+    return true;
+}
+export function writeResult(repoRoot, r) {
+    const dir = resolve(repoRoot, RESULTS_DIR);
+    if (!fileExists(dir)) {
+        try {
+            ensureResultsExcluded(repoRoot);
+        }
+        catch { /* never fail a write over this */ }
+    }
+    mkdirSync(dir, { recursive: true });
+    const dest = join(dir, resultFileName(r));
+    const tmp = `${dest}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(r, null, 2) + '\n', { mode: 0o600 });
+    renameSync(tmp, dest);
+    return dest;
+}
+/** Every parseable result with its id. Ids come from the directory listing, never from input. */
+export function readResultEntries(repoRoot) {
+    const dir = resolve(repoRoot, RESULTS_DIR);
+    let files;
+    try {
+        files = readdirSync(dir).filter((f) => f.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const f of files) {
+        try {
+            const r = JSON.parse(readFileSync(join(dir, f), 'utf8'));
+            if (r && r.schema_version === RESULT_SCHEMA_VERSION)
+                out.push({ id: f.slice(0, -'.json'.length), result: r });
+        }
+        catch { /* skip */ }
+    }
+    return out;
+}
+/** Reads every parseable result file. Unparseable files are ignored, not fatal. */
+export function readResults(repoRoot) {
+    return readResultEntries(repoRoot).map((e) => e.result);
+}
+export function countBySeverity(findings) {
+    const c = { high: 0, medium: 0, low: 0 };
+    for (const f of findings)
+        c[f.severity]++;
+    return c;
+}
+//# sourceMappingURL=results.js.map

package/dist/src/codewatch/results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"results.js","sourceRoot":"","sources":["../../../src/codewatch/results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AA+D1D,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO;QACL,cAAc,EAAE,qBAAqB;QACrC,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAc;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACtH,OAAO,GAAG,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,WAAW,aAAa,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,2CAA2C,WAAW,KAAK,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,CAAc;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,KAAK,qBAAqB;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,MAAM,CAAC,GAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/codewatch/reviewers/claude.d.ts

@@ -0,0 +1,9 @@
+import { type ReviewerAdapter } from './types.js';
+/**
+ * Claude Code headless review (`claude -p --output-format json`).
+ *
+ * The rules and the diff go in the prompt on stdin (no argv length limit, no
+ * file outside the working dir to grant access to). Needs no kiro-cli.
+ */
+export declare const claudeAdapter: ReviewerAdapter;
+//# sourceMappingURL=claude.d.ts.map

package/dist/src/codewatch/reviewers/claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAMvG;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,eAiC3B,CAAC"}

package/dist/src/codewatch/reviewers/claude.js

@@ -0,0 +1,48 @@
+import { extractReviewJson, normalizeReview, OUTPUT_CONTRACT } from './types.js';
+/** Read-only tools: the reviewer may look at surrounding code, never change it or run anything. */
+const ALLOWED_TOOLS = ['Read', 'Grep', 'Glob'];
+const DISALLOWED_TOOLS = ['Bash', 'Edit', 'Write', 'NotebookEdit', 'WebFetch', 'WebSearch', 'Task'];
+/**
+ * Claude Code headless review (`claude -p --output-format json`).
+ *
+ * The rules and the diff go in the prompt on stdin (no argv length limit, no
+ * file outside the working dir to grant access to). Needs no kiro-cli.
+ */
+export const claudeAdapter = {
+    id: 'claude',
+    binary: 'claude',
+    displayName: 'Claude Code',
+    invocation(req) {
+        const args = [
+            '-p',
+            '--output-format', 'json',
+            '--allowed-tools', ALLOWED_TOOLS.join(','),
+            '--disallowed-tools', DISALLOWED_TOOLS.join(','),
+        ];
+        if (req.model)
+            args.push('--model', req.model);
+        const input = 'You are a code reviewer. Review ONLY the changes in the diff below, for code quality and security, ' +
+            'against these rules. You may read files in the repository for context but must not modify anything.\n\n' +
+            `<rules>\n${req.rulesText}\n</rules>\n\n<diff>\n${req.diff}\n</diff>\n\n${OUTPUT_CONTRACT}`;
+        return { args, input };
+    },
+    parse(stdout) {
+        // Envelope: {"type":"result","is_error":false,"result":"<text>","modelUsage":{"<model>":{...}},...}
+        let env;
+        try {
+            env = JSON.parse(stdout.trim());
+        }
+        catch {
+            throw new Error('Claude Code output is not JSON (expected --output-format json)');
+        }
+        if (env?.is_error)
+            throw new Error(`Claude Code reported an error: ${String(env.result ?? env.subtype ?? 'unknown').slice(0, 300)}`);
+        if (typeof env?.result !== 'string')
+            throw new Error('Claude Code JSON has no "result" text');
+        const models = env.modelUsage && typeof env.modelUsage === 'object' ? Object.keys(env.modelUsage) : [];
+        // modelUsage can list a small helper model too; the one with the most output tokens did the review.
+        models.sort((a, b) => (env.modelUsage[b]?.outputTokens ?? 0) - (env.modelUsage[a]?.outputTokens ?? 0));
+        return normalizeReview(extractReviewJson(env.result), models[0] ?? null);
+    },
+};
+//# sourceMappingURL=claude.js.map

package/dist/src/codewatch/reviewers/claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAwB,MAAM,YAAY,CAAC;AAEvG,mGAAmG;AACnG,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAoB;IAC5C,EAAE,EAAE,QAAQ;IACZ,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,UAAU,CAAC,GAAG;QACZ,MAAM,IAAI,GAAG;YACX,IAAI;YACJ,iBAAiB,EAAE,MAAM;YACzB,iBAAiB,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1C,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;SACjD,CAAC;QACF,IAAI,GAAG,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,KAAK,GACT,qGAAqG;YACrG,yGAAyG;YACzG,YAAY,GAAG,CAAC,SAAS,yBAAyB,GAAG,CAAC,IAAI,gBAAgB,eAAe,EAAE,CAAC;QAC9F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,MAAM;QACV,oGAAoG;QACpG,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,GAAG,EAAE,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrI,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,oGAAoG;QACpG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/dist/src/codewatch/reviewers/index.d.ts

@@ -0,0 +1,39 @@
+import { type ParsedReview, type ReviewerAdapter, type ReviewerId, type ReviewRequest } from './types.js';
+export * from './types.js';
+export declare const ADAPTERS: Record<ReviewerId, ReviewerAdapter>;
+export { findOnPath, toolVersion } from '../../utils/tool-check.js';
+/** Reviewer tools present on PATH, in REVIEWER_IDS order. */
+export declare function detectReviewers(pathEnv?: string | undefined): ReviewerId[];
+export interface ReviewerChoice {
+    /** The reviewer to run, or null when none is available. */
+    id: ReviewerId | null;
+    /** Where the choice came from. */
+    source: 'git-config' | 'prism-config' | 'detected' | 'fallback' | 'none';
+    /** Set when the configured reviewer was not available and another was used. */
+    note: string | null;
+}
+/**
+ * Precedence: `git config prism.reviewer` (per-clone developer override), then
+ * `.prism/config.json` eval.reviewer (team default), then whatever is on PATH.
+ *
+ * If the chosen tool is not installed, another installed one is used and the
+ * substitution is noted, so a Claude Code user on a team that defaults to kiro
+ * still gets a review without installing kiro-cli.
+ */
+export declare function resolveReviewer(opts: {
+    gitConfigValue: string | null;
+    prismConfigValue: string | null | undefined;
+    available: ReviewerId[];
+}): ReviewerChoice;
+export interface ReviewRun {
+    ok: boolean;
+    review: ParsedReview | null;
+    error: string | null;
+    rawStdout: string;
+}
+/**
+ * Runs one adapter and parses its output. Never throws: a missing binary, a
+ * timeout, a non-zero exit and unparseable output all come back as ok:false.
+ */
+export declare function runReview(adapter: ReviewerAdapter, req: ReviewRequest, timeoutMs: number, binaryPath?: string): ReviewRun;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/codewatch/reviewers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEtI,cAAc,YAAY,CAAC;AAE3B,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,CAGxD,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAEpE,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,OAAO,GAAE,MAAM,GAAG,SAA4B,GAAG,UAAU,EAAE,CAE5F;AAED,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,EAAE,EAAE,UAAU,GAAG,IAAI,CAAC;IACtB,kCAAkC;IAClC,MAAM,EAAE,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACzE,+EAA+E;IAC/E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,SAAS,EAAE,UAAU,EAAE,CAAC;CACzB,GAAG,cAAc,CAuBjB;AAKD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAgCzH"}

package/dist/src/codewatch/reviewers/index.js

@@ -0,0 +1,97 @@
+import { spawnSync } from 'node:child_process';
+import { findOnPath } from '../../utils/tool-check.js';
+import { claudeAdapter } from './claude.js';
+import { kiroAdapter } from './kiro.js';
+import { isReviewerId, REVIEWER_IDS } from './types.js';
+export * from './types.js';
+export const ADAPTERS = {
+    kiro: kiroAdapter,
+    claude: claudeAdapter,
+};
+export { findOnPath, toolVersion } from '../../utils/tool-check.js';
+/** Reviewer tools present on PATH, in REVIEWER_IDS order. */
+export function detectReviewers(pathEnv = process.env.PATH) {
+    return REVIEWER_IDS.filter((id) => findOnPath(ADAPTERS[id].binary, pathEnv) !== null);
+}
+/**
+ * Precedence: `git config prism.reviewer` (per-clone developer override), then
+ * `.prism/config.json` eval.reviewer (team default), then whatever is on PATH.
+ *
+ * If the chosen tool is not installed, another installed one is used and the
+ * substitution is noted, so a Claude Code user on a team that defaults to kiro
+ * still gets a review without installing kiro-cli.
+ */
+export function resolveReviewer(opts) {
+    const { gitConfigValue, prismConfigValue, available } = opts;
+    let wanted = null;
+    let source = 'detected';
+    let note = null;
+    if (gitConfigValue) {
+        if (isReviewerId(gitConfigValue)) {
+            wanted = gitConfigValue;
+            source = 'git-config';
+        }
+        else
+            note = `ignored git config prism.reviewer="${gitConfigValue}" (expected ${REVIEWER_IDS.join(' or ')})`;
+    }
+    if (!wanted && prismConfigValue) {
+        if (isReviewerId(prismConfigValue)) {
+            wanted = prismConfigValue;
+            source = 'prism-config';
+        }
+        else
+            note = `ignored eval.reviewer="${prismConfigValue}" in .prism/config.json`;
+    }
+    if (wanted && available.includes(wanted))
+        return { id: wanted, source, note };
+    if (available.length === 0) {
+        return { id: null, source: 'none', note: wanted ? `${ADAPTERS[wanted].binary} is not on PATH` : 'neither kiro-cli nor claude is on PATH' };
+    }
+    if (wanted) {
+        return { id: available[0], source: 'fallback', note: `${ADAPTERS[wanted].binary} is not on PATH; used ${ADAPTERS[available[0]].binary} instead` };
+    }
+    return { id: available[0], source: 'detected', note };
+}
+/** Git sets these for hooks; a reviewer that shells out to git must not inherit them. */
+const GIT_HOOK_ENV = ['GIT_DIR', 'GIT_INDEX_FILE', 'GIT_WORK_TREE', 'GIT_PREFIX', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES'];
+/**
+ * Runs one adapter and parses its output. Never throws: a missing binary, a
+ * timeout, a non-zero exit and unparseable output all come back as ok:false.
+ */
+export function runReview(adapter, req, timeoutMs, binaryPath) {
+    const env = { ...process.env };
+    for (const k of GIT_HOOK_ENV)
+        delete env[k];
+    let inv;
+    try {
+        inv = adapter.invocation(req);
+    }
+    catch (e) {
+        return { ok: false, review: null, error: `could not build invocation: ${e.message}`, rawStdout: '' };
+    }
+    const res = spawnSync(binaryPath || adapter.binary, inv.args, {
+        cwd: req.repoRoot,
+        input: inv.input ?? '',
+        encoding: 'utf8',
+        env,
+        timeout: timeoutMs,
+        maxBuffer: 32 * 1024 * 1024,
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    const stdout = res.stdout || '';
+    if (res.error) {
+        const msg = res.error.code === 'ETIMEDOUT'
+            ? `${adapter.binary} timed out after ${Math.round(timeoutMs / 1000)}s`
+            : `${adapter.binary} failed to start: ${res.error.message}`;
+        return { ok: false, review: null, error: msg, rawStdout: stdout };
+    }
+    try {
+        const review = adapter.parse(stdout);
+        return { ok: true, review, error: null, rawStdout: stdout };
+    }
+    catch (e) {
+        const exit = res.status !== 0 ? ` (exit ${res.status}${res.stderr ? `: ${res.stderr.trim().slice(0, 200)}` : ''})` : '';
+        return { ok: false, review: null, error: `${e.message}${exit}`, rawStdout: stdout };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/src/codewatch/reviewers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAgF,MAAM,YAAY,CAAC;AAEtI,cAAc,YAAY,CAAC;AAE3B,MAAM,CAAC,MAAM,QAAQ,GAAwC;IAC3D,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAEpE,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,UAA8B,OAAO,CAAC,GAAG,CAAC,IAAI;IAC5E,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;AACxF,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAI/B;IACC,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC7D,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,MAAM,GAA6B,UAAU,CAAC;IAClD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,cAAc,CAAC;YAAC,MAAM,GAAG,YAAY,CAAC;QAAC,CAAC;;YAChF,IAAI,GAAG,sCAAsC,cAAc,eAAe,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAChC,IAAI,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,gBAAgB,CAAC;YAAC,MAAM,GAAG,cAAc,CAAC;QAAC,CAAC;;YACtF,IAAI,GAAG,0BAA0B,gBAAgB,yBAAyB,CAAC;IAClF,CAAC;IAED,IAAI,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,wCAAwC,EAAE,CAAC;IAC7I,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,yBAAyB,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,sBAAsB,EAAE,kCAAkC,CAAC,CAAC;AAS9I;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAwB,EAAE,GAAkB,EAAE,SAAiB,EAAE,UAAmB;IAC5G,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACvG,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5D,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;QACtB,QAAQ,EAAE,MAAM;QAChB,GAAG;QACH,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,GAAG,GAAI,GAAG,CAAC,KAA+B,CAAC,IAAI,KAAK,WAAW;YACnE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG;YACtE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/src/codewatch/reviewers/kiro.d.ts

@@ -0,0 +1,14 @@
+import { type ReviewerAdapter } from './types.js';
+/**
+ * kiro-cli headless review.
+ *
+ * Same shape as the CI gate (prism-eval-gate.yml): a short argv prompt that
+ * points kiro at files on disk, because kiro-cli has had a bug putting long
+ * stdin into HTTP headers. The rule set is passed as context by path -- kiro
+ * reads it with fs_read before reviewing.
+ *
+ * Only fs_read is trusted (`--trust-tools=fs_read`), so in --no-interactive
+ * mode any write or shell tool call is refused rather than run.
+ */
+export declare const kiroAdapter: ReviewerAdapter;
+//# sourceMappingURL=kiro.d.ts.map

package/dist/src/codewatch/reviewers/kiro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro.d.ts","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/kiro.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAElH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,eAmBzB,CAAC"}

package/dist/src/codewatch/reviewers/kiro.js

@@ -0,0 +1,32 @@
+import { extractReviewJson, normalizeReview, OUTPUT_CONTRACT, stripAnsi } from './types.js';
+/**
+ * kiro-cli headless review.
+ *
+ * Same shape as the CI gate (prism-eval-gate.yml): a short argv prompt that
+ * points kiro at files on disk, because kiro-cli has had a bug putting long
+ * stdin into HTTP headers. The rule set is passed as context by path -- kiro
+ * reads it with fs_read before reviewing.
+ *
+ * Only fs_read is trusted (`--trust-tools=fs_read`), so in --no-interactive
+ * mode any write or shell tool call is refused rather than run.
+ */
+export const kiroAdapter = {
+    id: 'kiro',
+    binary: 'kiro-cli',
+    displayName: 'kiro-cli',
+    invocation(req) {
+        const prompt = `You are a code reviewer. First read the review rules in ${req.rulesPath} and follow them. ` +
+            `Then read the diff at ${req.diffPath} and review only the changes it introduces, for code quality and security. ` +
+            OUTPUT_CONTRACT;
+        return {
+            args: ['chat', '--no-interactive', '--trust-tools=fs_read', '--model', req.model || 'auto', prompt],
+        };
+    },
+    parse(stdout) {
+        const text = stripAnsi(stdout);
+        // kiro-cli prints no machine-readable model; leave it to the caller's
+        // requested model.
+        return normalizeReview(extractReviewJson(text), null);
+    },
+};
+//# sourceMappingURL=kiro.js.map

package/dist/src/codewatch/reviewers/kiro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro.js","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/kiro.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAwB,MAAM,YAAY,CAAC;AAElH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAoB;IAC1C,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,UAAU;IAClB,WAAW,EAAE,UAAU;IACvB,UAAU,CAAC,GAAG;QACZ,MAAM,MAAM,GACV,2DAA2D,GAAG,CAAC,SAAS,oBAAoB;YAC5F,yBAAyB,GAAG,CAAC,QAAQ,6EAA6E;YAClH,eAAe,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,CAAC;SACpG,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,sEAAsE;QACtE,mBAAmB;QACnB,OAAO,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;CACF,CAAC"}

package/dist/src/codewatch/reviewers/types.d.ts

@@ -0,0 +1,56 @@
+import type { Finding } from '../results.js';
+export declare const REVIEWER_IDS: readonly ["kiro", "claude"];
+export type ReviewerId = typeof REVIEWER_IDS[number];
+export declare function isReviewerId(v: unknown): v is ReviewerId;
+export interface ReviewRequest {
+    repoRoot: string;
+    /** Repo-relative path of the shared rule set (`.prism/review/rules.md`). */
+    rulesPath: string;
+    /** Contents of the rule set, for adapters that pass it inline. */
+    rulesText: string;
+    /** Absolute path of the diff file on disk. */
+    diffPath: string;
+    /** The diff text itself, for adapters that pass it inline. */
+    diff: string;
+    /** Requested model, if the team pinned one. */
+    model?: string;
+}
+export interface Invocation {
+    args: string[];
+    /** Written to the child's stdin. */
+    input?: string;
+}
+export interface ParsedReview {
+    findings: Finding[];
+    summary: string | null;
+    score: number | null;
+    /** Model the tool reported using, if its output says. */
+    model: string | null;
+}
+/**
+ * One adapter per reviewer tool. An adapter only builds argv and parses
+ * output; running the process, timeouts and error handling are shared
+ * (see runReview in index.ts), so adding a tool is one small file.
+ */
+export interface ReviewerAdapter {
+    id: ReviewerId;
+    /** Executable looked up on PATH. */
+    binary: string;
+    displayName: string;
+    invocation(req: ReviewRequest): Invocation;
+    /** Throws when the output holds no usable review. */
+    parse(stdout: string): ParsedReview;
+}
+/** Output contract both adapters ask for. Matches the CI gate's JSON plus a `rule` field. */
+export declare const OUTPUT_CONTRACT: string;
+/** Strips ANSI escape sequences and carriage returns. */
+export declare function stripAnsi(s: string): string;
+/**
+ * Finds the last balanced top-level JSON object in free text that parses and
+ * has a `findings` array. Models wrap JSON in prose or fences; scanning for
+ * balanced braces (string-aware) is more reliable than one greedy regex.
+ */
+export declare function extractReviewJson(text: string): any;
+/** Converts the model's JSON into the shared schema. Tolerates missing fields. */
+export declare function normalizeReview(obj: any, model: string | null): ParsedReview;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/codewatch/reviewers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA6B,MAAM,eAAe,CAAC;AAExE,eAAO,MAAM,YAAY,6BAA8B,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAErD,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,UAAU,CAExD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,UAAU,CAAC;IACf,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,UAAU,CAAC;IAC3C,qDAAqD;IACrD,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;CACrC;AAED,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAGyB,CAAC;AAEtD,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CA6BnD;AAmBD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAc5E"}

package/dist/src/codewatch/reviewers/types.js

@@ -0,0 +1,91 @@
+export const REVIEWER_IDS = ['kiro', 'claude'];
+export function isReviewerId(v) {
+    return typeof v === 'string' && REVIEWER_IDS.includes(v);
+}
+/** Output contract both adapters ask for. Matches the CI gate's JSON plus a `rule` field. */
+export const OUTPUT_CONTRACT = 'Output ONLY one JSON object, no prose and no code fences: ' +
+    '{"findings":[{"file":"path","line":1,"severity":"high|medium|low","category":"security|correctness|performance|maintainability|reliability","rule":"name of the rule from the rules file","message":"str"}],"score":0.0,"summary":"str"}. ' +
+    'Use an empty findings array when nothing applies.';
+/** Strips ANSI escape sequences and carriage returns. */
+export function stripAnsi(s) {
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, '').replace(/\x1b\][^\x07]*\x07/g, '').replace(/\r/g, '');
+}
+/**
+ * Finds the last balanced top-level JSON object in free text that parses and
+ * has a `findings` array. Models wrap JSON in prose or fences; scanning for
+ * balanced braces (string-aware) is more reliable than one greedy regex.
+ */
+export function extractReviewJson(text) {
+    const candidates = [];
+    for (let start = text.indexOf('{'); start !== -1; start = text.indexOf('{', start + 1)) {
+        let depth = 0;
+        let inStr = false;
+        let esc = false;
+        for (let i = start; i < text.length; i++) {
+            const ch = text[i];
+            if (inStr) {
+                if (esc)
+                    esc = false;
+                else if (ch === '\\')
+                    esc = true;
+                else if (ch === '"')
+                    inStr = false;
+                continue;
+            }
+            if (ch === '"')
+                inStr = true;
+            else if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                depth--;
+                if (depth === 0) {
+                    candidates.push(text.slice(start, i + 1));
+                    break;
+                }
+            }
+        }
+    }
+    for (let i = candidates.length - 1; i >= 0; i--) {
+        try {
+            const obj = JSON.parse(candidates[i]);
+            if (obj && Array.isArray(obj.findings))
+                return obj;
+        }
+        catch { /* try the next one */ }
+    }
+    throw new Error('no JSON object with a "findings" array in reviewer output');
+}
+function normSeverity(v) {
+    const s = String(v ?? '').toLowerCase();
+    if (s === 'critical' || s === 'high')
+        return 'high';
+    if (s === 'medium' || s === 'moderate')
+        return 'medium';
+    return 'low';
+}
+/** The rules file uses five categories; the result schema keeps two. */
+function normCategory(v) {
+    return String(v ?? '').toLowerCase().includes('secur') ? 'security' : 'quality';
+}
+function normLine(v) {
+    const n = typeof v === 'number' ? v : parseInt(String(v ?? ''), 10);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
+}
+/** Converts the model's JSON into the shared schema. Tolerates missing fields. */
+export function normalizeReview(obj, model) {
+    const findings = obj.findings
+        .filter((f) => f && typeof f === 'object')
+        .map((f) => ({
+        severity: normSeverity(f.severity),
+        category: normCategory(f.category),
+        rule: String(f.rule || f.category || 'unspecified').slice(0, 200),
+        file: String(f.file || ''),
+        line: normLine(f.line),
+        message: String(f.message || '').slice(0, 2000),
+    }));
+    const score = typeof obj.score === 'number' && Number.isFinite(obj.score) ? obj.score : null;
+    const summary = typeof obj.summary === 'string' ? obj.summary.slice(0, 500) : null;
+    return { findings, summary, score, model };
+}
+//# sourceMappingURL=types.js.map

package/dist/src/codewatch/reviewers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/codewatch/reviewers/types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;AAGxD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAK,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AA6CD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAC1B,4DAA4D;IAC5D,4OAA4O;IAC5O,mDAAmD,CAAC;AAEtD,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,4CAA4C;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,GAAG;oBAAE,GAAG,GAAG,KAAK,CAAC;qBAChB,IAAI,EAAE,KAAK,IAAI;oBAAE,GAAG,GAAG,IAAI,CAAC;qBAC5B,IAAI,EAAE,KAAK,GAAG;oBAAE,KAAK,GAAG,KAAK,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,IAAI,CAAC;iBACxB,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpD,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAQ,EAAE,KAAoB;IAC5D,MAAM,QAAQ,GAAe,GAAG,CAAC,QAAkB;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QACjE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;KAChD,CAAC,CAAC,CAAC;IACN,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC"}

package/dist/src/codewatch/rules.d.ts

@@ -0,0 +1,12 @@
+/** Where install-eval-harness has always put the review rules for kiro-cli. */
+export declare const KIRO_STEERING_RULES = ".kiro/steering/code-review.md";
+/**
+ * Ensures the tool-neutral rule set exists at `.prism/review/rules.md`.
+ *
+ * Seed order: keep an existing rules.md; else copy the repo's
+ * `.kiro/steering/code-review.md` (a team may have customised it, and CI
+ * reviewed against it until now); else the bundled default -- the same file
+ * install-eval-harness ships as steering. Returns what happened.
+ */
+export declare function ensureRulesFile(gitRoot: string, bundledRulesPath: string): 'kept' | 'from-steering' | 'from-bundle';
+//# sourceMappingURL=rules.d.ts.map

package/dist/src/codewatch/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/codewatch/rules.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,aAAa,CAWnH"}

package/dist/src/codewatch/rules.js

@@ -0,0 +1,27 @@
+import { copyFileSync, existsSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { RULES_PATH } from './config.js';
+/** Where install-eval-harness has always put the review rules for kiro-cli. */
+export const KIRO_STEERING_RULES = '.kiro/steering/code-review.md';
+/**
+ * Ensures the tool-neutral rule set exists at `.prism/review/rules.md`.
+ *
+ * Seed order: keep an existing rules.md; else copy the repo's
+ * `.kiro/steering/code-review.md` (a team may have customised it, and CI
+ * reviewed against it until now); else the bundled default -- the same file
+ * install-eval-harness ships as steering. Returns what happened.
+ */
+export function ensureRulesFile(gitRoot, bundledRulesPath) {
+    const dest = resolve(gitRoot, RULES_PATH);
+    if (existsSync(dest))
+        return 'kept';
+    mkdirSync(dirname(dest), { recursive: true });
+    const steering = resolve(gitRoot, KIRO_STEERING_RULES);
+    if (existsSync(steering)) {
+        copyFileSync(steering, dest);
+        return 'from-steering';
+    }
+    copyFileSync(bundledRulesPath, dest);
+    return 'from-bundle';
+}
+//# sourceMappingURL=rules.js.map

package/dist/src/codewatch/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/codewatch/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,gBAAwB;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/src/commands/_top/dashboard.d.ts

@@ -0,0 +1,17 @@
+export declare function parsePort(v: string | undefined): number;
+declare const _default: {
+    description: string;
+    options: {
+        flags: string;
+        description: string;
+    }[];
+    action(opts: {
+        json?: boolean;
+        all?: boolean;
+        root?: string;
+        port?: string;
+        open?: boolean;
+    }): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=dashboard.d.ts.map