@qwen-code/qwen-code 0.21.1 → 0.21.2

package/chunks/{chunk-7BAU433D.js → chunk-DEEABGH2.js}

@@ -2,16 +2,13 @@
 "use strict";
 import {
   listCommand
-} from "./chunk-EVKE2FZL.js";
+} from "./chunk-KXDONCPU.js";
 import {
   getErrorMessage as getErrorMessage2
-} from "./chunk-T3O2B4XO.js";
-import {
-  serveCommand
-} from "./chunk-S4WJVPZW.js";
+} from "./chunk-CU47KXB5.js";
 import {
   ObservedChannelContactStore
-} from "./chunk-LGAOC3ZS.js";
+} from "./chunk-675H6PLP.js";
 import {
   escapeAnsiCtrlCodes
 } from "./chunk-YDLJGZHL.js";
@@ -24,14 +21,17 @@ import {
 import {
   isLoopbackBind
 } from "./chunk-RXFQM6FQ.js";
+import {
+  serveCommand
+} from "./chunk-V4XNUDPE.js";
 import {
   resolvePath
-} from "./chunk-ZHBO7WVX.js";
+} from "./chunk-CNTR4GR6.js";
 import {
   collectProviderModelsForProtocol,
   getAuthTypeFromEnv,
   resolveCliGenerationConfig
-} from "./chunk-KCO4FLFJ.js";
+} from "./chunk-6TAASXWL.js";
 import {
   resolveSkillSettings
 } from "./chunk-Z4X5MTRT.js";
@@ -50,17 +50,17 @@ import {
   registerToolCallDispatch,
   selectFirstModel,
   sessionsPath
-} from "./chunk-BNWB5CYE.js";
+} from "./chunk-D6MDRSZ6.js";
 import {
   getExtensionManager,
   requestChoicePluginNonInteractive,
   requestConsentNonInteractive,
   requestConsentOrFail,
   resolveExtensionCommandScope
-} from "./chunk-5MKRTI4T.js";
+} from "./chunk-A7Y5H4TX.js";
 import {
   parseChannelConfig
-} from "./chunk-2XSLTRFZ.js";
+} from "./chunk-I5BT7ADR.js";
 import {
   findCliEntryPath
 } from "./chunk-V6WHFGST.js";
@@ -91,7 +91,7 @@ import {
 import {
   normalizeWorkerDiagnostic,
   sanitizeWorkerDiagnostic
-} from "./chunk-GZ3RCT54.js";
+} from "./chunk-6MPDY6ZG.js";
 import {
   normalizeServeChannelSelection
 } from "./chunk-ALMR3E6Q.js";
@@ -104,14 +104,14 @@ import {
   signalService,
   waitForExit,
   writeServiceInfo
-} from "./chunk-4G2BISNC.js";
+} from "./chunk-IIUGIWWY.js";
 import {
   DEFAULT_BASE_URL,
   buildHeaders,
   clearAccount,
   loadAccount,
   saveAccount
-} from "./chunk-GEBV2JGB.js";
+} from "./chunk-ZPZ7ZJEE.js";
 import {
   AcpBridge,
   ChannelLoopScheduler,
@@ -122,43 +122,44 @@ import {
   isChannelProactiveDeliveryError,
   sanitizeLogText,
   sanitizePromptText
-} from "./chunk-7I5GTCT4.js";
+} from "./chunk-JCJ7LKNA.js";
 import {
   assembleMcpServers,
   getPendingGatedMcpServers,
   mcpCommand
-} from "./chunk-6RPMI2AB.js";
+} from "./chunk-KR32NIAN.js";
 import {
   loadSettings
-} from "./chunk-EIF3FXTB.js";
+} from "./chunk-W3UKBMSI.js";
 import {
   detectSystemLanguage,
   getCurrentLanguage,
   initializeI18n,
   resolveLanguageSetting,
   t
-} from "./chunk-TCIFAA7K.js";
+} from "./chunk-3F2WDAV6.js";
 import {
   loadEnvironment
-} from "./chunk-2N7CODY5.js";
+} from "./chunk-EU5TBFJI.js";
+import {
+  isWorkspaceTrusted
+} from "./chunk-P755N4CS.js";
+import {
+  require_strip_json_comments
+} from "./chunk-ALGGS7UH.js";
 import {
   hideBin,
   yargs_default
 } from "./chunk-XFSFZCM5.js";
 import {
   getCliVersion
-} from "./chunk-VYOXCEPJ.js";
+} from "./chunk-2KKCCLPT.js";
 import {
   getPackageJson
 } from "./chunk-VJNBRRZG.js";
-import {
-  isWorkspaceTrusted
-} from "./chunk-Q43KPN7X.js";
-import {
-  require_strip_json_comments
-} from "./chunk-ALGGS7UH.js";
 import {
   writeStderrLine,
+  writeStderrLineSafe,
   writeStdoutLine
 } from "./chunk-OWAK7LMW.js";
 import {
@@ -194,7 +195,7 @@ import {
   unquoteCStylePath,
   updateChannelMemoryEntry,
   updateSetting
-} from "./chunk-X5WNMMIA.js";
+} from "./chunk-54YCNSK5.js";
 import {
   nextFireTime,
   parseCron
@@ -202,27 +203,27 @@ import {
 import {
   parseBooleanEnvFlag,
   resolveTelemetrySettings
-} from "./chunk-75MIQ3LV.js";
+} from "./chunk-Z3S5EMOW.js";
 import {
   getAllGeminiMdFilenames,
   setGeminiMdFilename
-} from "./chunk-PT722TDT.js";
+} from "./chunk-DUNI4EBW.js";
 import {
   SchemaValidator,
   ToolNames
-} from "./chunk-Y6AXW2OG.js";
+} from "./chunk-MM7TH7ZM.js";
 import {
   DEFAULT_QWEN_EMBEDDING_MODEL
-} from "./chunk-VCPIZRYH.js";
+} from "./chunk-HIVKI6O6.js";
 import {
   isTlsVerificationDisabled
-} from "./chunk-WZRWHXFE.js";
+} from "./chunk-Q3T5KA2V.js";
 import {
   atomicWriteFileSync
-} from "./chunk-7XATOOE7.js";
+} from "./chunk-HC45LTEN.js";
 import {
   recordChannelMemoryRecallMetrics
-} from "./chunk-BGTQCTQW.js";
+} from "./chunk-QARJNL2V.js";
 import {
   FatalConfigError,
   FatalSandboxError,
@@ -230,7 +231,7 @@ import {
   createDebugLogger,
   getErrorMessage,
   isNodeError
-} from "./chunk-UHUSJ6X7.js";
+} from "./chunk-E2BHWIDT.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -363,10 +364,10 @@ var require_command_exists = __commonJS({
     module.exports = /* @__PURE__ */ __name(function commandExists2(commandName, callback) {
       var cleanedCommandName = cleanInput(commandName);
       if (!callback && typeof Promise !== "undefined") {
-        return new Promise(function(resolve14, reject) {
+        return new Promise(function(resolve15, reject) {
           commandExists2(commandName, function(error, output) {
             if (output) {
-              resolve14(commandName);
+              resolve15(commandName);
             } else {
               reject(error);
             }
@@ -2622,7 +2623,7 @@ var stopCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-Q2AB5Z23.js");
+        const sdk = await import("./daemon-PCNCI5YU.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -2808,7 +2809,7 @@ var statusCommand = {
     if (argv["daemon-url"]) {
       const token = argv.token ?? process.env[QWEN_SERVER_TOKEN_ENV] ?? process.env[QWEN_DAEMON_TOKEN_ENV];
       try {
-        const sdk = await import("./daemon-Q2AB5Z23.js");
+        const sdk = await import("./daemon-PCNCI5YU.js");
         const client = new sdk.DaemonClient({
           baseUrl: argv["daemon-url"],
           ...token ? { token } : {}
@@ -2919,7 +2920,7 @@ var reloadCommand = {
     const token = resolveToken(argv.token);
     let sdk;
     try {
-      sdk = await import("./daemon-Q2AB5Z23.js");
+      sdk = await import("./daemon-PCNCI5YU.js");
     } catch (err) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(err)}`
@@ -2999,7 +3000,7 @@ var setCommand2 = {
     const selection = names[0] === "all" ? { mode: "all" } : { mode: "names", names };
     let sdk;
     try {
-      sdk = await import("./daemon-Q2AB5Z23.js");
+      sdk = await import("./daemon-PCNCI5YU.js");
     } catch (error) {
       writeStderrLine(
         `[Channel] Failed to load daemon SDK: ${safeChannelCommandErrorMessage(error)}`
@@ -3125,7 +3126,7 @@ function createDaemonChannelBridgeFacade(bridge, opts) {
 }
 __name(createDaemonChannelBridgeFacade, "createDaemonChannelBridgeFacade");
 async function loadDaemonSdk() {
-  return await import("./daemon-Q2AB5Z23.js");
+  return await import("./daemon-PCNCI5YU.js");
 }
 __name(loadDaemonSdk, "loadDaemonSdk");
 function selectedChannelNames(channelsConfig, selection) {
@@ -3172,12 +3173,12 @@ async function abortableStartup(value, signal) {
   const promise = Promise.resolve(value);
   if (!signal) return await promise;
   if (signal.aborted) throw startupAbortError();
-  return await new Promise((resolve14, reject) => {
+  return await new Promise((resolve15, reject) => {
     const onAbort = /* @__PURE__ */ __name(() => {
       reject(startupAbortError());
     }, "onAbort");
     signal.addEventListener("abort", onAbort, { once: true });
-    promise.then(resolve14, reject).finally(() => {
+    promise.then(resolve15, reject).finally(() => {
       signal.removeEventListener("abort", onAbort);
     });
   });
@@ -3584,7 +3585,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
   if (!send) {
     return Promise.reject(new Error("Channel worker IPC is unavailable."));
   }
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve15, reject) => {
     let settled = false;
     let unsubscribeMessage = /* @__PURE__ */ __name(() => {
     }, "unsubscribeMessage");
@@ -3598,7 +3599,7 @@ function reportStartupToSupervisor(message, signal, subscribeMessage = (listener
       settled = true;
       cleanup();
       if (error) reject(error);
-      else resolve14();
+      else resolve15();
     }, "finish");
     const onMessage = /* @__PURE__ */ __name((value) => {
       if (isChannelStartupReportAckMessage(value)) {
@@ -3846,8 +3847,8 @@ var daemonWorkerCommand = {
       let shuttingDown = false;
       let exitCode = 0;
       let finish;
-      const finished = new Promise((resolve14) => {
-        finish = resolve14;
+      const finished = new Promise((resolve15) => {
+        finish = resolve15;
       });
       const shutdown = /* @__PURE__ */ __name(async (reason) => {
         if (shuttingDown) {
@@ -3875,8 +3876,8 @@ var daemonWorkerCommand = {
                   ...activeChannelDeliveries.values(),
                   ...activeWebhookTasks.values()
                 ]),
-                new Promise((resolve14) => {
-                  const timer = setTimeout(resolve14, WORKER_SHUTDOWN_DRAIN_MS);
+                new Promise((resolve15) => {
+                  const timer = setTimeout(resolve15, WORKER_SHUTDOWN_DRAIN_MS);
                   timer.unref();
                 })
               ]);
@@ -6683,6 +6684,7 @@ function unmarkedComments(comments) {
 __name(unmarkedComments, "unmarkedComments");
 
 // packages/cli/src/commands/review/compose-review.ts
+var LOW_SIGNAL_SRC_DIFF_LINES = 100;
 function withMarker(line) {
   return line.startsWith(CRITICAL_PREFIX) ? line : `${CRITICAL_PREFIX} ${line}`;
 }
@@ -6927,6 +6929,19 @@ function composeReview(input) {
     downgraded = true;
     downgradedFrom = "Request changes";
   }
+  let lowSignal = null;
+  if (event === "APPROVE" && input.planPath) {
+    try {
+      const plan = JSON.parse(
+        readFileSync8(input.planPath, "utf8")
+      );
+      const src = Number(plan.srcDiffLines ?? 0);
+      if (src > LOW_SIGNAL_SRC_DIFF_LINES) {
+        lowSignal = { agents: requiredAgents(plan).length, srcDiffLines: src };
+      }
+    } catch {
+    }
+  }
   const footer = `_\u2014 ${modelId} via Qwen Code /review_`;
   const bilingual = bilingualFromPlan(input.planPath, input.prBodyFetcher);
   const render = /* @__PURE__ */ __name((parts, sep4) => {
@@ -7075,7 +7090,8 @@ ${footer}`;
       cappedBy,
       downgraded,
       downgradedFrom,
-      remediation
+      remediation,
+      lowSignal
     };
   }
   if (event === "APPROVE") {
@@ -7092,7 +7108,8 @@ ${footer}`;
       cappedBy,
       downgraded,
       downgradedFrom,
-      remediation
+      remediation,
+      lowSignal
     };
   }
   const clauses = [];
@@ -7146,7 +7163,8 @@ ${footer}`;
     cappedBy,
     downgraded,
     downgradedFrom,
-    remediation
+    remediation,
+    lowSignal
   };
 }
 __name(composeReview, "composeReview");
@@ -7400,6 +7418,9 @@ function verdictLine(r) {
   } else if (r.downgraded) {
     line += " \u2014 downgraded by a presubmit check";
   }
+  if (r.event === "APPROVE" && r.lowSignal) {
+    line += ` \u2014 low signal: none of the ${r.lowSignal.agents} review agents reported a finding on a non-trivial diff (${r.lowSignal.srcDiffLines} source diff lines)`;
+  }
   return line;
 }
 __name(verdictLine, "verdictLine");
@@ -10390,7 +10411,7 @@ function buildRoleBrief(report, role, opts = {}) {
     if (typeof base === "string" && base && pr !== void 0 && opts.planPath) {
       parts.push(
         "",
-        "**Then run the test-efficacy probe.** A green suite says the tests pass. It does not say they would have failed had the change been wrong, and those are different claims:",
+        "**Then run the test-efficacy probe.** A green suite says the tests pass. It does not say they would have failed had the change been wrong, and those are different claims. Give this call `timeout: 600000` too \u2014 besides the revert probe it runs up to 8 single-statement deletion mutants, each a suite run, and it budgets itself to finish inside that ceiling:",
         "",
         "```bash",
         `"\${QWEN_CODE_CLI:-qwen}" review test-efficacy ${resolve11(opts.planPath)} \\`,
@@ -10399,7 +10420,7 @@ function buildRoleBrief(report, role, opts = {}) {
         `  --out ${resolve11(dirname12(opts.planPath), `qwen-review-pr-${pr}-efficacy.json`)}`,
         "```",
         "",
-        'Read its `findings[]`. `kind: "unreachable"` is a test the project\'s test command never collects \u2014 it did not run here and it does not run in CI. `kind: "inert"` is a test that **still passed with the change reverted**: it is green whether or not the feature exists, so it cannot catch a regression in it. Report each as a **Suggestion** with `Source: [test]`, saying plainly which behaviour ships unprotected. **`inconclusive` is not a finding** \u2014 reverting the source often breaks the test\'s own compile, and that is not the test catching anything. Note it and move on.'
+        'Read its `findings[]`. `kind: "unreachable"` is a test the project\'s test command never collects \u2014 it did not run here and it does not run in CI. `kind: "inert"` is a test that **still passed with the change reverted**: it is green whether or not the feature exists, so it cannot catch a regression in it. `kind: "mutant-survived"` is a single safety statement the diff added (a `.clear()`, an `.abort(\u2026)`, a reset-to-empty) that was **deleted and every affected test stayed green** \u2014 no test in the diff fails when it is removed, which the whole-file revert cannot see when the file\'s other, tested behaviours mask it. Report each as a **Suggestion** with `Source: [test]`, saying plainly which behaviour has no test in this diff that would catch its removal. **`inconclusive` is not a finding** \u2014 for probes and mutants alike, reverting or mutating the source often breaks the test\'s own compile, and that is not the test catching anything. Mutants counted in `mutants.skippedForBudget`, `mutants.skippedForCap`, or `mutants.skippedForBaseline` never ran \u2014 not findings either. `mutants.note`, when present, explains why no mutants ran at all. Note them and move on.'
       );
     }
   }
@@ -10880,7 +10901,13 @@ var agentPromptCommand = {
 // packages/cli/src/commands/review/build-test.ts
 init_esbuild_shims();
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync16, rmSync as rmSync4, writeFileSync as writeFileSync15 } from "node:fs";
+import {
+  existsSync as existsSync5,
+  readFileSync as readFileSync16,
+  rmSync as rmSync4,
+  statfsSync,
+  writeFileSync as writeFileSync15
+} from "node:fs";
 import { join as join12, resolve as resolve12 } from "node:path";
 
 // packages/cli/src/commands/review/lib/workspaces.ts
@@ -11081,6 +11108,18 @@ ${rescued.join("\n")}
   return s.slice(0, KEEP_HEAD) + marker + s.slice(-KEEP_TAIL);
 }
 __name(trimOutput, "trimOutput");
+var INSTALL_MIN_FREE_BYTES = 3 * 1024 ** 3;
+var BUILD_MIN_FREE_BYTES = 1024 ** 3;
+function freeDiskBytes(dir) {
+  try {
+    const s = statfsSync(dir);
+    return s.bavail * s.bsize;
+  } catch {
+    return null;
+  }
+}
+__name(freeDiskBytes, "freeDiskBytes");
+var gib = /* @__PURE__ */ __name((bytes) => (bytes / 1024 ** 3).toFixed(1), "gib");
 function buildRunEnv(base = process.env) {
   return {
     ...base,
@@ -11226,7 +11265,14 @@ function runBuildTest(args) {
     );
   }
   if (args.install && npmLock && !installComplete()) {
-    const install = exec("npm ci --no-audit --no-fund", root, perCommandMs);
+    const installCmd = "npm ci --no-audit --no-fund";
+    const free = freeDiskBytes(root);
+    if (free !== null && free < INSTALL_MIN_FREE_BYTES) {
+      results.ok = false;
+      results.note = `Insufficient disk space (${gib(free)}G free, need ~${gib(INSTALL_MIN_FREE_BYTES)}G): skipped \`${installCmd}\`, so nothing could be built or tested. This is an environment issue, not a code finding \u2014 report it as informational.`;
+      return results;
+    }
+    const install = exec(installCmd, root, perCommandMs);
     results.install = install;
     if (install.timedOut) results.timedOut.push(install.command);
     if (install.timedOut) {
@@ -11245,6 +11291,12 @@ function runBuildTest(args) {
       return results;
     }
   }
+  const freeForBuild = freeDiskBytes(root);
+  if (freeForBuild !== null && freeForBuild < BUILD_MIN_FREE_BYTES) {
+    results.ok = false;
+    results.note = `Insufficient disk space (${gib(freeForBuild)}G free, need ~${gib(BUILD_MIN_FREE_BYTES)}G): skipped the build and tests rather than fill the disk mid-compile. This is an environment issue, not a code finding \u2014 report it as informational.`;
+    return results;
+  }
   const alsoBuild = [];
   let set = buildSetFor(affected, packages);
   const built = /* @__PURE__ */ new Set();
@@ -11813,6 +11865,288 @@ function planTestEfficacy(files, workspaceGlobs) {
   };
 }
 __name(planTestEfficacy, "planTestEfficacy");
+var MAX_MUTANTS = 8;
+var PROBE_RUN_TIMEOUT_MS = 3e5;
+var TOTAL_BUDGET_MS = 54e4;
+var RUN_ESTIMATE_MARGIN_MS = 15e3;
+var SAFETY_VERB_RE = /\.(?:clear|delete|reset|abort|removeListener|unref)\(|=\s*\[\]\s*;$|=\s*new\s+(?:Map|Set|WeakMap|WeakSet)(?:<[^=;]*>)?\(\)\s*;$/;
+var MUTANT_SOURCE_RE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
+var DECLARATION_FILE_RE = /\.d\.[cm]?ts$/;
+var NON_STATEMENT_START_RE = /^(?:const|let|var|function|class|interface|type|enum|import|export|return|throw|yield|if|for|while|switch|do|else|try|catch|finally|case|default|break|continue|async|public|private|protected|readonly|static)\b/;
+function skipTemplateOnLine(line, start) {
+  let depth = 0;
+  for (let i = start + 1; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "\\") {
+      i++;
+    } else if (depth === 0) {
+      if (ch === "`") return i;
+      if (ch === "$" && line[i + 1] === "{") {
+        depth = 1;
+        i++;
+      }
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+    }
+  }
+  return -1;
+}
+__name(skipTemplateOnLine, "skipTemplateOnLine");
+function scanLineDelimiters(line) {
+  let paren = 0;
+  let bracket = 0;
+  let brace = 0;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "`") {
+      const close = skipTemplateOnLine(line, i);
+      if (close < 0) return null;
+      i = close;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      i++;
+      while (i < line.length && line[i] !== ch) {
+        if (line[i] === "\\") i++;
+        i++;
+      }
+      if (i >= line.length) return null;
+      continue;
+    }
+    if (ch === "/" && line[i + 1] === "/") break;
+    if (ch === "/" && line[i + 1] === "*") {
+      const close = line.indexOf("*/", i + 2);
+      if (close < 0) return null;
+      i = close + 1;
+      continue;
+    }
+    if (ch === "(") paren++;
+    else if (ch === ")") paren--;
+    else if (ch === "[") bracket++;
+    else if (ch === "]") bracket--;
+    else if (ch === "{") brace++;
+    else if (ch === "}") brace--;
+    if (paren < 0 || bracket < 0 || brace < 0) return null;
+  }
+  return { paren, bracket, brace };
+}
+__name(scanLineDelimiters, "scanLineDelimiters");
+function scanFileLines(content) {
+  const inLiteral = [];
+  const codeLines = [];
+  let state = "code";
+  const templates = [];
+  let buf = "";
+  let lineStart = 0;
+  let rawLine = false;
+  const inTemplateOrComment = /* @__PURE__ */ __name(() => state !== "code" || templates.length > 0, "inTemplateOrComment");
+  inLiteral.push(inTemplateOrComment());
+  const endLine = /* @__PURE__ */ __name((i) => {
+    codeLines.push(rawLine ? content.slice(lineStart, i).trim() : buf.trim());
+    buf = "";
+    rawLine = false;
+    lineStart = i + 1;
+  }, "endLine");
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    if (ch === "\n") {
+      endLine(i);
+      inLiteral.push(inTemplateOrComment());
+      continue;
+    }
+    if (templates.length > 0) {
+      const top = templates.length - 1;
+      if (ch === "\\" && content[i + 1] !== "\n") {
+        i++;
+      } else if (templates[top] < 0) {
+        if (ch === "`") {
+          templates.pop();
+          if (templates.length === 0) buf += "`";
+        } else if (ch === "$" && content[i + 1] === "{") {
+          templates[top] = 0;
+          i++;
+        }
+      } else if (ch === "`") {
+        templates.push(-1);
+      } else if (ch === "{") {
+        templates[top]++;
+      } else if (ch === "}") {
+        if (templates[top] === 0) templates[top] = -1;
+        else templates[top]--;
+      }
+      continue;
+    }
+    if (state === "comment") {
+      if (ch === "*" && content[i + 1] === "/") {
+        state = "code";
+        i++;
+      }
+      continue;
+    }
+    if (ch === "`") {
+      buf += "`";
+      templates.push(-1);
+    } else if (ch === "/" && content[i + 1] === "*") {
+      state = "comment";
+      i++;
+    } else if (ch === "/" && content[i + 1] === "/") {
+      while (i + 1 < content.length && content[i + 1] !== "\n") i++;
+    } else if (ch === '"' || ch === "'") {
+      let k = i + 1;
+      while (k < content.length && content[k] !== ch && content[k] !== "\n") {
+        if (content[k] === "\\" && content[k + 1] !== "\n") k++;
+        k++;
+      }
+      if (k < content.length && content[k] === ch) {
+        buf += ch + ch;
+        i = k;
+      } else {
+        rawLine = true;
+        i = k < content.length && content[k] === "\n" ? k - 1 : k;
+      }
+    } else {
+      buf += ch;
+    }
+  }
+  endLine(content.length);
+  return {
+    inLiteral,
+    codeLines,
+    endState: templates.length > 0 ? "template" : state
+  };
+}
+__name(scanFileLines, "scanFileLines");
+function insideClassBody(codeLines, idx) {
+  let depth = 0;
+  for (let j = idx - 1; j >= 0; j--) {
+    const code = codeLines[j];
+    for (let i = code.length - 1; i >= 0; i--) {
+      const ch = code[i];
+      if (ch === "}") depth++;
+      else if (ch === "{") {
+        if (depth === 0) {
+          if (/\bclass\b/.test(code.slice(0, i))) return true;
+          for (let k = j - 1; k >= 0; k--) {
+            const prev = codeLines[k];
+            if (prev.includes(";")) break;
+            const d = scanLineDelimiters(prev);
+            if (!d || d.brace !== 0) break;
+            if (/\bclass\b/.test(prev)) return true;
+          }
+          return false;
+        }
+        depth--;
+      }
+    }
+  }
+  return false;
+}
+__name(insideClassBody, "insideClassBody");
+function isRemovableStatement(lines2, codeLines, idx) {
+  const t2 = (lines2[idx] ?? "").trim();
+  if (!(codeLines[idx] ?? "").endsWith(";")) return false;
+  if ((codeLines[idx] ?? "").slice(0, -1).includes(";")) return false;
+  if (!/^(?:await\s+)?[A-Za-z_$]/.test(t2)) return false;
+  if (NON_STATEMENT_START_RE.test(t2)) return false;
+  if (insideClassBody(codeLines, idx)) return false;
+  const depth = scanLineDelimiters(t2);
+  if (!depth || depth.paren !== 0 || depth.bracket !== 0 || depth.brace !== 0) {
+    return false;
+  }
+  let j = idx - 1;
+  while (j >= 0 && codeLines[j] === "") j--;
+  if (j < 0) return true;
+  return /[;{}]$/.test(codeLines[j]);
+}
+__name(isRemovableStatement, "isRemovableStatement");
+function selectMutants(files, cap = MAX_MUTANTS) {
+  const preferred = [];
+  const rest = [];
+  const derailed = [];
+  for (const f of files) {
+    const lines2 = f.content.split("\n");
+    const { inLiteral, codeLines, endState } = scanFileLines(f.content);
+    if (endState !== "code") {
+      derailed.push(f.file);
+      continue;
+    }
+    for (const n of [...f.addedLines].sort((a, b) => a - b)) {
+      const raw = lines2[n - 1];
+      if (raw === void 0) continue;
+      const t2 = raw.trim();
+      if (!SAFETY_VERB_RE.test(codeLines[n - 1] ?? "")) continue;
+      if (inLiteral[n - 1]) continue;
+      if (!isRemovableStatement(lines2, codeLines, n - 1)) continue;
+      (f.hasNewTests ? preferred : rest).push({
+        file: f.file,
+        line: n,
+        statement: t2
+      });
+    }
+  }
+  const eligible = [...preferred, ...rest];
+  return {
+    selected: eligible.slice(0, cap),
+    skippedForCap: Math.max(0, eligible.length - cap),
+    derailed
+  };
+}
+__name(selectMutants, "selectMutants");
+function parseAddedLines(diffText) {
+  const added = /* @__PURE__ */ new Map();
+  let file = null;
+  let inHunk = false;
+  let newLine = 0;
+  for (const line of diffText.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      inHunk = false;
+      continue;
+    }
+    if (!inHunk && line.startsWith("+++ ")) {
+      const p = line.slice(4).split("	")[0];
+      file = p === "/dev/null" ? null : p.replace(/^b\//, "");
+      continue;
+    }
+    const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (m) {
+      newLine = Number(m[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk || !file) continue;
+    if (line.startsWith("+")) {
+      const list = added.get(file);
+      if (list) list.push(newLine);
+      else added.set(file, [newLine]);
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return added;
+}
+__name(parseAddedLines, "parseAddedLines");
+function hasCollocatedNewTest(file, testPaths) {
+  const stem = file.replace(/\.[^./]+$/, "");
+  return testPaths.some((t2) => {
+    const tstem = t2.replace(/\.[^./]+$/, "");
+    return tstem === `${stem}.test` || tstem === `${stem}.spec`;
+  });
+}
+__name(hasCollocatedNewTest, "hasCollocatedNewTest");
+function classifyMutantRun(perFile) {
+  if (perFile.some((r) => r.verdict === "gated")) return "killed";
+  if (perFile.length === 0 || perFile.some((r) => r.verdict === "inconclusive"))
+    return "inconclusive";
+  return "survived";
+}
+__name(classifyMutantRun, "classifyMutantRun");
+function fitsAnotherMutantRun(remainingMs, estimatedRunMs) {
+  return remainingMs >= estimatedRunMs;
+}
+__name(fitsAnotherMutantRun, "fitsAnotherMutantRun");
 function classifyProbeRun(exitCode, stdout, probes, stderr = "") {
   let parsed;
   const start = stdout.indexOf("{");
@@ -11885,6 +12219,19 @@ function gitOut(cwd, ...args) {
   return (r.stdout ?? "").trim();
 }
 __name(gitOut, "gitOut");
+function gitCapture(cwd, ...args) {
+  const r = spawnSync3("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (r.error) throw r.error;
+  if (r.status !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${r.stderr ?? ""}`);
+  }
+  return r.stdout ?? "";
+}
+__name(gitCapture, "gitCapture");
 function existsAtRev(cwd, rev, path3) {
   const r = spawnSync3("git", ["cat-file", "-e", `${rev}:${path3}`], { cwd });
   if (r.error) throw r.error;
@@ -11931,7 +12278,61 @@ function probeCleanupFailureDetail(probeTree, removeError, sweepStderr) {
   return `could not remove probe worktree ${probeTree}${why ? `: ${why}` : ""}`;
 }
 __name(probeCleanupFailureDetail, "probeCleanupFailureDetail");
+function runProbeSuite(probeTree, probes, deadlineAt, now = Date.now) {
+  const started = now();
+  const timeout = deadlineAt !== void 0 ? Math.max(1, Math.min(PROBE_RUN_TIMEOUT_MS, deadlineAt - started)) : PROBE_RUN_TIMEOUT_MS;
+  const r = spawnSync3("npx", ["vitest", "run", "--reporter=json", ...probes], {
+    cwd: probeTree,
+    encoding: "utf8",
+    timeout,
+    // Vitest's JSON reporter on a large suite easily exceeds spawnSync's
+    // 1 MiB default stdout buffer, which returns ENOBUFS and turns every
+    // probe `inconclusive`. Match the 64 MiB ceiling the gh wrapper uses.
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (r.error) throw r.error;
+  if (r.signal) {
+    throw new Error(
+      `runner killed by ${r.signal}${r.signal === "SIGTERM" ? ` (probe timed out after ${Math.round(timeout / 1e3)}s)` : ""}`
+    );
+  }
+  return {
+    perFile: classifyProbeRun(
+      r.status ?? 1,
+      `${r.stdout ?? ""}`,
+      probes,
+      `${r.stderr ?? ""}`
+    ),
+    ms: now() - started
+  };
+}
+__name(runProbeSuite, "runProbeSuite");
+function runOneMutant(probeTree, mutant, probes, deadlineAt, now = Date.now) {
+  const abs = join14(probeTree, mutant.file);
+  const original = readFileSync18(abs, "utf8");
+  const lines2 = original.split("\n");
+  if ((lines2[mutant.line - 1] ?? "").trim() !== mutant.statement) {
+    return {
+      ...mutant,
+      verdict: "inconclusive",
+      detail: "the probe tree does not match the selected statement at this line \u2014 nothing was mutated"
+    };
+  }
+  lines2.splice(mutant.line - 1, 1);
+  try {
+    writeFileSync16(abs, lines2.join("\n"), "utf8");
+    const { perFile } = runProbeSuite(probeTree, probes, deadlineAt, now);
+    const verdict = classifyMutantRun(perFile);
+    const detail = verdict === "killed" ? "the suite went red with this statement deleted \u2014 a test catches its removal" : verdict === "survived" ? "every affected test still PASSED with this statement deleted \u2014 no test fails when it is removed" : "the mutated tree produced no clean verdict (likely a compile or import error) \u2014 not evidence either way";
+    return { ...mutant, verdict, detail };
+  } finally {
+    writeFileSync16(abs, original, "utf8");
+  }
+}
+__name(runOneMutant, "runOneMutant");
 async function runTestEfficacy(args) {
+  const now = args.now ?? Date.now;
+  const startedAt = now();
   const { report, worktree, base, out } = args;
   const plan = JSON.parse(readFileSync18(report, "utf8"));
   const rootPkg = JSON.parse(
@@ -11953,8 +12354,62 @@ async function runTestEfficacy(args) {
   }
   const results = [];
   let cleanupFailure;
+  const mutantResults = [];
+  let mutantsSkippedForBudget = 0;
+  let mutantsSkippedForCap = 0;
+  let mutantsSkippedForBaseline = 0;
+  let mutantsNote;
+  const noteMutants = /* @__PURE__ */ __name((note) => {
+    mutantsNote = mutantsNote ? `${mutantsNote}; ${note}` : note;
+  }, "noteMutants");
   if (probes.length > 0 && revert.length > 0) {
     const headSha = gitOut(worktree, "rev-parse", "HEAD");
+    let candidates = [];
+    try {
+      const mutantFiles = revert.filter(
+        (p) => MUTANT_SOURCE_RE.test(p) && !DECLARATION_FILE_RE.test(p)
+      );
+      if (mutantFiles.length > 0) {
+        const added = parseAddedLines(
+          gitCapture(
+            worktree,
+            "-c",
+            "core.quotePath=false",
+            "diff",
+            "--unified=0",
+            "--no-color",
+            "--src-prefix=a/",
+            "--dst-prefix=b/",
+            "--no-ext-diff",
+            "--no-textconv",
+            base,
+            headSha,
+            "--",
+            ...mutantFiles
+          )
+        );
+        const selection = selectMutants(
+          mutantFiles.filter((p) => (added.get(p) ?? []).length > 0).map((p) => ({
+            file: p,
+            content: gitCapture(worktree, "show", `${headSha}:${p}`),
+            addedLines: added.get(p) ?? [],
+            hasNewTests: hasCollocatedNewTest(p, probes)
+          }))
+        );
+        candidates = selection.selected;
+        mutantsSkippedForCap = selection.skippedForCap;
+        if (selection.derailed.length > 0) {
+          noteMutants(
+            `mutant selection dropped ${selection.derailed.length} file(s) whose literal scan derailed (${selection.derailed.join(", ")}) \u2014 a regex literal holding a quote or backtick can do this; their candidates were not probed`
+          );
+        }
+      }
+    } catch (e) {
+      noteMutants(
+        `mutant selection failed: ${e instanceof Error ? e.message : String(e)} \u2014 no mutants were run`
+      );
+      candidates = [];
+    }
     const probeTree = probeWorktreePath(worktree);
     let created = false;
     let sweep;
@@ -11967,6 +12422,43 @@ async function runTestEfficacy(args) {
       for (const file of probes) {
         results.push({ file, verdict: "inconclusive", detail });
       }
+      for (const c of candidates) {
+        mutantResults.push({ ...c, verdict: "inconclusive", detail });
+      }
+    }
+    if (created && candidates.length > 0) {
+      try {
+        const mutantDeadline = startedAt + TOTAL_BUDGET_MS - PROBE_RUN_TIMEOUT_MS;
+        const baseline = runProbeSuite(probeTree, probes, mutantDeadline, now);
+        const greenProbes = baseline.perFile.filter((r) => r.verdict === "inert").map((r) => r.file);
+        if (greenProbes.length === 0) {
+          mutantsSkippedForBaseline = candidates.length;
+          noteMutants(
+            "mutants not run: no probe file was green in the unmutated baseline (every file was red or collected nothing), so a red mutant run would prove nothing"
+          );
+        } else {
+          const estimatedRunMs = baseline.ms + RUN_ESTIMATE_MARGIN_MS;
+          for (const c of candidates) {
+            const remaining = mutantDeadline - now();
+            if (!fitsAnotherMutantRun(remaining, estimatedRunMs)) {
+              mutantsSkippedForBudget = candidates.length - mutantResults.length;
+              break;
+            }
+            mutantResults.push(
+              runOneMutant(probeTree, c, greenProbes, mutantDeadline, now)
+            );
+          }
+        }
+      } catch (e) {
+        const detail = `mutation probe could not run: ${e instanceof Error ? e.message : String(e)}`;
+        for (const c of candidates.slice(mutantResults.length)) {
+          mutantResults.push({
+            ...c,
+            verdict: "inconclusive",
+            detail
+          });
+        }
+      }
     }
     if (created) {
       try {
@@ -11979,32 +12471,8 @@ async function runTestEfficacy(args) {
           git2(probeTree, "checkout", base, "--", ...modified);
         }
         for (const p of added) safeRmWithin(probeTree, p);
-        const r = spawnSync3(
-          "npx",
-          ["vitest", "run", "--reporter=json", ...probes],
-          {
-            cwd: probeTree,
-            encoding: "utf8",
-            timeout: 3e5,
-            // Vitest's JSON reporter on a large suite easily exceeds spawnSync's
-            // 1 MiB default stdout buffer, which returns ENOBUFS and turns every
-            // probe `inconclusive`. Match the 64 MiB ceiling the gh wrapper uses.
-            maxBuffer: 64 * 1024 * 1024
-          }
-        );
-        if (r.error) throw r.error;
-        if (r.signal) {
-          throw new Error(
-            `runner killed by ${r.signal}${r.signal === "SIGTERM" ? " (probe timed out after 300s)" : ""}`
-          );
-        }
         results.push(
-          ...classifyProbeRun(
-            r.status ?? 1,
-            `${r.stdout ?? ""}`,
-            probes,
-            `${r.stderr ?? ""}`
-          )
+          ...runProbeSuite(probeTree, probes, startedAt + TOTAL_BUDGET_MS, now).perFile
         );
       } catch (e) {
         const detail = `probe could not run: ${e instanceof Error ? e.message : String(e)}`;
@@ -12043,23 +12511,57 @@ async function runTestEfficacy(args) {
       file: r.file,
       kind: "inert",
       message: `\`${r.file}\`: ${r.detail}. It passes whether or not the change is present, so it cannot catch a regression in it.`
+    })),
+    ...mutantResults.filter((m) => m.verdict === "survived").map((m) => ({
+      file: m.file,
+      kind: "mutant-survived",
+      message: `\`${m.file}:${m.line}\`: deleting the added safety statement \`${m.statement}\` leaves every affected test green. No test in this diff fails when it is removed \u2014 confirm an existing test covers it, or add one, so a regression that drops or skips this statement is caught.`
     }))
   ];
+  const count = /* @__PURE__ */ __name((v) => mutantResults.filter((m) => m.verdict === v).length, "count");
   const result = {
     unreachable,
     probed: results,
     inconclusive: results.filter((r) => r.verdict === "inconclusive"),
+    mutants: {
+      probed: mutantResults,
+      killed: count("killed"),
+      survived: count("survived"),
+      inconclusive: count("inconclusive"),
+      skippedForBudget: mutantsSkippedForBudget,
+      skippedForCap: mutantsSkippedForCap,
+      skippedForBaseline: mutantsSkippedForBaseline,
+      ...mutantsNote ? { note: mutantsNote } : {}
+    },
     findings,
     cleanupFailure
   };
   mkdirSync16(dirname13(out), { recursive: true });
   writeFileSync16(out, JSON.stringify(result, null, 2), "utf8");
   writeStdoutLine(
-    `Wrote test-efficacy report to ${out} (${unreachable.length} unreachable, ${results.length} probed, ${findings.length} finding(s))`
+    `Wrote test-efficacy report to ${out} (${unreachable.length} unreachable, ${results.length} probed, ${mutantResults.length} mutant(s), ${findings.length} finding(s))`
   );
   for (const f of findings) {
     writeStdoutLine(`  [test] ${f.kind}: ${f.file}`);
   }
+  if (mutantsSkippedForCap > 0) {
+    writeStdoutLine(
+      `  ${mutantsSkippedForCap} mutant(s) skipped: more candidates than the cap of ${MAX_MUTANTS}`
+    );
+  }
+  if (mutantsSkippedForBaseline > 0) {
+    writeStdoutLine(
+      `  ${mutantsSkippedForBaseline} mutant(s) skipped: no probe file was green in the unmutated baseline`
+    );
+  }
+  if (mutantsSkippedForBudget > 0) {
+    writeStdoutLine(
+      `  ${mutantsSkippedForBudget} mutant(s) skipped: the remaining budget cannot fit another suite run`
+    );
+  }
+  if (mutantsNote) {
+    writeStdoutLine(`  ${mutantsNote}`);
+  }
   if (cleanupFailure) {
     writeStderrLine(`WARNING: ${cleanupFailure}`);
   }
@@ -12067,7 +12569,7 @@ async function runTestEfficacy(args) {
 __name(runTestEfficacy, "runTestEfficacy");
 var testEfficacyCommand = {
   command: "test-efficacy <report>",
-  describe: "Check whether the diff's new tests actually gate its new behaviour (unreachable + revert probe)",
+  describe: "Check whether the diff's new tests actually gate its new behaviour (unreachable + revert probe + statement-deletion mutants)",
   builder: /* @__PURE__ */ __name((yargs) => yargs.positional("report", {
     type: "string",
     demandOption: true,
@@ -12330,13 +12832,285 @@ var cleanupCommand = {
   }, "handler")
 };
 
+// packages/cli/src/commands/review/run.ts
+init_esbuild_shims();
+import { spawn, execFileSync as execFileSync6 } from "node:child_process";
+import { readdirSync as readdirSync6, readFileSync as readFileSync20, statSync as statSync5 } from "node:fs";
+import { join as join16, resolve as resolve13 } from "node:path";
+var COMPOSED_PATTERN = /^qwen-review-.*composed\.json$/;
+var COMPOSED_POLL_MS = 250;
+var SIGNAL_EXIT_CODES = {
+  SIGHUP: 129,
+  SIGINT: 130,
+  SIGTERM: 143
+};
+var PARENT_SIGNALS = Object.keys(SIGNAL_EXIT_CODES);
+function buildReviewPrompt(args) {
+  const parts = ["/review"];
+  if (args.target) {
+    if (/\s/.test(args.target) || args.target.startsWith("-") || /['"]/.test(args.target)) {
+      throw new Error(
+        `Invalid review target ${JSON.stringify(args.target)}: expected a single PR number, PR URL, or file path`
+      );
+    }
+    parts.push(args.target);
+  }
+  if (args.effort) parts.push(`--effort ${args.effort}`);
+  if (args.comment) parts.push("--comment");
+  return parts.join(" ");
+}
+__name(buildReviewPrompt, "buildReviewPrompt");
+function newestArtifactSince(dir, pattern, startMs) {
+  let best = null;
+  let names;
+  try {
+    names = readdirSync6(dir);
+  } catch {
+    return null;
+  }
+  for (const name of names) {
+    if (!pattern.test(name)) continue;
+    const path3 = join16(dir, name);
+    let mtime;
+    try {
+      mtime = statSync5(path3).mtimeMs;
+    } catch {
+      continue;
+    }
+    if (mtime < startMs) continue;
+    if (!best || mtime > best.mtime) best = { path: path3, mtime };
+  }
+  return best ? best.path : null;
+}
+__name(newestArtifactSince, "newestArtifactSince");
+function exitCodeFor(completed, event, failOn) {
+  if (!completed) return 1;
+  if (failOn === "request-changes" && event === "REQUEST_CHANGES") return 3;
+  return 0;
+}
+__name(exitCodeFor, "exitCodeFor");
+function readComposed(path3) {
+  try {
+    const parsed = JSON.parse(readFileSync20(path3, "utf8"));
+    return typeof parsed.event === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+__name(readComposed, "readComposed");
+function killProcessGroup(pid, signal) {
+  if (process.platform === "win32") {
+    try {
+      execFileSync6("taskkill", ["/pid", String(pid), "/T", "/F"], {
+        stdio: "ignore"
+      });
+    } catch {
+    }
+    return;
+  }
+  try {
+    process.kill(-pid, signal);
+  } catch {
+  }
+}
+__name(killProcessGroup, "killProcessGroup");
+async function runReview(args) {
+  const startMs = Date.now();
+  const prompt = buildReviewPrompt(args);
+  const cutoffMs = startMs - 2e3;
+  const child = spawn(
+    process.execPath,
+    [
+      "--expose-gc",
+      process.argv[1],
+      "--prompt",
+      prompt,
+      "--approval-mode",
+      args.approvalMode
+    ],
+    {
+      // stdin CLOSED, not inherited: piped input would be prepended to the
+      // prompt and the leading `/` would no longer be the first character —
+      // the slash command would reach the model as plain text.
+      stdio: ["ignore", "pipe", "pipe"],
+      // The CLI relaunches itself in a child (for --max-old-space-size), so
+      // the pid we spawn is a wrapper whose grandchild is the real review.
+      // A new process group lets the timeout kill reach both.
+      detached: true
+    }
+  );
+  if (!args.quiet) {
+    const writeProgress = /* @__PURE__ */ __name((chunk) => {
+      try {
+        process.stderr.write(chunk);
+      } catch {
+      }
+    }, "writeProgress");
+    child.stdout?.on("data", writeProgress);
+    child.stderr?.on("data", writeProgress);
+  } else {
+    child.stdout?.resume();
+    child.stderr?.resume();
+  }
+  let capturedPath = null;
+  let capturedVerdict = null;
+  const captureTimer = setInterval(() => {
+    if (capturedVerdict !== null) return;
+    const path3 = newestArtifactSince(
+      REVIEW_TMP_DIR,
+      COMPOSED_PATTERN,
+      cutoffMs
+    );
+    if (path3 === null) return;
+    const verdict = readComposed(path3);
+    if (verdict !== null) {
+      capturedPath = path3;
+      capturedVerdict = verdict;
+    }
+  }, COMPOSED_POLL_MS);
+  let timedOut = false;
+  const timeoutMs = args.timeoutMinutes * 6e4;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    writeStderrLineSafe(
+      `review run: timeout after ${args.timeoutMinutes} minutes \u2014 terminating the review`
+    );
+    const pid = child.pid;
+    if (pid !== void 0) {
+      killProcessGroup(pid, "SIGTERM");
+      setTimeout(() => killProcessGroup(pid, "SIGKILL"), 1e4).unref();
+    }
+  }, timeoutMs);
+  const onParentSignal = /* @__PURE__ */ __name((signal) => {
+    clearTimeout(timer);
+    clearInterval(captureTimer);
+    const pid = child.pid;
+    if (pid !== void 0) {
+      killProcessGroup(pid, "SIGTERM");
+    }
+    process.exit(SIGNAL_EXIT_CODES[signal] ?? 1);
+  }, "onParentSignal");
+  for (const signal of PARENT_SIGNALS) process.on(signal, onParentSignal);
+  const childOutcome = await new Promise((resolvePromise) => {
+    child.on("close", (code, signal) => resolvePromise({ code, signal }));
+    child.on("error", (err) => {
+      writeStderrLineSafe(
+        `review run: failed to launch the CLI: ${err.message}`
+      );
+      resolvePromise({ code: null, signal: null });
+    });
+  });
+  const childExitCode = childOutcome.code;
+  const childSignal = childOutcome.signal;
+  clearTimeout(timer);
+  clearInterval(captureTimer);
+  for (const signal of PARENT_SIGNALS) process.off(signal, onParentSignal);
+  let composedPath = capturedPath;
+  let composed = capturedVerdict;
+  if (composed === null) {
+    composedPath = newestArtifactSince(
+      REVIEW_TMP_DIR,
+      COMPOSED_PATTERN,
+      cutoffMs
+    );
+    composed = composedPath ? readComposed(composedPath) : null;
+  }
+  const reportPath = newestArtifactSince(REVIEWS_DIR, /\.md$/, cutoffMs);
+  const completed = composed !== null;
+  const result = {
+    completed,
+    event: composed?.event ?? null,
+    verdictLine: composed?.verdictLine ?? null,
+    baseEvent: composed?.baseEvent ?? null,
+    cappedBy: composed?.cappedBy ?? [],
+    downgraded: composed?.downgraded ?? false,
+    downgradedFrom: composed?.downgradedFrom ?? null,
+    remediation: composed?.remediation ?? [],
+    composedPath: composedPath ? resolve13(composedPath) : null,
+    reportPath: reportPath ? resolve13(reportPath) : null,
+    childExitCode,
+    childSignal,
+    timedOut,
+    durationMs: Date.now() - startMs
+  };
+  process.exitCode = exitCodeFor(completed, result.event, args.failOn);
+  try {
+    if (args.json) {
+      writeStdoutLine(JSON.stringify(result, null, 2));
+    } else if (completed) {
+      writeStdoutLine(result.verdictLine ?? `Event: ${result.event}`);
+      if (result.reportPath) writeStdoutLine(`Report: ${result.reportPath}`);
+    } else {
+      const detail = composedPath !== null ? `a composed verdict was found at ${resolve13(composedPath)} but could not be parsed` : "no composed verdict was produced";
+      writeStdoutLine(
+        timedOut ? "Review did not complete: timed out." : `Review did not complete: ${detail}${childExitCode !== null ? ` (CLI exit ${childExitCode})` : ""}${childSignal !== null ? ` (killed by ${childSignal})` : ""}.`
+      );
+    }
+  } catch {
+  }
+}
+__name(runReview, "runReview");
+var runCommand = {
+  command: "run [target]",
+  describe: "Run a full /review non-interactively and print the verdict (machine-readable with --json)",
+  builder: /* @__PURE__ */ __name((yargs) => yargs.positional("target", {
+    type: "string",
+    describe: "What to review: a PR number, a PR URL, or a file path; omit to review the local working tree"
+  }).option("effort", {
+    type: "string",
+    choices: [...EFFORT_LEVELS],
+    describe: "The review effort. Defaults to the skill default for the target (high for a PR, medium locally)."
+  }).option("comment", {
+    type: "boolean",
+    default: false,
+    describe: "Authorise posting the review to GitHub (PR targets only) \u2014 same meaning as `/review <pr> --comment`"
+  }).option("json", {
+    type: "boolean",
+    default: false,
+    describe: "Print the full result as JSON on stdout"
+  }).option("fail-on", {
+    type: "string",
+    choices: ["none", "request-changes"],
+    default: "none",
+    describe: "Exit 3 when the review completes with this outcome \u2014 lets CI gate on the verdict without parsing output"
+  }).option("timeout-minutes", {
+    type: "number",
+    default: 120,
+    describe: "Terminate the review after this long without a verdict (exit 1)"
+  }).option("approval-mode", {
+    type: "string",
+    default: "yolo",
+    choices: ["plan", "default", "auto-edit", "auto", "yolo"],
+    describe: "Approval mode for the child CLI. The default is yolo: headless runs cannot answer confirmation prompts, and anything still unapproved would be auto-denied mid-review."
+  }).option("quiet", {
+    type: "boolean",
+    default: false,
+    describe: "Suppress the child CLI progress stream on stderr"
+  }), "builder"),
+  handler: /* @__PURE__ */ __name(async (argv) => {
+    await runReview({
+      target: argv["target"],
+      effort: argv["effort"],
+      comment: Boolean(argv["comment"]),
+      json: Boolean(argv["json"]),
+      failOn: argv["fail-on"] ?? "none",
+      // `|| 120` would treat an explicit `--timeout-minutes 0` as falsy and
+      // silently substitute the default; decide default-vs-value by finiteness
+      // so 0 still reaches the 1-minute floor.
+      timeoutMinutes: Number.isFinite(Number(argv["timeout-minutes"])) ? Math.max(1, Number(argv["timeout-minutes"])) : 120,
+      approvalMode: String(argv["approval-mode"] ?? "yolo"),
+      quiet: Boolean(argv["quiet"])
+    });
+  }, "handler")
+};
+
 // packages/cli/src/commands/review.ts
 var reviewCommand = {
   command: "review",
-  describe: "Internal helpers used by the /review skill (PR worktree setup, context fetch, rules loading, presubmit checks, cleanup)",
-  builder: /* @__PURE__ */ __name((yargs) => yargs.command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(presubmitCommand).command(testEfficacyCommand).command(composeReviewCommand).command(submitCommand).command(cleanupCommand).demandCommand(
+  describe: "Run a review non-interactively (`run`), plus the internal helpers used by the /review skill (PR worktree setup, context fetch, rules loading, presubmit checks, cleanup)",
+  builder: /* @__PURE__ */ __name((yargs) => yargs.command(runCommand).command(parseArgsCommand).command(fetchPrCommand).command(captureLocalCommand).command(planDiffCommand).command(prContextCommand).command(commentStatusCommand).command(loadRulesCommand).command(agentPromptCommand).command(buildTestCommand).command(scriptLintCommand).command(resolveAnchorsCommand).command(checkCoverageCommand).command(presubmitCommand).command(testEfficacyCommand).command(composeReviewCommand).command(submitCommand).command(cleanupCommand).demandCommand(
     1,
-    "Specify a subcommand: parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, script-lint, resolve-anchors, check-coverage, presubmit, test-efficacy, compose-review, submit, or cleanup."
+    "Specify a subcommand: run, parse-args, fetch-pr, capture-local, plan-diff, pr-context, comment-status, load-rules, agent-prompt, build-test, script-lint, resolve-anchors, check-coverage, presubmit, test-efficacy, compose-review, submit, or cleanup."
   ).version(false), "builder"),
   handler: /* @__PURE__ */ __name(() => {
   }, "handler")
@@ -12536,10 +13310,10 @@ var updateCommand3 = {
       stdioHelpers,
       { updateEventEmitter }
     ] = await Promise.all([
-      import("./settings-DJDXFDZ3.js"),
-      import("./updateCheck-KAQH67DV.js"),
-      import("./installationInfo-6AM4I2Y3.js"),
-      import("./standalone-update-MK3Z7KBI.js"),
+      import("./settings-LN7RNKBS.js"),
+      import("./updateCheck-4Q6RIKFW.js"),
+      import("./installationInfo-4MGG4WVI.js"),
+      import("./standalone-update-JAKIM2NF.js"),
       import("./stdioHelpers-HGIYTWAY.js"),
       import("./updateEventEmitter-5MKC7BLQ.js")
     ]);
@@ -13686,6 +14460,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     ).map((d) => d.trim()),
     disabledTools: disabledTools.length > 0 ? disabledTools : void 0,
     visibleTools: visibleTools.length > 0 ? visibleTools : void 0,
+    toolSearchThreshold: bareMode || safeMode ? 0 : settings.tools?.toolSearch?.threshold,
     // New unified permissions (PermissionManager source of truth).
     permissions: {
       allow: mergedAllow.length > 0 ? mergedAllow : void 0,
@@ -13796,6 +14571,7 @@ async function loadCliConfig(settings, argv, cwd = process.cwd(), overrideExtens
     bareMode,
     safeMode,
     allowedHttpHookUrls: bareMode || safeMode ? [] : settings.security?.allowedHttpHookUrls ?? [],
+    allowPrivateNetworkHooks: bareMode || safeMode ? false : settings.security?.allowPrivateNetworkHooks ?? false,
     cliVersion: await getCliVersion(),
     ideMode,
     chatCompression: settings.model?.chatCompression,