@review-agent/core 0.1.1 → 0.1.3

package/dist/index.d.ts

@@ -466,7 +466,7 @@ declare const RECORD_VERSION: 1;
 /** The version of this engine, on every record it writes. Kept in step with
  *  `packages/core/package.json` by `record.test.ts` — a record whose engine version is a guess is
  *  worth less than no record at all (design §4.7). */
-declare const ENGINE_VERSION = "0.1.1";
+declare const ENGINE_VERSION = "0.1.3";
 type RecordedSkill = {
     id: string;
     path: string;

package/dist/index.js

@@ -16,8 +16,61 @@ import { z as z3 } from "zod";
 
 // src/cli-process.ts
 import { spawn } from "child_process";
+import { accessSync, constants, realpathSync, statSync } from "fs";
+import { posix, win32 } from "path";
 import { z } from "zod";
-var claudeBinary = () => process.env.REVIEW_AGENT_CLAUDE_BIN ?? "claude";
+var resolveClaudeBinary = (a) => {
+  const platform = a.platform ?? process.platform;
+  const path = platform === "win32" ? win32 : posix;
+  const isExecutableFile = a.isExecutableFile ?? executableFileTest(platform);
+  const real = a.realpath ?? realpathOrSelf;
+  const avoid = real(path.resolve(a.avoidDir));
+  const inside = (candidate) => {
+    const rel = path.relative(avoid, real(candidate));
+    return rel === "" || !(rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel));
+  };
+  const named = a.env.REVIEW_AGENT_CLAUDE_BIN;
+  if (named !== void 0 && named !== "") {
+    if (!path.isAbsolute(named)) {
+      throw new Error("REVIEW_AGENT_CLAUDE_BIN must be an absolute path to the Claude Code binary; a relative one could resolve inside the code under review");
+    }
+    if (inside(named)) {
+      throw new Error("REVIEW_AGENT_CLAUDE_BIN points inside the checkout of the code under review; refusing to run it");
+    }
+    return named;
+  }
+  const names = platform === "win32" ? ["claude.exe"] : ["claude"];
+  for (const dir of pathEntries(a.env, platform)) {
+    if (dir === "" || !path.isAbsolute(dir)) continue;
+    for (const name of names) {
+      const candidate = path.join(dir, name);
+      if (!isExecutableFile(candidate) || inside(candidate)) continue;
+      return candidate;
+    }
+  }
+  throw new Error(platform === "win32" ? "Claude Code was not found: no claude.exe in an absolute PATH directory. Install it with Anthropic's installer (irm https://claude.ai/install.ps1 | iex) or WinGet, or set REVIEW_AGENT_CLAUDE_BIN to the absolute path of claude.exe" : "Claude Code was not found: no executable `claude` in an absolute PATH directory. Install Claude Code, or set REVIEW_AGENT_CLAUDE_BIN to its absolute path");
+};
+var pathEntries = (env, platform) => {
+  const key = platform === "win32" ? Object.keys(env).find((k) => k.toUpperCase() === "PATH") : "PATH";
+  const value = key === void 0 ? void 0 : env[key];
+  return (value ?? "").split(platform === "win32" ? ";" : ":");
+};
+var executableFileTest = (platform) => (p) => {
+  try {
+    if (!statSync(p).isFile()) return false;
+    if (platform !== "win32") accessSync(p, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var realpathOrSelf = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+};
 var CHILD_ENV_ALLOWLIST = [
   "PATH",
   "HOME",
@@ -76,11 +129,21 @@ var spawnClaude = (a) => new Promise((resolve3, reject) => {
     reject(new Error(refusal));
     return;
   }
-  const child = spawn(claudeBinary(), a.argv, {
+  let bin;
+  try {
+    bin = resolveClaudeBinary({ env: process.env, avoidDir: a.cwd });
+  } catch (e) {
+    reject(e instanceof Error ? e : new Error(String(e)));
+    return;
+  }
+  const viaNode = /\.(c|m)?js$/i.test(bin);
+  const child = spawn(viaNode ? process.execPath : bin, viaNode ? [bin, ...a.argv] : a.argv, {
     cwd: a.cwd,
     env: childEnv(a.extraEnv),
     signal: a.signal,
-    stdio: ["pipe", "pipe", "pipe"]
+    stdio: ["pipe", "pipe", "pipe"],
+    // No console window flashing up when the reviewer runs from a GUI app or a service on Windows.
+    windowsHide: true
   });
   let out = "";
   let err = "";
@@ -311,7 +374,7 @@ var runEngine = async (i) => {
     // review in progress, and a login failure reporting it would send someone looking at budgets.
     cutShort: terminalReason !== "completed" && failure?.kind !== "cli-error",
     // Always false, and it is not an oversight: nothing can fire. The spike of 2026-09-13
-    // (docs/spikes/wrap-up.md) proved the delivery half works — a PostToolUse hook passed through
+    // (a spike during development) proved the delivery half works — a PostToolUse hook passed through
     // --settings survives --restricted and demonstrably puts text in front of the model — and then
     // found there is no spend to trigger it on. The hook event carries no cost, no usage and no
     // token count; --no-session-persistence means the transcript it points at is never written; and
@@ -857,7 +920,7 @@ var runRecheckPass = async (a) => {
 
 // src/record.ts
 var RECORD_VERSION = 1;
-var ENGINE_VERSION = "0.1.1";
+var ENGINE_VERSION = "0.1.3";
 var buildReviewRecord = (a) => {
   const { request, settings, result, startedAt, finishedAt } = a;
   return {
@@ -912,10 +975,10 @@ import {
   existsSync,
   mkdirSync,
   readdirSync,
-  realpathSync,
+  realpathSync as realpathSync2,
   renameSync,
   rmSync,
-  statSync
+  statSync as statSync2
 } from "fs";
 import { isAbsolute, join, relative as relative2, resolve as resolve2 } from "path";
 import { createHash as createHash2, randomUUID } from "crypto";
@@ -933,8 +996,8 @@ var SkillError = class extends Error {
 var materialiseDir = (source, id) => {
   if (!isAbsolute(source.path)) throw new SkillError(id, "path must be absolute");
   if (!existsSync(source.path)) throw new SkillError(id, "no such directory");
-  const real = realpathSync(source.path);
-  if (!statSync(real).isDirectory()) throw new SkillError(id, "not a directory");
+  const real = realpathSync2(source.path);
+  if (!statSync2(real).isDirectory()) throw new SkillError(id, "not a directory");
   return real;
 };
 var GITHUB_REPO = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@review-agent/core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {