@rigour-labs/core 6.7.6 → 6.7.7

package/dist/review/reviewer/api-judge.d.ts

@@ -0,0 +1,28 @@
+import type { RunTrace } from './adapters.js';
+export type Reasoning = 'low' | 'medium' | 'high';
+export interface ApiJudgeOptions {
+    /** The API's base URL; `/chat/completions` is appended. */
+    url: string;
+    model: string;
+    key: string;
+    maxTurns: number;
+    timeoutMs: number;
+    cwd: string;
+    /** Where the tools may read: the checkout and the review's input folder. */
+    roots: string[];
+    reasoning?: Reasoning;
+    fetchImpl?: typeof fetch;
+}
+export interface ApiJudgeRun {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** What a run's stdout carries on success, for the adapter to read. */
+export interface ApiJudgeAnswer {
+    result: string;
+    usage: RunTrace['usage'];
+    cost_usd?: number;
+    trace: RunTrace;
+}
+export declare function runApiJudge(prompt: string, o: ApiJudgeOptions): Promise<ApiJudgeRun>;

package/dist/review/reviewer/api-judge.js

@@ -0,0 +1,161 @@
+/**
+ * A judge reached through a model API instead of an agent CLI, so any model a team can call works as
+ * a reviewer: OpenAI-compatible chat completions with tools (OpenAI, OpenRouter, a local server, other
+ * vendors through a gateway). Rigour runs the loop itself: the model asks for a read-only tool, Rigour
+ * runs it inside the checkout (and the review's own input folder) and hands the result back, until
+ * the model answers. The same prompt, the same evidence contract and the same trace as a CLI judge;
+ * the key comes from an environment variable named in rigour.yml, never from the file.
+ */
+import fs from 'fs';
+import path from 'path';
+import { execa } from 'execa';
+const SYSTEM = 'You review code with read-only tools. Read the files the task names with read_file (the review inputs are named by absolute path), search the repository with search, read history with git. When you are done, reply with the final answer the task asks for and nothing else.';
+const MAX_RESULT_CHARS = 60_000;
+const GIT_ALLOWED = new Set(['log', 'show', 'diff', 'blame', 'grep', 'ls-files', 'rev-parse', 'merge-base']);
+/** Git options that write, or point git at another repository. */
+const GIT_REFUSED = /^(--output|-o$|--git-dir|--work-tree|-C$|--exec-path|-c$|--config-env)/;
+const TOOLS = [
+    { type: 'function', function: { name: 'read_file', description: 'Read a file in the repository or the review inputs, or a line range of it.', parameters: { type: 'object', properties: { path: { type: 'string' }, start_line: { type: 'integer' }, end_line: { type: 'integer' } }, required: ['path'] } } },
+    { type: 'function', function: { name: 'search', description: 'Search the tracked files for a regular expression (git grep -n), optionally under one path.', parameters: { type: 'object', properties: { pattern: { type: 'string' }, path: { type: 'string' } }, required: ['pattern'] } } },
+    { type: 'function', function: { name: 'list_dir', description: 'List a directory in the repository or the review inputs.', parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } } },
+    { type: 'function', function: { name: 'git', description: 'Run a read-only git command in the repository: log, show, diff, blame, grep, ls-files, rev-parse, merge-base.', parameters: { type: 'object', properties: { args: { type: 'array', items: { type: 'string' } } }, required: ['args'] } } },
+];
+const n = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+export async function runApiJudge(prompt, o) {
+    const fetchImpl = o.fetchImpl ?? fetch;
+    const deadline = Date.now() + o.timeoutMs;
+    const messages = [{ role: 'system', content: SYSTEM }, { role: 'user', content: prompt }];
+    const usage = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0 };
+    const calls = [];
+    let cost;
+    const fail = (why) => ({ exitCode: 1, stdout: '', stderr: `api judge (${o.model}): ${why}` });
+    for (let turn = 1; turn <= o.maxTurns; turn++) {
+        const left = deadline - Date.now();
+        if (left <= 0)
+            return fail(`timed out after ${o.timeoutMs} ms`);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), left);
+        let response;
+        try {
+            response = await fetchImpl(`${o.url.replace(/\/$/, '')}/chat/completions`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', authorization: `Bearer ${o.key}` },
+                body: JSON.stringify({ model: o.model, messages, tools: TOOLS, tool_choice: 'auto', ...(o.reasoning ? { reasoning_effort: o.reasoning } : {}) }),
+                signal: controller.signal,
+            });
+        }
+        catch (error) {
+            return fail(`request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!response.ok)
+            return fail(`HTTP ${response.status}: ${(await response.text()).slice(0, 300)}`);
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            return fail('the answer was not JSON');
+        }
+        const u = body.usage ?? {};
+        const cached = n(u.prompt_tokens_details?.cached_tokens);
+        usage.input += Math.max(0, n(u.prompt_tokens) - cached);
+        usage.cacheRead += cached;
+        usage.output += n(u.completion_tokens);
+        if (typeof u.cost === 'number')
+            cost = (cost ?? 0) + u.cost;
+        const message = body.choices?.[0]?.message;
+        if (!message)
+            return fail('no choices in the answer');
+        messages.push(message);
+        const toolCalls = Array.isArray(message.tool_calls) ? message.tool_calls : [];
+        if (toolCalls.length === 0) {
+            const answer = { result: String(message.content ?? ''), usage, ...(cost !== undefined ? { cost_usd: cost } : {}), trace: { turns: turn, usage, calls } };
+            return { exitCode: 0, stdout: JSON.stringify(answer), stderr: '' };
+        }
+        for (const call of toolCalls) {
+            const ran = await runTool(call, o);
+            calls.push({ turn, tool: ran.tool, target: ran.target, resultChars: ran.result.length });
+            messages.push({ role: 'tool', tool_call_id: call.id, content: ran.result });
+        }
+    }
+    return fail(`no answer within ${o.maxTurns} turns`);
+}
+/** One tool call, inside the allowed roots only; the trace names tools as the CLI judges do (Read, Grep, Glob, Bash). */
+async function runTool(call, o) {
+    const name = String(call?.function?.name ?? '');
+    let args = {};
+    try {
+        args = JSON.parse(call?.function?.arguments || '{}');
+    }
+    catch {
+        return { tool: name, target: '', result: 'refused: the arguments were not JSON' };
+    }
+    const clip = (text) => (text.length > MAX_RESULT_CHARS ? `${text.slice(0, MAX_RESULT_CHARS)}\n…[truncated at ${MAX_RESULT_CHARS} characters]` : text);
+    if (name === 'read_file') {
+        const target = inside(String(args.path ?? ''), o);
+        if (!target)
+            return { tool: 'Read', target: String(args.path ?? ''), result: 'refused: outside the repository and the review inputs' };
+        try {
+            const lines = fs.readFileSync(target, 'utf8').split('\n');
+            const start = Math.max(1, Number(args.start_line) || 1);
+            const end = Math.min(lines.length, Number(args.end_line) || lines.length);
+            return { tool: 'Read', target, result: clip(lines.slice(start - 1, end).map((l, i) => `${start + i}: ${l}`).join('\n')) };
+        }
+        catch (error) {
+            return { tool: 'Read', target, result: `error: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
+    if (name === 'list_dir') {
+        const target = inside(String(args.path ?? '.'), o);
+        if (!target)
+            return { tool: 'Glob', target: String(args.path ?? ''), result: 'refused: outside the repository and the review inputs' };
+        try {
+            return { tool: 'Glob', target, result: clip(fs.readdirSync(target, { withFileTypes: true }).map(e => (e.isDirectory() ? `${e.name}/` : e.name)).join('\n')) };
+        }
+        catch (error) {
+            return { tool: 'Glob', target, result: `error: ${error instanceof Error ? error.message : String(error)}` };
+        }
+    }
+    if (name === 'search') {
+        const pattern = String(args.pattern ?? '');
+        const under = args.path ? inside(String(args.path), o) : undefined;
+        if (args.path && !under)
+            return { tool: 'Grep', target: pattern, result: 'refused: outside the repository' };
+        const run = await execa('git', ['grep', '-n', '-I', '-e', pattern, ...(under ? ['--', path.relative(o.cwd, under) || '.'] : [])], { cwd: o.cwd, reject: false, maxBuffer: 16 * 1024 * 1024 });
+        return { tool: 'Grep', target: pattern, result: clip(run.stdout || (run.exitCode === 1 ? '(no match)' : run.stderr)) };
+    }
+    if (name === 'git') {
+        const gitArgs = Array.isArray(args.args) ? args.args.map(String) : [];
+        if (!GIT_ALLOWED.has(gitArgs[0] ?? '') || gitArgs.some(a => GIT_REFUSED.test(a)))
+            return { tool: 'Bash', target: `git ${gitArgs.join(' ')}`, result: 'refused: only read-only git commands, without options that write or point elsewhere' };
+        const run = await execa('git', ['--no-pager', ...gitArgs], { cwd: o.cwd, reject: false, maxBuffer: 16 * 1024 * 1024 });
+        return { tool: 'Bash', target: `git ${gitArgs.join(' ')}`, result: clip(run.stdout || run.stderr) };
+    }
+    return { tool: name, target: '', result: `refused: no tool named ${name}` };
+}
+/** The real path of `p` when it lies under one of the roots; undefined otherwise (a symlink out is outside). */
+function inside(p, o) {
+    const resolved = path.resolve(o.cwd, p);
+    let real;
+    try {
+        real = fs.realpathSync(resolved);
+    }
+    catch {
+        return undefined;
+    }
+    for (const root of o.roots) {
+        let base;
+        try {
+            base = fs.realpathSync(root);
+        }
+        catch {
+            continue;
+        }
+        if (real === base || real.startsWith(base + path.sep))
+            return real;
+    }
+    return undefined;
+}

package/dist/review/reviewer/api-judge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/reviewer/api-judge.test.js

@@ -0,0 +1,87 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { runApiJudge } from './api-judge.js';
+let repo;
+let work;
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'api-judge-'));
+    work = fs.mkdtempSync(path.join(os.tmpdir(), 'api-judge-inputs-'));
+    execFileSync('git', ['-C', repo, 'init', '-q']);
+    fs.mkdirSync(path.join(repo, 'src'));
+    fs.writeFileSync(path.join(repo, 'src/job.ts'), 'export function job() {\n    return 1;\n}\n');
+    execFileSync('git', ['-C', repo, 'add', '-A']);
+    execFileSync('git', ['-C', repo, '-c', 'user.email=t@x', '-c', 'user.name=t', 'commit', '-qm', 'init']);
+    fs.writeFileSync(path.join(work, 'full.diff'), '+++ b/src/job.ts\n');
+});
+afterEach(() => { for (const d of [repo, work])
+    fs.rmSync(d, { recursive: true, force: true }); });
+/** A model that plays a scripted conversation: each entry is what it answers to the next request. */
+function model(turns) {
+    const seen = [];
+    let i = 0;
+    const fetchImpl = (async (_url, init) => {
+        const body = JSON.parse(init.body);
+        seen.push(body);
+        const turn = turns[i++] ?? { text: 'done' };
+        if (turn.status)
+            return new Response('nope', { status: turn.status });
+        const message = turn.tools
+            ? { role: 'assistant', content: null, tool_calls: turn.tools.map((t, k) => ({ id: `c${i}-${k}`, type: 'function', function: { name: t.name, arguments: JSON.stringify(t.args) } })) }
+            : { role: 'assistant', content: turn.text };
+        return new Response(JSON.stringify({ choices: [{ message }], usage: turn.usage ?? { prompt_tokens: 100, completion_tokens: 10, prompt_tokens_details: { cached_tokens: 60 } } }), { status: 200, headers: { 'content-type': 'application/json' } });
+    });
+    return { fetchImpl, seen };
+}
+const options = (fetchImpl, extra = {}) => ({ url: 'https://example.test/v1', model: 'some-model', key: 'k', maxTurns: 10, timeoutMs: 30_000, cwd: repo, roots: [repo, work], fetchImpl, ...extra });
+describe('the API judge', () => {
+    it('runs the tools the model asks for inside the checkout and the inputs, then returns its answer with the usage and the trace', async () => {
+        const { fetchImpl, seen } = model([
+            { tools: [{ name: 'read_file', args: { path: path.join(work, 'full.diff') } }, { name: 'read_file', args: { path: 'src/job.ts', start_line: 2, end_line: 2 } }] },
+            { tools: [{ name: 'search', args: { pattern: 'return' } }, { name: 'git', args: { args: ['log', '-1', '--format=%s'] } }, { name: 'list_dir', args: { path: 'src' } }] },
+            { text: '{"prior_points":[]}', usage: { prompt_tokens: 50, completion_tokens: 5, cost: 0.01 } },
+        ]);
+        const run = await runApiJudge('review this', options(fetchImpl));
+        expect(run.exitCode).toBe(0);
+        const answer = JSON.parse(run.stdout);
+        expect(answer.result).toBe('{"prior_points":[]}');
+        expect(answer.usage).toEqual({ input: 130, cacheRead: 120, cacheWrite: 0, output: 25 });
+        expect(answer.cost_usd).toBe(0.01);
+        expect(answer.trace.turns).toBe(3);
+        expect(answer.trace.calls.map(c => c.tool)).toEqual(['Read', 'Read', 'Grep', 'Bash', 'Glob']);
+        const toolResults = (request) => request.messages.filter((m) => m.role === 'tool').map((m) => m.content);
+        expect(toolResults(seen[1])).toEqual(['1: +++ b/src/job.ts\n2: ', '2:     return 1;']); // turn 1's reads, as the model got them
+        expect(toolResults(seen[2]).slice(2)).toEqual(['src/job.ts:2:    return 1;', 'init', 'job.ts']); // turn 2's search, git and listing
+        expect(seen[0].messages[0].role).toBe('system');
+        expect(seen[0].tools.map((t) => t.function.name)).toEqual(['read_file', 'search', 'list_dir', 'git']);
+    });
+    it('refuses to read outside the roots, a symlink out included, and refuses git that writes or points elsewhere', async () => {
+        fs.symlinkSync(os.homedir(), path.join(repo, 'out'));
+        const { fetchImpl, seen } = model([
+            { tools: [{ name: 'read_file', args: { path: '/etc/hosts' } }, { name: 'read_file', args: { path: 'out/.bashrc' } }, { name: 'git', args: { args: ['log', '--output=/tmp/x'] } }, { name: 'git', args: { args: ['push'] } }, { name: 'nope', args: {} }] },
+            { text: 'ok' },
+        ]);
+        await runApiJudge('p', options(fetchImpl));
+        const results = seen[1].messages.filter((m) => m.role === 'tool').map((m) => m.content);
+        expect(results).toEqual([
+            'refused: outside the repository and the review inputs', 'refused: outside the repository and the review inputs',
+            'refused: only read-only git commands, without options that write or point elsewhere', 'refused: only read-only git commands, without options that write or point elsewhere',
+            'refused: no tool named nope',
+        ]);
+    });
+    it('fails closed on a turn cap, an HTTP error and a timeout, saying why', async () => {
+        const loop = model(Array.from({ length: 5 }, () => ({ tools: [{ name: 'list_dir', args: { path: '.' } }] })));
+        expect(await runApiJudge('p', options(loop.fetchImpl, { maxTurns: 3 }))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('no answer within 3 turns') });
+        expect(await runApiJudge('p', options(model([{ status: 429 }]).fetchImpl))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('HTTP 429') });
+        const slow = (async (_u, init) => new Promise((_r, reject) => init.signal.addEventListener('abort', () => reject(new Error('aborted')))));
+        expect(await runApiJudge('p', options(slow, { timeoutMs: 50 }))).toMatchObject({ exitCode: 1, stderr: expect.stringContaining('request failed') });
+    });
+    it('passes the reasoning effort when asked', async () => {
+        const { fetchImpl, seen } = model([{ text: 'ok' }]);
+        await runApiJudge('p', options(fetchImpl, { reasoning: 'low' }));
+        expect(seen[0].reasoning_effort).toBe('low');
+        expect(seen[0].model).toBe('some-model');
+    });
+});

package/dist/review/reviewer/settings.d.ts

@@ -35,6 +35,16 @@ export interface ResolvedReviewer {
     judges: 2 | 3;
     escalate: 'always' | 'risk';
     cross_models: Record<string, string>;
+    /** Reasoning effort per reviewer name (codex, api). */
+    reasoning: Record<string, 'low' | 'medium' | 'high'>;
+    /** The API judge, when the team configured one (review.reviewer.api). */
+    api?: {
+        url: string;
+        model: string;
+        key_env: string;
+        vendor?: 'anthropic' | 'openai' | 'google' | 'other';
+        max_turns: number;
+    };
     /** Environment variables each judge's CLI must not see (the team's, never a person's). */
     judge_env: Record<string, {
         unset: string[];

package/dist/review/reviewer/settings.js

@@ -13,7 +13,7 @@ const RANK = { single: 0, cross: 1, full: 2 };
 /** How near a layer is to this run: the nearer wins. */
 const NEAR = { flag: 0, env: 1, user: 2, team: 3 };
 export function resolveReviewer(config, choice = {}, user = loadSettings().reviewer, env = process.env) {
-    const team = config.review?.reviewer ?? { enabled: false, on_push: 'background', reviewers: ['claude'], mode: 'single', models: {}, timeout_ms: 15 * 60_000, panel: 'off', mode_required: false, panel_max_items: 20, dismissals: false, judges: 2, escalate: 'always', cross_models: {}, judge_env: {} };
+    const team = config.review?.reviewer ?? { enabled: false, on_push: 'background', reviewers: ['claude'], mode: 'single', models: {}, timeout_ms: 15 * 60_000, panel: 'off', mode_required: false, panel_max_items: 20, dismissals: false, judges: 2, escalate: 'always', cross_models: {}, judge_env: {}, reasoning: {} };
     const refused = [];
     const envMode = parseMode(env.RIGOUR_REVIEWER_MODE);
     const envPanel = parseSwitch(env.RIGOUR_REVIEWER_PANEL);
@@ -79,6 +79,8 @@ export function resolveReviewer(config, choice = {}, user = loadSettings().revie
         escalate: requiredEscalation(team, user, refused),
         cross_models: team.cross_models,
         judge_env: team.judge_env ?? {},
+        reasoning: team.reasoning ?? {},
+        ...(team.api ? { api: team.api } : {}),
         source: { mode: modeSource, panel: panelSource },
         required: { mode: team.mode_required, panel: requirePanel },
         refused,

package/dist/review/reviewer.d.ts

@@ -9,6 +9,8 @@ export { defaultExec, githubEnv, githubToken, parseJsonArrays, type Exec, type P
 export { itemLine, type OpenItem } from './reviewer/verdict.js';
 export type ReviewerOutcome = 'passed' | 'findings' | 'unavailable' | 'skipped';
 export interface ReviewerOptions {
+    /** For tests: what the API judge calls instead of fetch. */
+    fetch?: typeof fetch;
     /** The pull request to read when the checkout is detached (a backtest). */
     pr?: number;
     /** ISO time: a review or comment posted from then on is not shown to the reviewer (a backtest). */

package/dist/review/reviewer.js

@@ -21,7 +21,8 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { ADAPTERS, isReviewerName, resolveAdapter, selectReviewers, vendorsOf } from './reviewer/adapters.js';
+import { runApiJudge } from './reviewer/api-judge.js';
+import { ADAPTERS, apiVendor, isReviewerName, resolveAdapter, selectReviewers, vendorsOf } from './reviewer/adapters.js';
 import { defaultExec, GH_TIMEOUT_MS, githubEnv } from './reviewer/exec.js';
 import { bodyAsOf, findPullRequest, ghFor, humanReviews, linesChanged, mergesBaseIn, rulesText, sha } from './reviewer/inputs.js';
 import { mergeImpact } from './reviewer/merge-impact.js';
@@ -76,13 +77,20 @@ async function review(cwd, base, config, exec, progress, options) {
     const candidates = settings.reviewers.filter(isReviewerName);
     const installed = new Map();
     for (const name of candidates) {
+        if (name === 'api') {
+            // The API judge is installed when the team configured it and the key it names is set.
+            if (settings.api && process.env[settings.api.key_env])
+                installed.set('api', { binary: 'api', version: settings.api.model });
+            continue;
+        }
         const found = await resolveAdapter(ADAPTERS[name], cwd, exec);
         if (found)
             installed.set(name, found);
     }
+    const vendorOf = (name) => (name === 'api' ? apiVendor(settings.api) : ADAPTERS[name].vendor);
     const authors = vendorsOf(await git(['log', '--format=%(trailers:key=Co-Authored-By,valueonly)%(trailers:key=Co-authored-by,valueonly)', `${baseSha}..HEAD`]));
     const mode = settings.mode;
-    let reviewers = selectReviewers(candidates, mode, authors, new Set(installed.keys()), settings.judges);
+    let reviewers = selectReviewers(candidates, mode, authors, new Set(installed.keys()), settings.judges, vendorOf);
     if (reviewers.length === 0)
         return none('unavailable', `no reviewer installed: ${candidates.map(n => ADAPTERS[n].binary).join(', ') || 'review.reviewer.reviewers is empty'}`);
     modeRecord = modeRan(settings, reviewers, candidates, installed);
@@ -199,6 +207,10 @@ async function review(cwd, base, config, exec, progress, options) {
     if (over)
         return none(settings.required.panel || settings.required.mode ? 'unavailable' : 'skipped', over, { reviewers, scope, why, pr: pr?.number });
     const work = fs.mkdtempSync(path.join(os.tmpdir(), 'rigour-reviewer-'));
+    // One judge run, by CLI or by API: the same prompt, the same cost accounting, the same trace.
+    const runJudge = (name, prompt, model) => name === 'api'
+        ? runApiJudge(prompt, { url: settings.api.url, model: settings.api.model, key: process.env[settings.api.key_env] ?? '', maxTurns: settings.api.max_turns, timeoutMs: settings.timeout_ms, cwd, roots: [cwd, work], ...(settings.reasoning[name] ? { reasoning: settings.reasoning[name] } : {}), ...(options.fetch ? { fetchImpl: options.fetch } : {}) })
+        : exec(installed.get(name).binary, ADAPTERS[name].args(prompt, model, { reasoning: settings.reasoning[name] }), { cwd, timeoutMs: settings.timeout_ms, unset: judgeUnset(name, settings.judge_env) });
     try {
         const file = (name, text) => {
             const target = path.join(work, name);
@@ -239,7 +251,7 @@ async function review(cwd, base, config, exec, progress, options) {
             const answers = await Promise.all(reviewers.map(async (name) => {
                 const adapter = ADAPTERS[name];
                 const ask = async () => {
-                    const run = await exec(installed.get(name).binary, adapter.args(prompt, modelFor(name)), { cwd, timeoutMs: settings.timeout_ms, unset: judgeUnset(name, settings.judge_env) });
+                    const run = await runJudge(name, prompt, modelFor(name));
                     progress(`Rigour reviewer: ${name} finished in ${Math.round((Date.now() - started) / 1000)}s (exit ${run.exitCode})`);
                     const answer = adapter.answer(run.stdout);
                     store.addSpend(1, answer.costUsd); // every run counts against the caps, an answer or not
@@ -293,7 +305,7 @@ async function review(cwd, base, config, exec, progress, options) {
                 },
                 ask: async (judge, asked) => {
                     const name = judge;
-                    const run = await exec(installed.get(name).binary, ADAPTERS[name].args(crossExamPrompt(repoRoot, head.slice(0, 9), diffFile, asked), settings.cross_models[name] ?? modelFor(name)), { cwd, timeoutMs: settings.timeout_ms, unset: judgeUnset(name, settings.judge_env) });
+                    const run = await runJudge(name, crossExamPrompt(repoRoot, head.slice(0, 9), diffFile, asked), settings.cross_models[name] ?? modelFor(name));
                     const answer = ADAPTERS[name].answer(run.stdout);
                     store.addSpend(1, answer.costUsd);
                     reserved--;

package/dist/review/reviewer.test.js

@@ -256,6 +256,33 @@ describe('the reviewer', () => {
         expect(again.cached).toBe(true);
         expect(again.record?.integrity).toBe(first.record?.integrity);
     });
+    it('reviews through the API judge when the team configured one and its key is set, with the same prompt and accounting', async () => {
+        const seen = seenNow();
+        const calls = [];
+        const fetchImpl = (async (_url, init) => {
+            const body = JSON.parse(init.body);
+            calls.push(body);
+            const last = body.messages.at(-1);
+            const message = last.role === 'user'
+                ? { role: 'assistant', content: null, tool_calls: [{ id: 't1', type: 'function', function: { name: 'read_file', arguments: JSON.stringify({ path: /(\S+full\.diff)/.exec(last.content)[1] }) } }] }
+                : { role: 'assistant', content: JSON.stringify({ ...EMPTY, findings: [{ class: 'correctness', file: 'src/job.ts', line: 2, issue: 'returns before the lock', input: 'two runs', consequence: 'two emails', quote: 'return 1;', severity: 'blocking' }] }) };
+            return new Response(JSON.stringify({ choices: [{ message }], usage: { prompt_tokens: 100, completion_tokens: 20, cost: 0.05 } }), { status: 200 });
+        });
+        const apiConfig = ConfigSchema.parse({ version: 1, review: { reviewer: { enabled: true, reviewers: ['api'], api: { url: 'https://example.test/v1', model: 'qwen3-coder', key_env: 'TEST_JUDGE_KEY' }, reasoning: { api: 'low' } } } });
+        const without = await runReviewer(repo, 'main', apiConfig, fakes(() => '', seen), () => undefined, { fetch: fetchImpl });
+        expect(without).toMatchObject({ outcome: 'unavailable', reason: expect.stringContaining('no reviewer installed') }); // the key is not set
+        process.env.TEST_JUDGE_KEY = 'secret';
+        try {
+            const result = await runReviewer(repo, 'main', apiConfig, fakes(() => '', seen), () => undefined, { fetch: fetchImpl, force: true });
+            expect(result).toMatchObject({ outcome: 'findings', reviewers: ['api'], costUsd: 0.1, items: [expect.objectContaining({ issue: 'returns before the lock', reviewer: 'api' })] });
+            expect(calls[0].reasoning_effort).toBe('low');
+            expect(calls[0].messages[1].content).toContain('full.diff'); // the same prompt a CLI judge gets
+            expect(result.record?.judges).toEqual([{ reviewer: 'api', version: 'qwen3-coder', cost_usd: 0.1, turns: 2 }]);
+        }
+        finally {
+            delete process.env.TEST_JUDGE_KEY;
+        }
+    });
     it('asks a judge once more after an answer that is not a verdict, and is unavailable only when the second is not one either', async () => {
         const seen = seenNow();
         let calls = 0;

package/dist/templates/universal-config.js

@@ -293,6 +293,7 @@ export const UNIVERSAL_CONFIG = {
             escalate: 'always',
             cross_models: {},
             judge_env: {},
+            reasoning: {},
         },
     },
     ignore: [],

package/dist/types/index.d.ts

@@ -2457,6 +2457,32 @@ export declare const ConfigSchema: z.ZodObject<{
             escalate: z.ZodDefault<z.ZodOptional<z.ZodEnum<["always", "risk"]>>>;
             /** A model per reviewer name for cross-examination (a narrow verification task), e.g. { claude: "haiku" }. */
             cross_models: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+            /** Reasoning effort per reviewer name where the CLI or API takes one (codex, api): low, medium or high. */
+            reasoning: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["low", "medium", "high"]>>>>;
+            /**
+             * A judge reached through a model API (OpenAI-compatible chat completions with tools), named `api` in
+             * `reviewers`: any model the team can call. The key is read from the environment variable `key_env`, never
+             * from this file. `vendor` is the model's maker, for cross and full modes (inferred from the model name when unset).
+             */
+            api: z.ZodOptional<z.ZodObject<{
+                url: z.ZodString;
+                model: z.ZodString;
+                key_env: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                vendor: z.ZodOptional<z.ZodEnum<["anthropic", "openai", "google", "other"]>>;
+                max_turns: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, "strip", z.ZodTypeAny, {
+                model: string;
+                url: string;
+                key_env: string;
+                max_turns: number;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+            }, {
+                model: string;
+                url: string;
+                key_env?: string | undefined;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+                max_turns?: number | undefined;
+            }>>;
             /**
              * Environment variables a judge's CLI must not see, per reviewer name, e.g. { codex: { unset: [OPENAI_API_KEY] } }
              * when that variable holds a key meant for another service. RIGOUR_API_KEY is never passed to a judge.
@@ -2482,12 +2508,20 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            reasoning: Record<string, "high" | "medium" | "low">;
             judge_env: Record<string, {
                 unset: string[];
             }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env: string;
+                max_turns: number;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+            } | undefined;
         }, {
             enabled?: boolean | undefined;
             mode?: "single" | "cross" | "full" | undefined;
@@ -2505,6 +2539,14 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            reasoning?: Record<string, "high" | "medium" | "low"> | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env?: string | undefined;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+                max_turns?: number | undefined;
+            } | undefined;
             judge_env?: Record<string, {
                 unset?: string[] | undefined;
             }> | undefined;
@@ -2526,12 +2568,20 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            reasoning: Record<string, "high" | "medium" | "low">;
             judge_env: Record<string, {
                 unset: string[];
             }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env: string;
+                max_turns: number;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+            } | undefined;
         };
         github_account?: string | undefined;
     }, {
@@ -2555,6 +2605,14 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            reasoning?: Record<string, "high" | "medium" | "low"> | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env?: string | undefined;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+                max_turns?: number | undefined;
+            } | undefined;
             judge_env?: Record<string, {
                 unset?: string[] | undefined;
             }> | undefined;
@@ -2832,12 +2890,20 @@ export declare const ConfigSchema: z.ZodObject<{
             judges: 2 | 3;
             escalate: "always" | "risk";
             cross_models: Record<string, string>;
+            reasoning: Record<string, "high" | "medium" | "low">;
             judge_env: Record<string, {
                 unset: string[];
             }>;
             model?: string | undefined;
             max_runs_per_day?: number | undefined;
             max_usd_per_day?: number | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env: string;
+                max_turns: number;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+            } | undefined;
         };
         github_account?: string | undefined;
     };
@@ -3120,6 +3186,14 @@ export declare const ConfigSchema: z.ZodObject<{
             judges?: 2 | 3 | undefined;
             escalate?: "always" | "risk" | undefined;
             cross_models?: Record<string, string> | undefined;
+            reasoning?: Record<string, "high" | "medium" | "low"> | undefined;
+            api?: {
+                model: string;
+                url: string;
+                key_env?: string | undefined;
+                vendor?: "anthropic" | "openai" | "google" | "other" | undefined;
+                max_turns?: number | undefined;
+            } | undefined;
             judge_env?: Record<string, {
                 unset?: string[] | undefined;
             }> | undefined;

package/dist/types/index.js

@@ -423,6 +423,20 @@ export const ConfigSchema = z.object({
             escalate: z.enum(['always', 'risk']).optional().default('always'),
             /** A model per reviewer name for cross-examination (a narrow verification task), e.g. { claude: "haiku" }. */
             cross_models: z.record(ModelName).optional().default({}),
+            /** Reasoning effort per reviewer name where the CLI or API takes one (codex, api): low, medium or high. */
+            reasoning: z.record(z.enum(['low', 'medium', 'high'])).optional().default({}),
+            /**
+             * A judge reached through a model API (OpenAI-compatible chat completions with tools), named `api` in
+             * `reviewers`: any model the team can call. The key is read from the environment variable `key_env`, never
+             * from this file. `vendor` is the model's maker, for cross and full modes (inferred from the model name when unset).
+             */
+            api: z.object({
+                url: z.string().url(),
+                model: z.string().min(1),
+                key_env: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, 'an environment variable name').optional().default('RIGOUR_JUDGE_API_KEY'),
+                vendor: z.enum(['anthropic', 'openai', 'google', 'other']).optional(),
+                max_turns: z.number().int().positive().optional().default(60),
+            }).optional(),
             /**
              * Environment variables a judge's CLI must not see, per reviewer name, e.g. { codex: { unset: [OPENAI_API_KEY] } }
              * when that variable holds a key meant for another service. RIGOUR_API_KEY is never passed to a judge.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.7.6",
+  "version": "6.7.7",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22.13"
@@ -72,11 +72,11 @@
     "@anthropic-ai/sdk": "^0.30.1",
     "pg": "^8.16.3",
     "openai": "^5.23.2",
-    "@rigour-labs/brain-darwin-arm64": "6.7.6",
-    "@rigour-labs/brain-darwin-x64": "6.7.6",
-    "@rigour-labs/brain-linux-arm64": "6.7.6",
-    "@rigour-labs/brain-linux-x64": "6.7.6",
-    "@rigour-labs/brain-win-x64": "6.7.6"
+    "@rigour-labs/brain-darwin-arm64": "6.7.7",
+    "@rigour-labs/brain-darwin-x64": "6.7.7",
+    "@rigour-labs/brain-linux-arm64": "6.7.7",
+    "@rigour-labs/brain-win-x64": "6.7.7",
+    "@rigour-labs/brain-linux-x64": "6.7.7"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",