@wardby/cli 0.4.1 → 0.5.1

package/dist/providers/jobs/kubernetes.js

@@ -35,6 +35,7 @@ import { parseWorkerDiagnosticLine } from "./docker.js";
 import { KubernetesAlreadyExistsError, KubernetesConflictError } from "./kubernetes-api.js";
 import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT_PROBE_DENY_REFUSED, ENFORCEMENT_PROBE_PROXY_UNREACHABLE, KEEPER_CONTAINER, KEEPER_SEEDED_MARKER, KUBERNETES_ISOLATION_ERROR, STORAGE_ROOT, TOOL_RUNNER_CONTAINER, WORKER_CONTAINER, assertRunNetworkPolicyMatches, assertRunPodMatches, buildCapabilitySecret, buildRunNetworkPolicy, buildRunPod, enforcementProbeScript, kubernetesRunNames, kubernetesRunNamesForToken, runLabels, serviceContainerName, validateKubernetesSpec, } from "./kubernetes-isolation.js";
 import { claudeToolSetup } from "./claude-tool-setup.js";
+import { podQuotaUsage, quotaShortfall } from "./kubernetes-quota.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 import { safeExtract } from "./safe-extract.js";
 import { reportServiceState, } from "./service-state.js";
@@ -185,6 +186,8 @@ const TOKEN = /^[a-f0-9]{20}$/;
 const WORKSPACE_STORAGE = `${STORAGE_ROOT}/workspace`;
 const INPUT_STORAGE = `${STORAGE_ROOT}/input`;
 const RESULT_PATH = `${STORAGE_ROOT}/output/result.json`;
+/** Stands in for the proxy ClusterIP when building a pod only to count its resources. */
+const QUOTA_PROBE_PROXY_IP = "10.0.0.1";
 const kubernetesLog = logger.child({ module: "kubernetes-jobs" });
 const PHASES = new Set(["provisioning", "active", "succeeded", "failed", "stopped", "lost", "removed"]);
 const TERMINAL_PHASES = new Set(["succeeded", "failed", "stopped", "lost", "removed"]);
@@ -427,6 +430,53 @@ export class KubernetesJobLauncher {
             return undefined;
         }
     }
+    /**
+     * Whether this spec's pod fits the free room in the namespace's ResourceQuota
+     * (KubernetesJobConfig.resourceQuota), counted from the same pod `launch` would create. Any
+     * doubt (no quota configured, unreadable, unparseable, a spec the pod builder rejects) answers
+     * yes, so the launch and the API server stay the authority.
+     */
+    async hasCapacityFor(spec) {
+        const quotaName = this.options.config.resourceQuota;
+        if (!quotaName)
+            return true;
+        let quota;
+        try {
+            quota = await this.api.readResourceQuota(this.namespace, quotaName);
+        }
+        catch {
+            this.warnOnce("kubernetes_resource_quota_unreadable: capacity is not checked before launch");
+            return true;
+        }
+        if (!quota) {
+            this.warnOnce(`kubernetes_resource_quota_missing: ${quotaName}; capacity is not checked before launch`);
+            return true;
+        }
+        let usage;
+        try {
+            const { runtimeClassName, priorityClassName, platform } = this.options.config;
+            // The proxy address only fills a hosts entry; it doesn't change what the pod requests.
+            const pod = buildRunPod(spec, {
+                namespace: this.namespace,
+                proxyIp: QUOTA_PROBE_PROXY_IP,
+                runtimeClassName,
+                priorityClassName,
+                platform,
+            });
+            usage = podQuotaUsage(pod);
+        }
+        catch {
+            return true;
+        }
+        return quotaShortfall(quota, usage) === null;
+    }
+    warnedOnce = new Set();
+    warnOnce(message) {
+        if (this.warnedOnce.has(message))
+            return;
+        this.warnedOnce.add(message);
+        this.warn(message);
+    }
     async launch(spec) {
         try {
             validateKubernetesSpec(spec);

package/dist/providers/jobs/types.d.ts

@@ -81,6 +81,13 @@ export interface JobLauncher {
      * cannot know the handle in advance omit this, and callers persist only after `launch` returns.
      */
     plannedHandle?: (spec: JobSpec) => JobHandle | undefined;
+    /**
+     * Whether the cluster has room for this spec's job right now (Kubernetes: the namespace
+     * ResourceQuota). Asked before a run claims a slot; false keeps the run queued so it is retried
+     * later instead of failing when the job is refused. Absent, or any doubt, means yes: the launch
+     * itself stays the authority.
+     */
+    hasCapacityFor?: (spec: JobSpec) => Promise<boolean>;
     launch: (spec: JobSpec) => Promise<JobHandle>;
     status: (handle: JobHandle) => Promise<JobStatus>;
     collect: (handle: JobHandle) => Promise<JobResult>;

package/dist/providers/review-host/ci.d.ts

@@ -0,0 +1,7 @@
+/** Host-neutral CI summary for repo_pr_read. */
+import type { CiCheckView, CiState } from "./types.js";
+/** Most CI results listed on one head. */
+export declare const MAX_CI_CHECKS = 50;
+export declare const FAILING_CONCLUSIONS: ReadonlySet<string>;
+export declare const PASSING_CONCLUSIONS: ReadonlySet<string>;
+export declare function summarizeCi(checks: readonly CiCheckView[]): Exclude<CiState, "unavailable">;

package/dist/providers/review-host/ci.js

@@ -0,0 +1,20 @@
+/** Most CI results listed on one head. */
+export const MAX_CI_CHECKS = 50;
+export const FAILING_CONCLUSIONS = new Set([
+    "failure",
+    "timed_out",
+    "action_required",
+    "startup_failure",
+    "error",
+]);
+export const PASSING_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
+export function summarizeCi(checks) {
+    if (checks.length === 0)
+        return "none";
+    if (checks.some((c) => c.status === "completed" && FAILING_CONCLUSIONS.has(c.conclusion ?? "")))
+        return "failing";
+    if (checks.some((c) => c.status !== "completed"))
+        return "pending";
+    const allPassing = checks.every((c) => PASSING_CONCLUSIONS.has(c.conclusion ?? ""));
+    return allPassing && checks.some((c) => c.conclusion === "success") ? "passing" : "inconclusive";
+}

package/dist/providers/review-host/github-events.d.ts

@@ -1,6 +1,13 @@
 import type { HostEvent } from "./types.js";
 export declare function verifyGitHubSignature(rawBody: string, header: string | undefined, secret: string): boolean;
+type Json = Record<string, unknown>;
+/**
+ * The run id in a PR description's marker. Only a PR the App itself authored
+ * counts: anyone can write the marker into their own PR's description.
+ */
+export declare function appMarkerRunId(pr: Json | null, slug: string): string | undefined;
 export declare function normalizeGitHubEvent(eventName: string, payload: unknown, app: {
     id: number;
     slug: string;
 }): HostEvent | null;
+export {};

package/dist/providers/review-host/github-events.js

@@ -11,6 +11,8 @@ const SAFE_SHA = /^[0-9a-f]{40}$/;
 const PUSH_MAX_COMMITS = 2048;
 const SAFE_BRANCH = /^[A-Za-z0-9._/-]{1,100}$/;
 const PUSH_MAX_PATHS = 1000;
+/** Pull requests one CI completion may re-review; a commit is rarely the head of more. */
+const MAX_CI_PRS = 10;
 /** Mirrors the runId shape validated in providers/vcs (github.ts, git.ts). */
 const SAFE_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 /** The hidden marker a coding run writes at the top of every PR it opens (providers/vcs/github.ts); legacy prefix too. */
@@ -44,14 +46,10 @@ function subjectOf(item) {
     return typeof item?.title === "string" ? { title: item.title, body: text(item.body) } : undefined;
 }
 /**
- * The run that opened this PR. Only a PR the App itself authored counts:
- * anyone can write the marker into their own PR's description. Only an open
- * PR counts too: a merged or closed PR's branch is stale (a squash merge leaves
- * its commits behind), so a follow-up there starts from the default branch.
+ * The run id in a PR description's marker. Only a PR the App itself authored
+ * counts: anyone can write the marker into their own PR's description.
  */
-function priorRunIdOf(pr, slug) {
-    if (pr?.state !== "open")
-        return undefined;
+export function appMarkerRunId(pr, slug) {
     const author = obj(pr?.user);
     if (author?.type !== "Bot" || typeof author.login !== "string")
         return undefined;
@@ -60,6 +58,16 @@ function priorRunIdOf(pr, slug) {
     const id = RUN_MARKER.exec(text(pr?.body))?.[1];
     return id && SAFE_RUN_ID.test(id) ? id : undefined;
 }
+/**
+ * The run that opened this PR, for a follow-up. Only an open PR counts: a
+ * merged or closed PR's branch is stale (a squash merge leaves its commits
+ * behind), so a follow-up there starts from the default branch.
+ */
+function priorRunIdOf(pr, slug) {
+    if (pr?.state !== "open")
+        return undefined;
+    return appMarkerRunId(pr, slug);
+}
 /**
  * A cheap pre-filter only: author_association is not a permission (MEMBER is
  * any org member, COLLABORATOR includes read and triage). The real gate is the
@@ -134,6 +142,22 @@ export function normalizeGitHubEvent(eventName, payload, app) {
         const isFork = typeof headRepo !== "string" || headRepo.toLowerCase() !== repository;
         return { kind: "pr_updated", provider: "github", repository, prNumber, headSha, isFork };
     }
+    if (eventName === "check_suite") {
+        if (p.action !== "completed")
+            return null;
+        const suite = obj(p.check_suite);
+        // wardby's own review check finishing is not CI.
+        if (int(obj(suite?.app)?.id) === app.id)
+            return null;
+        const headSha = suite?.head_sha;
+        if (typeof headSha !== "string" || !SAFE_SHA.test(headSha))
+            return null;
+        const prs = Array.isArray(suite?.pull_requests) ? suite.pull_requests : [];
+        const prNumbers = [...new Set(prs.map((pr) => int(obj(pr)?.number)).filter((n) => n !== null))];
+        if (prNumbers.length === 0)
+            return null;
+        return { kind: "ci_completed", provider: "github", repository, headSha, prNumbers: prNumbers.slice(0, MAX_CI_PRS) };
+    }
     if (eventName === "check_run") {
         if (p.action !== "rerequested")
             return null;

package/dist/providers/review-host/github.d.ts

@@ -4,8 +4,10 @@
  * the narrowest permission set that call needs (GitHubAppClient.withScopedToken),
  * and revokes it afterwards. See docs/private/2026-09-25-code-review-host-design.md §5.1.
  */
-import type { GitHubAppClient } from "../vcs/github.js";
-import { ReviewHostError, type CodeReviewHost, type CommentInput, type CommentRef, type CompleteCheckInput, type EditCommentInput, type FileListView, type FileReadResult, type HostPermission, type HostUser, type PublishReviewInput, type PublishReviewResult, type PullRequestHead, type PullRequestView, type StartCheckInput } from "./types.js";
+import { type GitHubAppClient } from "../vcs/github.js";
+import { ReviewHostError, type CiView, type CodeReviewHost, type CommentInput, type CommentRef, type CompleteCheckInput, type EditCommentInput, type FileListView, type FileReadResult, type HostPermission, type HostUser, type PublishReviewInput, type PublishReviewResult, type PullRequestHead, type PullRequestOrigin, type PullRequestView, type StartCheckInput } from "./types.js";
+/** listFiles leaves out vendored trees and lockfiles; every host applies the same filter. */
+export declare function skippedInListing(path: string): boolean;
 type Json = Record<string, unknown>;
 /** Maps GitHubAppClient's fixed error messages onto host-neutral codes; keeps the body-free message. */
 export declare function toReviewHostError(err: unknown): ReviewHostError;
@@ -21,7 +23,22 @@ export declare class GitHubReviewHost implements CodeReviewHost {
         login: string;
     }>;
     pullRequestHead(repository: string, prNumber: number): Promise<PullRequestHead>;
+    pullRequestOrigin(repository: string, prNumber: number): Promise<PullRequestOrigin>;
+    addLabel(repository: string, prNumber: number, label: string): Promise<void>;
+    replaceRelatedSection(repository: string, prNumber: number, input: {
+        expectedMarkerRunId: string;
+        block: string;
+    }): Promise<"updated" | "unchanged" | "skipped">;
     private head;
+    /**
+     * CI on one commit: check runs (Checks: read) minus wardby's own, then
+     * commit statuses (Commit statuses: read) best effort. Never throws: a
+     * failure reading check runs is state "unavailable", a failure reading
+     * statuses only sets statusesUnavailable. Both reads are attempted
+     * independently, so a failed checks read still mints (and attempts) the
+     * statuses token.
+     */
+    readCi(repository: string, headSha: string): Promise<CiView>;
     readPullRequest(repository: string, prNumber: number, opts: {
         sinceSha?: string;
         maxPatchChars: number;

package/dist/providers/review-host/github.js

@@ -1,5 +1,14 @@
+/**
+ * GitHub implementation of CodeReviewHost, acting as the wardby GitHub App.
+ * Each method mints its own installation token scoped to one repository and
+ * the narrowest permission set that call needs (GitHubAppClient.withScopedToken),
+ * and revokes it afterwards. See docs/private/2026-09-25-code-review-host-design.md §5.1.
+ */
+import { MAX_PULL_REQUEST_BODY_CHARS, upsertRelatedSection } from "../vcs/github.js";
 import { normalizeGitHubRepository } from "../../coding/protocol.js";
+import { MAX_CI_CHECKS, summarizeCi } from "./ci.js";
 import { partitionComments } from "./diff-lines.js";
+import { appMarkerRunId } from "./github-events.js";
 import { findingMarker, hasFindingMarker, hasReviewMarker, parseReviewMarker, renderInlineComment, renderSummaryComment, verdictConclusion, } from "./review-format.js";
 import { ReviewHostError, } from "./types.js";
 const READ = { contents: "read", pull_requests: "read" };
@@ -8,11 +17,22 @@ const MAX_FILE_PAGES = 3;
 const MAX_COMMENT_PAGES = 3;
 const MAX_LISTED_FILES = 1000;
 const VENDORED = /(^|\/)(node_modules|dist|\.venv)\//;
+/** listFiles leaves out vendored trees and lockfiles; every host applies the same filter. */
+export function skippedInListing(path) {
+    return VENDORED.test(path) || path.endsWith("package-lock.json");
+}
 const CHECK_TEXT_LIMIT = 65_535;
 const COMMENT_WRITE = { issues: "write", pull_requests: "write" };
 const REVIEW_WRITE = { pull_requests: "write", checks: "write" };
 /** Always implicitly granted to an installation token; enough for the collaborator-permission endpoint. */
 const METADATA_READ = { metadata: "read" };
+/** Editing a pull request's description: nothing else. */
+const PR_WRITE = { pull_requests: "write" };
+/** CI reads, each on its own token: Checks is already granted; Commit statuses may not be. */
+const CHECKS_READ = { checks: "read" };
+const STATUSES_READ = { statuses: "read" };
+const CI_NAME_CHARS = 100;
+const APP_SLUG = /^[a-z0-9-]{1,64}$/;
 const GITHUB_USER_ID = /^[1-9]\d{0,19}$/;
 const GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
 /** Highest first: user.permissions booleans, which (unlike the legacy field) keep maintain and triage apart. */
@@ -103,6 +123,31 @@ function fileView(raw) {
         changes: typeof raw.changes === "number" ? raw.changes : num(raw.additions) + num(raw.deletions),
     };
 }
+function checkRunView(raw) {
+    const status = raw.status === "completed" ? "completed" : raw.status === "in_progress" ? "in_progress" : "queued";
+    const app = raw.app && typeof raw.app === "object" ? raw.app : null;
+    return {
+        name: str(raw.name).slice(0, CI_NAME_CHARS),
+        kind: "check_run",
+        status,
+        conclusion: status === "completed" && typeof raw.conclusion === "string" ? raw.conclusion : null,
+        app: app && typeof app.slug === "string" && APP_SLUG.test(app.slug) ? app.slug : null,
+    };
+}
+function statusView(raw) {
+    const state = str(raw.state);
+    return {
+        name: str(raw.context).slice(0, CI_NAME_CHARS),
+        kind: "status",
+        status: state === "pending" ? "in_progress" : "completed",
+        conclusion: state === "pending" ? null : state,
+        app: null,
+    };
+}
+/** True for a check run wardby's own App created (its review checks, wardby/continuation). */
+function fromApp(raw, appId) {
+    return !!raw.app && typeof raw.app === "object" && raw.app.id === appId;
+}
 const THREADS_QUERY = `query($owner: String!, $name: String!, $number: Int!) {
   repository(owner: $owner, name: $name) {
     pullRequest(number: $number) {
@@ -205,6 +250,48 @@ export class GitHubReviewHost {
             return this.head(repository, pr);
         });
     }
+    async pullRequestOrigin(repository, prNumber) {
+        const { slug } = await this.client.appIdentity();
+        return this.withToken(repository, READ, async (get) => {
+            const pr = record(await (await get(`${repoPath(repository)}/pulls/${prNumber}`)).json());
+            const labels = Array.isArray(pr.labels)
+                ? pr.labels
+                    .map((l) => (l && typeof l === "object" ? str(l.name) : ""))
+                    .filter((name) => name !== "")
+                : [];
+            const markerRunId = appMarkerRunId(pr, slug);
+            return {
+                ...this.head(repository, pr),
+                labels,
+                merged: pr.merged === true,
+                draft: pr.draft === true,
+                ...(markerRunId ? { markerRunId } : {}),
+            };
+        });
+    }
+    async addLabel(repository, prNumber, label) {
+        await this.withToken(repository, COMMENT_WRITE, async (get) => {
+            await get(`${repoPath(repository)}/issues/${prNumber}/labels`, { method: "POST", body: JSON.stringify({ labels: [label] }) }, [200]);
+        });
+    }
+    async replaceRelatedSection(repository, prNumber, input) {
+        const { slug } = await this.client.appIdentity();
+        const base = repoPath(repository);
+        return this.withToken(repository, PR_WRITE, async (get) => {
+            const pr = record(await (await get(`${base}/pulls/${prNumber}`)).json());
+            // Re-checked on the body actually being edited: only the App's own PR for this run.
+            if (pr.state !== "open" || appMarkerRunId(pr, slug) !== input.expectedMarkerRunId)
+                return "skipped";
+            const body = typeof pr.body === "string" ? pr.body : "";
+            const next = upsertRelatedSection(body, input.block);
+            if (next === null || next.length > MAX_PULL_REQUEST_BODY_CHARS)
+                return "skipped";
+            if (next === body)
+                return "unchanged";
+            await get(`${base}/pulls/${prNumber}`, { method: "PATCH", body: JSON.stringify({ body: next }) }, [200]);
+            return "updated";
+        });
+    }
     head(repository, pr) {
         const head = record(pr.head);
         const headRepo = head.repo && typeof head.repo === "object" ? record(head.repo) : null;
@@ -216,9 +303,64 @@ export class GitHubReviewHost {
             headRepo.full_name.toLowerCase() !== normalizeGitHubRepository(repository);
         return { headSha, isFork, state: str(pr.state) };
     }
+    /**
+     * CI on one commit: check runs (Checks: read) minus wardby's own, then
+     * commit statuses (Commit statuses: read) best effort. Never throws: a
+     * failure reading check runs is state "unavailable", a failure reading
+     * statuses only sets statusesUnavailable. Both reads are attempted
+     * independently, so a failed checks read still mints (and attempts) the
+     * statuses token.
+     */
+    async readCi(repository, headSha) {
+        const base = repoPath(repository);
+        let checks = [];
+        let truncated = false;
+        let unavailableReason;
+        try {
+            const { id: appId } = await this.client.appIdentity();
+            ({ checks, truncated } = await this.withToken(repository, CHECKS_READ, async (get) => {
+                const payload = record(await (await get(`${base}/commits/${headSha}/check-runs?filter=latest&per_page=100`)).json());
+                const runs = list(payload.check_runs ?? []);
+                const total = typeof payload.total_count === "number" ? payload.total_count : runs.length;
+                return { checks: runs.filter((r) => !fromApp(r, appId)).map(checkRunView), truncated: total > runs.length };
+            }));
+        }
+        catch (err) {
+            unavailableReason = toReviewHostError(err).code;
+        }
+        let statusesUnavailable = false;
+        try {
+            const statuses = await this.withToken(repository, STATUSES_READ, async (get) => {
+                const payload = record(await (await get(`${base}/commits/${headSha}/status?per_page=100`)).json());
+                return list(payload.statuses ?? []).map(statusView);
+            });
+            checks = [...checks, ...statuses];
+        }
+        catch {
+            statusesUnavailable = true;
+        }
+        if (unavailableReason !== undefined) {
+            return {
+                headSha,
+                state: "unavailable",
+                checks: [],
+                truncated: false,
+                statusesUnavailable: true,
+                unavailableReason,
+            };
+        }
+        const shown = checks.slice(0, MAX_CI_CHECKS);
+        return {
+            headSha,
+            state: summarizeCi(checks),
+            checks: shown,
+            truncated: truncated || shown.length < checks.length,
+            statusesUnavailable,
+        };
+    }
     async readPullRequest(repository, prNumber, opts) {
         const base = repoPath(repository);
-        return this.withToken(repository, READ, async (get, graphql) => {
+        const view = await this.withToken(repository, READ, async (get, graphql) => {
             const pr = record(await (await get(`${base}/pulls/${prNumber}`)).json());
             const { headSha, isFork, state } = this.head(repository, pr);
             const prFiles = async () => {
@@ -298,6 +440,7 @@ export class GitHubReviewHost {
                 openThreads,
             };
         });
+        return { ...view, ci: await this.readCi(repository, view.headSha) };
     }
     async readFile(repository, path, ref, window) {
         assertRelativePath(path);
@@ -346,7 +489,7 @@ export class GitHubReviewHost {
             const tree = record(await (await get(`${base}/git/trees/${encodeURIComponent(resolvedRef)}?recursive=1`)).json());
             const entries = list(tree.tree)
                 .filter((e) => e.type === "blob" && typeof e.path === "string" && e.path.startsWith(pathPrefix))
-                .filter((e) => !VENDORED.test(str(e.path)) && !str(e.path).endsWith("package-lock.json"));
+                .filter((e) => !skippedInListing(str(e.path)));
             return {
                 ref: resolvedRef,
                 count: entries.length,

package/dist/providers/review-host/index.d.ts

@@ -1,9 +1,15 @@
+import { type LocalReviewHostOptions } from "./local.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "./types.js";
 export * from "./types.js";
 export { GitHubReviewHost } from "./github.js";
 export { GitHubUserAuthorizer } from "./github-user-auth.js";
-/** One host per configured provider; empty when no GitHub App is configured (the repo_* tools are then never offered). */
-export declare function buildReviewHosts(env?: NodeJS.ProcessEnv): ReviewHostRegistry;
+export { LocalReviewHost } from "./local.js";
+/**
+ * One host per configured provider: github when a GitHub App is configured,
+ * local always (the roots are re-read on every local call, so a link with no
+ * roots configured is refused with local_repo_not_allowed at call time).
+ */
+export declare function buildReviewHosts(env: NodeJS.ProcessEnv, db: LocalReviewHostOptions["db"]): ReviewHostRegistry;
 /**
  * One identity-linking flow per provider whose App has OAuth client
  * credentials (GITHUB_APP_CLIENT_ID/SECRET). Empty = link_host_account is

package/dist/providers/review-host/index.js

@@ -1,20 +1,31 @@
 import { loadGitHubUserAuthConfig, loadGitHubVcsConfig } from "../../config/providers.js";
+import { loadLocalRepoRoots } from "../../coding/local-repo.js";
 import { GitHubAppClient } from "../vcs/github.js";
 import { GitHubReviewHost } from "./github.js";
 import { GitHubUserAuthorizer } from "./github-user-auth.js";
+import { LocalReviewHost } from "./local.js";
 export * from "./types.js";
 export { GitHubReviewHost } from "./github.js";
 export { GitHubUserAuthorizer } from "./github-user-auth.js";
+export { LocalReviewHost } from "./local.js";
 function githubClient(env) {
     const github = loadGitHubVcsConfig(env);
     if (!github.appId || !github.privateKey)
         return null;
     return new GitHubAppClient({ appId: github.appId, privateKey: github.privateKey, apiVersion: github.apiVersion });
 }
-/** One host per configured provider; empty when no GitHub App is configured (the repo_* tools are then never offered). */
-export function buildReviewHosts(env = process.env) {
+/**
+ * One host per configured provider: github when a GitHub App is configured,
+ * local always (the roots are re-read on every local call, so a link with no
+ * roots configured is refused with local_repo_not_allowed at call time).
+ */
+export function buildReviewHosts(env, db) {
+    const hosts = {};
     const client = githubClient(env);
-    return client ? { github: new GitHubReviewHost(client) } : {};
+    if (client)
+        hosts.github = new GitHubReviewHost(client);
+    hosts.local = new LocalReviewHost({ db, roots: () => loadLocalRepoRoots(env).roots });
+    return hosts;
 }
 /**
  * One identity-linking flow per provider whose App has OAuth client

package/dist/providers/review-host/local.d.ts

@@ -0,0 +1,72 @@
+/**
+ * CodeReviewHost over local git repositories (`local:/abs/path`). A "pull
+ * request" is a LocalPullRequest row: a branch compared against a base in the
+ * repository, keyed by a durable number. Reviews and comments are stored as
+ * LocalReview rows; checks, reactions and threads are no-ops.
+ *
+ * Every read goes through git objects (`cat-file`, `ls-tree`, `diff A B`),
+ * never the working tree, in the canonical repository path that
+ * resolveLocalRepository returns at call time (the trusted roots can change).
+ * git runs with GIT_* stripped, hooks and fsmonitor off, no external diff or
+ * textconv drivers, and literal pathspecs. Every ref from the model or a row
+ * is checked before it reaches git (a 40-hex sha, or a branch name that
+ * `git check-ref-format --branch` accepts and that cannot read as an option),
+ * and revisions follow `--end-of-options`.
+ */
+import type { PrismaClient } from "#prisma";
+import { type CodeReviewHost, type CommentInput, type CommentRef, type CompleteCheckInput, type EditCommentInput, type FileListView, type FileReadResult, type HostPermission, type HostUser, type PublishReviewInput, type PublishReviewResult, type PullRequestHead, type PullRequestView, type StartCheckInput } from "./types.js";
+type Db = Pick<PrismaClient, "localPullRequest" | "localReview">;
+export interface LocalReviewHostOptions {
+    db: Db;
+    /** Trusted roots, read at each call (default: LOCAL_REPO_ROOTS). */
+    roots?: () => readonly string[];
+}
+export declare class LocalReviewHost implements CodeReviewHost {
+    readonly provider: "local";
+    private readonly db;
+    private readonly roots;
+    constructor(options: LocalReviewHostOptions);
+    /** The canonical repository and its realpath, checked against the current roots. */
+    private repo;
+    private pullRequest;
+    /** Rejects anything but a plain branch/tag name before it can reach git as a revision or an option. */
+    private assertRefName;
+    /** The commit a sha or branch name points at. */
+    private commitOf;
+    /** The repository's checked-out HEAD commit (its "default branch"), and a label for it. */
+    private defaultRef;
+    private resolveRef;
+    private isAncestor;
+    /** Files changed between two commits (both 40-hex), with rename detection, in git's order. */
+    private changedFiles;
+    /** Attaches patches, sharing one character budget across files and flagging truncation like GitHub. */
+    private withPatches;
+    repositoryPermission(_repository: string, _user: HostUser): Promise<{
+        level: HostPermission;
+        login: string;
+    }>;
+    readPullRequest(repository: string, prNumber: number, opts: {
+        sinceSha?: string;
+        maxPatchChars: number;
+        agentMarker: string;
+    }): Promise<PullRequestView>;
+    pullRequestHead(repository: string, prNumber: number): Promise<PullRequestHead>;
+    readFile(repository: string, path: string, ref: string | undefined, window: {
+        startLine: number;
+        maxLines: number;
+    }): Promise<FileReadResult>;
+    listFiles(repository: string, ref: string | undefined, pathPrefix?: string): Promise<FileListView>;
+    publishReview(repository: string, input: PublishReviewInput): Promise<PublishReviewResult>;
+    /** Stored as a COMMENT review on the branch's current head. The host is not told who comments: agentId is "". */
+    comment(repository: string, input: CommentInput): Promise<{
+        url: string;
+        id: string;
+    }>;
+    editComment(_repository: string, _input: EditCommentInput): Promise<void>;
+    acknowledge(_repository: string, _target: CommentRef): Promise<void>;
+    startCheck(_repository: string, _input: StartCheckInput): Promise<{
+        checkId: string;
+    }>;
+    completeCheck(_repository: string, _input: CompleteCheckInput): Promise<void>;
+}
+export {};