@weareikko/code-review 0.8.3 → 0.8.5

package/dist/{cli-CICuhytH.js → cli-DmzA9PxS.js}

@@ -1,7 +1,7 @@
 import { mkdir, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { existsSync, readFileSync } from "node:fs";
+import nodeFs, { existsSync, readFileSync } from "node:fs";
 import { getEnvApiKey, getModel } from "@earendil-works/pi-ai";
 import { createHash, randomUUID } from "node:crypto";
 import { tracingChannel } from "node:diagnostics_channel";
@@ -10,6 +10,9 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { Agent } from "@earendil-works/pi-agent-core";
 import { createReadOnlyTools } from "@earendil-works/pi-coding-agent";
+import { createTwoFilesPatch } from "diff";
+import * as git from "isomorphic-git";
+import { Type } from "typebox";
 import { homedir } from "node:os";
 import { parse } from "yaml";
 import { SpanKind, SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
@@ -512,7 +515,12 @@ function buildSizeNoticeBlock(notice) {
 	if (sizeSkippedFiles.length > 0) {
 		const fileList = sizeSkippedFiles.map((file) => `- \`${file.path}\` (${formatChars(file.chars)})`).join("\n");
 		const cov = notice.coverage;
-		const coverageLine = cov && cov.totalLines > 0 ? `> **Partial review — ~${Math.round(cov.reviewedLines / cov.totalLines * 100)}% of changed lines reviewed** (${cov.reviewedLines} of ${cov.totalLines}). The files below were NOT reviewed; their absence from the findings is not a clean bill of health.` : `> **${sizeSkippedFiles.length} file(s) were not reviewed** — the diff exceeded the size budget, so these files were dropped from the review:`;
+		const retrieved = notice.retrieved === true;
+		let coverageLine;
+		if (cov && cov.totalLines > 0) {
+			const pct = Math.round(cov.reviewedLines / cov.totalLines * 100);
+			coverageLine = retrieved ? `> **Large diff — ~${pct}% of changed lines fit the inline budget** (${cov.reviewedLines} of ${cov.totalLines}). The files below exceeded it and were staged for on-demand retrieval; see the review summary for which were read. Absence from the findings is not a clean bill of health.` : `> **Partial review — ~${pct}% of changed lines reviewed** (${cov.reviewedLines} of ${cov.totalLines}). The files below were NOT reviewed; their absence from the findings is not a clean bill of health.`;
+		} else coverageLine = retrieved ? `> **${sizeSkippedFiles.length} file(s) exceeded the size budget** — their diffs were staged for on-demand retrieval; see the review summary for which were read:` : `> **${sizeSkippedFiles.length} file(s) were not reviewed** — the diff exceeded the size budget, so these files were dropped from the review:`;
 		blocks.push([
 			`> [!WARNING]`,
 			coverageLine,
@@ -543,7 +551,7 @@ function buildSummaryBody(summary, costFooter, options = {}) {
 	return `${withFooter}\n\n${buildSummaryHistoryBlock(historyEntries)}`;
 }
 function buildReviewedCommitFooter(commitSha) {
-	return `Reviewed by ${PRODUCT_LINK} v0.8.3 for commit ${commitSha}.`;
+	return `Reviewed by ${PRODUCT_LINK} v0.8.5 for commit ${commitSha}.`;
 }
 function extractReviewedCommitSha(body) {
 	return REVIEWED_COMMIT_FOOTER_PATTERN.exec(body)?.[1] ?? null;
@@ -795,6 +803,12 @@ var REVIEW_DEPTHS = [
 	"verify",
 	"full"
 ];
+var REVIEW_INPUT_MODES = [
+	"auto",
+	"inline",
+	"disk",
+	"commits"
+];
 var THINKING_LEVELS = [
 	"off",
 	"minimal",
@@ -936,6 +950,7 @@ var BOOLEAN_FLAGS = new Set([
 	"no-summary",
 	"force-review",
 	"retrieve-skipped",
+	"no-retrieve-skipped",
 	"verbose",
 	"help",
 	"version"
@@ -994,6 +1009,22 @@ function resolvePostSummary(args, env) {
 	}
 	return true;
 }
+function resolveRetrieveSkipped(args, env) {
+	if (args.noRetrieveSkipped === true) return false;
+	if (args.retrieveSkipped === true) return true;
+	const raw = env.CODE_REVIEW_RETRIEVE_SKIPPED;
+	if (typeof raw === "string") {
+		const normalized = raw.trim().toLowerCase();
+		if ([
+			"0",
+			"false",
+			"no",
+			"off"
+		].includes(normalized)) return false;
+		if (normalized.length > 0) return true;
+	}
+	return true;
+}
 function normalizeChoice(value) {
 	return String(value ?? "").trim().toLowerCase();
 }
@@ -1189,6 +1220,7 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 		minSeverity: normalizeChoice(args.minSeverity ?? env.CODE_REVIEW_MIN_SEVERITY ?? "info"),
 		thinkingLevel: normalizeChoice(args.thinking ?? env.CODE_REVIEW_THINKING_LEVEL ?? "off"),
 		reviewDepth: normalizeChoice(args.reviewDepth ?? env.CODE_REVIEW_DEPTH ?? "single"),
+		inputMode: normalizeChoice(args.inputMode ?? env.CODE_REVIEW_INPUT_MODE ?? "auto"),
 		verifyModel: String(args.verifyModel ?? env.CODE_REVIEW_VERIFY_MODEL ?? ""),
 		postingMode: normalizeChoice(args.postingMode ?? env.CODE_REVIEW_POSTING_MODE ?? "direct"),
 		apiKey,
@@ -1197,7 +1229,7 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 		maxDiffChars,
 		decomposeHintLines,
 		diffContext,
-		retrieveSkipped: toBoolean(args.retrieveSkipped) || toBoolean(env.CODE_REVIEW_RETRIEVE_SKIPPED),
+		retrieveSkipped: resolveRetrieveSkipped(args, env),
 		reviewFile: String(args.reviewFile ?? "code-review.md"),
 		output: String(args.output ?? "review-comments.json"),
 		dryRun: toBoolean(args.dryRun),
@@ -1246,6 +1278,7 @@ function validateConfig(config) {
 	].includes(config.minSeverity)) throw new ConfigError("--min-severity must be one of: info, warn, critical");
 	if (!THINKING_LEVELS.includes(config.thinkingLevel)) throw new ConfigError(`--thinking must be one of: ${THINKING_LEVELS.join(", ")}`);
 	if (!REVIEW_DEPTHS.includes(config.reviewDepth)) throw new ConfigError(`--review-depth must be one of: ${REVIEW_DEPTHS.join(", ")}`);
+	if (config.inputMode !== void 0 && !REVIEW_INPUT_MODES.includes(config.inputMode)) throw new ConfigError(`--input-mode must be one of: ${REVIEW_INPUT_MODES.join(", ")}`);
 	if (!POSTING_MODES.includes(config.postingMode)) throw new ConfigError(`--posting-mode must be one of: ${POSTING_MODES.join(", ")}`);
 }
 //#endregion
@@ -1379,7 +1412,7 @@ function gitErrorMessage(error) {
 		err.stdout
 	].filter(Boolean).join("\n").trim();
 }
-async function git(args, options = {}) {
+async function git$1(args, options = {}) {
 	try {
 		const { stdout } = await exec$1("git", args, {
 			cwd: options.cwd,
@@ -1421,7 +1454,7 @@ function getMergeDiffCommand(targetBranch, options = {}) {
 	];
 }
 async function fetchBranch(remote, branch, options) {
-	await git([
+	await git$1([
 		"fetch",
 		"--no-tags",
 		remote,
@@ -1430,7 +1463,7 @@ async function fetchBranch(remote, branch, options) {
 }
 async function isTracked(path, options) {
 	try {
-		await git([
+		await git$1([
 			"ls-files",
 			"--error-unmatch",
 			"--",
@@ -1457,7 +1490,7 @@ async function removeGeneratedCodeQualityArtifacts(paths = DEFAULT_CODEQUALITY_A
 async function prepareGitHistory(sourceBranch, targetBranch, options = {}) {
 	const remote = options.remote ?? "origin";
 	await removeGeneratedCodeQualityArtifacts(options.codeQualityArtifacts, options);
-	await git([
+	await git$1([
 		"fetch",
 		"--unshallow",
 		"--no-tags",
@@ -1471,7 +1504,7 @@ async function prepareGitHistory(sourceBranch, targetBranch, options = {}) {
 	}
 	if (fetchErrors.length === 2) throw new GitError(`Unable to fetch MR source/target branches from ${remote}.`, { hint: fetchErrors.join("\n") });
 	try {
-		await git([
+		await git$1([
 			"merge-base",
 			remoteRef(remote, targetBranch),
 			"HEAD"
@@ -1485,7 +1518,7 @@ async function prepareGitHistory(sourceBranch, targetBranch, options = {}) {
 	}
 }
 async function getMergeDiff(targetBranch, options = {}) {
-	return git(getMergeDiffCommand(targetBranch, options), options);
+	return git$1(getMergeDiffCommand(targetBranch, options), options);
 }
 function getMergeCommitLogArguments(targetBranch, options = {}) {
 	return [
@@ -1496,7 +1529,7 @@ function getMergeCommitLogArguments(targetBranch, options = {}) {
 	];
 }
 async function getMergeCommitLog(targetBranch, options = {}) {
-	return git(["log", ...getMergeCommitLogArguments(targetBranch, options)], options);
+	return git$1(["log", ...getMergeCommitLogArguments(targetBranch, options)], options);
 }
 /**
 * Summarize a unified diff into file/line counts for telemetry. Counts one file
@@ -1524,6 +1557,171 @@ function summarizeDiff(diff) {
 	};
 }
 //#endregion
+//#region src/git-tool.ts
+/**
+* Custom read-only git tools for the reviewer agent (Mode C: commit exploration).
+*
+* The reviewer's default toolbox (`createReadOnlyTools`) has no git access, and a
+* general bash tool is unsafe here — the reviewer processes attacker-controlled
+* MR content with CI credentials in the environment. These tools expose only
+* three read-only operations, backed by isomorphic-git (pure JS, no shell-out,
+* so there is no command-injection surface) and scoped to a single repo dir:
+*
+* - `git_log`: list commits (optionally the range since a base ref).
+* - `git_show`: a commit's message + unified diff against its first parent.
+* - `git_diff`: unified diff between two refs.
+*
+* Ref arguments are validated to sha/ref shapes; nothing is passed to a shell.
+*/
+/** Accept 4-40 hex sha prefixes or conservative ref names (branch/tag/HEAD~n). */
+var REF_RE = /^[0-9a-zA-Z._/~^-]{1,120}$/;
+var MAX_PATCH_BYTES = 2e5;
+function assertRef(ref) {
+	if (!REF_RE.test(ref)) throw new Error(`Invalid git ref: ${JSON.stringify(ref)}`);
+}
+function text(body) {
+	return {
+		content: [{
+			type: "text",
+			text: body
+		}],
+		details: void 0
+	};
+}
+async function resolveOid(dir, fs, ref) {
+	assertRef(ref);
+	return git.resolveRef({
+		fs,
+		dir,
+		ref
+	}).catch(() => git.expandOid({
+		fs,
+		dir,
+		oid: ref
+	}));
+}
+function decode(data) {
+	if (data.includes(0)) return null;
+	return Buffer.from(data).toString("utf8");
+}
+async function readFileAt(dir, fs, oid, filepath) {
+	try {
+		const { blob } = await git.readBlob({
+			fs,
+			dir,
+			oid,
+			filepath
+		});
+		return decode(blob);
+	} catch {
+		return null;
+	}
+}
+/** Unified diff of every changed file between two commit oids. */
+async function diffCommits(dir, fs, oldOid, newOid) {
+	const trees = oldOid ? [git.TREE({ ref: oldOid }), git.TREE({ ref: newOid })] : [git.TREE({ ref: newOid })];
+	const changed = await git.walk({
+		fs,
+		dir,
+		trees,
+		map: async (filepath, entries) => {
+			if (filepath === ".") return void 0;
+			if (!oldOid) {
+				const [b] = entries;
+				return b && await b.type() === "blob" ? filepath : void 0;
+			}
+			const [a, b] = entries;
+			if ((a ? await a.oid() : void 0) === (b ? await b.oid() : void 0)) return void 0;
+			const aType = a ? await a.type() : void 0;
+			const bType = b ? await b.type() : void 0;
+			if (aType === "tree" || bType === "tree") return void 0;
+			return filepath;
+		}
+	});
+	const patches = [];
+	let patchBytes = 0;
+	for (const filepath of changed.sort()) {
+		const before = oldOid ? await readFileAt(dir, fs, oldOid, filepath) ?? "" : "";
+		const after = await readFileAt(dir, fs, newOid, filepath) ?? "";
+		if (before === after) continue;
+		const patch = createTwoFilesPatch(`a/${filepath}`, `b/${filepath}`, before, after);
+		patches.push(patch);
+		patchBytes += patch.length + 1;
+		if (patchBytes > MAX_PATCH_BYTES) {
+			patches.push(`\n[diff truncated at ${MAX_PATCH_BYTES} bytes — open the file directly for the rest]`);
+			break;
+		}
+	}
+	return patches.join("\n") || "(no textual changes)";
+}
+/**
+* Build the read-only git tools scoped to `dir` (the repo root). Returns an empty
+* array when `dir` is not a git repository, so callers can wire it
+* unconditionally.
+*/
+function createGitTools(dir, options = {}) {
+	const fs = options.fs ?? nodeFs;
+	if (!fs.existsSync(join(dir, ".git"))) return [];
+	return [
+		{
+			name: "git_log",
+			label: "git log",
+			description: "List commits in this repository (newest first). Optionally pass `since` (a ref/sha) to list only commits after it — the range you have not reviewed yet.",
+			parameters: Type.Object({
+				since: Type.Optional(Type.String({ description: "Only list commits after this ref/sha (exclusive)." })),
+				maxCount: Type.Optional(Type.Number({ description: "Maximum number of commits to return (default 50)." }))
+			}),
+			async execute(_id, params) {
+				const depth = Math.min(Math.max(params.maxCount ?? 50, 1), 500);
+				const commits = await git.log({
+					fs,
+					dir,
+					depth
+				});
+				let stop = -1;
+				if (params.since) {
+					const sinceOid = await resolveOid(dir, fs, params.since);
+					stop = commits.findIndex((c) => c.oid === sinceOid);
+					if (stop < 0) return text(`(base ref ${params.since} is not within the ${depth} most recent commits — re-run git_log with a larger maxCount to cover the full unreviewed range)`);
+				}
+				const list = (stop >= 0 ? commits.slice(0, stop) : commits).map((c) => {
+					const subject = c.commit.message.split("\n", 1)[0];
+					return `${c.oid.slice(0, 10)}  ${subject}  (${c.commit.author.name})`;
+				});
+				return text(list.length ? list.join("\n") : "(no commits in range)");
+			}
+		},
+		{
+			name: "git_show",
+			label: "git show",
+			description: "Show a commit's message and its unified diff against its first parent. Pass `ref` (a sha or ref).",
+			parameters: Type.Object({ ref: Type.String({ description: "The commit sha or ref to show." }) }),
+			async execute(_id, params) {
+				const oid = await resolveOid(dir, fs, params.ref);
+				const { commit } = await git.readCommit({
+					fs,
+					dir,
+					oid
+				});
+				const diff = await diffCommits(dir, fs, commit.parent[0] ?? null, oid);
+				return text(`commit ${oid}\nAuthor: ${commit.author.name} <${commit.author.email}>\n\n${commit.message.trim()}\n\n${diff}`);
+			}
+		},
+		{
+			name: "git_diff",
+			label: "git diff",
+			description: "Unified diff between two refs/shas. Pass `from` and `to`.",
+			parameters: Type.Object({
+				from: Type.String({ description: "Base ref/sha." }),
+				to: Type.String({ description: "Target ref/sha." })
+			}),
+			async execute(_id, params) {
+				return text(await diffCommits(dir, fs, await resolveOid(dir, fs, params.from), await resolveOid(dir, fs, params.to)));
+			}
+		}
+	];
+}
+//#endregion
 //#region src/logger.ts
 var LEVELS = {
 	debug: 0,
@@ -2206,11 +2404,12 @@ function atEndOfBlockComment(text, i) {
 }
 //#endregion
 //#region src/verify.ts
-function buildVerifySystemPrompt(diff, commitLog) {
+function buildVerifySystemPrompt(diff, commitLog, staged) {
+	const diskMode = staged !== void 0 && staged.length > 0;
 	const parts = [
 		"You are a strict, adversarial verifier of a SINGLE code-review finding. Your job is to REFUTE the finding, not to agree with it.",
 		"",
-		"Each request gives you one proposed finding (file, line, severity, confidence, and body) to check against the diff below. You may read referenced files to confirm reachability. Decide whether the finding survives scrutiny.",
+		diskMode ? "Each request gives you one proposed finding (file, line, severity, confidence, and body). The change is NOT inline below — every file diff is staged on disk (see <staged_files>). Open the finding's file (and any others you need) with your file-read tool to check reachability. Decide whether the finding survives scrutiny." : "Each request gives you one proposed finding (file, line, severity, confidence, and body) to check against the diff below. You may read referenced files to confirm reachability. Decide whether the finding survives scrutiny.",
 		"",
 		"Apply this bar:",
 		"- The finding must point to a concrete defect demonstrable from the diff (and any file you read): a specific input, state, or execution path triggers it, and a violated contract is visible.",
@@ -2226,7 +2425,10 @@ function buildVerifySystemPrompt(diff, commitLog) {
 		"- \"drop\": not a real defect — speculative, stylistic, contradicted by the code/comments, or based on external state not visible in the diff."
 	];
 	if (commitLog?.trim()) parts.push("", `Commit messages for this change (oldest first):\n<commits>\n${commitLog.trim()}\n</commits>`);
-	parts.push("", `Verify each finding against this diff:\n<diff>\n${diff}\n</diff>`);
+	if (diskMode) {
+		const list = staged.map((f) => `- ${f.path} → ${f.diskPath}`).join("\n");
+		parts.push("", `The change is staged on disk — open the relevant file(s) to verify:\n<staged_files>\n${list}\n</staged_files>`);
+	} else parts.push("", `Verify each finding against this diff:\n<diff>\n${diff}\n</diff>`);
 	return parts.join("\n");
 }
 function buildVerifyUserPrompt(comment) {
@@ -3015,18 +3217,18 @@ function gitSkillCacheKey(url, ref) {
 * remote's default branch via `HEAD`.
 */
 async function gitShallowClone(url, ref, dir) {
-	await git([
+	await git$1([
 		"init",
 		"--quiet",
 		dir
 	]);
-	await git([
+	await git$1([
 		"remote",
 		"add",
 		"origin",
 		url
 	], { cwd: dir });
-	await git([
+	await git$1([
 		"fetch",
 		"--depth",
 		"1",
@@ -3034,7 +3236,7 @@ async function gitShallowClone(url, ref, dir) {
 		"origin",
 		ref || "HEAD"
 	], { cwd: dir });
-	await git([
+	await git$1([
 		"checkout",
 		"--quiet",
 		"FETCH_HEAD"
@@ -3176,11 +3378,18 @@ async function cleanupSkippedDiffs(cwd) {
 	});
 }
 /**
-* Render the `<skipped_files>` block for the retrieval mode: each dropped file
-* with its on-disk diff path and an instruction to read the highest-risk ones.
+* Render the `<skipped_files>` block: each file with its on-disk diff path and an
+* instruction to read them.
+*
+* - `partial` (retrieval mode): only budget-dropped files are staged; the rest
+*   of the diff is inline, so the agent reads the highest-risk staged files.
+* - `full` (disk input mode): the ENTIRE change is staged — nothing is inline —
+*   so reading is not optional; the review is only as good as what gets opened.
 */
-function renderRetrievableSkippedBlock(files) {
-	return `<skipped_files>\n${files.map((f) => `- ${f.path} → ${f.diskPath}`).join("\n")}\n</skipped_files>\nThese files exceeded the inline size budget, so their diffs are NOT in the prompt above — but each is staged on disk at the path shown. Use your file-read tool to open the diffs most likely to contain defects (start with source files over config/tests) and review them as if they were inline. You may not have budget to read them all; say in your summary which you reviewed and which you did not.`;
+function renderRetrievableSkippedBlock(files, mode = "partial") {
+	const list = files.map((f) => `- ${f.path} → ${f.diskPath}`).join("\n");
+	if (mode === "full") return `<skipped_files>\n${list}\n</skipped_files>\nThis review has NO diff inline — every changed file's diff is staged on disk at the path shown, and the list above is the complete change. Use your file-read tool to open and review them; a file you do not open is a file you did not review. Prioritise source files over config/tests/generated, but aim to cover the whole change. In your summary, state explicitly which files you reviewed and which you did not open.`;
+	return `<skipped_files>\n${list}\n</skipped_files>\nThese files exceeded the inline size budget, so their diffs are NOT in the prompt above — but each is staged on disk at the path shown. Use your file-read tool to open the diffs most likely to contain defects (start with source files over config/tests) and review them as if they were inline. You may not have budget to read them all; say in your summary which you reviewed and which you did not.`;
 }
 //#endregion
 //#region src/triage.ts
@@ -3569,13 +3778,22 @@ function filterDiff(raw, maxChars = DEFAULT_MAX_DIFF_CHARS) {
 		totalChars += section.length;
 		reviewedChangedLines += changedLines;
 	}
+	const allSections = kept.map((section) => {
+		const filePath = parseFilePath(section.split("\n", 1)[0] ?? "");
+		return filePath ? {
+			path: filePath,
+			section,
+			changedLines: countChangedLines(section)
+		} : null;
+	}).filter((entry) => entry !== null);
 	return {
 		diff: included.join(""),
 		noiseSkippedFiles,
 		sizeSkippedFiles,
 		reviewedChangedLines,
 		skippedChangedLines,
-		sizeSkippedSections
+		sizeSkippedSections,
+		allSections
 	};
 }
 function mergeContent(files) {
@@ -3781,17 +3999,27 @@ function buildAngleSystemPrompt(context, minSeverity, angle) {
 		"</review_angle>"
 	].join("\n");
 }
-function buildUserPrompt(diff, skippedFiles = [], commitLog, priorThreads, intent, coverage, retrievableSkipped) {
+function buildUserPrompt(diff, skippedFiles = [], commitLog, priorThreads, intent, coverage, retrievableSkipped, omitInlineDiff = false, commitExploration) {
 	const parts = [];
 	const intentBlock = renderIntentBlock(intent);
 	if (intentBlock) parts.push(`The author described the purpose of this change below. Use it as context for reading the diff. If the code omits something promised or adds something never claimed, note it in one line of the summary — do not raise inline findings on the description text itself:\n${intentBlock}`);
 	if (commitLog?.trim()) parts.push(`Commits in this MR (oldest first):\n<commits>\n${commitLog.trim()}\n</commits>`);
-	parts.push(`Review this diff:\n<diff>\n${diff}\n</diff>`);
-	if (retrievableSkipped && retrievableSkipped.length > 0) parts.push(renderRetrievableSkippedBlock(retrievableSkipped));
-	else if (skippedFiles.length > 0) parts.push(`<skipped_files>\n${skippedFiles.map((file) => `- ${file}`).join("\n")}\n</skipped_files>\nThe above files were not included because the diff exceeded the size limit. Mention them explicitly in your summary as not reviewed.`);
+	if (commitExploration) {
+		const since = commitExploration.sinceRef;
+		parts.push([
+			"This review has NO diff inline. Explore the change with the read-only git tools:",
+			since ? `- \`git_log\` with since="${since}" lists the commits you have NOT reviewed yet (everything after ${since}). Review exactly those commits.` : "- `git_log` lists the commits in this change. Review all of them.",
+			"- `git_show <sha>` shows a commit's message and full diff. Open every commit in scope.",
+			"- `git_diff <from> <to>` shows the combined diff between two points if you prefer to review the range at once.",
+			"A commit you do not open is code you did not review. In your summary, state which commits you reviewed."
+		].join("\n"));
+	}
+	if (!omitInlineDiff && !commitExploration) parts.push(`Review this diff:\n<diff>\n${diff}\n</diff>`);
+	if (retrievableSkipped && retrievableSkipped.length > 0) parts.push(renderRetrievableSkippedBlock(retrievableSkipped, omitInlineDiff ? "full" : "partial"));
+	else if (skippedFiles.length > 0) parts.push(`<skipped_files>\n${skippedFiles.map((file) => `- ${file}`).join("\n")}\n</skipped_files>\nThe above files were not included because the diff exceeded the size limit. They are already surfaced to the reader in the MR summary, so do not re-list them; just do not assume they are clean, since you did not see them.`);
 	if (coverage && coverage.totalLines > 0 && coverage.reviewedLines < coverage.totalLines) {
 		const pct = Math.round(coverage.reviewedLines / coverage.totalLines * 100);
-		parts.push(`<coverage>You reviewed ${coverage.reviewedLines} of ${coverage.totalLines} changed lines (~${pct}%). The rest were dropped for the size budget and you did NOT see them. State this partial coverage in your summary and do not imply the unreviewed files are clean — their absence from your findings is not a clearance.</coverage>`);
+		parts.push(`<coverage>You reviewed ${coverage.reviewedLines} of ${coverage.totalLines} changed lines (~${pct}%). The rest were dropped for the size budget and you did NOT see them. The MR summary already reports this partial coverage to the reader, so do not restate it; just do not imply the unreviewed files are clean — their absence from your findings is not a clearance.</coverage>`);
 	}
 	if (priorThreads && priorThreads.length > 0) {
 		const block = renderPriorThreadsBlock(priorThreads);
@@ -4007,32 +4235,86 @@ function accumulateUsage(target, message, modelId) {
 		addUsageToBucket(bucket, message);
 	}
 }
+/**
+* The "consider decomposing this MR" hint: present when a threshold is set
+* (`> 0`) and the change exceeds it. `changedLines` is the count the caller
+* deems reviewed — the budget-fitted subset for inline mode, the whole change
+* for disk/commits mode.
+*/
+function resolveDecomposeHint(threshold, reviewedLines) {
+	return threshold > 0 && reviewedLines > threshold ? {
+		lines: reviewedLines,
+		threshold
+	} : void 0;
+}
 async function runReview(config, options) {
 	const cwd = options.cwd ?? config.cwd;
 	const minSeverity = toGitLabReviewSeverity(config.minSeverity);
 	const logger = options.logger ?? noopLogger;
+	const inputMode = config.inputMode ?? "auto";
+	const gitTools = createGitTools(cwd);
+	let commitsMode = inputMode === "commits";
+	if (commitsMode && gitTools.length === 0) {
+		logger.warn("Commit-exploration input mode requires a git checkout, but none was found in cwd; falling back to auto input mode.");
+		commitsMode = false;
+	}
+	const effectiveMode = commitsMode ? "commits" : inputMode === "commits" ? "auto" : inputMode;
 	const maxDiffChars = config.maxDiffChars > 0 ? config.maxDiffChars : DEFAULT_MAX_DIFF_CHARS;
-	const { diff, noiseSkippedFiles, sizeSkippedFiles, reviewedChangedLines, skippedChangedLines, sizeSkippedSections } = filterDiff(options.diff, maxDiffChars);
-	if (!diff.trim()) throw new ReviewerError("No reviewable diff content after filtering noise files.", { hint: "Ensure the merge request introduces changes outside of generated/lock files." });
-	const skippedFiles = [...sizeSkippedFiles.map((f) => f.path), ...noiseSkippedFiles];
-	const decomposeHint = config.decomposeHintLines > 0 && reviewedChangedLines > config.decomposeHintLines ? {
-		lines: reviewedChangedLines,
-		threshold: config.decomposeHintLines
-	} : void 0;
-	const coverage = sizeSkippedFiles.length > 0 ? {
-		reviewedLines: reviewedChangedLines,
-		totalLines: reviewedChangedLines + skippedChangedLines
-	} : void 0;
-	const sizeNotice = {
-		sizeSkippedFiles,
-		decomposeHint,
-		coverage
-	};
-	const retrievableSkipped = config.retrieveSkipped && sizeSkippedSections.length > 0 ? await writeSkippedDiffs(cwd, sizeSkippedSections) : [];
-	if (retrievableSkipped.length > 0) logger.info(`Staged ${retrievableSkipped.length} dropped-file diff(s) on disk for retrieval.`);
+	const { diff, noiseSkippedFiles, sizeSkippedFiles, reviewedChangedLines, skippedChangedLines, sizeSkippedSections, allSections } = filterDiff(options.diff, maxDiffChars);
+	const overflowed = sizeSkippedSections.length > 0;
+	const diskMode = effectiveMode === "disk" || effectiveMode === "auto" && overflowed;
+	if (effectiveMode === "auto") logger.info(diskMode ? `Auto input mode: diff exceeds the ${maxDiffChars}-char budget — staging all files on disk for the agent to read.` : "Auto input mode: diff fits the budget — reviewing inline.");
+	if (!(diskMode || commitsMode ? allSections.length > 0 : diff.trim().length > 0)) throw new ReviewerError("No reviewable diff content after filtering noise files.", { hint: "Ensure the merge request introduces changes outside of generated/lock files." });
+	const decomposeHint = resolveDecomposeHint(config.decomposeHintLines, diskMode || commitsMode ? reviewedChangedLines + skippedChangedLines : reviewedChangedLines);
+	let promptDiff;
+	let promptSkippedFiles;
+	let promptCoverage;
+	let retrievableSkipped;
+	let sizeNotice;
+	if (commitsMode) {
+		retrievableSkipped = [];
+		promptDiff = "";
+		promptSkippedFiles = [];
+		promptCoverage = void 0;
+		sizeNotice = {
+			sizeSkippedFiles: [],
+			decomposeHint,
+			retrieved: false
+		};
+		logger.info(options.sinceRef ? `Commit-exploration input mode: reviewing commits since ${options.sinceRef}.` : "Commit-exploration input mode: reviewing the full commit range.");
+	} else if (diskMode) {
+		retrievableSkipped = allSections.length > 0 ? await writeSkippedDiffs(cwd, allSections.map(({ path, section }) => ({
+			path,
+			section
+		}))) : [];
+		if (retrievableSkipped.length > 0) logger.info(`Disk input mode: staged ${retrievableSkipped.length} file diff(s) for on-demand review.`);
+		promptDiff = "";
+		promptSkippedFiles = [];
+		promptCoverage = void 0;
+		sizeNotice = {
+			sizeSkippedFiles: [],
+			decomposeHint,
+			retrieved: false
+		};
+	} else {
+		promptSkippedFiles = [...sizeSkippedFiles.map((f) => f.path), ...noiseSkippedFiles];
+		promptCoverage = sizeSkippedFiles.length > 0 ? {
+			reviewedLines: reviewedChangedLines,
+			totalLines: reviewedChangedLines + skippedChangedLines
+		} : void 0;
+		retrievableSkipped = config.retrieveSkipped && sizeSkippedSections.length > 0 ? await writeSkippedDiffs(cwd, sizeSkippedSections) : [];
+		if (retrievableSkipped.length > 0) logger.info(`Staged ${retrievableSkipped.length} dropped-file diff(s) on disk for retrieval.`);
+		promptDiff = diff;
+		sizeNotice = {
+			sizeSkippedFiles,
+			decomposeHint,
+			coverage: promptCoverage,
+			retrieved: retrievableSkipped.length > 0
+		};
+	}
 	const context = await loadReviewContext(cwd, config.skills, (msg) => logger.warn(msg), { refreshGitSkills: config.refreshGitSkills });
 	const systemPrompt = buildJSONSystemPrompt(context, minSeverity);
-	const userPrompt = buildUserPrompt(diff, skippedFiles, options.commitLog, options.priorThreads, options.intent, coverage, retrievableSkipped);
+	const userPrompt = buildUserPrompt(promptDiff, promptSkippedFiles, options.commitLog, options.priorThreads, options.intent, promptCoverage, retrievableSkipped, diskMode, commitsMode ? { sinceRef: options.sinceRef } : void 0);
 	const skillNames = context.skills.map((s) => s.name);
 	if (skillNames.length > 0) logger.debug(`Skills loaded: ${skillNames.join(", ")}`);
 	if (context.conventions.length > 0) logger.debug(`Conventions: ${context.conventions.map((f) => f.path).join(", ")}`);
@@ -4040,7 +4322,7 @@ async function runReview(config, options) {
 	const pool = buildEffectivePool(config, logger);
 	if (pool.length > 1) logger.info(`Model pool: ${pool.map((m) => m.id).join(", ")}.`);
 	const primary = pool[0];
-	const tools = createReadOnlyTools(cwd);
+	const tools = [...createReadOnlyTools(cwd), ...gitTools];
 	const createAgent = options.createAgent ?? defaultCreateAgent;
 	const timeoutMs = options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS;
 	const aggregated = emptyUsage();
@@ -4052,7 +4334,9 @@ async function runReview(config, options) {
 		timeoutMs,
 		logger,
 		aggregated,
-		verifyMember: resolveVerifyMember(config, primary, logger)
+		verifyMember: resolveVerifyMember(config, primary, logger),
+		attachTelemetry: options.attachTelemetry,
+		verifyStaged: diskMode ? retrievableSkipped : void 0
 	};
 	let outputText;
 	if (config.reviewDepth === "full") {
@@ -4218,6 +4502,7 @@ async function runMultiAngleFind(context, minSeverity, userPrompt, deps) {
 			thinkingLevel: deps.thinkingLevel,
 			getApiKey: member.getApiKey
 		});
+		const detachTelemetry = deps.attachTelemetry?.(agent);
 		try {
 			const parsed = parseReviewMarkdownWithWarnings(await runAgentToCompletion(agent, userPrompt, {
 				timeoutMs: deps.timeoutMs,
@@ -4231,6 +4516,8 @@ async function runMultiAngleFind(context, minSeverity, userPrompt, deps) {
 			summaries[index] = parsed.summary;
 		} catch (error) {
 			deps.logger.warn(`Find angle "${angle.key}" failed: ${error.message}; skipping.`);
+		} finally {
+			detachTelemetry?.();
 		}
 	}), FIND_CONCURRENCY);
 	const raw = groups.reduce((total, group) => total + group.length, 0);
@@ -4256,7 +4543,7 @@ async function verifyAndSynthesize(findings, summary, diff, commitLog, deps) {
 	})).filter(({ finding }) => finding.comment.severity === "critical" || finding.comment.severity === "warn");
 	const verdicts = /* @__PURE__ */ new Map();
 	if (severe.length > 0) {
-		const verifySystemPrompt = buildVerifySystemPrompt(diff, commitLog);
+		const verifySystemPrompt = buildVerifySystemPrompt(diff, commitLog, deps.verifyStaged);
 		await runBounded(severe.map(({ finding, index }) => async () => {
 			const comment = finding.comment;
 			const verifierMember = deps.verifyMember ?? pickVerifier(deps.pool, finding.authorModel);
@@ -4267,6 +4554,7 @@ async function verifyAndSynthesize(findings, summary, diff, commitLog, deps) {
 				thinkingLevel: deps.thinkingLevel,
 				getApiKey: verifierMember.getApiKey
 			});
+			const detachTelemetry = deps.attachTelemetry?.(verifier);
 			try {
 				const text = await runAgentToCompletion(verifier, buildVerifyUserPrompt(comment), {
 					timeoutMs: deps.timeoutMs,
@@ -4279,6 +4567,8 @@ async function verifyAndSynthesize(findings, summary, diff, commitLog, deps) {
 					decision: "keep",
 					reason: "verifier error; finding kept"
 				});
+			} finally {
+				detachTelemetry?.();
 			}
 		}), VERIFY_CONCURRENCY);
 	}
@@ -4909,7 +5199,7 @@ async function loadDefaultRuntime() {
 	const [sdkNode, resources, semconv] = modules;
 	const serviceResource = resources.resourceFromAttributes({
 		[semconv.ATTR_SERVICE_NAME ?? "service.name"]: SERVICE_NAME,
-		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.8.3"
+		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.8.5"
 	});
 	process.env.OTEL_METRICS_EXPORTER = process.env.OTEL_METRICS_EXPORTER ?? "otlp";
 	process.env.OTEL_LOGS_EXPORTER = process.env.OTEL_LOGS_EXPORTER ?? "otlp";
@@ -5341,7 +5631,7 @@ function boldCommentTitle(body) {
 */
 function buildCommentBody(body, commitSha, confidence) {
 	const confidenceLine = `_Confidence: ${confidence}._`;
-	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.8.3 for commit ${commitSha}.</sub>`;
+	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.8.5 for commit ${commitSha}.</sub>`;
 	return `${boldCommentTitle(body.trim())}\n\n${confidenceLine}\n\n---\n\n${footer}`;
 }
 function buildPayload(comment, body, refs, resolved) {
@@ -6066,15 +6356,21 @@ Options:
                           context aids reasoning but inflates tokens and fits fewer files in
                           the budget; less fits more. 0 = built-in default (20).
                           (env: CODE_REVIEW_DIFF_CONTEXT)
-  --retrieve-skipped      Stage diffs for files dropped by the size budget on disk so the
-                          reviewer can read them on demand instead of losing them.
-                          (env: CODE_REVIEW_RETRIEVE_SKIPPED=true)
+  --no-retrieve-skipped   Disable staging diffs for files dropped by the size budget on disk.
+                          Retrieval is on by default: dropped diffs are staged so the reviewer
+                          can read them on demand instead of losing them.
+                          (env: CODE_REVIEW_RETRIEVE_SKIPPED=0)
   --min-severity <level>  info, warn, or critical (default: info)
   --thinking <level>      off, minimal, low, medium, high, or xhigh (default: off).
                           Higher levels add billable thinking tokens at the model output rate.
   --review-depth <depth>  single (one pass), verify (adversarial re-check of each
                           severe finding), or full (multi-angle finders → triage →
                           verify). (default: single; env: CODE_REVIEW_DEPTH)
+  --input-mode <mode>     How the change is fed to the reviewer: auto (inline while it
+                          fits the budget, disk on overflow), inline (diff in the prompt),
+                          disk (every file diff staged on disk; the agent reads on demand),
+                          or commits (agent explores via read-only git tools).
+                          (default: auto; env: CODE_REVIEW_INPUT_MODE)
   --verify-model <p/id>   Model for the Verify stage (verify/full depth). Pairs a cheap
                           finder with a strong, high-precision verifier. Warns if it looks
                           cheaper than --model. Empty (default) = pool selection.
@@ -6181,7 +6477,8 @@ async function run(config, bridges) {
 						description: mr.description
 					},
 					logger,
-					attachTelemetry: bridges?.otel?.createAgentTelemetry(runId)
+					attachTelemetry: bridges?.otel?.createAgentTelemetry(runId),
+					sinceRef: config.inputMode === "commits" && reviewedCommitSha && reviewedCommitSha !== refs.head_sha ? reviewedCommitSha : void 0
 				});
 				context.usage = result;
 				return result;
@@ -6428,10 +6725,10 @@ async function main(argv = process.argv.slice(2)) {
 		return;
 	}
 	if (argv.includes("--version") || argv.includes("-v")) {
-		console.log("0.8.3");
+		console.log("0.8.5");
 		return;
 	}
-	process.stderr.write(`[code-review] @weareikko/code-review v0.8.3\n`);
+	process.stderr.write(`[code-review] @weareikko/code-review v0.8.5\n`);
 	assertNodeVersion();
 	applyCodeReviewEnvPrefix();
 	applyDefaultCacheRetention();
@@ -6454,4 +6751,4 @@ if (isDirectRun()) main().catch((error) => {
 //#endregion
 export { normalizeBody as $, SUMMARY_HISTORY_END as A, buildSummaryHistoryEntries as B, createDiagnosticContext as C, traceDiagnosticPhase as D, traceDiagnostic as E, SUMMARY_MARKER as F, findExistingSummaryNoteId as G, extractSummaryHistoryEntries as H, buildArchivedSummaryEntry as I, upsertSummaryNote as J, stripSummaryHistory as K, buildReviewedCommitFooter as L, SUMMARY_HISTORY_ENTRY_START as M, SUMMARY_HISTORY_LIMIT as N, normalizeSeverity as O, SUMMARY_HISTORY_START as P, fingerprints as Q, buildSizeNoticeBlock as R, DIAGNOSTIC_CHANNEL_PREFIX as S, diagnosticChannels as T, findExistingReviewedCommitSha as U, extractReviewedCommitSha as V, findExistingSummaryNote as W, extractDiffHunkContext as X, appendFingerprintMarkers as Y, extractExistingFingerprints as Z, resolveNpmSkillDir as _, main as a, parseReviewMarkdownWithWarnings as b, buildGeneratedComments as c, startOtelBridge as d, sha256 as et, filterDiff as f, parseSkillSpec as g, loadNamedSkill as h, formatUsageLine as i, SUMMARY_HISTORY_ENTRY_END as j, toGitLabReviewSeverity as k, buildPayload as l, gitSkillCacheKey as m, formatPerModelUsage as n, run as o, runReview as p, stripSummaryMarker as q, formatSkillsFooter as r, withHttpStamping as s, countPostedBySeverity as t, isOtelEnabled as u, resolveSkillCacheDir as v, createDiagnosticRunId as w, DIAGNOSTIC_CHANNEL_NAMES as x, parseReviewMarkdown as y, buildSummaryBody as z };
 
-//# sourceMappingURL=cli-CICuhytH.js.map
+//# sourceMappingURL=cli-DmzA9PxS.js.map