@weareikko/code-review 0.9.2 → 0.9.4

package/dist/{cli-D47EQ1qq.js → cli-C3kNr0rX.js}

@@ -1,20 +1,20 @@
-import { mkdir, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
-import { dirname, join, relative, resolve } from "node:path";
+import { mkdir, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import nodeFs, { existsSync, readFileSync } from "node:fs";
 import { getEnvApiKey, getModel } from "@earendil-works/pi-ai";
 import { createHash, randomUUID } from "node:crypto";
-import { tracingChannel } from "node:diagnostics_channel";
-import { performance } from "node:perf_hooks";
+import { homedir } from "node:os";
+import { parse } from "yaml";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { tracingChannel } from "node:diagnostics_channel";
+import { performance } from "node:perf_hooks";
 import { Agent } from "@earendil-works/pi-agent-core";
 import { createReadOnlyTools } from "@earendil-works/pi-coding-agent";
 import { createTwoFilesPatch } from "diff";
 import * as git from "isomorphic-git";
 import { Type } from "typebox";
-import { homedir } from "node:os";
-import { parse } from "yaml";
 import { SpanKind, SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
 import { SeverityNumber, logs } from "@opentelemetry/api-logs";
 //#region src/errors.ts
@@ -336,46 +336,875 @@ var GitHubClient = class {
 			responseBody: text,
 			hint: "Ensure the token can read pull-request review threads (pull-requests: read / repo scope)."
 		});
-		return parsed.data;
+		return parsed.data;
+	}
+	/**
+	* Return the database IDs of review comments that belong to a **settled**
+	* review thread — one that is either resolved or outdated. GitHub's REST
+	* comment endpoints omit both states; they are only exposed via GraphQL
+	* `reviewThreads.isResolved` / `isOutdated`. Callers use this set to mark
+	* normalized notes resolved so settled threads are excluded from summary
+	* carry-over and prior-thread context. Paginates over threads.
+	*
+	* Outdated counts as settled because GitHub, unlike GitLab, does not
+	* auto-resolve a thread when the line it anchors to changes: fixing a finding
+	* flips the thread to outdated but leaves `isResolved` false until someone
+	* manually resolves it. Treating outdated as settled mirrors GitLab's
+	* "automatically resolve outdated diff discussions" behaviour, so a fixed
+	* finding stops being re-listed under "Still open from earlier reviews" (#133).
+	*/
+	async listSettledReviewCommentIds(owner, repo, pull) {
+		const settled = /* @__PURE__ */ new Set();
+		let cursor = null;
+		let hasNext = true;
+		while (hasNext) {
+			const threads = (await this.graphql(REVIEW_THREADS_QUERY, {
+				owner,
+				repo,
+				pull,
+				cursor
+			})).repository?.pullRequest?.reviewThreads;
+			if (!threads) break;
+			for (const thread of threads.nodes ?? []) {
+				if (!thread.isResolved && !thread.isOutdated) continue;
+				for (const comment of thread.comments?.nodes ?? []) if (typeof comment.databaseId === "number") settled.add(comment.databaseId);
+			}
+			hasNext = threads.pageInfo?.hasNextPage ?? false;
+			cursor = threads.pageInfo?.endCursor ?? null;
+			if (!cursor) hasNext = false;
+		}
+		return settled;
+	}
+};
+//#endregion
+//#region src/git.ts
+var exec$1 = promisify(execFile);
+var DEFAULT_DIFF_CONTEXT = 20;
+var DEFAULT_CODEQUALITY_ARTIFACTS = [
+	"gl-code-quality-report.json",
+	"codequality.json",
+	"codeclimate.json",
+	"code-quality-report.json"
+];
+function gitErrorMessage(error) {
+	const err = error;
+	return [
+		err.message,
+		err.stderr,
+		err.stdout
+	].filter(Boolean).join("\n").trim();
+}
+async function git$1(args, options = {}) {
+	try {
+		const { stdout } = await exec$1("git", args, {
+			cwd: options.cwd,
+			maxBuffer: 50 * 1024 * 1024
+		});
+		return stdout;
+	} catch (error) {
+		throw new GitError(`git ${args.join(" ")} failed.`, {
+			cause: error,
+			hint: gitErrorMessage(error)
+		});
+	}
+}
+function remoteRef(remote, branch) {
+	return `refs/remotes/${remote}/${branch}`;
+}
+function getMergeDiffArguments(targetBranch, options = {}) {
+	const remote = options.remote ?? "origin";
+	const context = options.context ?? DEFAULT_DIFF_CONTEXT;
+	return [
+		`${remoteRef(remote, targetBranch)}...HEAD`,
+		`--unified=${context}`,
+		"--"
+	];
+}
+/**
+* Full git argv for the merge diff. `-c core.quotepath=false` keeps non-ASCII
+* paths literal instead of git's default octal-escaped + double-quoted form
+* (`"a/caf\303\251.ts"`), which the comment-position parser cannot match —
+* leaving such comments with invalid one-sided positions that 500 on
+* `bulk_publish`. Diffing literally also gives the reviewer readable paths.
+*/
+function getMergeDiffCommand(targetBranch, options = {}) {
+	return [
+		"-c",
+		"core.quotepath=false",
+		"diff",
+		...getMergeDiffArguments(targetBranch, options)
+	];
+}
+async function fetchBranch(remote, branch, options) {
+	await git$1([
+		"fetch",
+		"--no-tags",
+		remote,
+		`+refs/heads/${branch}:${remoteRef(remote, branch)}`
+	], options);
+}
+async function isTracked(path, options) {
+	try {
+		await git$1([
+			"ls-files",
+			"--error-unmatch",
+			"--",
+			path
+		], options);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function removeGeneratedCodeQualityArtifacts(paths = DEFAULT_CODEQUALITY_ARTIFACTS, options = {}) {
+	const removed = [];
+	for (const path of paths) {
+		if (await isTracked(path, options)) continue;
+		try {
+			await unlink(options.cwd ? join(options.cwd, path) : path);
+			removed.push(path);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	return removed;
+}
+async function prepareGitHistory(sourceBranch, targetBranch, options = {}) {
+	const remote = options.remote ?? "origin";
+	await removeGeneratedCodeQualityArtifacts(options.codeQualityArtifacts, options);
+	await git$1([
+		"fetch",
+		"--unshallow",
+		"--no-tags",
+		remote
+	], options).catch(() => void 0);
+	const fetchErrors = [];
+	for (const branch of [targetBranch, sourceBranch]) try {
+		await fetchBranch(remote, branch, options);
+	} catch (error) {
+		fetchErrors.push(`${branch}: ${gitErrorMessage(error)}`);
+	}
+	if (fetchErrors.length === 2) throw new GitError(`Unable to fetch MR source/target branches from ${remote}.`, { hint: fetchErrors.join("\n") });
+	try {
+		await git$1([
+			"merge-base",
+			remoteRef(remote, targetBranch),
+			"HEAD"
+		], options);
+	} catch (error) {
+		const fetchDetail = fetchErrors.length > 0 ? `\nFetch warnings:\n${fetchErrors.join("\n")}` : "";
+		throw new GitError(`Unable to prepare Git history for MR review: merge-base ${remoteRef(remote, targetBranch)} HEAD failed.`, {
+			cause: error,
+			hint: `Set GIT_DEPTH: 0 or ensure ${remote}/${targetBranch} is fetchable.${fetchDetail}\n${gitErrorMessage(error)}`
+		});
+	}
+}
+async function getMergeDiff(targetBranch, options = {}) {
+	return git$1(getMergeDiffCommand(targetBranch, options), options);
+}
+function getMergeCommitLogArguments(targetBranch, options = {}) {
+	return [
+		`${remoteRef(options.remote ?? "origin", targetBranch)}...HEAD`,
+		"--pretty=tformat:commit %h%nAuthor: %an%nDate: %as%n%n%s%n%n%b",
+		"--reverse",
+		"--no-merges"
+	];
+}
+async function getMergeCommitLog(targetBranch, options = {}) {
+	return git$1(["log", ...getMergeCommitLogArguments(targetBranch, options)], options);
+}
+/**
+* Summarize a unified diff into file/line counts for telemetry. Counts one file
+* per `diff --git` header and counts `+`/`-` lines only inside a hunk (after a
+* `@@` header), so the `--- a/file` / `+++ b/file` header lines are excluded and
+* a genuine content line whose text starts with `++`/`--` is still counted. Pure
+* and allocation-light so it can run on the full merge diff without an extra git
+* invocation.
+*/
+function summarizeDiff(diff) {
+	let filesChanged = 0;
+	let linesAdded = 0;
+	let linesRemoved = 0;
+	let inHunk = false;
+	for (const line of diff.split("\n")) if (line.startsWith("diff --git ")) {
+		filesChanged += 1;
+		inHunk = false;
+	} else if (line.startsWith("@@ ")) inHunk = true;
+	else if (inHunk && line.startsWith("+")) linesAdded += 1;
+	else if (inHunk && line.startsWith("-")) linesRemoved += 1;
+	return {
+		filesChanged,
+		linesAdded,
+		linesRemoved
+	};
+}
+//#endregion
+//#region src/skills.ts
+var SKILL_DIRS = [".agents/skills", ".claude/skills"];
+var RESOURCE_DIRS = ["references"];
+function parseFrontmatter(content) {
+	const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+	if (!match) return null;
+	let data;
+	try {
+		data = parse(match[1]);
+	} catch {
+		return null;
+	}
+	if (!data || typeof data !== "object") return null;
+	const { name, description } = data;
+	if (typeof name !== "string" || typeof description !== "string") return null;
+	const trimmedName = name.trim();
+	const trimmedDescription = description.trim();
+	if (!trimmedName || !trimmedDescription) return null;
+	return {
+		name: trimmedName,
+		description: trimmedDescription
+	};
+}
+async function loadSkillFromDir(dirPath, source) {
+	const skillMdPath = join(dirPath, "SKILL.md");
+	let content;
+	try {
+		content = await readFile(skillMdPath, "utf8");
+	} catch {
+		return null;
+	}
+	const parsed = parseFrontmatter(content);
+	if (!parsed) return null;
+	const resourceDirs = RESOURCE_DIRS.filter((d) => existsSync(join(dirPath, d)));
+	return {
+		name: parsed.name,
+		description: parsed.description,
+		filePath: skillMdPath,
+		rootDir: dirPath,
+		resourceDirs,
+		source
+	};
+}
+function resolveBuiltinSkillsDir() {
+	return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
+}
+async function loadBuiltinSkill(name) {
+	return loadSkillFromDir(join(resolveBuiltinSkillsDir(), name), "builtin");
+}
+async function loadAutoDiscoveredSkills(cwd, gitRoot, warn) {
+	const dirs = [];
+	let current = cwd;
+	while (true) {
+		dirs.unshift(current);
+		if (current === gitRoot) break;
+		const parent = dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	const found = /* @__PURE__ */ new Map();
+	for (const dir of dirs) for (const skillDir of SKILL_DIRS) {
+		const skillsPath = join(dir, skillDir);
+		let entries;
+		try {
+			entries = await readdir(skillsPath);
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const entryPath = join(skillsPath, entry);
+			const skill = await loadSkillFromDir(entryPath, "project");
+			if (skill) found.set(skill.name, skill);
+			else if (warn && existsSync(join(entryPath, "SKILL.md"))) warn(`Skill at ${entryPath} has a SKILL.md but is missing required frontmatter fields (name, description) — skill not loaded.`);
+		}
+	}
+	return [...found.values()];
+}
+/**
+* Parse a skill spec string into a typed `SkillSpec` descriptor.
+*
+* Supported spec formats:
+*
+* | Input                              | Result                                            |
+* |------------------------------------|---------------------------------------------------|
+* | `code-review`                      | `{ protocol: 'builtin', name: 'code-review' }`    |
+* | `npm:my-skill`                     | `{ protocol: 'npm', packageName: 'my-skill', ... }`|
+* | `npm:@scope/pkg`                   | `{ protocol: 'npm', packageName: '@scope/pkg', ... }`|
+* | `npm:@scope/bundle/security`       | `{ protocol: 'npm', packageName: '@scope/bundle', subpath: 'security' }`|
+* | `npm:bundle/security`              | `{ protocol: 'npm', packageName: 'bundle', subpath: 'security' }`|
+* | `file:./path/to/skill`             | `{ protocol: 'file', path: './path/to/skill' }`   |
+* | `file:/absolute/path`              | `{ protocol: 'file', path: '/absolute/path' }`    |
+* | `git:https://host/org/s.git`       | `{ protocol: 'git', url: 'https://host/org/s.git', ref: '', subpath: '' }` |
+* | `git:https://host/org/b.git#v1/sec`| `{ protocol: 'git', url: 'https://host/org/b.git', ref: 'v1', subpath: 'sec' }` |
+* | `git+ssh://git@host/org/s.git`     | `{ protocol: 'git', url: 'ssh://git@host/org/s.git', ref: '', subpath: '' }` |
+* | `acme:dev/aria-apg` (acme known)   | `{ protocol: 'marketplace', marketplace: 'acme', plugin: 'dev', skill: 'aria-apg' }` |
+*
+* A spec whose portion before the first `:` matches a registered marketplace
+* name (from `knownMarketplaces`) is parsed as a `marketplace` reference. The
+* remainder must be `<plugin>/<skill>` — an explicit skill is always required.
+*/
+function parseSkillSpec(spec, knownMarketplaces = /* @__PURE__ */ new Set()) {
+	if (spec.startsWith("file:")) return {
+		protocol: "file",
+		path: spec.slice(5)
+	};
+	if (spec.startsWith("npm:")) {
+		const rest = spec.slice(4);
+		if (rest.startsWith("@")) {
+			const parts = rest.split("/");
+			if (parts.length < 2) return {
+				protocol: "npm",
+				packageName: rest,
+				subpath: ""
+			};
+			return {
+				protocol: "npm",
+				packageName: `${parts[0]}/${parts[1]}`,
+				subpath: parts.slice(2).join("/")
+			};
+		}
+		const slashIdx = rest.indexOf("/");
+		if (slashIdx === -1) return {
+			protocol: "npm",
+			packageName: rest,
+			subpath: ""
+		};
+		return {
+			protocol: "npm",
+			packageName: rest.slice(0, slashIdx),
+			subpath: rest.slice(slashIdx + 1)
+		};
+	}
+	if (spec.startsWith("git+") || spec.startsWith("git:")) return parseGitSpec(spec);
+	const colonIdx = spec.indexOf(":");
+	if (colonIdx > 0 && knownMarketplaces.has(spec.slice(0, colonIdx))) return parseMarketplaceSkillSpec(spec, colonIdx);
+	return {
+		protocol: "builtin",
+		name: spec
+	};
+}
+/**
+* Parse the `<marketplace>:<plugin>/<skill>` selector into its parts. The
+* marketplace name has already been matched against the registry by the caller;
+* `colonIdx` is the index of the separating `:`. Throws a `ConfigError` when the
+* `<plugin>/<skill>` remainder is malformed (a skill name is always required).
+*/
+function parseMarketplaceSkillSpec(spec, colonIdx) {
+	const marketplace = spec.slice(0, colonIdx);
+	const rest = spec.slice(colonIdx + 1);
+	const slashIdx = rest.indexOf("/");
+	const plugin = slashIdx === -1 ? rest : rest.slice(0, slashIdx);
+	const skill = slashIdx === -1 ? "" : rest.slice(slashIdx + 1);
+	if (!plugin || !skill || skill.includes("/")) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `Marketplace skills use the form "<marketplace>:<plugin>/<skill>", e.g. "${marketplace}:dev/aria-apg".` });
+	return {
+		protocol: "marketplace",
+		marketplace,
+		plugin,
+		skill
+	};
+}
+/**
+* Parse a `git:` / `git+ssh:` skill spec into its URL, pinned ref, and subpath.
+*
+* - `git:<url>`         strips the `git:` marker; what follows is the clone URL
+*   (e.g. `git:https://host/org/repo.git`).
+* - `git+<transport>://…` strips the leading `git+`, leaving a URL git
+*   understands directly (`git+ssh://git@host/…` → `ssh://git@host/…`), matching
+*   npm's `package.json` git-dependency convention.
+*
+* An optional `#<ref>[/<subpath>]` fragment pins the ref (tag, branch, or
+* commit) and, after the first `/`, points at a skill directory inside the repo.
+*/
+function parseGitSpec(spec) {
+	const raw = spec.startsWith("git+") ? spec.slice(4) : spec.slice(4);
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return {
+			protocol: "git",
+			url: raw,
+			ref: "",
+			subpath: ""
+		};
+	}
+	const fragment = parsed.hash ? parsed.hash.slice(1) : "";
+	parsed.hash = "";
+	const url = parsed.toString();
+	const slashIdx = fragment.indexOf("/");
+	if (slashIdx === -1) return {
+		protocol: "git",
+		url,
+		ref: fragment,
+		subpath: ""
+	};
+	return {
+		protocol: "git",
+		url,
+		ref: fragment.slice(0, slashIdx),
+		subpath: fragment.slice(slashIdx + 1)
+	};
+}
+/**
+* Resolve the directory for an npm-installed skill by walking `node_modules`
+* upward from `cwd` (supports monorepo hoisting). Returns the resolved path
+* or `null` if the package / subpath cannot be found.
+*/
+async function resolveNpmSkillDir(packageName, subpath, cwd) {
+	let current = cwd;
+	while (true) {
+		const candidate = subpath ? join(current, "node_modules", packageName, subpath) : join(current, "node_modules", packageName);
+		if (existsSync(candidate)) return candidate;
+		const parent = dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	return null;
+}
+/** Strip a leading `git+` transport marker (`git+ssh://…` → `ssh://…`). */
+function normalizeGitUrl(raw) {
+	return raw.startsWith("git+") ? raw.slice(4) : raw;
+}
+/**
+* Remove embedded credentials from a URL so it is safe to show in logs, hints,
+* and errors. `https://user:token@host/path` becomes `https://***@host/path`.
+* Non-URL strings are returned with a best-effort `//user@` → `//***@` scrub.
+*/
+function redactUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (parsed.username || parsed.password) {
+			parsed.username = "***";
+			parsed.password = "";
+		}
+		return parsed.toString();
+	} catch {
+		return url.replace(/\/\/[^/@]+@/, "//***@");
+	}
+}
+/** Base directory for cached git-skill clones (honours `XDG_CACHE_HOME`). */
+function resolveSkillCacheDir() {
+	return join(process.env.XDG_CACHE_HOME?.trim() || join(homedir(), ".cache"), "code-review", "skills");
+}
+/**
+* Stable cache-directory name for a git skill. Keyed on the clone URL plus the
+* pinned ref so that two refs of the same repo never share a cache entry.
+*/
+function gitSkillCacheKey(url, ref) {
+	return createHash("sha256").update(`${url}#${ref}`).digest("hex").slice(0, 16);
+}
+/**
+* Shallow-clone `url` at `ref` into `dir`. Using init + a single-ref fetch +
+* `checkout FETCH_HEAD` (rather than `clone --branch`) means a branch, tag, or
+* commit SHA all resolve through the same path; an empty `ref` fetches the
+* remote's default branch via `HEAD`.
+*/
+async function gitShallowClone(url, ref, dir) {
+	await git$1([
+		"init",
+		"--quiet",
+		dir
+	]);
+	await git$1([
+		"remote",
+		"add",
+		"origin",
+		url
+	], { cwd: dir });
+	await git$1([
+		"fetch",
+		"--depth",
+		"1",
+		"--quiet",
+		"origin",
+		ref || "HEAD"
+	], { cwd: dir });
+	await git$1([
+		"checkout",
+		"--quiet",
+		"FETCH_HEAD"
+	], { cwd: dir });
+}
+/** Monotonic counter making each clone's temp dir unique within the process. */
+var cloneSeq = 0;
+/**
+* Resolve a git URL + ref to a local clone directory, reusing the on-disk cache
+* when possible. The clone lands in a temp sibling first and is renamed into
+* place atomically, so a crashed or concurrent clone never leaves a half-written
+* cache entry. With `refresh`, any cached copy is discarded first. Shared by
+* `git:` skills and Claude-plugin marketplaces (see `marketplaces.ts`).
+*/
+async function cloneGitRepo(url, ref, options) {
+	const repoDir = join(options.cacheDir, gitSkillCacheKey(url, ref));
+	if (options.refresh) await rm(repoDir, {
+		recursive: true,
+		force: true
+	});
+	else if (existsSync(join(repoDir, ".git"))) return repoDir;
+	else if (existsSync(repoDir)) await rm(repoDir, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(options.cacheDir, { recursive: true });
+	const tmpDir = `${repoDir}.tmp-${process.pid}-${cloneSeq += 1}`;
+	await rm(tmpDir, {
+		recursive: true,
+		force: true
+	});
+	try {
+		await gitShallowClone(url, ref, tmpDir);
+		try {
+			await rename(tmpDir, repoDir);
+		} catch (error) {
+			if (existsSync(join(repoDir, ".git"))) {
+				await rm(tmpDir, {
+					recursive: true,
+					force: true
+				});
+				return repoDir;
+			}
+			throw error;
+		}
+	} catch (error) {
+		await rm(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
+	return repoDir;
+}
+/**
+* Load a skill by its spec string (`code-review`, `npm:@scope/pkg`, `file:./path`,
+* `git:https://…`, …).
+*
+* Resolution order:
+* 1. `builtin` — package-bundled `skills/<name>/`
+* 2. `npm:`    — `node_modules/<packageName>[/subpath]` walked up from `cwd`
+* 3. `file:`   — direct filesystem path (relative paths resolved from `cwd`)
+* 4. `git:` / `git+ssh:` — shallow clone at the pinned ref, cached on disk,
+*    loading `SKILL.md` from the repo root or the `#<ref>/<subpath>` directory
+*
+* Throws a `ConfigError` if the spec cannot be resolved or the resolved
+* directory does not contain a valid `SKILL.md`.
+*/
+async function loadNamedSkill(spec, cwd, options = {}) {
+	const parsed = parseSkillSpec(spec);
+	if (parsed.protocol === "builtin") {
+		const skill = await loadBuiltinSkill(parsed.name);
+		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `No built-in skill named "${parsed.name}" was found. Check the skill name, or use npm: / file: to reference external skills.` });
+		return skill;
+	}
+	if (parsed.protocol === "npm") {
+		const dir = await resolveNpmSkillDir(parsed.packageName, parsed.subpath, cwd);
+		if (dir === null) {
+			const pkgRef = parsed.subpath ? `${parsed.packageName} (subpath "${parsed.subpath}")` : parsed.packageName;
+			throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `Package ${pkgRef} was not found in node_modules. Run \`npm install ${parsed.packageName}\` in the project.` });
+		}
+		const skill = await loadSkillFromDir(dir, "npm");
+		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `The package at ${dir} does not contain a valid SKILL.md.` });
+		return skill;
+	}
+	if (parsed.protocol === "file") {
+		const resolvedPath = parsed.path.startsWith("/") ? parsed.path : join(cwd, parsed.path);
+		const skill = await loadSkillFromDir(resolvedPath, "file");
+		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `No valid SKILL.md was found at "${resolvedPath}". Check that the path points to a skill directory.` });
+		return skill;
+	}
+	if (parsed.protocol === "marketplace") throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: "Marketplace skills must be resolved through a registered marketplace, not loaded directly." });
+	let repoDir;
+	try {
+		repoDir = await cloneGitRepo(parsed.url, parsed.ref, {
+			cacheDir: options.cacheDir ?? resolveSkillCacheDir(),
+			refresh: options.refresh ?? false
+		});
+	} catch (error) {
+		const atRef = parsed.ref ? ` at ref "${parsed.ref}"` : "";
+		throw new ConfigError(`Cannot load skill: "${spec}"`, {
+			cause: error,
+			hint: `Failed to clone "${redactUrl(parsed.url)}"${atRef}. Check the URL, the ref, and your git credentials. For GitLab, prefer the SSH form: git+ssh://git@host/group/project.git`
+		});
+	}
+	const skill = await loadSkillFromDir(parsed.subpath ? join(repoDir, parsed.subpath) : repoDir, "git");
+	if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: parsed.subpath ? `The cloned repository has no valid SKILL.md at subpath "${parsed.subpath}".` : "The cloned repository has no valid SKILL.md at its root. If the skill lives in a subdirectory, point at it with \"#<ref>/<subpath>\"." });
+	return skill;
+}
+//#endregion
+//#region src/marketplaces.ts
+/**
+* Marketplace manifest formats we know how to read. Different vendors ship the
+* same open SKILL.md standard but package it differently: Claude Code uses a
+* `.claude-plugin/marketplace.json` catalog (`anthropic`), OpenAI Codex uses a
+* `.codex-plugin/` layout (a future `codex` format). Only `anthropic` is
+* implemented today; the type is the extension point for the rest.
+*/
+var MARKETPLACE_FORMATS = ["anthropic"];
+/** The default format assumed when a marketplace declaration omits a prefix. */
+var DEFAULT_MARKETPLACE_FORMAT = "anthropic";
+/**
+* Marketplace names that collide with skill-spec protocol prefixes
+* (`npm:`, `file:`, `git:`) or the bare-name builtin lookup, and so cannot be
+* used as a marketplace name — `<name>:<plugin>/<skill>` would be ambiguous.
+*/
+var RESERVED_MARKETPLACE_NAMES = new Set([
+	"npm",
+	"file",
+	"git",
+	"builtin"
+]);
+var NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var FORMAT_PREFIX_PATTERN = /^([a-z][a-z0-9-]*):(?!\/\/)/;
+/**
+* Parse a single marketplace declaration: `<name>=<[format:]url[#ref]>`.
+*
+* - `acme=https://host/group/tools.git#1.0.0` → default `anthropic` format
+* - `acme=anthropic:https://host/group/tools.git#1.0.0` → explicit format
+* - `acme=git+ssh://git@host/group/tools.git#main` → SSH transport
+*
+* The `#<ref>` fragment is taken whole as the ref (branch names may contain
+* `/`). Throws a `ConfigError` with an actionable hint on any malformed input.
+*/
+function parseMarketplaceEntry(entry) {
+	const eqIdx = entry.indexOf("=");
+	if (eqIdx <= 0) throw new ConfigError(`Invalid marketplace declaration: "${redactUrl(entry)}"`, { hint: "Use <name>=<git-url>[#ref], e.g. acme=https://host/group/tools.git#1.0.0." });
+	const name = entry.slice(0, eqIdx).trim();
+	if (!NAME_PATTERN.test(name)) throw new ConfigError(`Invalid marketplace name: "${name}"`, { hint: "Names must start with a letter or digit and contain only letters, digits, \".\", \"_\", or \"-\"." });
+	if (RESERVED_MARKETPLACE_NAMES.has(name)) throw new ConfigError(`Marketplace name "${name}" is reserved`, { hint: `Choose another name — ${[...RESERVED_MARKETPLACE_NAMES].join(", ")} collide with skill-spec protocols.` });
+	let rhs = entry.slice(eqIdx + 1).trim();
+	let format = DEFAULT_MARKETPLACE_FORMAT;
+	const formatMatch = rhs.match(FORMAT_PREFIX_PATTERN);
+	if (formatMatch) {
+		const token = formatMatch[1];
+		if (!MARKETPLACE_FORMATS.includes(token)) throw new ConfigError(`Unknown marketplace format "${token}" in "${redactUrl(entry)}"`, { hint: `Supported formats: ${MARKETPLACE_FORMATS.join(", ")}. Omit the prefix (e.g. "${name}=https://…") to default to "${DEFAULT_MARKETPLACE_FORMAT}".` });
+		format = token;
+		rhs = rhs.slice(formatMatch[0].length);
+	}
+	let parsed;
+	try {
+		parsed = new URL(normalizeGitUrl(rhs));
+	} catch {
+		throw new ConfigError(`Invalid marketplace URL for "${name}": "${redactUrl(rhs)}"`, { hint: "Expected a git URL like https://host/group/tools.git or git+ssh://git@host/group/tools.git. scp-style (git@host:group/repo.git) is not supported — use the ssh:// form." });
+	}
+	const ref = parsed.hash ? parsed.hash.slice(1) : "";
+	parsed.hash = "";
+	return {
+		name,
+		format,
+		url: parsed.toString(),
+		ref
+	};
+}
+/**
+* Build a name→ref registry from parsed marketplace declarations, rejecting
+* duplicate names (a later entry silently shadowing an earlier one is a config
+* bug worth surfacing).
+*/
+function buildMarketplaceRegistry(refs) {
+	const registry = /* @__PURE__ */ new Map();
+	for (const ref of refs) {
+		if (registry.has(ref.name)) throw new ConfigError(`Duplicate marketplace name "${ref.name}"`, { hint: "Each marketplace must be declared once. Remove the duplicate declaration." });
+		registry.set(ref.name, ref);
+	}
+	return registry;
+}
+/**
+* Resolve a `<marketplace>:<plugin>/<skill>` reference to a loaded {@link Skill}.
+*
+* Clones the marketplace repo (reusing the shared on-disk clone cache), then
+* dispatches to the format-specific resolver. Throws a `ConfigError` with a
+* redacted, actionable hint when the marketplace, plugin, or skill cannot be
+* resolved — the caller treats that as a skip-and-warn, not a fatal error.
+*/
+async function loadMarketplaceSkill(spec, registry, options = {}) {
+	const ref = `${spec.marketplace}:${spec.plugin}/${spec.skill}`;
+	const mp = registry.get(spec.marketplace);
+	if (!mp) throw new ConfigError(`Cannot load skill: "${ref}"`, { hint: `No marketplace named "${spec.marketplace}" is registered. Declare it with CODE_REVIEW_MARKETPLACES or --marketplace.` });
+	let repoDir;
+	try {
+		repoDir = await cloneGitRepo(mp.url, mp.ref, {
+			cacheDir: options.cacheDir ?? resolveSkillCacheDir(),
+			refresh: options.refresh ?? false
+		});
+	} catch (error) {
+		const atRef = mp.ref ? ` at ref "${mp.ref}"` : "";
+		throw new ConfigError(`Cannot load marketplace "${mp.name}"`, {
+			cause: error,
+			hint: `Failed to clone "${redactUrl(mp.url)}"${atRef}. Check the URL, the ref, and your git credentials. For private GitLab, prefer git+ssh://git@host/group/project.git.`
+		});
+	}
+	switch (mp.format) {
+		case "anthropic": return resolveAnthropicSkill(repoDir, mp, spec);
+		default: {
+			const exhaustive = mp.format;
+			throw new ConfigError(`Unsupported marketplace format: "${String(exhaustive)}"`, { hint: `Supported formats: ${MARKETPLACE_FORMATS.join(", ")}.` });
+		}
+	}
+}
+/** Resolve a skill inside a Claude Code (`anthropic`) plugin marketplace. */
+async function resolveAnthropicSkill(repoDir, mp, spec) {
+	const ref = `${mp.name}:${spec.plugin}/${spec.skill}`;
+	const realRoot = await realpath(repoDir);
+	const manifestRaw = await readTextInside(realRoot, join(repoDir, ".claude-plugin", "marketplace.json"), ref);
+	if (manifestRaw === null) throw new ConfigError(`Marketplace "${mp.name}" is not a valid Anthropic plugin marketplace`, { hint: `Expected a readable .claude-plugin/marketplace.json at "${redactUrl(mp.url)}"${mp.ref ? ` (ref "${mp.ref}")` : ""}.` });
+	let manifest;
+	try {
+		manifest = JSON.parse(manifestRaw);
+	} catch (error) {
+		throw new ConfigError(`Marketplace "${mp.name}" is not a valid Anthropic plugin marketplace`, {
+			cause: error,
+			hint: `.claude-plugin/marketplace.json at "${redactUrl(mp.url)}" is not valid JSON.`
+		});
 	}
-	/**
-	* Return the database IDs of review comments that belong to a **settled**
-	* review thread — one that is either resolved or outdated. GitHub's REST
-	* comment endpoints omit both states; they are only exposed via GraphQL
-	* `reviewThreads.isResolved` / `isOutdated`. Callers use this set to mark
-	* normalized notes resolved so settled threads are excluded from summary
-	* carry-over and prior-thread context. Paginates over threads.
-	*
-	* Outdated counts as settled because GitHub, unlike GitLab, does not
-	* auto-resolve a thread when the line it anchors to changes: fixing a finding
-	* flips the thread to outdated but leaves `isResolved` false until someone
-	* manually resolves it. Treating outdated as settled mirrors GitLab's
-	* "automatically resolve outdated diff discussions" behaviour, so a fixed
-	* finding stops being re-listed under "Still open from earlier reviews" (#133).
-	*/
-	async listSettledReviewCommentIds(owner, repo, pull) {
-		const settled = /* @__PURE__ */ new Set();
-		let cursor = null;
-		let hasNext = true;
-		while (hasNext) {
-			const threads = (await this.graphql(REVIEW_THREADS_QUERY, {
-				owner,
-				repo,
-				pull,
-				cursor
-			})).repository?.pullRequest?.reviewThreads;
-			if (!threads) break;
-			for (const thread of threads.nodes ?? []) {
-				if (!thread.isResolved && !thread.isOutdated) continue;
-				for (const comment of thread.comments?.nodes ?? []) if (typeof comment.databaseId === "number") settled.add(comment.databaseId);
-			}
-			hasNext = threads.pageInfo?.hasNextPage ?? false;
-			cursor = threads.pageInfo?.endCursor ?? null;
-			if (!cursor) hasNext = false;
-		}
-		return settled;
+	const plugins = Array.isArray(manifest.plugins) ? manifest.plugins : [];
+	const entry = plugins.find((p) => p && p.name === spec.plugin);
+	if (!entry) {
+		const available = plugins.map((p) => typeof p?.name === "string" ? p.name : null).filter((n) => Boolean(n));
+		throw new ConfigError(`Plugin "${spec.plugin}" not found in marketplace "${mp.name}"`, { hint: available.length ? `Available plugins: ${available.join(", ")}.` : "The marketplace lists no plugins." });
+	}
+	const pluginDir = resolvePluginDir(repoDir, manifest, entry.source, mp, spec);
+	const realPluginDir = await resolveInside(realRoot, pluginDir, ref);
+	const bases = computeSkillBases(repoDir, pluginDir, entry, entry.strict !== false && realPluginDir ? await readPluginManifest(realRoot, realPluginDir, ref) : null, ref);
+	const skill = await findSkillInBases(realRoot, bases, pluginDir, spec.skill, ref);
+	if (!skill) throw new ConfigError(`Cannot load skill: "${ref}"`, { hint: `No skill "${spec.skill}" found in plugin "${spec.plugin}". Looked under the default skills/ directory${bases.length > 1 ? " and the plugin's custom \"skills\" paths" : ""}. Check the skill name against the marketplace.` });
+	return skill;
+}
+/**
+* Read a plugin's optional `.claude-plugin/plugin.json`. A missing file returns
+* `null` (the manifest is optional), but a malformed one throws a `ConfigError`
+* rather than being silently ignored — otherwise a typo would quietly drop the
+* plugin's declared `skills` paths.
+*/
+async function readPluginManifest(realRoot, pluginDir, ref) {
+	const raw = await readTextInside(realRoot, join(pluginDir, ".claude-plugin", "plugin.json"), ref);
+	if (raw === null) return null;
+	try {
+		return JSON.parse(raw);
+	} catch (error) {
+		throw new ConfigError(`Malformed plugin.json for "${ref}"`, {
+			cause: error,
+			hint: "The plugin's .claude-plugin/plugin.json is not valid JSON. Fix it in the marketplace repository."
+		});
 	}
-};
+}
+/** Normalize a `skills`/`commands` manifest field (string | string[]) to a path list. */
+function toPathArray(value) {
+	return (typeof value === "string" ? [value] : Array.isArray(value) ? value : []).filter((v) => typeof v === "string").map((v) => v.trim()).filter(Boolean);
+}
+/**
+* Compute the directories to search for a named skill, per the plugin schema:
+* the default `<plugin>/skills/` scan plus any directories declared in the
+* `skills` field of the marketplace entry and (unless `strict: false`) the
+* plugin's own `plugin.json`. When the plugin source resolves to the marketplace
+* root and the entry lists specific `skills` subdirectories, those replace the
+* default scan rather than adding to it.
+*/
+function computeSkillBases(repoDir, pluginDir, entry, pluginManifest, ref) {
+	const strict = entry.strict !== false;
+	const entrySkills = toPathArray(entry.skills);
+	const custom = (strict ? [...entrySkills, ...toPathArray(pluginManifest?.skills)] : entrySkills).map((p) => resolveUnderPlugin(repoDir, pluginDir, p, ref));
+	const bases = resolve(pluginDir) === resolve(repoDir) && entrySkills.length > 0 ? custom : [join(pluginDir, "skills"), ...custom];
+	return [...new Set(bases)];
+}
+/** Resolve a plugin-relative `skills` path to an absolute dir, guarding escapes. */
+function resolveUnderPlugin(repoDir, pluginDir, rel, ref) {
+	let p = rel.trim();
+	if (p === "." || p === "./") p = "";
+	else if (p.startsWith("./")) p = p.slice(2);
+	const dir = join(pluginDir, p);
+	ensureInside(repoDir, dir, ref);
+	return dir;
+}
+/**
+* Find `skillName` across the candidate base directories. Each base is either a
+* container of skill sub-directories (`<base>/<skill>/SKILL.md`) or a single
+* skill directory (`<base>/SKILL.md`, matched by its frontmatter `name`). Falls
+* back to a single `SKILL.md` at the plugin root (single-skill plugins).
+*
+* Every candidate is verified with {@link loadSkillIfInside} to resolve through
+* symlinks and reject any directory that escapes the cloned marketplace before a
+* file is read.
+*/
+async function findSkillInBases(realRoot, bases, pluginDir, skillName, ref) {
+	for (const base of bases) {
+		const container = await loadSkillIfInside(realRoot, join(base, skillName), ref);
+		if (container) return container;
+		const single = await loadSkillIfInside(realRoot, base, ref);
+		if (single && single.name === skillName) return single;
+	}
+	const root = await loadSkillIfInside(realRoot, pluginDir, ref);
+	return root && root.name === skillName ? root : null;
+}
+/**
+* Resolve `dir` through symlinks and confirm it stays within `realRoot`. Returns
+* the real path, or `null` when the directory does not exist (nothing to read).
+* A directory that resolves — via `..` or a symlink — outside the marketplace
+* throws a `ConfigError`, so a malicious manifest cannot reach outside the clone.
+*/
+async function resolveInside(realRoot, dir, ref) {
+	let real;
+	try {
+		real = await realpath(dir);
+	} catch {
+		return null;
+	}
+	assertInside(realRoot, real, ref);
+	return real;
+}
+/** Throw if `real` (an already-resolved real path) is not within `realRoot`. */
+function assertInside(realRoot, real, ref) {
+	if (real !== realRoot && !real.startsWith(realRoot + sep)) throw new ConfigError(`Refusing to load "${ref}": path escapes the marketplace repository`, { hint: "A plugin \"source\", manifest, or skill path resolved (via \"..\" or a symlink) outside the cloned marketplace." });
+}
+/**
+* Read a file only if its real path (following any symlink on the file itself,
+* not just its parent directory) stays within `realRoot`. Returns `null` when
+* the file does not exist; throws a `ConfigError` when it resolves outside the
+* marketplace, so a symlinked `SKILL.md` / manifest cannot exfiltrate an outside
+* file's contents.
+*/
+async function readTextInside(realRoot, filePath, ref) {
+	let real;
+	try {
+		real = await realpath(filePath);
+	} catch {
+		return null;
+	}
+	assertInside(realRoot, real, ref);
+	return readFile(real, "utf8");
+}
+/**
+* Load a skill from `dir` only if both the directory AND its `SKILL.md` file
+* resolve within `realRoot`. Guarding the file (not just the directory) closes
+* the case where a legitimate in-repo dir holds a `SKILL.md` symlinked outside.
+*/
+async function loadSkillIfInside(realRoot, dir, ref) {
+	const real = await resolveInside(realRoot, dir, ref);
+	if (!real) return null;
+	if (await readTextInside(realRoot, join(real, "SKILL.md"), ref) === null) return null;
+	return loadSkillFromDir(real, "marketplace");
+}
+/**
+* Resolve a plugin entry's `source` to an absolute directory inside the cloned
+* marketplace. Honors `metadata.pluginRoot` for bare (non-`./`) sources, per the
+* marketplace schema. Remote sources (github/url/git-subdir/npm) are rejected —
+* we only resolve plugins that live in the marketplace repository itself.
+*/
+function resolvePluginDir(repoDir, manifest, source, mp, spec) {
+	const ref = `${mp.name}:${spec.plugin}/${spec.skill}`;
+	if (typeof source !== "string" || !source.trim()) throw new ConfigError(`Plugin "${spec.plugin}" in marketplace "${mp.name}" has no local source`, { hint: "Only plugins whose \"source\" is a relative path within the marketplace repo are supported. Remote plugin sources (github/url/git-subdir/npm) are not fetched." });
+	let rel = source.trim();
+	if (rel === "." || rel === "./") rel = "";
+	else if (rel.startsWith("./")) rel = rel.slice(2);
+	else {
+		const pluginRoot = typeof manifest.metadata?.pluginRoot === "string" ? manifest.metadata.pluginRoot.trim() : "";
+		const root = pluginRoot.startsWith("./") ? pluginRoot.slice(2) : pluginRoot;
+		rel = root ? `${root.replace(/\/+$/, "")}/${rel}` : rel;
+	}
+	const dir = join(repoDir, rel);
+	ensureInside(repoDir, dir, ref);
+	return dir;
+}
+/** Guard against `..`/symlink escapes: `target` must stay within `root`. */
+function ensureInside(root, target, ref) {
+	const rootResolved = resolve(root);
+	const targetResolved = resolve(target);
+	if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + sep)) throw new ConfigError(`Refusing to load "${ref}": path escapes the marketplace repository`, { hint: "A plugin \"source\" or skill path resolved outside the cloned marketplace. Check the marketplace manifest." });
+}
 //#endregion
 //#region src/fingerprints.ts
 /**
@@ -560,7 +1389,7 @@ function buildSummaryBody(summary, costFooter, options = {}) {
 	return `${withFooter}\n\n${buildSummaryHistoryBlock(historyEntries)}`;
 }
 function buildReviewedCommitFooter(commitSha) {
-	return `Reviewed by ${PRODUCT_LINK} v0.9.2 for commit ${commitSha}.`;
+	return `Reviewed by ${PRODUCT_LINK} v0.9.4 for commit ${commitSha}.`;
 }
 function extractReviewedCommitSha(body) {
 	return REVIEWED_COMMIT_FOOTER_PATTERN.exec(body)?.[1] ?? null;
@@ -896,6 +1725,7 @@ var RESERVED_ENV_SUFFIXES = [
 	"FORCE_REVIEW",
 	"VERBOSE",
 	"SKILLS",
+	"MARKETPLACES",
 	"REFRESH_SKILLS",
 	"THINKING_LEVEL"
 ];
@@ -964,7 +1794,7 @@ var BOOLEAN_FLAGS = new Set([
 	"help",
 	"version"
 ]);
-var MULTI_FLAGS = new Set(["skill"]);
+var MULTI_FLAGS = new Set(["skill", "marketplace"]);
 function parseArgs(argv) {
 	const args = {};
 	for (let i = 0; i < argv.length; i += 1) {
@@ -1084,6 +1914,16 @@ function resolveSkills(args, env) {
 	return [];
 }
 /**
+* Resolve marketplace declarations from `--marketplace` (repeatable, preferred)
+* or the comma-separated `CODE_REVIEW_MARKETPLACES`. Each entry is
+* `<name>=<[format:]url[#ref]>`; parsing throws a `ConfigError` on malformed
+* entries, reserved names, or unknown formats (fail fast on misconfiguration).
+*/
+function resolveMarketplaces(args, env) {
+	const argMarketplace = args.marketplace;
+	return (Array.isArray(argMarketplace) ? argMarketplace : typeof argMarketplace === "string" && argMarketplace.length > 0 ? [argMarketplace] : (env.CODE_REVIEW_MARKETPLACES ?? "").split(",")).map((entry) => entry.trim()).filter(Boolean).map((entry) => parseMarketplaceEntry(entry));
+}
+/**
 * Resolve the model pool from `--model-pool` (preferred) or
 * `CODE_REVIEW_MODEL_POOL`. Both are comma-separated `provider/modelId` lists.
 * Entries are trimmed and empty entries dropped. Returns `[]` when unset, which
@@ -1248,6 +2088,7 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 		verbose: toBoolean(args.verbose) || toBoolean(env.CODE_REVIEW_VERBOSE),
 		cwd: String(args.cwd ?? process.cwd()),
 		skills: resolveSkills(args, env),
+		marketplaces: resolveMarketplaces(args, env),
 		refreshGitSkills: toBoolean(env.CODE_REVIEW_REFRESH_SKILLS)
 	};
 }
@@ -1358,7 +2199,7 @@ function createDiagnosticContext(phase, config, runId, overrides = {}) {
 		phase,
 		project: config.project,
 		mr: config.mr,
-		gitlabUrl: config.gitlabUrl,
+		gitlabUrl: config.platform === "github" ? config.githubServerUrl : config.gitlabUrl,
 		platform: config.platform,
 		cwd: config.cwd,
 		model: config.model,
@@ -1392,179 +2233,17 @@ function traceDiagnosticPhase(phase, config, runId, operation, overrides = {}) {
 function toDiagnosticError(error, secretValues = []) {
 	if (error instanceof Error) {
 		const code = "code" in error && typeof error.code === "string" ? error.code : void 0;
-		const timeout = "timeout" in error && error.timeout === true ? true : void 0;
-		const status = "status" in error && typeof error.status === "number" ? error.status : void 0;
-		return {
-			name: error.name,
-			message: scrubSecrets(error.message, secretValues),
-			code,
-			timeout,
-			status
-		};
-	}
-	return { message: scrubSecrets(String(error), secretValues) };
-}
-//#endregion
-//#region src/git.ts
-var exec$1 = promisify(execFile);
-var DEFAULT_DIFF_CONTEXT = 20;
-var DEFAULT_CODEQUALITY_ARTIFACTS = [
-	"gl-code-quality-report.json",
-	"codequality.json",
-	"codeclimate.json",
-	"code-quality-report.json"
-];
-function gitErrorMessage(error) {
-	const err = error;
-	return [
-		err.message,
-		err.stderr,
-		err.stdout
-	].filter(Boolean).join("\n").trim();
-}
-async function git$1(args, options = {}) {
-	try {
-		const { stdout } = await exec$1("git", args, {
-			cwd: options.cwd,
-			maxBuffer: 50 * 1024 * 1024
-		});
-		return stdout;
-	} catch (error) {
-		throw new GitError(`git ${args.join(" ")} failed.`, {
-			cause: error,
-			hint: gitErrorMessage(error)
-		});
-	}
-}
-function remoteRef(remote, branch) {
-	return `refs/remotes/${remote}/${branch}`;
-}
-function getMergeDiffArguments(targetBranch, options = {}) {
-	const remote = options.remote ?? "origin";
-	const context = options.context ?? DEFAULT_DIFF_CONTEXT;
-	return [
-		`${remoteRef(remote, targetBranch)}...HEAD`,
-		`--unified=${context}`,
-		"--"
-	];
-}
-/**
-* Full git argv for the merge diff. `-c core.quotepath=false` keeps non-ASCII
-* paths literal instead of git's default octal-escaped + double-quoted form
-* (`"a/caf\303\251.ts"`), which the comment-position parser cannot match —
-* leaving such comments with invalid one-sided positions that 500 on
-* `bulk_publish`. Diffing literally also gives the reviewer readable paths.
-*/
-function getMergeDiffCommand(targetBranch, options = {}) {
-	return [
-		"-c",
-		"core.quotepath=false",
-		"diff",
-		...getMergeDiffArguments(targetBranch, options)
-	];
-}
-async function fetchBranch(remote, branch, options) {
-	await git$1([
-		"fetch",
-		"--no-tags",
-		remote,
-		`+refs/heads/${branch}:${remoteRef(remote, branch)}`
-	], options);
-}
-async function isTracked(path, options) {
-	try {
-		await git$1([
-			"ls-files",
-			"--error-unmatch",
-			"--",
-			path
-		], options);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function removeGeneratedCodeQualityArtifacts(paths = DEFAULT_CODEQUALITY_ARTIFACTS, options = {}) {
-	const removed = [];
-	for (const path of paths) {
-		if (await isTracked(path, options)) continue;
-		try {
-			await unlink(options.cwd ? join(options.cwd, path) : path);
-			removed.push(path);
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-	}
-	return removed;
-}
-async function prepareGitHistory(sourceBranch, targetBranch, options = {}) {
-	const remote = options.remote ?? "origin";
-	await removeGeneratedCodeQualityArtifacts(options.codeQualityArtifacts, options);
-	await git$1([
-		"fetch",
-		"--unshallow",
-		"--no-tags",
-		remote
-	], options).catch(() => void 0);
-	const fetchErrors = [];
-	for (const branch of [targetBranch, sourceBranch]) try {
-		await fetchBranch(remote, branch, options);
-	} catch (error) {
-		fetchErrors.push(`${branch}: ${gitErrorMessage(error)}`);
-	}
-	if (fetchErrors.length === 2) throw new GitError(`Unable to fetch MR source/target branches from ${remote}.`, { hint: fetchErrors.join("\n") });
-	try {
-		await git$1([
-			"merge-base",
-			remoteRef(remote, targetBranch),
-			"HEAD"
-		], options);
-	} catch (error) {
-		const fetchDetail = fetchErrors.length > 0 ? `\nFetch warnings:\n${fetchErrors.join("\n")}` : "";
-		throw new GitError(`Unable to prepare Git history for MR review: merge-base ${remoteRef(remote, targetBranch)} HEAD failed.`, {
-			cause: error,
-			hint: `Set GIT_DEPTH: 0 or ensure ${remote}/${targetBranch} is fetchable.${fetchDetail}\n${gitErrorMessage(error)}`
-		});
-	}
-}
-async function getMergeDiff(targetBranch, options = {}) {
-	return git$1(getMergeDiffCommand(targetBranch, options), options);
-}
-function getMergeCommitLogArguments(targetBranch, options = {}) {
-	return [
-		`${remoteRef(options.remote ?? "origin", targetBranch)}...HEAD`,
-		"--pretty=tformat:commit %h%nAuthor: %an%nDate: %as%n%n%s%n%n%b",
-		"--reverse",
-		"--no-merges"
-	];
-}
-async function getMergeCommitLog(targetBranch, options = {}) {
-	return git$1(["log", ...getMergeCommitLogArguments(targetBranch, options)], options);
-}
-/**
-* Summarize a unified diff into file/line counts for telemetry. Counts one file
-* per `diff --git` header and counts `+`/`-` lines only inside a hunk (after a
-* `@@` header), so the `--- a/file` / `+++ b/file` header lines are excluded and
-* a genuine content line whose text starts with `++`/`--` is still counted. Pure
-* and allocation-light so it can run on the full merge diff without an extra git
-* invocation.
-*/
-function summarizeDiff(diff) {
-	let filesChanged = 0;
-	let linesAdded = 0;
-	let linesRemoved = 0;
-	let inHunk = false;
-	for (const line of diff.split("\n")) if (line.startsWith("diff --git ")) {
-		filesChanged += 1;
-		inHunk = false;
-	} else if (line.startsWith("@@ ")) inHunk = true;
-	else if (inHunk && line.startsWith("+")) linesAdded += 1;
-	else if (inHunk && line.startsWith("-")) linesRemoved += 1;
-	return {
-		filesChanged,
-		linesAdded,
-		linesRemoved
-	};
+		const timeout = "timeout" in error && error.timeout === true ? true : void 0;
+		const status = "status" in error && typeof error.status === "number" ? error.status : void 0;
+		return {
+			name: error.name,
+			message: scrubSecrets(error.message, secretValues),
+			code,
+			timeout,
+			status
+		};
+	}
+	return { message: scrubSecrets(String(error), secretValues) };
 }
 //#endregion
 //#region src/git-tool.ts
@@ -2905,452 +3584,117 @@ function parseInlineSection(markdown, out, warnings) {
 	flush();
 	if (sawBodyBeforeHeader) warnings.push("Ignored text in the inline comments section before the first parseable comment header.");
 }
-function parseReviewMarkdownWithWarnings(markdown) {
-	const comments = [];
-	const warnings = [];
-	const { summary, malformed } = parseJsonComments(markdown, comments, warnings);
-	parseInlineSection(markdown, comments, warnings);
-	if (malformed && comments.length > 0) {
-		warnings.push(`A reviewer JSON block was unparseable (${malformed.reason}), but ${comments.length} comment(s) were recovered from other sections; continuing.`);
-		return {
-			comments,
-			summary,
-			warnings,
-			malformed: null
-		};
-	}
-	return {
-		comments,
-		summary,
-		warnings,
-		malformed
-	};
-}
-function parseReviewMarkdown(markdown) {
-	return parseReviewMarkdownWithWarnings(markdown).comments;
-}
-//#endregion
-//#region src/prior-threads.ts
-var FINGERPRINT_MARKER_RE = new RegExp(FINGERPRINT_MARKER_PATTERN, "i");
-/**
-* Returns true when the note body contains a code-review fingerprint marker
-* (current or legacy prefix).
-* Used to identify notes posted by the bot without needing a getCurrentUser() call.
-*/
-function isBotNote(note) {
-	return FINGERPRINT_MARKER_RE.test(note.body ?? "");
-}
-/**
-* Parses the `+++ b/<path>` lines from a unified diff and returns the set of
-* new file paths. `/dev/null` (deleted files) is excluded.
-*/
-function extractChangedFiles(diff) {
-	const files = /* @__PURE__ */ new Set();
-	for (const line of diff.split("\n")) {
-		const match = line.match(/^\+\+\+ b\/(.+)$/);
-		if (match && match[1] !== "/dev/null") files.add(match[1]);
-	}
-	return files;
-}
-/**
-* Returns the line number for a discussion note's position.
-* Prefers the new-side line (`new_line`) then falls back to `old_line`.
-*/
-function positionLine$1(note) {
-	return note.position?.new_line ?? note.position?.old_line ?? null;
-}
-/**
-* Returns the file path for a discussion note's position.
-* Prefers the new path then falls back to the old path.
-*/
-function positionFile$1(note) {
-	return note.position?.new_path ?? note.position?.old_path ?? null;
-}
-/**
-* Extracts prior review threads from existing MR discussions that are relevant
-* to the current diff.
-*
-* A thread is included when:
-* - It contains at least one bot note (identified by fingerprint marker).
-* - It contains at least one non-system human reply after the bot note.
-* - The thread's file appears in `changedFiles`.
-*
-* Resolved threads are included but marked with `resolved: true` so the
-* reviewer can reference them without re-raising the concern.
-*/
-function extractPriorThreads(discussions, changedFiles) {
-	const threads = [];
-	for (const discussion of discussions) {
-		const notes = discussion.notes ?? [];
-		const botNoteIndex = notes.findIndex(isBotNote);
-		if (botNoteIndex === -1) continue;
-		const botNote = notes[botNoteIndex];
-		const file = positionFile$1(botNote);
-		if (!file || !changedFiles.has(file)) continue;
-		const replies = notes.slice(botNoteIndex + 1).filter((n) => !n.system && (n.body?.trim() ?? "")).filter((n) => !isBotNote(n)).map((n) => n.body?.trim() ?? "");
-		if (replies.length === 0) continue;
-		const resolved = notes.some((n) => n.resolved === true);
-		threads.push({
-			file,
-			line: positionLine$1(botNote),
-			resolved,
-			botComment: normalizeBody(botNote.body ?? ""),
-			replies
-		});
-	}
-	return threads;
-}
-/**
-* Renders a `<prior_review_feedback>` XML block from a list of prior threads.
-* Returns an empty string when `threads` is empty.
-*/
-function renderPriorThreadsBlock(threads) {
-	if (threads.length === 0) return "";
-	return `<prior_review_feedback>\n${threads.map((t) => {
-		return `  <thread ${[
-			`file="${t.file}"`,
-			t.line !== null ? `line="${t.line}"` : null,
-			`resolved="${t.resolved}"`
-		].filter(Boolean).join(" ")}>\n${`    <comment>${escapeXml(t.botComment)}</comment>`}\n${t.replies.map((r) => `    <reply>${escapeXml(r)}</reply>`).join("\n")}\n  </thread>`;
-	}).join("\n")}\n</prior_review_feedback>`;
-}
-function escapeXml(text) {
-	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-}
-//#endregion
-//#region src/skills.ts
-var SKILL_DIRS = [".agents/skills", ".claude/skills"];
-var RESOURCE_DIRS = ["references"];
-function parseFrontmatter(content) {
-	const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-	if (!match) return null;
-	let data;
-	try {
-		data = parse(match[1]);
-	} catch {
-		return null;
-	}
-	if (!data || typeof data !== "object") return null;
-	const { name, description } = data;
-	if (typeof name !== "string" || typeof description !== "string") return null;
-	const trimmedName = name.trim();
-	const trimmedDescription = description.trim();
-	if (!trimmedName || !trimmedDescription) return null;
-	return {
-		name: trimmedName,
-		description: trimmedDescription
-	};
-}
-async function loadSkillFromDir(dirPath, source) {
-	const skillMdPath = join(dirPath, "SKILL.md");
-	let content;
-	try {
-		content = await readFile(skillMdPath, "utf8");
-	} catch {
-		return null;
-	}
-	const parsed = parseFrontmatter(content);
-	if (!parsed) return null;
-	const resourceDirs = RESOURCE_DIRS.filter((d) => existsSync(join(dirPath, d)));
-	return {
-		name: parsed.name,
-		description: parsed.description,
-		filePath: skillMdPath,
-		rootDir: dirPath,
-		resourceDirs,
-		source
-	};
-}
-function resolveBuiltinSkillsDir() {
-	return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
-}
-async function loadBuiltinSkill(name) {
-	return loadSkillFromDir(join(resolveBuiltinSkillsDir(), name), "builtin");
-}
-async function loadAutoDiscoveredSkills(cwd, gitRoot, warn) {
-	const dirs = [];
-	let current = cwd;
-	while (true) {
-		dirs.unshift(current);
-		if (current === gitRoot) break;
-		const parent = dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	const found = /* @__PURE__ */ new Map();
-	for (const dir of dirs) for (const skillDir of SKILL_DIRS) {
-		const skillsPath = join(dir, skillDir);
-		let entries;
-		try {
-			entries = await readdir(skillsPath);
-		} catch {
-			continue;
-		}
-		for (const entry of entries) {
-			const entryPath = join(skillsPath, entry);
-			const skill = await loadSkillFromDir(entryPath, "project");
-			if (skill) found.set(skill.name, skill);
-			else if (warn && existsSync(join(entryPath, "SKILL.md"))) warn(`Skill at ${entryPath} has a SKILL.md but is missing required frontmatter fields (name, description) — skill not loaded.`);
-		}
-	}
-	return [...found.values()];
-}
-/**
-* Parse a skill spec string into a typed `SkillSpec` descriptor.
-*
-* Supported spec formats:
-*
-* | Input                              | Result                                            |
-* |------------------------------------|---------------------------------------------------|
-* | `code-review`                      | `{ protocol: 'builtin', name: 'code-review' }`    |
-* | `npm:my-skill`                     | `{ protocol: 'npm', packageName: 'my-skill', ... }`|
-* | `npm:@scope/pkg`                   | `{ protocol: 'npm', packageName: '@scope/pkg', ... }`|
-* | `npm:@scope/bundle/security`       | `{ protocol: 'npm', packageName: '@scope/bundle', subpath: 'security' }`|
-* | `npm:bundle/security`              | `{ protocol: 'npm', packageName: 'bundle', subpath: 'security' }`|
-* | `file:./path/to/skill`             | `{ protocol: 'file', path: './path/to/skill' }`   |
-* | `file:/absolute/path`              | `{ protocol: 'file', path: '/absolute/path' }`    |
-* | `git:https://host/org/s.git`       | `{ protocol: 'git', url: 'https://host/org/s.git', ref: '', subpath: '' }` |
-* | `git:https://host/org/b.git#v1/sec`| `{ protocol: 'git', url: 'https://host/org/b.git', ref: 'v1', subpath: 'sec' }` |
-* | `git+ssh://git@host/org/s.git`     | `{ protocol: 'git', url: 'ssh://git@host/org/s.git', ref: '', subpath: '' }` |
-*/
-function parseSkillSpec(spec) {
-	if (spec.startsWith("file:")) return {
-		protocol: "file",
-		path: spec.slice(5)
-	};
-	if (spec.startsWith("npm:")) {
-		const rest = spec.slice(4);
-		if (rest.startsWith("@")) {
-			const parts = rest.split("/");
-			if (parts.length < 2) return {
-				protocol: "npm",
-				packageName: rest,
-				subpath: ""
-			};
-			return {
-				protocol: "npm",
-				packageName: `${parts[0]}/${parts[1]}`,
-				subpath: parts.slice(2).join("/")
-			};
-		}
-		const slashIdx = rest.indexOf("/");
-		if (slashIdx === -1) return {
-			protocol: "npm",
-			packageName: rest,
-			subpath: ""
-		};
-		return {
-			protocol: "npm",
-			packageName: rest.slice(0, slashIdx),
-			subpath: rest.slice(slashIdx + 1)
-		};
-	}
-	if (spec.startsWith("git+") || spec.startsWith("git:")) return parseGitSpec(spec);
-	return {
-		protocol: "builtin",
-		name: spec
-	};
-}
-/**
-* Parse a `git:` / `git+ssh:` skill spec into its URL, pinned ref, and subpath.
-*
-* - `git:<url>`         strips the `git:` marker; what follows is the clone URL
-*   (e.g. `git:https://host/org/repo.git`).
-* - `git+<transport>://…` strips the leading `git+`, leaving a URL git
-*   understands directly (`git+ssh://git@host/…` → `ssh://git@host/…`), matching
-*   npm's `package.json` git-dependency convention.
-*
-* An optional `#<ref>[/<subpath>]` fragment pins the ref (tag, branch, or
-* commit) and, after the first `/`, points at a skill directory inside the repo.
-*/
-function parseGitSpec(spec) {
-	const raw = spec.startsWith("git+") ? spec.slice(4) : spec.slice(4);
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
+function parseReviewMarkdownWithWarnings(markdown) {
+	const comments = [];
+	const warnings = [];
+	const { summary, malformed } = parseJsonComments(markdown, comments, warnings);
+	parseInlineSection(markdown, comments, warnings);
+	if (malformed && comments.length > 0) {
+		warnings.push(`A reviewer JSON block was unparseable (${malformed.reason}), but ${comments.length} comment(s) were recovered from other sections; continuing.`);
 		return {
-			protocol: "git",
-			url: raw,
-			ref: "",
-			subpath: ""
+			comments,
+			summary,
+			warnings,
+			malformed: null
 		};
 	}
-	const fragment = parsed.hash ? parsed.hash.slice(1) : "";
-	parsed.hash = "";
-	const url = parsed.toString();
-	const slashIdx = fragment.indexOf("/");
-	if (slashIdx === -1) return {
-		protocol: "git",
-		url,
-		ref: fragment,
-		subpath: ""
-	};
 	return {
-		protocol: "git",
-		url,
-		ref: fragment.slice(0, slashIdx),
-		subpath: fragment.slice(slashIdx + 1)
+		comments,
+		summary,
+		warnings,
+		malformed
 	};
 }
+function parseReviewMarkdown(markdown) {
+	return parseReviewMarkdownWithWarnings(markdown).comments;
+}
+//#endregion
+//#region src/prior-threads.ts
+var FINGERPRINT_MARKER_RE = new RegExp(FINGERPRINT_MARKER_PATTERN, "i");
 /**
-* Resolve the directory for an npm-installed skill by walking `node_modules`
-* upward from `cwd` (supports monorepo hoisting). Returns the resolved path
-* or `null` if the package / subpath cannot be found.
+* Returns true when the note body contains a code-review fingerprint marker
+* (current or legacy prefix).
+* Used to identify notes posted by the bot without needing a getCurrentUser() call.
 */
-async function resolveNpmSkillDir(packageName, subpath, cwd) {
-	let current = cwd;
-	while (true) {
-		const candidate = subpath ? join(current, "node_modules", packageName, subpath) : join(current, "node_modules", packageName);
-		if (existsSync(candidate)) return candidate;
-		const parent = dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	return null;
-}
-/** Base directory for cached git-skill clones (honours `XDG_CACHE_HOME`). */
-function resolveSkillCacheDir() {
-	return join(process.env.XDG_CACHE_HOME?.trim() || join(homedir(), ".cache"), "code-review", "skills");
+function isBotNote(note) {
+	return FINGERPRINT_MARKER_RE.test(note.body ?? "");
 }
 /**
-* Stable cache-directory name for a git skill. Keyed on the clone URL plus the
-* pinned ref so that two refs of the same repo never share a cache entry.
+* Parses the `+++ b/<path>` lines from a unified diff and returns the set of
+* new file paths. `/dev/null` (deleted files) is excluded.
 */
-function gitSkillCacheKey(url, ref) {
-	return createHash("sha256").update(`${url}#${ref}`).digest("hex").slice(0, 16);
+function extractChangedFiles(diff) {
+	const files = /* @__PURE__ */ new Set();
+	for (const line of diff.split("\n")) {
+		const match = line.match(/^\+\+\+ b\/(.+)$/);
+		if (match && match[1] !== "/dev/null") files.add(match[1]);
+	}
+	return files;
 }
 /**
-* Shallow-clone `url` at `ref` into `dir`. Using init + a single-ref fetch +
-* `checkout FETCH_HEAD` (rather than `clone --branch`) means a branch, tag, or
-* commit SHA all resolve through the same path; an empty `ref` fetches the
-* remote's default branch via `HEAD`.
+* Returns the line number for a discussion note's position.
+* Prefers the new-side line (`new_line`) then falls back to `old_line`.
 */
-async function gitShallowClone(url, ref, dir) {
-	await git$1([
-		"init",
-		"--quiet",
-		dir
-	]);
-	await git$1([
-		"remote",
-		"add",
-		"origin",
-		url
-	], { cwd: dir });
-	await git$1([
-		"fetch",
-		"--depth",
-		"1",
-		"--quiet",
-		"origin",
-		ref || "HEAD"
-	], { cwd: dir });
-	await git$1([
-		"checkout",
-		"--quiet",
-		"FETCH_HEAD"
-	], { cwd: dir });
+function positionLine$1(note) {
+	return note.position?.new_line ?? note.position?.old_line ?? null;
 }
 /**
-* Resolve a git skill spec to a local clone directory, reusing the on-disk
-* cache when possible. The clone lands in a temp sibling first and is renamed
-* into place atomically, so a crashed or concurrent clone never leaves a
-* half-written cache entry. With `refresh`, any cached copy is discarded first.
+* Returns the file path for a discussion note's position.
+* Prefers the new path then falls back to the old path.
 */
-async function cloneGitSkill(url, ref, options) {
-	const repoDir = join(options.cacheDir, gitSkillCacheKey(url, ref));
-	if (options.refresh) await rm(repoDir, {
-		recursive: true,
-		force: true
-	});
-	else if (existsSync(join(repoDir, ".git"))) return repoDir;
-	else if (existsSync(repoDir)) await rm(repoDir, {
-		recursive: true,
-		force: true
-	});
-	await mkdir(options.cacheDir, { recursive: true });
-	const tmpDir = `${repoDir}.tmp-${process.pid}`;
-	await rm(tmpDir, {
-		recursive: true,
-		force: true
-	});
-	try {
-		await gitShallowClone(url, ref, tmpDir);
-		try {
-			await rename(tmpDir, repoDir);
-		} catch (error) {
-			if (existsSync(join(repoDir, ".git"))) {
-				await rm(tmpDir, {
-					recursive: true,
-					force: true
-				});
-				return repoDir;
-			}
-			throw error;
-		}
-	} catch (error) {
-		await rm(tmpDir, {
-			recursive: true,
-			force: true
-		});
-		throw error;
-	}
-	return repoDir;
+function positionFile$1(note) {
+	return note.position?.new_path ?? note.position?.old_path ?? null;
 }
 /**
-* Load a skill by its spec string (`code-review`, `npm:@scope/pkg`, `file:./path`,
-* `git:https://…`, …).
+* Extracts prior review threads from existing MR discussions that are relevant
+* to the current diff.
 *
-* Resolution order:
-* 1. `builtin` — package-bundled `skills/<name>/`
-* 2. `npm:`    — `node_modules/<packageName>[/subpath]` walked up from `cwd`
-* 3. `file:`   — direct filesystem path (relative paths resolved from `cwd`)
-* 4. `git:` / `git+ssh:` — shallow clone at the pinned ref, cached on disk,
-*    loading `SKILL.md` from the repo root or the `#<ref>/<subpath>` directory
+* A thread is included when:
+* - It contains at least one bot note (identified by fingerprint marker).
+* - It contains at least one non-system human reply after the bot note.
+* - The thread's file appears in `changedFiles`.
 *
-* Throws a `ConfigError` if the spec cannot be resolved or the resolved
-* directory does not contain a valid `SKILL.md`.
+* Resolved threads are included but marked with `resolved: true` so the
+* reviewer can reference them without re-raising the concern.
 */
-async function loadNamedSkill(spec, cwd, options = {}) {
-	const parsed = parseSkillSpec(spec);
-	if (parsed.protocol === "builtin") {
-		const skill = await loadBuiltinSkill(parsed.name);
-		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `No built-in skill named "${parsed.name}" was found. Check the skill name, or use npm: / file: to reference external skills.` });
-		return skill;
-	}
-	if (parsed.protocol === "npm") {
-		const dir = await resolveNpmSkillDir(parsed.packageName, parsed.subpath, cwd);
-		if (dir === null) {
-			const pkgRef = parsed.subpath ? `${parsed.packageName} (subpath "${parsed.subpath}")` : parsed.packageName;
-			throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `Package ${pkgRef} was not found in node_modules. Run \`npm install ${parsed.packageName}\` in the project.` });
-		}
-		const skill = await loadSkillFromDir(dir, "npm");
-		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `The package at ${dir} does not contain a valid SKILL.md.` });
-		return skill;
-	}
-	if (parsed.protocol === "file") {
-		const resolvedPath = parsed.path.startsWith("/") ? parsed.path : join(cwd, parsed.path);
-		const skill = await loadSkillFromDir(resolvedPath, "file");
-		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `No valid SKILL.md was found at "${resolvedPath}". Check that the path points to a skill directory.` });
-		return skill;
-	}
-	let repoDir;
-	try {
-		repoDir = await cloneGitSkill(parsed.url, parsed.ref, {
-			cacheDir: options.cacheDir ?? resolveSkillCacheDir(),
-			refresh: options.refresh ?? false
-		});
-	} catch (error) {
-		const atRef = parsed.ref ? ` at ref "${parsed.ref}"` : "";
-		throw new ConfigError(`Cannot load skill: "${spec}"`, {
-			cause: error,
-			hint: `Failed to clone "${parsed.url}"${atRef}. Check the URL, the ref, and your git credentials. For GitLab, prefer the SSH form: git+ssh://git@host/group/project.git`
+function extractPriorThreads(discussions, changedFiles) {
+	const threads = [];
+	for (const discussion of discussions) {
+		const notes = discussion.notes ?? [];
+		const botNoteIndex = notes.findIndex(isBotNote);
+		if (botNoteIndex === -1) continue;
+		const botNote = notes[botNoteIndex];
+		const file = positionFile$1(botNote);
+		if (!file || !changedFiles.has(file)) continue;
+		const replies = notes.slice(botNoteIndex + 1).filter((n) => !n.system && (n.body?.trim() ?? "")).filter((n) => !isBotNote(n)).map((n) => n.body?.trim() ?? "");
+		if (replies.length === 0) continue;
+		const resolved = notes.some((n) => n.resolved === true);
+		threads.push({
+			file,
+			line: positionLine$1(botNote),
+			resolved,
+			botComment: normalizeBody(botNote.body ?? ""),
+			replies
 		});
 	}
-	const skill = await loadSkillFromDir(parsed.subpath ? join(repoDir, parsed.subpath) : repoDir, "git");
-	if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: parsed.subpath ? `The cloned repository has no valid SKILL.md at subpath "${parsed.subpath}".` : "The cloned repository has no valid SKILL.md at its root. If the skill lives in a subdirectory, point at it with \"#<ref>/<subpath>\"." });
-	return skill;
+	return threads;
+}
+/**
+* Renders a `<prior_review_feedback>` XML block from a list of prior threads.
+* Returns an empty string when `threads` is empty.
+*/
+function renderPriorThreadsBlock(threads) {
+	if (threads.length === 0) return "";
+	return `<prior_review_feedback>\n${threads.map((t) => {
+		return `  <thread ${[
+			`file="${t.file}"`,
+			t.line !== null ? `line="${t.line}"` : null,
+			`resolved="${t.resolved}"`
+		].filter(Boolean).join(" ")}>\n${`    <comment>${escapeXml(t.botComment)}</comment>`}\n${t.replies.map((r) => `    <reply>${escapeXml(r)}</reply>`).join("\n")}\n  </thread>`;
+	}).join("\n")}\n</prior_review_feedback>`;
+}
+function escapeXml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
 //#endregion
 //#region src/skipped-retrieval.ts
@@ -3689,10 +4033,14 @@ async function loadReviewContext(cwd, skillNames = [], warn, options = {}) {
 		walkUpContextFiles(cwd, REVIEW_RULE_FILES, gitRoot),
 		loadAutoDiscoveredSkills(cwd, gitRoot, warn)
 	]);
+	const registry = buildMarketplaceRegistry(options.marketplaces ?? []);
+	const knownMarketplaces = new Set(registry.keys());
 	const skills = [...discovered];
 	const discoveredNames = new Set(discovered.map((s) => s.name));
 	const named = await Promise.all(skillNames.filter((n) => !discoveredNames.has(n)).map(async (n) => {
 		try {
+			const spec = parseSkillSpec(n, knownMarketplaces);
+			if (spec.protocol === "marketplace") return await loadMarketplaceSkill(spec, registry, { refresh: options.refreshGitSkills });
 			return await loadNamedSkill(n, cwd, { refresh: options.refreshGitSkills });
 		} catch (error) {
 			warn?.(`Skipping skill "${n}": ${formatError(error)}`);
@@ -4329,7 +4677,10 @@ async function runReview(config, options) {
 			retrieved: retrievableSkipped.length > 0
 		};
 	}
-	const context = await loadReviewContext(cwd, config.skills, (msg) => logger.warn(msg), { refreshGitSkills: config.refreshGitSkills });
+	const context = await loadReviewContext(cwd, config.skills, (msg) => logger.warn(msg), {
+		refreshGitSkills: config.refreshGitSkills,
+		marketplaces: config.marketplaces
+	});
 	const systemPrompt = buildJSONSystemPrompt(context, minSeverity);
 	const userPrompt = buildUserPrompt(promptDiff, promptSkippedFiles, options.commitLog, options.priorThreads, options.intent, promptCoverage, retrievableSkipped, diskMode, commitsMode ? { sinceRef: options.sinceRef } : void 0);
 	const skillNames = context.skills.map((s) => s.name);
@@ -5265,7 +5616,7 @@ async function loadDefaultRuntime() {
 	const [sdkNode, resources, semconv] = modules;
 	const serviceResource = resources.resourceFromAttributes({
 		[semconv.ATTR_SERVICE_NAME ?? "service.name"]: SERVICE_NAME,
-		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.9.2"
+		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.9.4"
 	});
 	applyOtelExporterDefaults(process.env);
 	const sdk = new sdkNode.NodeSDK({ resource: resources.defaultResource().merge(serviceResource) });
@@ -5737,7 +6088,7 @@ function boldCommentTitle(body) {
 */
 function buildCommentBody(body, commitSha, confidence) {
 	const confidenceLine = `_Confidence: ${confidence}._`;
-	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.9.2 for commit ${commitSha}.</sub>`;
+	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.9.4 for commit ${commitSha}.</sub>`;
 	return `${boldCommentTitle(body.trim())}\n\n${confidenceLine}\n\n---\n\n${footer}`;
 }
 function buildPayload(comment, body, refs, resolved) {
@@ -6844,10 +7195,10 @@ async function main(argv = process.argv.slice(2)) {
 		return;
 	}
 	if (argv.includes("--version") || argv.includes("-v")) {
-		console.log("0.9.2");
+		console.log("0.9.4");
 		return;
 	}
-	process.stderr.write(`[code-review] @weareikko/code-review v0.9.2\n`);
+	process.stderr.write(`[code-review] @weareikko/code-review v0.9.4\n`);
 	assertNodeVersion();
 	applyCodeReviewEnvPrefix();
 	applyDefaultCacheRetention();
@@ -6868,6 +7219,6 @@ if (isDirectRun()) main().catch((error) => {
 	process.exitCode = 1;
 });
 //#endregion
-export { normalizeBody as $, SUMMARY_HISTORY_END as A, buildSummaryHistoryEntries as B, createDiagnosticContext as C, traceDiagnosticPhase as D, traceDiagnostic as E, SUMMARY_MARKER as F, findExistingSummaryNoteId as G, extractSummaryHistoryEntries as H, buildArchivedSummaryEntry as I, upsertSummaryNote as J, stripSummaryHistory as K, buildReviewedCommitFooter as L, SUMMARY_HISTORY_ENTRY_START as M, SUMMARY_HISTORY_LIMIT as N, normalizeSeverity as O, SUMMARY_HISTORY_START as P, fingerprints as Q, buildSizeNoticeBlock as R, DIAGNOSTIC_CHANNEL_PREFIX as S, diagnosticChannels as T, findExistingReviewedCommitSha as U, extractReviewedCommitSha as V, findExistingSummaryNote as W, extractDiffHunkContext as X, appendFingerprintMarkers as Y, extractExistingFingerprints as Z, resolveNpmSkillDir as _, main as a, parseReviewMarkdownWithWarnings as b, buildGeneratedComments as c, startOtelBridge as d, sha256 as et, filterDiff as f, parseSkillSpec as g, loadNamedSkill as h, formatUsageLine as i, SUMMARY_HISTORY_ENTRY_END as j, toGitLabReviewSeverity as k, buildPayload as l, gitSkillCacheKey as m, formatPerModelUsage as n, run as o, runReview as p, stripSummaryMarker as q, formatSkillsFooter as r, withHttpStamping as s, countPostedBySeverity as t, isOtelEnabled as u, resolveSkillCacheDir as v, createDiagnosticRunId as w, DIAGNOSTIC_CHANNEL_NAMES as x, parseReviewMarkdown as y, buildSummaryBody as z };
+export { resolveNpmSkillDir as $, SUMMARY_MARKER as A, findExistingSummaryNoteId as B, normalizeSeverity as C, SUMMARY_HISTORY_ENTRY_START as D, SUMMARY_HISTORY_ENTRY_END as E, buildSummaryHistoryEntries as F, extractDiffHunkContext as G, stripSummaryMarker as H, extractReviewedCommitSha as I, normalizeBody as J, extractExistingFingerprints as K, extractSummaryHistoryEntries as L, buildReviewedCommitFooter as M, buildSizeNoticeBlock as N, SUMMARY_HISTORY_LIMIT as O, buildSummaryBody as P, parseSkillSpec as Q, findExistingReviewedCommitSha as R, traceDiagnosticPhase as S, SUMMARY_HISTORY_END as T, upsertSummaryNote as U, stripSummaryHistory as V, appendFingerprintMarkers as W, gitSkillCacheKey as X, sha256 as Y, loadNamedSkill as Z, DIAGNOSTIC_CHANNEL_PREFIX as _, main as a, diagnosticChannels as b, buildGeneratedComments as c, startOtelBridge as d, resolveSkillCacheDir as et, filterDiff as f, DIAGNOSTIC_CHANNEL_NAMES as g, parseReviewMarkdownWithWarnings as h, formatUsageLine as i, buildArchivedSummaryEntry as j, SUMMARY_HISTORY_START as k, buildPayload as l, parseReviewMarkdown as m, formatPerModelUsage as n, run as o, runReview as p, fingerprints as q, formatSkillsFooter as r, withHttpStamping as s, countPostedBySeverity as t, isOtelEnabled as u, createDiagnosticContext as v, toGitLabReviewSeverity as w, traceDiagnostic as x, createDiagnosticRunId as y, findExistingSummaryNote as z };
 
-//# sourceMappingURL=cli-D47EQ1qq.js.map
+//# sourceMappingURL=cli-C3kNr0rX.js.map