@weareikko/code-review 0.9.5 → 0.9.7

package/dist/{cli-tIo5jQvJ.js → cli-m4pS6_5q.js}

@@ -35,7 +35,7 @@ var GitlabReviewError = class extends Error {
 };
 /**
 * Patterns that identify a provider credit/quota-exhaustion error across
-* providers (Anthropic, OpenAI, Cloudflare AI Gateway, …). Matched against the
+* providers (Anthropic, OpenAI, OpenRouter, …). Matched against the
 * provider's error message. Deliberately excludes transient rate limits (429),
 * which are retryable rather than a billing dead-end.
 */
@@ -399,7 +399,7 @@ async function git$1(args, options = {}) {
 	try {
 		const { stdout } = await exec$1("git", args, {
 			cwd: options.cwd,
-			maxBuffer: 50 * 1024 * 1024
+			maxBuffer: 52428800
 		});
 		return stdout;
 	} catch (error) {
@@ -541,6 +541,10 @@ function summarizeDiff(diff) {
 }
 //#endregion
 //#region src/skills.ts
+/** Normalize a filesystem-relative path to the POSIX form used in URLs. */
+function toPosixPath(path) {
+	return sep === "/" ? path : path.split(sep).join("/");
+}
 var SKILL_DIRS = [".agents/skills", ".claude/skills"];
 var RESOURCE_DIRS = ["references"];
 function parseFrontmatter(content) {
@@ -563,7 +567,7 @@ function parseFrontmatter(content) {
 		description: trimmedDescription
 	};
 }
-async function loadSkillFromDir(dirPath, source) {
+async function loadSkillFromDir(dirPath, origin) {
 	const skillMdPath = join(dirPath, "SKILL.md");
 	let content;
 	try {
@@ -580,14 +584,17 @@ async function loadSkillFromDir(dirPath, source) {
 		filePath: skillMdPath,
 		rootDir: dirPath,
 		resourceDirs,
-		source
+		origin
 	};
 }
 function resolveBuiltinSkillsDir() {
 	return join(dirname(fileURLToPath(import.meta.url)), "..", "skills");
 }
 async function loadBuiltinSkill(name) {
-	return loadSkillFromDir(join(resolveBuiltinSkillsDir(), name), "builtin");
+	return loadSkillFromDir(join(resolveBuiltinSkillsDir(), name), {
+		kind: "builtin",
+		name
+	});
 }
 async function loadAutoDiscoveredSkills(cwd, gitRoot, warn) {
 	const dirs = [];
@@ -610,7 +617,10 @@ async function loadAutoDiscoveredSkills(cwd, gitRoot, warn) {
 		}
 		for (const entry of entries) {
 			const entryPath = join(skillsPath, entry);
-			const skill = await loadSkillFromDir(entryPath, "project");
+			const skill = await loadSkillFromDir(entryPath, {
+				kind: "project",
+				path: toPosixPath(relative(gitRoot, entryPath))
+			});
 			if (skill) found.set(skill.name, skill);
 			else if (warn && existsSync(join(entryPath, "SKILL.md"))) warn(`Skill at ${entryPath} has a SKILL.md but is missing required frontmatter fields (name, description) — skill not loaded.`);
 		}
@@ -781,7 +791,8 @@ function redactUrl(url) {
 }
 /** Base directory for cached git-skill clones (honours `XDG_CACHE_HOME`). */
 function resolveSkillCacheDir() {
-	return join(process.env.XDG_CACHE_HOME?.trim() || join(homedir(), ".cache"), "code-review", "skills");
+	const base = process.env.XDG_CACHE_HOME?.trim() || join(homedir(), ".cache");
+	return join(base, "code-review", "skills");
 }
 /**
 * Stable cache-directory name for a git skill. Keyed on the clone URL plus the
@@ -898,13 +909,20 @@ async function loadNamedSkill(spec, cwd, options = {}) {
 			const pkgRef = parsed.subpath ? `${parsed.packageName} (subpath "${parsed.subpath}")` : parsed.packageName;
 			throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `Package ${pkgRef} was not found in node_modules. Run \`npm install ${parsed.packageName}\` in the project.` });
 		}
-		const skill = await loadSkillFromDir(dir, "npm");
+		const skill = await loadSkillFromDir(dir, {
+			kind: "npm",
+			packageName: parsed.packageName,
+			subpath: parsed.subpath
+		});
 		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `The package at ${dir} does not contain a valid SKILL.md.` });
 		return skill;
 	}
 	if (parsed.protocol === "file") {
 		const resolvedPath = parsed.path.startsWith("/") ? parsed.path : join(cwd, parsed.path);
-		const skill = await loadSkillFromDir(resolvedPath, "file");
+		const skill = await loadSkillFromDir(resolvedPath, {
+			kind: "file",
+			path: resolvedPath
+		});
 		if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: `No valid SKILL.md was found at "${resolvedPath}". Check that the path points to a skill directory.` });
 		return skill;
 	}
@@ -922,7 +940,12 @@ async function loadNamedSkill(spec, cwd, options = {}) {
 			hint: `Failed to clone "${redactUrl(parsed.url)}"${atRef}. Check the URL, the ref, and your git credentials. For GitLab, prefer the SSH form: git+ssh://git@host/group/project.git`
 		});
 	}
-	const skill = await loadSkillFromDir(parsed.subpath ? join(repoDir, parsed.subpath) : repoDir, "git");
+	const skill = await loadSkillFromDir(parsed.subpath ? join(repoDir, parsed.subpath) : repoDir, {
+		kind: "git",
+		url: parsed.url,
+		ref: parsed.ref,
+		path: parsed.subpath
+	});
 	if (!skill) throw new ConfigError(`Cannot load skill: "${spec}"`, { hint: parsed.subpath ? `The cloned repository has no valid SKILL.md at subpath "${parsed.subpath}".` : "The cloned repository has no valid SKILL.md at its root. If the skill lives in a subdirectory, point at it with \"#<ref>/<subpath>\"." });
 	return skill;
 }
@@ -943,7 +966,7 @@ var DEFAULT_MARKETPLACE_FORMAT = "anthropic";
 * (`npm:`, `file:`, `git:`) or the bare-name builtin lookup, and so cannot be
 * used as a marketplace name — `<name>:<plugin>/<skill>` would be ambiguous.
 */
-var RESERVED_MARKETPLACE_NAMES = new Set([
+var RESERVED_MARKETPLACE_NAMES = /* @__PURE__ */ new Set([
 	"npm",
 	"file",
 	"git",
@@ -1061,7 +1084,7 @@ async function resolveAnthropicSkill(repoDir, mp, spec) {
 	const pluginDir = resolvePluginDir(repoDir, manifest, entry.source, mp, spec);
 	const realPluginDir = await resolveInside(realRoot, pluginDir, ref);
 	const bases = computeSkillBases(repoDir, pluginDir, entry, entry.strict !== false && realPluginDir ? await readPluginManifest(realRoot, realPluginDir, ref) : null, ref);
-	const skill = await findSkillInBases(realRoot, bases, pluginDir, spec.skill, ref);
+	const skill = await findSkillInBases(realRoot, bases, pluginDir, spec, ref, mp);
 	if (!skill) throw new ConfigError(`Cannot load skill: "${ref}"`, { hint: `No skill "${spec.skill}" found in plugin "${spec.plugin}". Looked under the default skills/ directory${bases.length > 1 ? " and the plugin's custom \"skills\" paths" : ""}. Check the skill name against the marketplace.` });
 	return skill;
 }
@@ -1121,14 +1144,15 @@ function resolveUnderPlugin(repoDir, pluginDir, rel, ref) {
 * symlinks and reject any directory that escapes the cloned marketplace before a
 * file is read.
 */
-async function findSkillInBases(realRoot, bases, pluginDir, skillName, ref) {
+async function findSkillInBases(realRoot, bases, pluginDir, spec, ref, mp) {
+	const skillName = spec.skill;
 	for (const base of bases) {
-		const container = await loadSkillIfInside(realRoot, join(base, skillName), ref);
+		const container = await loadSkillIfInside(realRoot, join(base, skillName), ref, mp, spec);
 		if (container) return container;
-		const single = await loadSkillIfInside(realRoot, base, ref);
+		const single = await loadSkillIfInside(realRoot, base, ref, mp, spec);
 		if (single && single.name === skillName) return single;
 	}
-	const root = await loadSkillIfInside(realRoot, pluginDir, ref);
+	const root = await loadSkillIfInside(realRoot, pluginDir, ref, mp, spec);
 	return root && root.name === skillName ? root : null;
 }
 /**
@@ -1173,11 +1197,18 @@ async function readTextInside(realRoot, filePath, ref) {
 * resolve within `realRoot`. Guarding the file (not just the directory) closes
 * the case where a legitimate in-repo dir holds a `SKILL.md` symlinked outside.
 */
-async function loadSkillIfInside(realRoot, dir, ref) {
+async function loadSkillIfInside(realRoot, dir, ref, mp, spec) {
 	const real = await resolveInside(realRoot, dir, ref);
 	if (!real) return null;
 	if (await readTextInside(realRoot, join(real, "SKILL.md"), ref) === null) return null;
-	return loadSkillFromDir(real, "marketplace");
+	return loadSkillFromDir(real, {
+		kind: "marketplace",
+		marketplace: mp.name,
+		plugin: spec.plugin,
+		url: mp.url,
+		ref: mp.ref,
+		path: toPosixPath(relative(realRoot, real))
+	});
 }
 /**
 * Resolve a plugin entry's `source` to an absolute directory inside the cloned
@@ -1304,13 +1335,24 @@ function extractExistingFingerprints(discussions) {
 	for (const discussion of discussions) for (const note of discussion.notes ?? []) for (const match of String(note.body ?? "").matchAll(FINGERPRINT_MARKER_RE$2)) set.add(match[1]);
 	return set;
 }
+//#endregion
+//#region src/product.ts
+/**
+* The published package name, shown in review footers. Independent of the review
+* platform: the same tool posts to GitLab and GitHub, so the footer identifies
+* the tool, not the backend. Kept as a single source of truth so the inline and
+* summary footers can never drift apart.
+*/
+var PRODUCT_NAME = "@weareikko/code-review";
+/** Canonical project URL used in the footer's markdown link. */
+var PRODUCT_URL = "https://github.com/weareikko/code-review";
 /**
 * The `[name](url)` markdown link used verbatim in both the inline comment footer
 * ({@link buildCommentBody}) and the reviewed-commit summary footer
 * ({@link buildReviewedCommitFooter}). Changing this changes the reviewed-commit
 * footer format, which is guarded by a migration test.
 */
-var PRODUCT_LINK = `[@weareikko/code-review](https://github.com/weareikko/code-review)`;
+var PRODUCT_LINK = `[${PRODUCT_NAME}](${PRODUCT_URL})`;
 //#endregion
 //#region src/posting.ts
 var SUMMARY_MARKER = "<!-- code-review:summary -->";
@@ -1390,7 +1432,7 @@ function buildSummaryBody(summary, costFooter, options = {}) {
 	return `${withFooter}\n\n${buildSummaryHistoryBlock(historyEntries)}`;
 }
 function buildReviewedCommitFooter(commitSha) {
-	return `Reviewed by ${PRODUCT_LINK} v0.9.5 for commit ${commitSha}.`;
+	return `Reviewed by ${PRODUCT_LINK} v0.9.7 for commit ${commitSha}.`;
 }
 function extractReviewedCommitSha(body) {
 	return REVIEWED_COMMIT_FOOTER_PATTERN.exec(body)?.[1] ?? null;
@@ -1610,8 +1652,9 @@ async function createDraftsConcurrently(gitlab, project, mr, fresh) {
 			next += 1;
 			if (index >= fresh.length) return;
 			const item = fresh[index];
+			const draft = await gitlab.createDraftNote(project, mr, item.payload);
 			records[index] = {
-				id: (await gitlab.createDraftNote(project, mr, item.payload)).id,
+				id: draft.id,
 				fingerprints: item.fingerprints
 			};
 		}
@@ -1742,8 +1785,8 @@ var RESERVED_ENV_SUFFIX_SET = new Set(RESERVED_ENV_SUFFIXES);
 * CI-wide variable of the same name.
 *
 * This lets credentials and infra vars that `@earendil-works/pi-ai` reads
-* (`ANTHROPIC_API_KEY`, `CLOUDFLARE_API_KEY`, `CLOUDFLARE_ACCOUNT_ID`,
-* `OLLAMA_HOST`, ambient AWS/Vertex creds, …) — and the GitLab tokens — be
+* (`ANTHROPIC_API_KEY`, `OPENROUTER_API_KEY`, `OLLAMA_HOST`,
+* ambient AWS/Vertex creds, …) — and the GitLab tokens — be
 * scoped under `CODE_REVIEW_` in shared CI without enumerating pi-ai's
 * provider list.
 *
@@ -1771,8 +1814,8 @@ function applyCodeReviewEnvPrefix(env = process.env) {
 /**
 * Default pi-ai's prompt-cache retention to `long` when the caller has not set
 * it. pi-ai reads `PI_CACHE_RETENTION` from `process.env` at request time; `long`
-* asks providers that support it (e.g. OpenAI's `openai-responses` API, including
-* via the Cloudflare AI Gateway) to keep the cached system-prompt prefix for up
+* asks providers that support it (e.g. OpenAI's `openai-responses` API) to keep
+* the cached system-prompt prefix for up
 * to 24h so reviews spaced hours apart still reuse it. It is a safe no-op for
 * providers/models without long-retention support (e.g. Anthropic), where it
 * behaves exactly like the default `short`.
@@ -1784,7 +1827,7 @@ function applyDefaultCacheRetention(env = process.env) {
 	if (!env.PI_CACHE_RETENTION) env.PI_CACHE_RETENTION = "long";
 	return env;
 }
-var BOOLEAN_FLAGS = new Set([
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 	"dry-run",
 	"no-post",
 	"no-summary",
@@ -1795,7 +1838,7 @@ var BOOLEAN_FLAGS = new Set([
 	"help",
 	"version"
 ]);
-var MULTI_FLAGS = new Set(["skill", "marketplace"]);
+var MULTI_FLAGS = /* @__PURE__ */ new Set(["skill", "marketplace"]);
 function parseArgs(argv) {
 	const args = {};
 	for (let i = 0; i < argv.length; i += 1) {
@@ -2035,6 +2078,16 @@ function detectPlatform(args, env, readEventFile = readEventFileSync) {
 	if (hasGitLab && !hasGitHub) return "gitlab";
 	throw new ConfigError(hasGitHub && hasGitLab ? "Ambiguous review platform: both GitHub and GitLab identifiers are present." : "Could not detect the review platform from the environment.", { hint: `Set --platform (or CODE_REVIEW_PLATFORM) to one of: ${PLATFORMS.join(", ")}.` });
 }
+/**
+* Web URL of the repository under review, as the CI environment reports it:
+* GitLab exposes it directly, GitHub composes it from the server and the
+* `owner/repo` slug. Returns `undefined` outside CI, where no such URL exists.
+* Shared by the config (skill source links) and the OTel attribute builder.
+*/
+function resolveProjectWebUrl(env = process.env) {
+	if (env.CI_PROJECT_URL) return env.CI_PROJECT_URL.replace(/\/$/, "");
+	if (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY) return `${env.GITHUB_SERVER_URL.replace(/\/$/, "")}/${env.GITHUB_REPOSITORY}`;
+}
 function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 	const args = parseArgs(argv);
 	const platform = detectPlatform(args, env);
@@ -2042,6 +2095,7 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 	const token = resolveGitLabToken(args, env);
 	const githubApiUrl = String(args.githubApiUrl ?? env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "");
 	const githubServerUrl = String(args.githubServerUrl ?? env.GITHUB_SERVER_URL ?? "https://github.com").replace(/\/$/, "");
+	const githubRepository = String(args.githubRepository ?? env.GITHUB_REPOSITORY ?? "");
 	const model = String(args.model ?? env.CODE_REVIEW_MODEL ?? "");
 	const apiKey = String(args.apiKey ?? resolveProviderApiKey(model) ?? "");
 	const baseUrl = String(args.baseUrl ?? first(env.CODE_REVIEW_BASE_URL, resolveOllamaBaseUrl(model, env)) ?? "");
@@ -2060,11 +2114,12 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 		gitlabUrl,
 		gitlabToken: token.token,
 		gitlabAuthHeader: token.header,
-		githubRepository: String(args.githubRepository ?? env.GITHUB_REPOSITORY ?? ""),
+		githubRepository,
 		githubPr: resolveGitHubPr(args, env),
 		githubToken: String(args.githubToken ?? env.GITHUB_TOKEN ?? ""),
 		githubApiUrl,
 		githubServerUrl,
+		projectWebUrl: resolveProjectWebUrl(env) ?? "",
 		model,
 		modelPool: resolveModelPool(args, env),
 		minSeverity: normalizeChoice(args.minSeverity ?? env.CODE_REVIEW_MIN_SEVERITY ?? "info"),
@@ -2393,7 +2448,8 @@ function createGitTools(dir, options = {}) {
 					dir,
 					oid
 				});
-				const diff = await diffCommits(dir, fs, commit.parent[0] ?? null, oid);
+				const parent = commit.parent[0] ?? null;
+				const diff = await diffCommits(dir, fs, parent, oid);
 				return text(`commit ${oid}\nAuthor: ${commit.author.name} <${commit.author.email}>\n\n${commit.message.trim()}\n\n${diff}`);
 			}
 		},
@@ -2406,7 +2462,9 @@ function createGitTools(dir, options = {}) {
 				to: Type.String({ description: "Target ref/sha." })
 			}),
 			async execute(_id, params) {
-				return text(await diffCommits(dir, fs, await resolveOid(dir, fs, params.from), await resolveOid(dir, fs, params.to)));
+				const fromOid = await resolveOid(dir, fs, params.from);
+				const toOid = await resolveOid(dir, fs, params.to);
+				return text(await diffCommits(dir, fs, fromOid, toOid));
 			}
 		}
 	];
@@ -2572,6 +2630,80 @@ function removeAtIndex(text, start, count) {
 function endsWithCommaOrNewline(text) {
 	return /[,\n][ \t\r]*$/.test(text);
 }
+var namedHtmlEntities = {
+	"&quot;": "\"",
+	"&amp;": "&",
+	"&lt;": "<",
+	"&gt;": ">",
+	"&apos;": "'"
+};
+/**
+* Try to match an HTML entity at the start of the given fragment. The fragment
+* is a small slice of text that begins exactly at the candidate '&'. Returns the
+* decoded character and the number of characters consumed, or null when there
+* is no complete, valid entity (for example a truncated "&quot" without ';').
+*/
+function matchHtmlEntity(fragment) {
+	if (fragment.charAt(0) !== "&") return null;
+	const semicolon = fragment.indexOf(";");
+	if (semicolon === -1) return null;
+	const entity = fragment.substring(0, semicolon + 1);
+	const named = namedHtmlEntities[entity];
+	if (named !== void 0) return {
+		char: named,
+		length: entity.length
+	};
+	if (fragment.charAt(1) === "#") {
+		const body = fragment.substring(2, semicolon);
+		const hex = body.charAt(0) === "x" || body.charAt(0) === "X";
+		const digits = hex ? body.substring(1) : body;
+		if (digits.length > 0) {
+			const code = Number.parseInt(digits, hex ? 16 : 10);
+			if (!Number.isNaN(code) && code >= 0 && code <= 1114111) return {
+				char: String.fromCodePoint(code),
+				length: entity.length
+			};
+		}
+	}
+	return null;
+}
+/**
+* Test whether a matched HTML entity decodes to a double quote character
+*/
+function isDoubleQuoteEntity(match) {
+	return match !== null && match.char === "\"";
+}
+/**
+* Test whether a matched HTML entity decodes to a single quote character
+*/
+function isSingleQuoteEntity(match) {
+	return match !== null && match.char === "'";
+}
+/**
+* Count the number of occurrences of a single character in a string
+*/
+function countOccurrences(text, char) {
+	let count = 0;
+	for (let i = 0; i < text.length; i++) if (text.charAt(i) === char) count++;
+	return count;
+}
+/**
+* Test whether `closeChar` is a closing bracket and `text` still contains an
+* unmatched opening bracket of the same kind. This indicates that the end of
+* `text` is located inside the brackets, for example the quote in
+* `"a (b") c"` is followed by `)` while `(` is still unclosed.
+*
+* Note that the (potentially expensive) counting is only performed when
+* `closeChar` actually is a closing bracket.
+*/
+function isInsideUnclosedBracket(text, closeChar) {
+	switch (closeChar) {
+		case ")": return countOccurrences(text, "(") > countOccurrences(text, ")");
+		case "]": return countOccurrences(text, "[") > countOccurrences(text, "]");
+		case "}": return countOccurrences(text, "{") > countOccurrences(text, "}");
+		default: return false;
+	}
+}
 //#endregion
 //#region node_modules/jsonrepair/lib/esm/regular/jsonrepair.js
 var controlCharacters = {
@@ -2744,23 +2876,26 @@ function jsonrepair(text) {
 					processedComma = parseCharacter(",");
 					if (!processedComma) output = insertBeforeLastWhitespace(output, ",");
 					parseWhitespaceAndSkipComments();
-				} else {
-					processedComma = true;
-					initial = false;
-				}
+				} else processedComma = true;
 				skipEllipsis();
 				if (!(parseString() || parseUnquotedString(true))) {
-					if (text[i] === "}" || text[i] === "{" || text[i] === "]" || text[i] === "[" || text[i] === void 0) output = stripLastOccurrence(output, ",");
-					else throwObjectKeyExpected();
+					if (text[i] === "}" || text[i] === "{" || text[i] === "]" || text[i] === "[" || text[i] === void 0) {
+						if (!initial) output = stripLastOccurrence(output, ",");
+					} else throwObjectKeyExpected();
 					break;
 				}
 				parseWhitespaceAndSkipComments();
 				const processedColon = parseCharacter(":");
 				const truncatedText = i >= text.length;
-				if (!processedColon) if (isStartOfValue(text[i]) || truncatedText) output = insertBeforeLastWhitespace(output, ":");
-				else throwColonExpected();
-				if (!parseValue()) if (processedColon || truncatedText) output += "null";
-				else throwColonExpected();
+				if (!processedColon) {
+					if (isStartOfValue(text[i]) || truncatedText) output = insertBeforeLastWhitespace(output, ":");
+					else throwColonExpected();
+				}
+				if (!parseValue()) {
+					if (processedColon || truncatedText) output += "null";
+					else throwColonExpected();
+				}
+				initial = false;
 			}
 			if (text[i] === "}") {
 				output += "}";
@@ -2783,12 +2918,13 @@ function jsonrepair(text) {
 			while (i < text.length && text[i] !== "]") {
 				if (!initial) {
 					if (!parseCharacter(",")) output = insertBeforeLastWhitespace(output, ",");
-				} else initial = false;
+				}
 				skipEllipsis();
 				if (!parseValue()) {
-					output = stripLastOccurrence(output, ",");
+					if (!initial) output = stripLastOccurrence(output, ",");
 					break;
 				}
+				initial = false;
 			}
 			if (text[i] === "]") {
 				output += "]";
@@ -2830,17 +2966,19 @@ function jsonrepair(text) {
 	function parseString() {
 		let stopAtDelimiter = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : false;
 		let stopAtIndex = arguments.length > 1 && arguments[1] !== void 0 ? arguments[1] : -1;
-		let skipEscapeChars = text[i] === "\\";
+		const skipEscapeChars = text[i] === "\\";
 		if (skipEscapeChars) {
 			i++;
-			skipEscapeChars = true;
+			if (!isQuote(text[i])) throwUnexpectedCharacter();
 		}
-		if (isQuote(text[i])) {
+		const openEntity = text[i] === "&" ? matchHtmlEntity(text.slice(i, i + 12)) : null;
+		const openedByEntity = isDoubleQuoteEntity(openEntity) || isSingleQuoteEntity(openEntity);
+		if (isQuote(text[i]) || openedByEntity) {
 			const isEndQuote = isDoubleQuote(text[i]) ? isDoubleQuote : isSingleQuote(text[i]) ? isSingleQuote : isSingleQuoteLike(text[i]) ? isSingleQuoteLike : isDoubleQuoteLike;
 			const iBefore = i;
 			const oBefore = output.length;
 			let str = "\"";
-			i++;
+			i += openedByEntity && openEntity ? openEntity.length : 1;
 			while (true) {
 				if (i >= text.length) {
 					const iPrev = prevNonWhitespaceIndex(i - 1);
@@ -2858,17 +2996,19 @@ function jsonrepair(text) {
 					output += str;
 					return true;
 				}
-				if (isEndQuote(text[i])) {
+				const entity = openedByEntity && text[i] === "&" ? matchHtmlEntity(text.slice(i, i + 12)) : null;
+				if (entity && openEntity ? entity.char === openEntity.char : isEndQuote(text[i])) {
 					const iQuote = i;
 					const oQuote = str.length;
 					str += "\"";
-					i++;
+					i += entity ? entity.length : 1;
 					output += str;
 					parseWhitespaceAndSkipComments(false);
-					if (stopAtDelimiter || i >= text.length || isDelimiter(text[i]) || isQuote(text[i]) || isDigit(text[i])) {
+					if (stopAtDelimiter || i >= text.length || isDelimiter(text[i]) && !isInsideUnclosedBracket(str, text[i]) || isQuote(text[i]) && !nextQuoteIsEndQuote(i) || isDigit(text[i])) {
 						parseConcatenatedString();
 						return true;
 					}
+					if (text[i] === "\\") throwUnexpectedCharacter();
 					const iPrevChar = prevNonWhitespaceIndex(iQuote - 1);
 					const prevChar = text.charAt(iPrevChar);
 					if (prevChar === ",") {
@@ -2882,7 +3022,7 @@ function jsonrepair(text) {
 						return parseString(true);
 					}
 					output = output.substring(0, oBefore);
-					i = iQuote + 1;
+					i = iQuote + (entity ? entity.length : 1);
 					str = `${str.substring(0, oQuote)}\\${str.substring(oQuote)}`;
 				} else if (stopAtDelimiter && isUnquotedStringDelimiter(text[i])) {
 					if (text[i - 1] === ":" && regexUrlStart.test(text.substring(iBefore + 1, i + 2))) while (i < text.length && regexUrlChar.test(text[i])) {
@@ -2893,6 +3033,12 @@ function jsonrepair(text) {
 					output += str;
 					parseConcatenatedString();
 					return true;
+				} else if (entity) {
+					const char = entity.char;
+					if (char === "\"") str += "\\\"";
+					else if (isControlCharacter(char)) str += controlCharacters[char];
+					else str += char;
+					i += entity.length;
 				} else if (text[i] === "\\") {
 					const char = text.charAt(i + 1);
 					if (escapeCharacters[char] !== void 0) {
@@ -2954,51 +3100,48 @@ function jsonrepair(text) {
 	*/
 	function parseNumber() {
 		const start = i;
+		let num = "";
+		let invalid = false;
 		if (text[i] === "-") {
+			num += text[i];
+			i++;
+			if (!isDigit(text[i]) && atEndOfNumber()) num += "0";
+		}
+		if (text[i] === "0" && isDigit(text[i + 1])) invalid = true;
+		while (isDigit(text[i])) {
+			num += text[i];
 			i++;
-			if (atEndOfNumber()) {
-				repairNumberEndingWithNumericSymbol(start);
-				return true;
-			}
-			if (!isDigit(text[i])) {
-				i = start;
-				return false;
-			}
 		}
-		while (isDigit(text[i])) i++;
 		if (text[i] === ".") {
+			if (num === "" || num === "-") num += "0";
+			num += text[i];
 			i++;
-			if (atEndOfNumber()) {
-				repairNumberEndingWithNumericSymbol(start);
-				return true;
-			}
-			if (!isDigit(text[i])) {
-				i = start;
-				return false;
+			if (!isDigit(text[i])) num += "0";
+			while (isDigit(text[i])) {
+				num += text[i];
+				i++;
 			}
-			while (isDigit(text[i])) i++;
 		}
-		if (text[i] === "e" || text[i] === "E") {
-			i++;
-			if (text[i] === "-" || text[i] === "+") i++;
-			if (atEndOfNumber()) {
-				repairNumberEndingWithNumericSymbol(start);
-				return true;
+		if (i > start) {
+			if (text[i] === "e" || text[i] === "E") {
+				if (num === "-") invalid = true;
+				num += text[i];
+				i++;
+				if (text[i] === "-" || text[i] === "+") {
+					num += text[i];
+					i++;
+				}
+				if (!isDigit(text[i])) num += "0";
+				while (isDigit(text[i])) {
+					num += text[i];
+					i++;
+				}
 			}
-			if (!isDigit(text[i])) {
+			if (!atEndOfNumber()) {
 				i = start;
 				return false;
 			}
-			while (isDigit(text[i])) i++;
-		}
-		if (!atEndOfNumber()) {
-			i = start;
-			return false;
-		}
-		if (i > start) {
-			const num = text.slice(start, i);
-			const hasInvalidLeadingZero = /^0\d/.test(num);
-			output += hasInvalidLeadingZero ? `"${num}"` : num;
+			output += invalid ? `"${text.substring(start, i)}"` : num;
 			return true;
 		}
 		return false;
@@ -3011,7 +3154,7 @@ function jsonrepair(text) {
 		return parseKeyword("true", "true") || parseKeyword("false", "false") || parseKeyword("null", "null") || parseKeyword("True", "true") || parseKeyword("False", "false") || parseKeyword("None", "null");
 	}
 	function parseKeyword(name, value) {
-		if (text.slice(i, i + name.length) === name) {
+		if (text.slice(i, i + name.length) === name && !isFunctionNameChar(text[i + name.length])) {
 			output += value;
 			i += name.length;
 			return true;
@@ -3064,12 +3207,14 @@ function jsonrepair(text) {
 		while (prev > 0 && isWhitespace(text, prev)) prev--;
 		return prev;
 	}
+	function nextQuoteIsEndQuote(index) {
+		let next = index + 1;
+		while (next < text.length && isWhitespace(text, next)) next++;
+		return next >= text.length || isDelimiter(text[next]);
+	}
 	function atEndOfNumber() {
 		return i >= text.length || isDelimiter(text[i]) || isWhitespace(text, i);
 	}
-	function repairNumberEndingWithNumericSymbol(start) {
-		output += `${text.slice(start, i)}0`;
-	}
 	function throwInvalidCharacter(char) {
 		throw new JSONRepairError(`Invalid character ${JSON.stringify(char)}`, i);
 	}
@@ -3713,7 +3858,8 @@ function slugify(path) {
 */
 async function writeSkippedDiffs(cwd, sections) {
 	if (sections.length === 0) return [];
-	await mkdir(join(cwd, SKIPPED_DIFF_DIR), { recursive: true });
+	const dir = join(cwd, SKIPPED_DIFF_DIR);
+	await mkdir(dir, { recursive: true });
 	const files = [];
 	for (const { path, section } of sections) {
 		const relative = join(SKIPPED_DIFF_DIR, slugify(path));
@@ -3785,7 +3931,7 @@ function normalizeSubject(body) {
 var MAX_LINE_DELTA = 2;
 /** Min token-set Jaccard similarity of normalised subjects required to merge. */
 var SUBJECT_SIMILARITY_THRESHOLD = .6;
-var STOP_WORDS = new Set([
+var STOP_WORDS = /* @__PURE__ */ new Set([
 	"a",
 	"an",
 	"the",
@@ -3908,7 +4054,7 @@ function triageFindings(groups) {
 }
 //#endregion
 //#region src/gitlab-review.ts
-var DEFAULT_REVIEW_TIMEOUT_MS = 600 * 1e3;
+var DEFAULT_REVIEW_TIMEOUT_MS = 6e5;
 var DEFAULT_MAX_DIFF_CHARS = 1e5;
 var CONVENTION_FILES = ["AGENTS.md", "CLAUDE.md"];
 var REVIEW_RULE_FILES = ["REVIEW.md"];
@@ -3926,7 +4072,7 @@ var NOISE_PATH_PATTERNS = [
 	/\.d\.ts$/,
 	/\.(js|css)\.map$/
 ];
-var LOCKFILE_BASENAMES = new Set([
+var LOCKFILE_BASENAMES = /* @__PURE__ */ new Set([
 	"package-lock.json",
 	"npm-shrinkwrap.json",
 	"yarn.lock",
@@ -3967,12 +4113,11 @@ var exec = promisify(execFile);
 *
 * pi-ai >=0.82 requires an explicit stream function (earlier versions built one
 * internally from model + getApiKey); `streamSimple` is the drop-in. Critically,
-* 0.83 also moved cloudflare-ai-gateway base-URL substitution — the
-* `{CLOUDFLARE_ACCOUNT_ID}` / `{CLOUDFLARE_GATEWAY_ID}` placeholders — from a
-* direct `process.env` read to an explicit `env` on the stream options. Without
-* threading `env` through, the gateway URL keeps its literal placeholders and
-* every request fails with Cloudflare 401 2035 ("Invalid request path"). Passing
-* `env` is harmless for providers whose base URL has no placeholders.
+* 0.83 also moved base-URL placeholder substitution from a direct `process.env`
+* read to an explicit `env` on the stream options. Providers whose base URL
+* contains `{VAR}` placeholders keep them literal — and fail every request —
+* unless `env` is threaded through. Passing `env` is harmless for providers
+* whose base URL has none.
 *
 * `stream` is injectable so the env threading can be unit-tested without a live call.
 */
@@ -4734,7 +4879,10 @@ async function runReview(config, options) {
 		tokens: aggregated.tokens,
 		cost: aggregated.cost,
 		byModel: buildByModelUsage(aggregated),
-		skills: context.skills.map((s) => s.name),
+		skills: context.skills.map((s) => ({
+			name: s.name,
+			origin: s.origin
+		})),
 		sizeNotice
 	});
 	let outputText;
@@ -5348,7 +5496,8 @@ async function startOtelBridge(options = {}) {
 		createAgentTelemetry(runId) {
 			const reviewerEntry = openByRun.get(runId)?.get(GEN_AI_PHASE);
 			if (!reviewerEntry || reviewerEntry.closed) return void 0;
-			return buildAgentSubscriber(tracer, tokenUsage, operationCost, timeToFirstToken, trace.setSpan(context.active(), reviewerEntry.span), {
+			const reviewerSpanCtx = trace.setSpan(context.active(), reviewerEntry.span);
+			return buildAgentSubscriber(tracer, tokenUsage, operationCost, timeToFirstToken, reviewerSpanCtx, {
 				ciAttrs,
 				runId,
 				configuredModel: runMeta.get(runId)?.model,
@@ -5638,7 +5787,7 @@ async function loadDefaultRuntime() {
 	const [sdkNode, resources, semconv] = modules;
 	const serviceResource = resources.resourceFromAttributes({
 		[semconv.ATTR_SERVICE_NAME ?? "service.name"]: SERVICE_NAME,
-		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.9.5"
+		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.9.7"
 	});
 	applyOtelExporterDefaults(process.env);
 	const sdk = new sdkNode.NodeSDK({ resource: resources.defaultResource().merge(serviceResource) });
@@ -5822,7 +5971,7 @@ function buildCiSpanAttrs(env) {
 	if (taskRunId) attrs["cicd.pipeline.task.run.id"] = taskRunId;
 	const pipelineRunId = env.CI_PIPELINE_ID ?? env.GITHUB_RUN_ID;
 	if (pipelineRunId) attrs["cicd.pipeline.run.id"] = pipelineRunId;
-	const repositoryUrl = env.CI_PROJECT_URL ?? (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}` : void 0);
+	const repositoryUrl = resolveProjectWebUrl(env);
 	if (repositoryUrl) attrs["vcs.repository.url.full"] = repositoryUrl;
 	return attrs;
 }
@@ -6110,7 +6259,7 @@ function boldCommentTitle(body) {
 */
 function buildCommentBody(body, commitSha, confidence) {
 	const confidenceLine = `_Confidence: ${confidence}._`;
-	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.9.5 for commit ${commitSha}.</sub>`;
+	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.9.7 for commit ${commitSha}.</sub>`;
 	return `${boldCommentTitle(body.trim())}\n\n${confidenceLine}\n\n---\n\n${footer}`;
 }
 function buildPayload(comment, body, refs, resolved) {
@@ -6683,6 +6832,99 @@ function createPlatform(config) {
 	return new GitLabPlatform(config);
 }
 //#endregion
+//#region src/skill-links.ts
+/**
+* Hosts that serve blobs at `/<repo>/blob/<ref>/<path>`. Everything else is
+* assumed to be GitLab (`/<repo>/-/blob/<ref>/<path>`), which covers both
+* gitlab.com and the self-hosted instances this tool mostly runs against.
+*/
+var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "www.github.com"]);
+/** Percent-encode each path segment while keeping the `/` separators intact. */
+function encodePath(path) {
+	return path.split("/").filter(Boolean).map((segment) => encodeURIComponent(segment)).join("/");
+}
+/**
+* Build a blob URL for `path` at `ref` inside the repository served at
+* `repoWebUrl`. An empty ref resolves to `HEAD`, which both GitHub and GitLab
+* accept, so a skill pinned to a remote's default branch still links.
+*/
+function blobUrl(repoWebUrl, ref, path) {
+	let parsed;
+	try {
+		parsed = new URL(repoWebUrl);
+	} catch {
+		return;
+	}
+	return `${`${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`}/${GITHUB_HOSTS.has(parsed.host) ? "blob" : "-/blob"}/${encodeURIComponent(ref || "HEAD")}/${encodePath(path)}`;
+}
+/**
+* Convert a git clone URL to the repository's web URL: drop any transport
+* marker, embedded credentials, and the `.git` suffix, and serve it over HTTPS.
+* Accepts `https://`, `ssh://`, `git+<transport>://`, and scp-style
+* (`git@host:group/repo.git`) forms. Returns `undefined` for anything it cannot
+* parse, so an exotic remote simply yields an unlinked skill.
+*/
+function gitRepoWebUrl(cloneUrl) {
+	let raw = cloneUrl.trim();
+	if (!raw) return void 0;
+	if (raw.startsWith("git+")) raw = raw.slice(4);
+	const scp = /^(?:[^@/]+@)?([^/:]+):(?!\/)(.+)$/.exec(raw);
+	if (scp) raw = `ssh://${scp[1]}/${scp[2]}`;
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return;
+	}
+	if (!parsed.host) return void 0;
+	const path = parsed.pathname.replace(/\.git\/?$/, "").replace(/\/+$/, "");
+	if (!path || path === "/") return void 0;
+	return `https://${parsed.host}${path}`;
+}
+/**
+* Resolve a link to a skill's `SKILL.md`, or `undefined` when the source is not
+* reachable from a browser (a `file:` path, or an in-repo skill on a run with no
+* CI project URL). Built-in skills link to the published tag of this package, so
+* the link always shows the skill exactly as the run used it.
+*/
+function skillSourceUrl(origin, context = {}) {
+	switch (origin.kind) {
+		case "builtin": return blobUrl(PRODUCT_URL, "0.9.7", `skills/${origin.name}/SKILL.md`);
+		case "project":
+			if (!context.projectWebUrl || !context.commitSha) return void 0;
+			return blobUrl(context.projectWebUrl, context.commitSha, `${origin.path}/SKILL.md`);
+		case "npm": return `https://www.npmjs.com/package/${origin.packageName}`;
+		case "file": return;
+		case "git":
+		case "marketplace": {
+			const repoWebUrl = gitRepoWebUrl(origin.url);
+			if (!repoWebUrl) return void 0;
+			const path = origin.path ? `${origin.path}/SKILL.md` : "SKILL.md";
+			return blobUrl(repoWebUrl, origin.ref, path);
+		}
+	}
+}
+/**
+* The name a skill is shown under in the footer. Marketplace skills carry their
+* full selector (`<marketplace>:<plugin>/<skill>`) because a bare skill name says
+* nothing about which marketplace and plugin it came from — and that selector is
+* exactly what a developer would put in `CODE_REVIEW_SKILLS` to use it. Every
+* other source shows the skill's own name.
+*/
+function skillDisplayName(skill) {
+	return skill.origin.kind === "marketplace" ? `${skill.origin.marketplace}:${skill.origin.plugin}/${skill.name}` : skill.name;
+}
+/**
+* Render one skill for the summary footer: a link to its source when one can be
+* resolved, otherwise the bare name. The name keeps its code span either way so
+* linked and unlinked skills read the same.
+*/
+function formatSkillLink(skill, context = {}) {
+	const name = skillDisplayName(skill);
+	const url = skillSourceUrl(skill.origin, context);
+	return url ? `[\`${name}\`](${url})` : `\`${name}\``;
+}
+//#endregion
 //#region src/summary-carryover.ts
 var FINGERPRINT_MARKER_GLOBAL_RE = new RegExp(FINGERPRINT_MARKER_PATTERN, "gi");
 var RISK_RANK = {
@@ -7058,7 +7300,10 @@ async function run(config, bridges) {
 				const summaryBody = withCarriedOverFindings(parsed.summary, discussions, currentFingerprints);
 				const result = await platform.upsertSummary(summaryBody, discussions, {
 					costFooter: [formatUsageLine(usage), formatPerModelUsage(usage)].filter(Boolean).join("\n\n"),
-					skillsFooter: formatSkillsFooter(usage.skills),
+					skillsFooter: formatSkillsFooter(usage.skills, {
+						projectWebUrl: config.projectWebUrl,
+						commitSha: refs.head_sha
+					}),
 					reviewedCommitSha: refs.head_sha,
 					runId,
 					sizeNotice: usage.sizeNotice
@@ -7125,9 +7370,15 @@ function zeroReviewUsage(model, thinkingLevel) {
 		sizeNotice: { sizeSkippedFiles: [] }
 	};
 }
-function formatSkillsFooter(skills) {
+/**
+* The summary footer's skills line. Each skill links to its `SKILL.md` source so
+* a developer reading the review can check what the reviewer was told; skills
+* with no reachable source (a `file:` path, or an in-repo skill on a run without
+* CI project coordinates) stay as plain names.
+*/
+function formatSkillsFooter(skills, context = {}) {
 	if (skills.length === 0) return void 0;
-	return `Skills: ${skills.map((s) => `\`${s}\``).join(", ")}`;
+	return `Skills: ${skills.map((s) => formatSkillLink(s, context)).join(", ")}`;
 }
 function formatUsageLine(usage) {
 	const formatter = new Intl.NumberFormat("en-US");
@@ -7217,10 +7468,10 @@ async function main(argv = process.argv.slice(2)) {
 		return;
 	}
 	if (argv.includes("--version") || argv.includes("-v")) {
-		console.log("0.9.5");
+		console.log("0.9.7");
 		return;
 	}
-	process.stderr.write(`[code-review] @weareikko/code-review v0.9.5\n`);
+	process.stderr.write(`[code-review] @weareikko/code-review v0.9.7\n`);
 	assertNodeVersion();
 	applyCodeReviewEnvPrefix();
 	applyDefaultCacheRetention();
@@ -7241,6 +7492,6 @@ if (isDirectRun()) main().catch((error) => {
 	process.exitCode = 1;
 });
 //#endregion
-export { resolveNpmSkillDir as $, SUMMARY_MARKER as A, findExistingSummaryNoteId as B, normalizeSeverity as C, SUMMARY_HISTORY_ENTRY_START as D, SUMMARY_HISTORY_ENTRY_END as E, buildSummaryHistoryEntries as F, extractDiffHunkContext as G, stripSummaryMarker as H, extractReviewedCommitSha as I, normalizeBody as J, extractExistingFingerprints as K, extractSummaryHistoryEntries as L, buildReviewedCommitFooter as M, buildSizeNoticeBlock as N, SUMMARY_HISTORY_LIMIT as O, buildSummaryBody as P, parseSkillSpec as Q, findExistingReviewedCommitSha as R, traceDiagnosticPhase as S, SUMMARY_HISTORY_END as T, upsertSummaryNote as U, stripSummaryHistory as V, appendFingerprintMarkers as W, gitSkillCacheKey as X, sha256 as Y, loadNamedSkill as Z, DIAGNOSTIC_CHANNEL_PREFIX as _, main as a, diagnosticChannels as b, buildGeneratedComments as c, startOtelBridge as d, resolveSkillCacheDir as et, filterDiff as f, DIAGNOSTIC_CHANNEL_NAMES as g, parseReviewMarkdownWithWarnings as h, formatUsageLine as i, buildArchivedSummaryEntry as j, SUMMARY_HISTORY_START as k, buildPayload as l, parseReviewMarkdown as m, formatPerModelUsage as n, run as o, runReview as p, fingerprints as q, formatSkillsFooter as r, withHttpStamping as s, countPostedBySeverity as t, isOtelEnabled as u, createDiagnosticContext as v, toGitLabReviewSeverity as w, traceDiagnostic as x, createDiagnosticRunId as y, findExistingSummaryNote as z };
+export { normalizeBody as $, SUMMARY_HISTORY_END as A, buildSummaryHistoryEntries as B, createDiagnosticContext as C, traceDiagnosticPhase as D, traceDiagnostic as E, SUMMARY_MARKER as F, findExistingSummaryNoteId as G, extractSummaryHistoryEntries as H, buildArchivedSummaryEntry as I, upsertSummaryNote as J, stripSummaryHistory as K, buildReviewedCommitFooter as L, SUMMARY_HISTORY_ENTRY_START as M, SUMMARY_HISTORY_LIMIT as N, normalizeSeverity as O, SUMMARY_HISTORY_START as P, fingerprints as Q, buildSizeNoticeBlock as R, DIAGNOSTIC_CHANNEL_PREFIX as S, diagnosticChannels as T, findExistingReviewedCommitSha as U, extractReviewedCommitSha as V, findExistingSummaryNote as W, extractDiffHunkContext as X, appendFingerprintMarkers as Y, extractExistingFingerprints as Z, filterDiff as _, main as a, resolveSkillCacheDir as at, parseReviewMarkdownWithWarnings as b, blobUrl as c, skillDisplayName as d, sha256 as et, skillSourceUrl as f, startOtelBridge as g, isOtelEnabled as h, formatUsageLine as i, resolveNpmSkillDir as it, SUMMARY_HISTORY_ENTRY_END as j, toGitLabReviewSeverity as k, formatSkillLink as l, buildPayload as m, formatPerModelUsage as n, loadNamedSkill as nt, run as o, buildGeneratedComments as p, stripSummaryMarker as q, formatSkillsFooter as r, parseSkillSpec as rt, withHttpStamping as s, countPostedBySeverity as t, gitSkillCacheKey as tt, gitRepoWebUrl as u, runReview as v, createDiagnosticRunId as w, DIAGNOSTIC_CHANNEL_NAMES as x, parseReviewMarkdown as y, buildSummaryBody as z };
 
-//# sourceMappingURL=cli-tIo5jQvJ.js.map
+//# sourceMappingURL=cli-m4pS6_5q.js.map