argus-reviewer-e2e 0.4.1 → 0.4.2

package/dist/config.d.ts

@@ -114,11 +114,17 @@ export interface Config {
      */
     decisionModel: string | undefined;
     /**
-     * Hard budget for the `argus-reviewer code-review` lane. When set, the
-     * review stops early if the cumulative OpenRouter cost exceeds this cap.
+     * Hard budget for the `argus-reviewer code-review` lane. Unset follows
+     * `budgetUsd` (default $1/run); `0` runs the review lane uncapped. After
+     * resolveConfig `undefined` means explicitly unlimited.
      */
     codeReviewBudgetUsd: number | undefined;
     provider: ProviderRules;
+    /**
+     * Per-run spend cap in USD. Default `DEFAULT_BUDGET_USD` ($1). `0` is the
+     * explicit unlimited switch (every command logs a warning). After
+     * resolveConfig `undefined` means explicitly unlimited — never "unset".
+     */
     budgetUsd: number | undefined;
     target: Target | undefined;
     cacheDir: string | undefined;
@@ -271,8 +277,39 @@ export interface Config {
          * paths); `[]` excludes nothing.
          */
         exclude: string[];
+        /**
+         * `realtime` (default) calls the chat API per chunk. `batch` submits all
+         * chunks through OpenRouter's async Batch API (cheaper, slower: minutes),
+         * falling back to realtime on failure or timeout.
+         */
+        mode: 'realtime' | 'batch';
+        /**
+         * Poll deadline for a batch, ms. Must sit inside the CI job timeout
+         * (the shipped workflow's is 15 minutes) with room left for a realtime
+         * fallback. Default 480000.
+         */
+        batchTimeoutMs: number;
+        /**
+         * Model for `mode: 'batch'`, a `:batch` slug (the base slug is what is
+         * sent). Separate from `code_model` because not every realtime model has
+         * a batch endpoint. Unset: `<review model>:batch` when that slug is known
+         * to exist, else DEFAULT_BATCH_MODEL.
+         */
+        batchModel: string | undefined;
+        /**
+         * Per-request timeout for realtime review calls, ms (1..900000,
+         * default 120000). Reasoning models need more than the default.
+         */
+        requestTimeoutMs: number;
     };
 }
+export declare const DEFAULT_REQUEST_TIMEOUT_MS = 120000;
+export declare const MAX_REQUEST_TIMEOUT_MS = 900000;
+export declare const DEFAULT_BATCH_MODEL = "deepseek/deepseek-v4.1-flash:batch";
+/** Batch slug for a review: explicit `batchModel`, else `<model>:batch` if known to exist, else the default. */
+export declare function resolveBatchModel(reviewModel: string, batchModel: string | undefined): string;
+/** Validates a per-request timeout; returns an error message or undefined when valid. */
+export declare function checkRequestTimeoutMs(v: unknown): string | undefined;
 export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox' | 'review' | 'explore' | 'app'>> & {
     provider?: Partial<ProviderRules>;
     sandbox?: Partial<Sandbox>;
@@ -281,6 +318,27 @@ export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox' | 'review'
     app?: Partial<AppLane>;
 };
 export declare const DEFAULT_RECORD_STEP_CAP = 40;
+/** Built-in per-run spend cap (USD) when nothing else is configured. */
+export declare const DEFAULT_BUDGET_USD = 1;
+/** Logged by every paid command when the cap was explicitly disabled. */
+export declare const UNCAPPED_WARNING = "warning: spend cap disabled (budgetUsd/ARGUS_BUDGET_USD = 0): this run is UNCAPPED; model spend is unbounded";
+export type BudgetSetting = {
+    kind: 'unset';
+} | {
+    kind: 'invalid';
+} | {
+    kind: 'unlimited';
+} | {
+    kind: 'cap';
+    usd: number;
+};
+/** Parse ARGUS_BUDGET_USD / the `budget-usd` action input: `0` = unlimited. */
+export declare function parseBudgetSetting(raw: string | undefined): BudgetSetting;
+/**
+ * Apply an env/action budget setting. Returns the new cap (`undefined` =
+ * unlimited) or `'keep'` when the setting is unset/invalid.
+ */
+export declare function applyBudgetSetting(s: BudgetSetting): number | undefined | 'keep';
 export declare const DEFAULT_EXPLORE: Explore;
 export declare const DEFAULT_APP: AppLane;
 export declare const DEFAULT_SANDBOX: Sandbox;

package/dist/config.js

@@ -2,7 +2,58 @@ import { pathToFileURL } from 'node:url';
 import { DEFAULT_REVIEW_EXCLUDE } from './review/scope.js';
 import { isReviewProfile } from './review/packs.js';
 import { JEV_DEFAULT_MODEL } from './vision/decisions.js';
+export const DEFAULT_REQUEST_TIMEOUT_MS = 120_000;
+export const MAX_REQUEST_TIMEOUT_MS = 900_000;
+export const DEFAULT_BATCH_MODEL = 'deepseek/deepseek-v4.1-flash:batch';
+/**
+ * Base slugs measured to have an OpenRouter `:batch` endpoint (reviewer
+ * bake-off, 2026-10-03). The realtime default deepseek-v4-flash has none.
+ */
+const KNOWN_BATCH_BASES = new Set([
+    'google/gemini-2.5-flash-lite',
+    'deepseek/deepseek-v4.1-flash',
+    'z-ai/glm-5.3',
+    'z-ai/glm-5.3-flash',
+    'openai/gpt-oss-120b',
+]);
+/** Batch slug for a review: explicit `batchModel`, else `<model>:batch` if known to exist, else the default. */
+export function resolveBatchModel(reviewModel, batchModel) {
+    if (batchModel !== undefined && batchModel !== '')
+        return batchModel;
+    const base = reviewModel.replace(/:batch$/, '');
+    return KNOWN_BATCH_BASES.has(base) ? `${base}:batch` : DEFAULT_BATCH_MODEL;
+}
+/** Validates a per-request timeout; returns an error message or undefined when valid. */
+export function checkRequestTimeoutMs(v) {
+    return typeof v === 'number' && Number.isInteger(v) && v >= 1 && v <= MAX_REQUEST_TIMEOUT_MS
+        ? undefined
+        : `requestTimeoutMs must be an integer from 1 to ${MAX_REQUEST_TIMEOUT_MS} (ms), got ${String(v)}`;
+}
 export const DEFAULT_RECORD_STEP_CAP = 40;
+/** Built-in per-run spend cap (USD) when nothing else is configured. */
+export const DEFAULT_BUDGET_USD = 1;
+/** Logged by every paid command when the cap was explicitly disabled. */
+export const UNCAPPED_WARNING = 'warning: spend cap disabled (budgetUsd/ARGUS_BUDGET_USD = 0): this run is UNCAPPED; model spend is unbounded';
+/** Parse ARGUS_BUDGET_USD / the `budget-usd` action input: `0` = unlimited. */
+export function parseBudgetSetting(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return { kind: 'unset' };
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0)
+        return { kind: 'invalid' };
+    return n === 0 ? { kind: 'unlimited' } : { kind: 'cap', usd: n };
+}
+/**
+ * Apply an env/action budget setting. Returns the new cap (`undefined` =
+ * unlimited) or `'keep'` when the setting is unset/invalid.
+ */
+export function applyBudgetSetting(s) {
+    if (s.kind === 'cap')
+        return s.usd;
+    if (s.kind === 'unlimited')
+        return undefined;
+    return 'keep';
+}
 export const DEFAULT_EXPLORE = {
     enabled: false,
     maxSteps: 20,
@@ -29,13 +80,13 @@ const defaults = {
     model: 'google/gemini-2.5-flash-lite',
     escalation_model: 'moonshotai/kimi-k2.5',
     grounding_model: undefined,
-    code_model: 'deepseek/deepseek-v4.1-flash',
+    code_model: 'deepseek/deepseek-v4-flash',
     decisionModel: JEV_DEFAULT_MODEL,
     codeReviewBudgetUsd: undefined,
     provider: {
         ignore: ['siliconflow', 'novitaai', 'atlascloud', 'streamlake', 'chutes'],
     },
-    budgetUsd: undefined,
+    budgetUsd: DEFAULT_BUDGET_USD,
     target: undefined,
     cacheDir: undefined,
     testsDir: undefined,
@@ -67,6 +118,10 @@ const defaults = {
         requestChanges: true,
         profiles: [],
         exclude: [...DEFAULT_REVIEW_EXCLUDE],
+        mode: 'realtime',
+        batchTimeoutMs: 480_000,
+        batchModel: undefined,
+        requestTimeoutMs: DEFAULT_REQUEST_TIMEOUT_MS,
     },
 };
 export function defineConfig(input) {
@@ -207,7 +262,35 @@ export function resolveConfig(input = {}) {
             rawReview.exclude.every((g) => typeof g === 'string' && g !== '')
             ? [...rawReview.exclude]
             : [...DEFAULT_REVIEW_EXCLUDE];
+    review.mode = review.mode === 'batch' ? 'batch' : 'realtime';
+    review.batchTimeoutMs = posInt(review.batchTimeoutMs, defaults.review.batchTimeoutMs);
+    if (typeof review.batchModel !== 'string' || review.batchModel.trim() === '') {
+        review.batchModel = undefined;
+    }
+    if (rawReview.requestTimeoutMs !== undefined) {
+        const bad = checkRequestTimeoutMs(rawReview.requestTimeoutMs);
+        if (bad !== undefined)
+            throw new Error(`review.${bad}`);
+    }
     const resolved = { ...defaults, ...input, provider, sandbox, explore, app, review };
+    // 0 = explicit unlimited; anything not a finite non-negative number
+    // (mis-typed, negative, null) degrades to the default cap, never to unlimited.
+    const rawBudget = input.budgetUsd;
+    resolved.budgetUsd =
+        rawBudget === undefined
+            ? DEFAULT_BUDGET_USD
+            : typeof rawBudget === 'number' && Number.isFinite(rawBudget) && rawBudget >= 0
+                ? rawBudget === 0
+                    ? undefined
+                    : rawBudget
+                : DEFAULT_BUDGET_USD;
+    const rawReviewBudget = input.codeReviewBudgetUsd;
+    resolved.codeReviewBudgetUsd =
+        typeof rawReviewBudget === 'number' && Number.isFinite(rawReviewBudget) && rawReviewBudget > 0
+            ? rawReviewBudget
+            : rawReviewBudget === 0
+                ? undefined
+                : resolved.budgetUsd;
     resolved.recordStepCap = posInt(resolved.recordStepCap, DEFAULT_RECORD_STEP_CAP);
     // Retention is a non-negative integer (0 = keep none) — a mis-typed or
     // negative bound degrades to unset, never to "keep everything".

package/dist/detect.js

@@ -160,7 +160,7 @@ async function a0EnvFileHost(home) {
  * the default local port (http://localhost:5080).
  */
 export async function resolveA0Host(env, opts = {}) {
-    const home = opts.home ?? homedir();
+    const home = opts.home ?? (env.HOME || homedir());
     const probe = opts.probe ?? defaultProbe;
     const fromEnv = env.AGENT_ZERO_HOST;
     if (fromEnv !== undefined && fromEnv !== '')
@@ -192,7 +192,7 @@ async function playwrightBrowsers(home) {
 }
 export async function detectEnvironment(env, opts = {}) {
     const exec = opts.exec ?? defaultExec;
-    const home = opts.home ?? homedir();
+    const home = opts.home ?? (env.HOME || homedir());
     const [a0Version, gh, browsers, a0Host] = await Promise.all([
         // Even the presence probe gets the allowlisted env — an `a0` binary is
         // third-party code and never sees provider/git secrets.

package/dist/engine/loop.d.ts

@@ -3,7 +3,7 @@ import { Actions } from './actions.js';
 import { Config, ProviderRules } from '../config.js';
 import { CallCost, CallKind } from '../vision/cost.js';
 import { Ledger } from '../vision/ledger.js';
-import { JsonSchema, Message } from '../vision/openrouter.js';
+import { BatchItemResult, BatchRequest, JsonSchema, Message } from '../vision/openrouter.js';
 import { FingerprintRecord, Point } from '../cache/fingerprint.js';
 import { CachedAssert, FlowCache } from '../cache/store.js';
 import { ErrorRecord } from '../journal/schema.js';
@@ -23,6 +23,13 @@ export interface VisionClient {
         cost: CallCost;
         model: string;
     }>;
+    /** Optional async Batch API path (code review `review.mode: batch`). */
+    completeBatch?(opts: {
+        model: string;
+        requests: BatchRequest[];
+        kind?: CallKind;
+        deadlineMs: number;
+    }): Promise<BatchItemResult[]>;
 }
 export interface UiDriverApi {
     click(x: number, y: number): Promise<Observation>;

package/dist/onboarding/pr-content.d.ts

@@ -0,0 +1,12 @@
+export declare const DEFAULT_BRANCH = "argus/onboarding";
+/** A validation message, or undefined when the repo slug is safe to use in argv and URLs. */
+export declare function validateRepo(repo: string): string | undefined;
+export declare function validateBranch(branch: string): string | undefined;
+export interface PrBodyInput {
+    repo: string;
+    /** Default per-run budget in USD, from the resolved config defaults. */
+    budgetUsd: number;
+    /** Files this PR adds. */
+    paths: string[];
+}
+export declare function renderPrBody(input: PrBodyInput): string;

package/dist/onboarding/pr-content.js

@@ -0,0 +1,56 @@
+/**
+ * Pure, runtime-neutral pieces of the onboarding PR: name validation and the
+ * PR body. No Node imports, so the CLI (`init --pr`) and the App Worker
+ * (bundled for Cloudflare) render the same PR and cannot drift.
+ */
+import { scaffoldChecklist } from './scaffold.js';
+export const DEFAULT_BRANCH = 'argus/onboarding';
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+/** A validation message, or undefined when the repo slug is safe to use in argv and URLs. */
+export function validateRepo(repo) {
+    if (!REPO_RE.test(repo) || repo.split('/').some((p) => p === '.' || p === '..')) {
+        return `--repo must look like owner/name (letters, digits, . _ -), got ${JSON.stringify(repo)}`;
+    }
+    return undefined;
+}
+export function validateBranch(branch) {
+    if (!BRANCH_RE.test(branch) ||
+        branch.includes('..') ||
+        branch.endsWith('/') ||
+        branch.endsWith('.lock')) {
+        return `--branch is not a safe branch name: ${JSON.stringify(branch)}`;
+    }
+    return undefined;
+}
+export function renderPrBody(input) {
+    const { repo, budgetUsd, paths } = input;
+    return `## Add Argus reviewer
+
+This PR adds a review-only [Argus](https://github.com/duketopceo/Argus) setup. Nothing runs until it is merged.
+
+### Files added
+
+${paths.map((p) => `- \`${p}\``).join('\n')}
+
+### Before merging: add the secret
+
+- [ ] Add \`OPENROUTER_API_KEY\` as a repository secret: https://github.com/${repo}/settings/secrets/actions/new?name=OPENROUTER_API_KEY
+  - Or from your own terminal: \`gh secret set OPENROUTER_API_KEY --repo ${repo}\`
+- [ ] Review the workflow files above. They use \`pull_request\` (never \`pull_request_target\`), \`persist-credentials: false\`, a pinned action SHA and least-privilege \`permissions\`.
+
+Argus never sees your key. It is your OpenRouter key (BYOK) and it stays in your repository secrets. The command that opened this PR did not read it.
+
+### What runs and what it costs
+
+\`\`\`
+${scaffoldChecklist(budgetUsd).join('\n')}
+\`\`\`
+
+### How to stop or uninstall
+
+- Remove \`.github/workflows/argus-reviewer.yml\` and \`.github/workflows/argus-mention.yml\`, or
+- delete the \`OPENROUTER_API_KEY\` repository secret (reviews stop, nothing else changes).
+- Optionally delete \`argus-reviewer.config.ts\` and \`tests/argus/\`.
+`;
+}

package/dist/onboarding/pr.d.ts

@@ -0,0 +1,23 @@
+import type { ExecFn } from '../detect.js';
+export { DEFAULT_BRANCH, renderPrBody, validateBranch, validateRepo, type PrBodyInput } from './pr-content.js';
+/** owner/name from a GitHub remote URL (ssh, https, with or without .git). */
+export declare function parseGithubRemote(url: string): string | undefined;
+export interface InitPrOptions {
+    cwd: string;
+    exec: ExecFn;
+    repo: string | undefined;
+    branch: string;
+    budgetUsd: number;
+}
+export type InitPrResult = {
+    kind: 'created';
+    url: string;
+    repo: string;
+    branch: string;
+} | {
+    kind: 'existing';
+    url: string;
+    repo: string;
+    branch: string;
+};
+export declare function initPr(opts: InitPrOptions): Promise<InitPrResult>;

package/dist/onboarding/pr.js

@@ -0,0 +1,196 @@
+/**
+ * `argus-reviewer init --pr`: open an onboarding pull request instead of
+ * writing into the working tree.
+ *
+ * Shells out to the local `git` and `gh` through the injected ExecFn, so the
+ * user's own credentials do the pushing and nothing about the repo reaches
+ * Argus. The scaffold is committed in a throwaway git worktree, never in the
+ * user's checkout. This module never reads, prints or transmits
+ * OPENROUTER_API_KEY: the PR only names the secret and links to the page
+ * where the user adds it themselves.
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { CliError } from '../ui/errors.js';
+import { renderPrBody, validateBranch } from './pr-content.js';
+import { renderScaffold } from './scaffold.js';
+export { DEFAULT_BRANCH, renderPrBody, validateBranch, validateRepo } from './pr-content.js';
+const CONFIG_NAMES = [
+    'argus-reviewer.config.ts',
+    'argus-reviewer.config.json',
+    'vision-e2e.config.ts',
+    'vision-e2e.config.json',
+];
+const SHORT_MS = 30_000;
+const NET_MS = 120_000;
+/** owner/name from a GitHub remote URL (ssh, https, with or without .git). */
+export function parseGithubRemote(url) {
+    const m = url.trim().match(/github\.com[:/]([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/);
+    return m?.[1];
+}
+function fail(message, fix) {
+    return new CliError('COMMAND_FAILED', message, fix !== undefined ? { fix } : {});
+}
+export async function initPr(opts) {
+    const { cwd, exec, branch } = opts;
+    const git = (args, ms = SHORT_MS) => exec('git', ['-C', cwd, ...args], ms);
+    const gh = (args, ms = SHORT_MS) => exec('gh', args, ms);
+    // 1. Which repo. The checkout's origin is the push target, so --repo may
+    //    only confirm it, never redirect it.
+    const originRes = await git(['remote', 'get-url', 'origin']);
+    const originRepo = originRes.code === 0 ? parseGithubRemote(originRes.stdout) : undefined;
+    if (originRepo === undefined) {
+        throw fail('this checkout has no GitHub remote named origin to push the onboarding branch to', 'git remote add origin https://github.com/<owner>/<name>.git');
+    }
+    if (opts.repo !== undefined && opts.repo.toLowerCase() !== originRepo.toLowerCase()) {
+        throw fail(`--repo ${opts.repo} does not match this checkout's origin (${originRepo})`, `run it from a checkout of ${opts.repo}, or drop --repo`);
+    }
+    const repo = originRepo;
+    // 2. An open onboarding PR already? Report it and stop.
+    const listed = await gh([
+        'pr',
+        'list',
+        '--repo',
+        repo,
+        '--head',
+        branch,
+        '--state',
+        'open',
+        '--json',
+        'url',
+    ]);
+    if (listed.code !== 0) {
+        throw fail(`could not query pull requests with gh: ${firstLine(listed.stderr) || 'gh not available'}`, 'install the GitHub CLI and run: gh auth login');
+    }
+    const existingUrl = firstUrl(listed.stdout);
+    if (existingUrl !== undefined)
+        return { kind: 'existing', url: existingUrl, repo, branch };
+    // 3. Never overwrite. An existing config is not a conflict: it is kept
+    //    and left out of the PR, as plain `init` does.
+    const hasConfig = CONFIG_NAMES.some((n) => existsSync(join(cwd, n)));
+    const files = renderScaffold({ a0Host: undefined, includeConfig: !hasConfig });
+    const conflicts = files.filter((f) => existsSync(join(cwd, f.path))).map((f) => f.path);
+    if (conflicts.length > 0) {
+        throw fail(`refusing to overwrite existing files:\n${conflicts.map((c) => `  ${c}`).join('\n')}`, 'move or delete them, or use `argus-reviewer init` to keep your versions');
+    }
+    // 4. Base branch.
+    const base = await defaultBranch(git, gh, repo);
+    // 5. Branch: reuse whatever already exists, otherwise create and push it.
+    const remoteHas = (await git(['ls-remote', '--exit-code', '--heads', 'origin', branch], NET_MS)).code === 0;
+    const localHas = (await git(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`])).code === 0;
+    if (!remoteHas && !localHas) {
+        await commitInWorktree({ ...opts, files, base, git });
+    }
+    else if (!remoteHas) {
+        const pushed = await git(['push', '-u', 'origin', branch], NET_MS);
+        if (pushed.code !== 0)
+            throw fail(`git push failed: ${firstLine(pushed.stderr)}`);
+    }
+    // 6. Open the PR.
+    const bodyDir = await mkdtemp(join(tmpdir(), 'argus-initpr-body-'));
+    try {
+        const bodyFile = join(bodyDir, 'body.md');
+        await writeFile(bodyFile, renderPrBody({ repo, budgetUsd: opts.budgetUsd, paths: files.map((f) => f.path) }), 'utf8');
+        const created = await gh([
+            'pr',
+            'create',
+            '--repo',
+            repo,
+            '--head',
+            branch,
+            '--base',
+            base,
+            '--title',
+            'Add Argus reviewer (review-only, bring your own key)',
+            '--body-file',
+            bodyFile,
+        ], NET_MS);
+        const url = firstUrl(created.stdout, true);
+        if (created.code !== 0 || url === undefined) {
+            throw fail(`gh pr create failed: ${firstLine(created.stderr) || firstLine(created.stdout)}`);
+        }
+        return { kind: 'created', url, repo, branch };
+    }
+    finally {
+        await rm(bodyDir, { recursive: true, force: true });
+    }
+}
+async function defaultBranch(git, gh, repo) {
+    const sym = await git(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+    const fromRef = sym.code === 0 ? sym.stdout.trim().replace(/^origin\//, '') : '';
+    if (fromRef !== '' && !validateBranch(fromRef))
+        return fromRef;
+    const view = await gh([
+        'repo',
+        'view',
+        '--repo',
+        repo,
+        '--json',
+        'defaultBranchRef',
+        '--jq',
+        '.defaultBranchRef.name',
+    ]);
+    const name = view.stdout.trim();
+    if (view.code === 0 && name !== '' && !validateBranch(name))
+        return name;
+    throw fail(`could not determine the default branch of ${repo}`, 'git remote set-head origin --auto');
+}
+async function commitInWorktree(o) {
+    const { git, files, base, branch } = o;
+    const dir = await mkdtemp(join(tmpdir(), 'argus-initpr-wt-'));
+    const wt = (args, ms = SHORT_MS) => o.exec('git', ['-C', dir, ...args], ms);
+    try {
+        const added = await git(['worktree', 'add', '--no-track', '-b', branch, dir, `origin/${base}`]);
+        if (added.code !== 0) {
+            throw fail(`could not create the onboarding branch from origin/${base}: ${firstLine(added.stderr)}`, 'git fetch origin');
+        }
+        for (const f of files) {
+            const abs = join(dir, f.path);
+            await mkdir(dirname(abs), { recursive: true });
+            await writeFile(abs, f.content, 'utf8');
+        }
+        const staged = await wt(['add', '--', ...files.map((f) => f.path)]);
+        if (staged.code !== 0)
+            throw fail(`git add failed: ${firstLine(staged.stderr)}`);
+        const committed = await wt([
+            'commit',
+            '-m',
+            'chore: add Argus reviewer (review-only, BYOK)',
+            '-m',
+            'Generated by `argus-reviewer init --pr`.',
+        ]);
+        if (committed.code !== 0) {
+            throw fail(`git commit failed: ${firstLine(committed.stderr) || firstLine(committed.stdout)}`);
+        }
+        const pushed = await wt(['push', '-u', 'origin', branch], NET_MS);
+        if (pushed.code !== 0)
+            throw fail(`git push failed: ${firstLine(pushed.stderr)}`);
+    }
+    finally {
+        await git(['worktree', 'remove', '--force', dir]);
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+function firstLine(s) {
+    return s.trim().split('\n')[0] ?? '';
+}
+/** First https URL in gh output: a JSON `[{"url":...}]` list, or (last=true) a bare line. */
+function firstUrl(stdout, last = false) {
+    if (last) {
+        const line = stdout.trim().split('\n').pop() ?? '';
+        return /^https:\/\/github\.com\/\S+$/.test(line) ? line : undefined;
+    }
+    try {
+        const parsed = JSON.parse(stdout);
+        if (Array.isArray(parsed)) {
+            const u = parsed[0]?.url;
+            return typeof u === 'string' && u.startsWith('https://') ? u : undefined;
+        }
+    }
+    catch {
+        // fall through
+    }
+    return undefined;
+}

package/dist/onboarding/scaffold.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Pure scaffold generator shared by `argus-reviewer init` and `init --pr`
+ * (and, later, the App's onboarding Worker, so the surfaces cannot drift).
+ * No I/O, no config execution, no environment reads. Workflow templates keep
+ * `persist-credentials: false`, a pinned action SHA, least-privilege
+ * `permissions`, and never `pull_request_target`.
+ */
+/**
+ * The one place the user-facing action pin lives. Bump it here (and the golden
+ * fixtures) on release; see RELEASING.md. v0.4.0 and v0.4.1 ship an action.yml
+ * GitHub cannot parse, so never pin to them.
+ */
+export declare const ACTION_PIN_SHA = "dbf4b7f669507402d527cb0e350285ca56129448";
+export declare const ACTION_PIN_TAG = "v0.4.2";
+export interface ScaffoldFile {
+    path: string;
+    content: string;
+}
+export interface ScaffoldOptions {
+    /** Detected Agent Zero host: earns a commented suggestion in the config, never an enabled lane. */
+    a0Host: string | undefined;
+    /** False when a config file already exists (init without --force). */
+    includeConfig: boolean;
+}
+export declare function initConfig(a0Host: string | undefined): string;
+export declare const INIT_TEST = "test('home renders', async (td) => {\n  const ok = await td.assert('the page rendered without obvious errors')\n  if (!ok) throw new Error('home did not render')\n})\n";
+export declare const INIT_WORKFLOW: string;
+export declare const INIT_MENTION_WORKFLOW: string;
+export declare const CONFIG_PATH = "argus-reviewer.config.ts";
+/** The files `init` writes, in write order. */
+export declare function renderScaffold(opts: ScaffoldOptions): ScaffoldFile[];
+/**
+ * "What runs and what it costs": what is sent to the provider, the default
+ * budget, and the stop path. Kept verbatim (DESIGN 7.8). `budgetUsd` comes
+ * from the caller's resolved defaults so it cannot go stale here.
+ */
+export declare function scaffoldChecklist(budgetUsd: number): string[];