clud-bug 0.7.0-rc.15 → 0.7.0-rc.18

package/dist/cli/hooks.d.ts

@@ -1,18 +1,26 @@
-/** Stable marker embedded in our hook's prompt so re-runs replace it in place. */
+/** Stable marker embedded in our hook so re-runs — and upgrades from the old,
+ * broken `type: agent` hook — replace it in place. */
 export declare const CLUD_BUG_HOOK_MARKER = "clud-bug-local-review";
 /**
- * Build the `prompt` of the Claude Code `type: agent` commit-review hook,
- * pinned to the clud-bug VERSION that scaffolded it. Pinning matters: a bare
- * `npx clud-bug` resolves to the `latest` dist-tag, which can predate the
- * `review-prompt` verb (e.g. while v0.7 is prerelease on `next`); `@${version}`
- * guarantees the verb exists. `clud-bug update` refreshes the pin in place.
+ * Build the shell `command` of the commit-review hook, pinned to the clud-bug
+ * VERSION that scaffolded it (a bare `npx clud-bug` resolves to the `latest`
+ * dist-tag, which can predate the `review-prompt` verb; `@${version}` guarantees
+ * it). `clud-bug update` refreshes the pin in place.
  *
- * Rather than baking a static recipe (which would drift from the repo's
- * skills/config), it tells the subagent to run `clud-bug review-prompt` — the
- * engine-driven verb that emits a recipe tailored to THIS repo's resolved plan
- * — and follow it. The recipe is generated fresh at commit time, always current.
+ * The command, in order:
+ *   1. Idempotency — skip if this exact HEAD was already surfaced (avoids a
+ *      re-review on an amend-with-no-change or a double-fire). The reviewed SHA
+ *      is recorded under `.git/` (untracked), reusing the "last-reviewed-sha"
+ *      idea the hosted bot uses on PR comments.
+ *   2. Fetch a fresh recipe tailored to THIS repo: `review-prompt --trigger
+ *      commit` (an instruction recipe — `git show HEAD` + the skills + the
+ *      report format — NOT raw data; it is meant to be FOLLOWED by an agent).
+ *   3. Surface it to the session by printing it and `exit 2`, so `asyncRewake`
+ *      shows it to the main agent as a system reminder. The agent then reviews
+ *      the commit on the session subscription.
+ *   4. Any failure or empty output → `exit 0` (quiet; the commit is never blocked).
  */
-export declare function buildCommitReviewPrompt(version: string): string;
+export declare function buildCommitReviewCommand(version: string): string;
 /** One Claude Code hook entry: a tool matcher plus its hook list. */
 export interface HookMatcherEntry {
     matcher?: string;
@@ -24,17 +32,17 @@ export interface ClaudeSettings {
     [key: string]: unknown;
 }
 /**
- * Builds the PostToolUse entry that spawns the commit-review subagent: a native
- * `type: agent` hook that is backgrounded (`async`), surfaces findings
- * (`asyncRewake`), and fires only on `git commit` (`if`).
+ * Builds the PostToolUse entry that runs the commit-review command: a native
+ * `type: command` hook, backgrounded (`async`), surfacing the recipe back to the
+ * session (`asyncRewake` + exit 2), firing only on `git commit` (`if`).
  */
-export declare function buildLocalReviewHook(recipe: string): HookMatcherEntry;
+export declare function buildLocalReviewHook(command: string): HookMatcherEntry;
 /**
  * Merges the clud-bug commit-review hook into an existing `.claude/settings.json`
- * object. **Idempotent** (replaces any prior clud-bug entry rather than
- * duplicating) and **non-clobbering** (preserves every other top-level key,
- * every other event, and every other hook). Tolerates a missing/malformed
+ * object. **Idempotent** (replaces any prior clud-bug entry — including the old
+ * `type: agent` one — rather than duplicating) and **non-clobbering** (preserves
+ * every other top-level key, event, and hook). Tolerates a missing/malformed
  * `existing` value.
  */
-export declare function mergeLocalReviewHook(existing: unknown, recipe: string): ClaudeSettings;
+export declare function mergeLocalReviewHook(existing: unknown, command: string): ClaudeSettings;
 //# sourceMappingURL=hooks.d.ts.map

package/dist/cli/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAcA,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAkB/D;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAcrE;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAwBtF"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAkBA;sDACsD;AACtD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuBhE;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CActE;AAcD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAwBvF"}

package/dist/cli/hooks.js

@@ -1,90 +1,111 @@
-// Wave 6b — Claude Code `type: agent` commit-review hook scaffolding.
+// Wave 6b (rc.17 fix) — Claude Code `type: command` commit-review hook scaffolding.
 //
 // `clud-bug init --with-hooks` writes a native Claude Code hook that, on every
-// `git commit` the agent makes, spawns a clud-bug review SUBAGENT in the same
-// session — so it runs on the session's subscription (no API key), in the
-// background (the commit never blocks), and surfaces findings back to the agent.
+// `git commit`, runs clud-bug's review recipe ON THIS SESSION'S SUBSCRIPTION
+// (no API key), in the background (the commit never blocks).
 //
-// The model (see the Wave 6b plan): clud-bug supplies the *recipe* (the
-// agent-hook `prompt`); Claude Code runs it as a subagent. This is the dynamic,
-// always-on counterpart to the `/clud-bug-review` slash command.
-//
-// `type: agent` hooks are documented as experimental; the same outcome is
-// reachable via a `type: command` hook + `additionalContext` if the API shifts.
-/** Stable marker embedded in our hook's prompt so re-runs replace it in place. */
+// WHY `type: command`, NOT `type: agent`: a Claude Code `type: agent` hook
+// spawns a subagent restricted to Read/Grep/Glob — it has NO Bash and the tool
+// set is not configurable (see code.claude.com/docs/en/hooks: "spawn a subagent
+// that can use tools like Read, Grep, and Glob"). The original Wave 6b hook used
+// `type: agent` and told the subagent to run `npx clud-bug review-prompt` — a
+// Bash CLI call an agent hook can never make — so the review NEVER ran for
+// anyone. A `type: command` hook CAN run the CLI: it fetches the engine's recipe
+// and surfaces it to the session via exit-2 (`asyncRewake`), so the MAIN agent —
+// which has Bash, git, gh, and the subscription — performs the review. The hook
+// exits 0 on any failure, so a review that can't run is a quiet no-op and the
+// commit is NEVER blocked.
+/** Stable marker embedded in our hook so re-runs — and upgrades from the old,
+ * broken `type: agent` hook — replace it in place. */
 export const CLUD_BUG_HOOK_MARKER = 'clud-bug-local-review';
 /**
- * Build the `prompt` of the Claude Code `type: agent` commit-review hook,
- * pinned to the clud-bug VERSION that scaffolded it. Pinning matters: a bare
- * `npx clud-bug` resolves to the `latest` dist-tag, which can predate the
- * `review-prompt` verb (e.g. while v0.7 is prerelease on `next`); `@${version}`
- * guarantees the verb exists. `clud-bug update` refreshes the pin in place.
+ * Build the shell `command` of the commit-review hook, pinned to the clud-bug
+ * VERSION that scaffolded it (a bare `npx clud-bug` resolves to the `latest`
+ * dist-tag, which can predate the `review-prompt` verb; `@${version}` guarantees
+ * it). `clud-bug update` refreshes the pin in place.
  *
- * Rather than baking a static recipe (which would drift from the repo's
- * skills/config), it tells the subagent to run `clud-bug review-prompt` — the
- * engine-driven verb that emits a recipe tailored to THIS repo's resolved plan
- * — and follow it. The recipe is generated fresh at commit time, always current.
+ * The command, in order:
+ *   1. Idempotency — skip if this exact HEAD was already surfaced (avoids a
+ *      re-review on an amend-with-no-change or a double-fire). The reviewed SHA
+ *      is recorded under `.git/` (untracked), reusing the "last-reviewed-sha"
+ *      idea the hosted bot uses on PR comments.
+ *   2. Fetch a fresh recipe tailored to THIS repo: `review-prompt --trigger
+ *      commit` (an instruction recipe — `git show HEAD` + the skills + the
+ *      report format — NOT raw data; it is meant to be FOLLOWED by an agent).
+ *   3. Surface it to the session by printing it and `exit 2`, so `asyncRewake`
+ *      shows it to the main agent as a system reminder. The agent then reviews
+ *      the commit on the session subscription.
+ *   4. Any failure or empty output → `exit 0` (quiet; the commit is never blocked).
  */
-export function buildCommitReviewPrompt(version) {
-    return `<!-- ${CLUD_BUG_HOOK_MARKER} v1 -->
-You are clud-bug's local commit review, running as a background subagent on this
-session's own subscription (no extra auth — you have git, gh, and file access).
-
-Step 1 — get your review recipe from clud-bug's engine:
-
-    npx clud-bug@${version} review-prompt --trigger commit
-
-That prints a structured review recipe tailored to THIS repo's skills + config (a
-fast single pass for a commit). If that command isn't available, run the repo's
-installed clud-bug CLI's \`review-prompt --trigger commit\` instead.
-
-Step 2 — follow that recipe exactly: review the commit that was just made against
-the skills it names, and surface any findings back into the session so they can be
-fixed. A clean commit needs only a one-line note.
-
-Keep it tight — this is the commit-time safety net; the deeper review runs at PR time.`;
+export function buildCommitReviewCommand(version) {
+    return [
+        // Marker as a `#` comment (NOT a `:` no-op) so its free text can never break
+        // `sh` — a paren / quote / `$` in the marker line would be a syntax error
+        // under `: ...`. The dogfood caught this. `isOurHook` finds the marker here.
+        `# ${CLUD_BUG_HOOK_MARKER} v2 — clud-bug commit review on the session subscription`,
+        // Belt-and-suspenders gate. The `if: Bash(git commit *)` / `Bash(logmind log *)`
+        // field filters at the platform on Claude Code >= 2.1.85; OLDER CC ignores
+        // `if` and would fire this on EVERY Bash call (a review recipe after every
+        // command). Command hooks get the event JSON on stdin — re-check it here. If
+        // stdin is empty (a CC that doesn't pipe it), fall through and trust `if`.
+        `ev=$(cat 2>/dev/null)`,
+        `if [ -n "$ev" ]; then case "$ev" in *'git commit'*|*'logmind log'*) ;; *) exit 0 ;; esac; fi`,
+        `sha=$(git rev-parse HEAD 2>/dev/null) || exit 0`,
+        `gitdir=$(git rev-parse --git-dir 2>/dev/null) || exit 0`,
+        `marker="$gitdir/clud-bug-last-commit-review"`,
+        `[ "$(cat "$marker" 2>/dev/null)" = "$sha" ] && exit 0`,
+        `recipe=$(npx clud-bug@${version} review-prompt --trigger commit 2>/dev/null) || exit 0`,
+        `[ -n "$recipe" ] || exit 0`,
+        `printf '%s' "$sha" > "$marker" 2>/dev/null || true`,
+        `printf '%s\\n\\n%s\\n' "clud-bug commit review (max mode — on this session's subscription): a commit was just made. Follow this recipe now — review that commit against the skills it names and surface any findings." "$recipe"`,
+        `exit 2`,
+    ].join('\n');
 }
 /**
- * Builds the PostToolUse entry that spawns the commit-review subagent: a native
- * `type: agent` hook that is backgrounded (`async`), surfaces findings
- * (`asyncRewake`), and fires only on `git commit` (`if`).
+ * Builds the PostToolUse entry that runs the commit-review command: a native
+ * `type: command` hook, backgrounded (`async`), surfacing the recipe back to the
+ * session (`asyncRewake` + exit 2), firing only on `git commit` (`if`).
  */
-export function buildLocalReviewHook(recipe) {
+export function buildLocalReviewHook(command) {
+    const base = { type: 'command', async: true, asyncRewake: true, timeout: 180, command };
     return {
         matcher: 'Bash',
         hooks: [
-            {
-                type: 'agent',
-                if: 'Bash(git commit *)',
-                async: true,
-                asyncRewake: true,
-                timeout: 180,
-                prompt: recipe,
-            },
+            { ...base, if: 'Bash(git commit *)' },
+            // thrillmade repos (and any logmind user) commit via `logmind log`, which
+            // wraps `git commit` inside its own binary — so the Bash tool call is
+            // `logmind log ...`, which `Bash(git commit *)` never matches. Fire on it
+            // too, or max mode never triggers in a logmind repo. The idempotency
+            // SHA-marker means whichever path runs, a commit is reviewed exactly once.
+            { ...base, if: 'Bash(logmind log *)' },
         ],
     };
 }
 function isOurHook(h) {
-    return typeof h?.['prompt'] === 'string' && h['prompt'].includes(CLUD_BUG_HOOK_MARKER);
+    // Match our marker in `command` (current `type: command` hook) OR `prompt`
+    // (the old, broken `type: agent` hook) so a re-install / `clud-bug update`
+    // replaces either in place.
+    const field = h?.['command'] ?? h?.['prompt'];
+    return typeof field === 'string' && field.includes(CLUD_BUG_HOOK_MARKER);
 }
 function isCludBugReviewEntry(entry) {
     return !!entry && Array.isArray(entry.hooks) && entry.hooks.some(isOurHook);
 }
 /**
  * Merges the clud-bug commit-review hook into an existing `.claude/settings.json`
- * object. **Idempotent** (replaces any prior clud-bug entry rather than
- * duplicating) and **non-clobbering** (preserves every other top-level key,
- * every other event, and every other hook). Tolerates a missing/malformed
+ * object. **Idempotent** (replaces any prior clud-bug entry — including the old
+ * `type: agent` one — rather than duplicating) and **non-clobbering** (preserves
+ * every other top-level key, event, and hook). Tolerates a missing/malformed
  * `existing` value.
  */
-export function mergeLocalReviewHook(existing, recipe) {
+export function mergeLocalReviewHook(existing, command) {
     const base = existing && typeof existing === 'object' ? { ...existing } : {};
     const hooks = { ...(base.hooks ?? {}) };
     const priorPost = Array.isArray(hooks.PostToolUse) ? hooks.PostToolUse : [];
     // Preserve every non-clud-bug hook — including any the user co-located INSIDE
     // our own matcher entry: drop only the hook(s) carrying our marker, never the
     // whole entry.
-    const ours = buildLocalReviewHook(recipe);
+    const ours = buildLocalReviewHook(command);
     const otherEntries = [];
     const coLocatedUserHooks = [];
     for (const entry of priorPost) {

package/dist/cli/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,iFAAiF;AACjF,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAEhF,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,QAAQ,oBAAoB;;;;;;mBAMlB,OAAO;;;;;;;;;;uFAU6D,CAAC;AACxF,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,oBAAoB;gBACxB,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,MAAM;aACf;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAsC;IACvD,OAAO,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,QAAQ,CAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB,EAAE,MAAc;IACpE,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAI,QAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAuC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAmC,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,2BAA2B;AAE3B;sDACsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO;QACL,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,KAAK,oBAAoB,0DAA0D;QACnF,iFAAiF;QACjF,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,uBAAuB;QACvB,8FAA8F;QAC9F,iDAAiD;QACjD,yDAAyD;QACzD,8CAA8C;QAC9C,uDAAuD;QACvD,yBAAyB,OAAO,wDAAwD;QACxF,4BAA4B;QAC5B,oDAAoD;QACpD,kOAAkO;QAClO,QAAQ;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW,CAAC;IACjG,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACrC,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,qEAAqE;YACrE,2EAA2E;YAC3E,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAsC;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB,EAAE,OAAe;IACrE,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAI,QAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAuC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAmC,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAmPA,iBAAe,IAAI,kBA6BlB;AAm8DD,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAuQA,iBAAe,IAAI,kBA6BlB;AAigED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/cli/main.js

@@ -22,7 +22,7 @@ import { detect, buildDescriptionLine } from '../core/detect.js';
 import { renderFile, pickTemplate, templateLanguage } from '../core/render.js';
 import { reviewPrompt } from '../core/prompts.js';
 import { SkillsClient, rankAndCap } from '../core/skills.js';
-import { writeSkills, writeSkill, loadBaseline, readManifest, writeManifest, removeSkill, listInstalled, diffManifest, } from './skills.js';
+import { writeSkills, writeSkill, loadBaseline, loadDesignKit, readManifest, writeManifest, removeSkill, listInstalled, diffManifest, } from './skills.js';
 import { computeAuditFileSet } from './audit.js';
 import { renderAuditHeader } from '../core/audit.js';
 import { runUpdate } from './update.js';
@@ -38,6 +38,7 @@ import { computeReviewCost, costPerLOC, cacheHitRate, extractTokensFromLog, roll
 const PKG_ROOT = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 const TEMPLATES = join(PKG_ROOT, 'templates');
 const BASELINE_DIR = join(TEMPLATES, 'skills', 'baseline');
+const DESIGN_DIR = join(TEMPLATES, 'skills', 'design');
 function parseArgs(argv) {
     const args = {
         _: [], offline: false, acceptAll: false, commit: false, help: false, version: false,
@@ -61,6 +62,16 @@ function parseArgs(argv) {
         // Claude Code session (reviews the current PR with the session's tokens).
         withLocalReview: false,
         withHooks: false,
+        // rc.16: `clud-bug init --with-design` installs the design-critic kit
+        // (3 `kind: design` skills) and flips the off-by-default `design` block to
+        // enabled so the visual review lens runs (local recipe + hosted bot).
+        withDesign: false,
+        // rc.18: `clud-bug init --local-only` installs MAX MODE (skills + slash
+        // command + commit hook), but SKIPS the GitHub Action workflows (which run
+        // claude-code-action with ANTHROPIC_API_KEY). For repos that review on a
+        // Claude subscription via the in-session hook, not a billed CI Action.
+        // Implies --with-local-review + --with-hooks.
+        localOnly: false,
         // v0.7.0-rc.4: `clud-bug configure-github` flags.
         // --dry-run prints the diff but skips PATCH; --branch overrides "main".
         dryRun: false,
@@ -110,6 +121,10 @@ function parseArgs(argv) {
             args.withLocalReview = true;
         else if (a === '--with-hooks')
             args.withHooks = true;
+        else if (a === '--with-design')
+            args.withDesign = true;
+        else if (a === '--local-only')
+            args.localOnly = true;
         else if (a === '--dry-run')
             args.dryRun = true;
         else if (a === '--branch')
@@ -222,11 +237,18 @@ Options:
                         \`/clud-bug-review\` works in a Claude Code session —
                         reviews the current branch's PR using that session's
                         own tokens (no hosted App, no extra auth).
-  --with-hooks          (init) Also scaffold a native Claude Code \`type: agent\`
+  --with-hooks          (init) Scaffold a native Claude Code \`type: command\`
                         commit-review hook into .claude/settings.json — on every
-                        \`git commit\` the agent makes, a backgrounded clud-bug
-                        review subagent runs on the session's subscription.
-                        Implies --with-local-review. Off by default.
+                        \`git commit\` / \`logmind log\`, it fetches a review recipe and
+                        surfaces it to the agent (on this session's subscription)
+                        via asyncRewake. Implies --with-local-review. Off by default.
+  --with-design         (init) Install the design-critic kit (3 \`kind: design\`
+                        skills) and enable the off-by-default visual review
+                        lens — renders changed UI and critiques it. Off by default.
+  --local-only          (init) MAX MODE: install the slash command + commit hook
+                        (implies --with-local-review + --with-hooks) but SKIP the
+                        GitHub Action workflows. Reviews run in your Claude Code
+                        session on your subscription — no API key, no per-review bill.
   --quiet,-q            Token-frugal mode for agent invocations. Suppresses
                         progress chatter; emits exactly one final
                         \`ok <key-value>\` summary line per command. Errors
@@ -1141,27 +1163,37 @@ async function runInit(args) {
             language: templateLanguage(tmplName),
         }),
     });
-    const workflowPath = join(cwd, '.github', 'workflows', 'clud-bug-review.yml');
-    await mkdir(dirname(workflowPath), { recursive: true });
-    await writeFile(workflowPath, workflow);
-    log(`    wrote ${rel(cwd, workflowPath)}`);
-    // Install the audit workflow alongside the per-PR review one.
-    // Manual-trigger by default; users opt into the cron by uncommenting.
-    // Routed through renderFile so {{CCA_VERSION}} substitution pins
-    // claude-code-action consistently with the review workflow.
-    const auditTmpl = await renderFile(join(TEMPLATES, 'audit.yml.tmpl'), {});
-    const auditPath = join(cwd, '.github', 'workflows', 'clud-bug-audit.yml');
-    await writeFile(auditPath, auditTmpl);
-    log(`    wrote ${rel(cwd, auditPath)}`);
-    // Install the self-update workflow. Cron weekly Mondays 12:00 UTC; opens
-    // a PR if a newer clud-bug version is published. Disable by deleting the
-    // file or pinning via .claude/skills/.clud-bug.json.
-    // Routed through renderFile for parity (no CCA ref today but future
-    // tokens should propagate uniformly).
-    const selfUpdateTmpl = await renderFile(join(TEMPLATES, 'self-update.yml.tmpl'), {});
-    const selfUpdatePath = join(cwd, '.github', 'workflows', 'clud-bug-self-update.yml');
-    await writeFile(selfUpdatePath, selfUpdateTmpl);
-    log(`    wrote ${rel(cwd, selfUpdatePath)}`);
+    // --local-only (max mode): SKIP the GitHub Action workflows entirely. The
+    // review + audit workflows run `claude-code-action` with ANTHROPIC_API_KEY
+    // (per-token cost); max mode reviews on the session's own subscription, so a
+    // local-only install must never add a token-billing Action. (self-update is
+    // benign but skipped too — local-only means no clud-bug CI workflows at all.)
+    if (args.localOnly) {
+        log('    skipped GitHub Action workflows (--local-only: max mode runs on the session subscription, no API key)');
+    }
+    else {
+        const workflowPath = join(cwd, '.github', 'workflows', 'clud-bug-review.yml');
+        await mkdir(dirname(workflowPath), { recursive: true });
+        await writeFile(workflowPath, workflow);
+        log(`    wrote ${rel(cwd, workflowPath)}`);
+        // Install the audit workflow alongside the per-PR review one.
+        // Manual-trigger by default; users opt into the cron by uncommenting.
+        // Routed through renderFile so {{CCA_VERSION}} substitution pins
+        // claude-code-action consistently with the review workflow.
+        const auditTmpl = await renderFile(join(TEMPLATES, 'audit.yml.tmpl'), {});
+        const auditPath = join(cwd, '.github', 'workflows', 'clud-bug-audit.yml');
+        await writeFile(auditPath, auditTmpl);
+        log(`    wrote ${rel(cwd, auditPath)}`);
+        // Install the self-update workflow. Cron weekly Mondays 12:00 UTC; opens
+        // a PR if a newer clud-bug version is published. Disable by deleting the
+        // file or pinning via .claude/skills/.clud-bug.json.
+        // Routed through renderFile for parity (no CCA ref today but future
+        // tokens should propagate uniformly).
+        const selfUpdateTmpl = await renderFile(join(TEMPLATES, 'self-update.yml.tmpl'), {});
+        const selfUpdatePath = join(cwd, '.github', 'workflows', 'clud-bug-self-update.yml');
+        await writeFile(selfUpdatePath, selfUpdateTmpl);
+        log(`    wrote ${rel(cwd, selfUpdatePath)}`);
+    }
     // v0.7.0 (Wave 6b): optional local-review slash command. Scaffolds
     // `.claude/commands/clud-bug-review.md` so `/clud-bug-review` works inside a
     // Claude Code session — the agent reviews the current branch's open PR using
@@ -1170,6 +1202,12 @@ async function runInit(args) {
     // `--with-hooks` implies `--with-local-review` — the auto hook and the manual
     // `/clud-bug-review` command are complementary (the hook auto-runs the engine
     // recipe on each commit; the command runs it on demand against the PR).
+    // --local-only IS the max-mode install: the slash command + the commit hook,
+    // minus the GitHub Action workflows (gated above).
+    if (args.localOnly) {
+        args.withLocalReview = true;
+        args.withHooks = true;
+    }
     if (args.withHooks)
         args.withLocalReview = true;
     if (args.withLocalReview) {
@@ -1179,14 +1217,16 @@ async function runInit(args) {
         await writeFile(commandPath, commandContent);
         log(`    wrote ${rel(cwd, commandPath)}`);
     }
-    // v0.7.0 (Wave 6b): optional native commit-review hook. Merges a Claude Code
-    // `type: agent` PostToolUse hook into `.claude/settings.json` (preserving any
-    // existing settings + hooks) that, on every `git commit` the agent makes,
-    // spawns a clud-bug review subagent on the session's subscription, in the
-    // background — the hook's prompt runs `clud-bug review-prompt` and follows it.
+    // v0.7.0 (Wave 6b; rc.17 fix): optional native commit-review hook. Merges a
+    // Claude Code `type: command` PostToolUse hook into `.claude/settings.json`
+    // (preserving any existing settings + hooks) that, on every `git commit`, runs
+    // `clud-bug review-prompt` and surfaces the recipe back to the session so the
+    // agent reviews the commit on the session's subscription, in the background.
+    // (`type: command`, not `type: agent` — agent hooks get no Bash, so they could
+    // never run the CLI; see hooks.ts.)
     if (args.withHooks) {
-        const { mergeLocalReviewHook, buildCommitReviewPrompt } = await import('./hooks.js');
-        const hookPrompt = buildCommitReviewPrompt(await readPkgVersion());
+        const { mergeLocalReviewHook, buildCommitReviewCommand } = await import('./hooks.js');
+        const hookCommand = buildCommitReviewCommand(await readPkgVersion());
         const settingsPath = join(cwd, '.claude', 'settings.json');
         await mkdir(dirname(settingsPath), { recursive: true });
         // Read-then-parse so we can tell "no file yet" (fresh merge) from "file
@@ -1210,11 +1250,26 @@ async function runInit(args) {
             }
         }
         if (proceed) {
-            const merged = mergeLocalReviewHook(existing, hookPrompt);
+            const merged = mergeLocalReviewHook(existing, hookCommand);
             await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n');
             log(`    wrote ${rel(cwd, settingsPath)} (commit-review hook)`);
         }
     }
+    // rc.16: --with-design installs the bundled design-critic kit (3 `kind:
+    // design` skills) and enables the off-by-default design lens. writeSkills
+    // writes the SKILL.md files + merges the manifest entries; the `design` block
+    // is flipped on the manifest read below so the local recipe + hosted bot both
+    // run the visual pass. Idempotent — re-runs replace the skills in place.
+    if (args.withDesign) {
+        const designKit = await loadDesignKit(DESIGN_DIR);
+        if (designKit.length > 0) {
+            await writeSkills(join(cwd, '.claude', 'skills'), designKit, client);
+            log(`    pinned ${designKit.length} design specimens (visual review lens enabled)`);
+        }
+        else {
+            warn('No design-kit skills found to install (templates/skills/design/ empty?).');
+        }
+    }
     // Stamp the manifest. Sets strictMode: true ONLY on fresh installs —
     // a manifest that's never been touched by clud-bug init/update has no
     // lastUpdate field. Existing v0.3.x advisory installs (where strictMode
@@ -1223,6 +1278,12 @@ async function runInit(args) {
     // fresh inits. Users opt out by setting strictMode: false.
     const skillsDirPath = join(cwd, '.claude', 'skills');
     const manifest = await readManifest(skillsDirPath);
+    if (args.withDesign) {
+        // Flip the off-by-default design lens on; preserve any existing knobs
+        // (gate / themes / viewports) the user already set.
+        const prior = manifest.design ?? {};
+        manifest.design = { ...prior, enabled: true };
+    }
     const isFreshInstall = manifest.lastUpdate === undefined;
     manifest.lastUpdateVersion = await readPkgVersion();
     manifest.lastUpdate = new Date().toISOString();
@@ -1252,9 +1313,14 @@ async function runInit(args) {
         log('  committing...');
         const toAdd = [
             '.claude',
-            '.github/workflows/clud-bug-review.yml',
-            '.github/workflows/clud-bug-audit.yml',
-            '.github/workflows/clud-bug-self-update.yml',
+            // No GitHub Action workflows under --local-only (none were written).
+            ...(args.localOnly
+                ? []
+                : [
+                    '.github/workflows/clud-bug-review.yml',
+                    '.github/workflows/clud-bug-audit.yml',
+                    '.github/workflows/clud-bug-self-update.yml',
+                ]),
             ...agentDocs.created,
             ...agentDocs.touched,
         ];
@@ -1269,22 +1335,44 @@ async function runInit(args) {
     await runInitBranchProtection(args);
     log('');
     log('Field kit assembled. Next:');
-    log('  1. Set ANTHROPIC_API_KEY in your repo secrets:');
-    log('     Settings → Secrets and variables → Actions → New repository secret');
-    if (!args.commit) {
-        log('  2. git add .claude .github/workflows/clud-bug-*.yml && git commit && git push');
-        log('  3. Open a PR — the naturalist arrives within ~2 minutes.');
+    if (args.localOnly) {
+        log('  Max mode — reviews run inside your Claude Code session on your own');
+        log('  subscription. No API key, no GitHub Action, no per-review bill. On every');
+        log('  commit the hook surfaces a review recipe; or run /clud-bug-review on demand.');
+        if (!args.commit) {
+            log('  → git add .claude && git commit && git push');
+        }
+        else {
+            log('  → git push.');
+        }
     }
     else {
-        log('  2. git push, then open a PR — the naturalist arrives within ~2 minutes.');
+        log('  1. Set ANTHROPIC_API_KEY in your repo secrets:');
+        log('     Settings → Secrets and variables → Actions → New repository secret');
+        if (!args.commit) {
+            log('  2. git add .claude .github/workflows/clud-bug-*.yml && git commit && git push');
+            log('  3. Open a PR — the naturalist arrives within ~2 minutes.');
+        }
+        else {
+            log('  2. git push, then open a PR — the naturalist arrives within ~2 minutes.');
+        }
     }
     log('');
     log('Drop your own .claude/skills/<name>/SKILL.md files anytime — they get pinned automatically.');
-    log('For a whole-repo walk: Actions tab → Clud Bug 🐛 Audit → Run workflow.');
-    log('Self-update is on (weekly Mondays 12:00 UTC). Pin via "pinVersion" in .claude/skills/.clud-bug.json.');
+    // These reference the GitHub Action workflows, which --local-only does not write.
+    if (!args.localOnly) {
+        log('For a whole-repo walk: Actions tab → Clud Bug 🐛 Audit → Run workflow.');
+        log('Self-update is on (weekly Mondays 12:00 UTC). Pin via "pinVersion" in .claude/skills/.clud-bug.json.');
+    }
     log('');
-    log('Strict mode is ON by default (clud-bug-review fails the check on critical findings).');
-    log('  • Add `clud-bug-review` to your branch protection required checks for full enforcement.');
+    if (args.localOnly) {
+        log('Strict mode + branch-protection enforcement apply to the GitHub Action path; max mode is');
+        log('advisory by design — findings surface in your session for you to act on.');
+    }
+    else {
+        log('Strict mode is ON by default (clud-bug-review fails the check on critical findings).');
+        log('  • Add `clud-bug-review` to your branch protection required checks for full enforcement.');
+    }
     log('  • Opt out by setting "strictMode": false in .claude/skills/.clud-bug.json.');
     // v0.6.33 — opt-in unified install (mirror of logmind v0.6.8). When
     // --with-skdd is passed, subprocess to `pip install logmind` + `logmind init`