clud-bug 0.7.0-rc.17 → 0.7.0-rc.19

package/dist/cli/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAkBA;sDACsD;AACtD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuBhE;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CActE;AAcD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAwBvF"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAkBA;sDACsD;AACtD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAgChE;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CActE;AAcD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAwBvF"}

package/dist/cli/hooks.js

@@ -54,8 +54,17 @@ export function buildCommitReviewCommand(version) {
         `gitdir=$(git rev-parse --git-dir 2>/dev/null) || exit 0`,
         `marker="$gitdir/clud-bug-last-commit-review"`,
         `[ "$(cat "$marker" 2>/dev/null)" = "$sha" ] && exit 0`,
-        `recipe=$(npx clud-bug@${version} review-prompt --trigger commit 2>/dev/null) || exit 0`,
-        `[ -n "$recipe" ] || exit 0`,
+        // H4 — one retry on a transient npx/network blip (a stale lock, a slow
+        // registry) before giving up, so a hiccup doesn't silently skip the review.
+        // `|| recipe=` clears it on a NON-ZERO exit so partial/error stdout from a
+        // mid-run crash (or an old npm warning on stdout) is never mistaken for a
+        // valid recipe — only a clean, exit-0 run surfaces.
+        `recipe=$(npx clud-bug@${version} review-prompt --trigger commit 2>/dev/null) || recipe=`,
+        `if [ -z "$recipe" ]; then sleep 1; recipe=$(npx clud-bug@${version} review-prompt --trigger commit 2>/dev/null) || recipe=; fi`,
+        // H4 — when the recipe still can't be fetched, leave a diagnostic marker so a
+        // FAILED review is distinguishable from a CLEAN one (a clean review surfaces
+        // the recipe + the agent reports clean). Never blocks the commit.
+        `if [ -z "$recipe" ]; then printf '%s' "$sha" > "$gitdir/clud-bug-review-skipped" 2>/dev/null || true; exit 0; fi`,
         `printf '%s' "$sha" > "$marker" 2>/dev/null || true`,
         `printf '%s\\n\\n%s\\n' "clud-bug commit review (max mode — on this session's subscription): a commit was just made. Follow this recipe now — review that commit against the skills it names and surface any findings." "$recipe"`,
         `exit 2`,

package/dist/cli/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,2BAA2B;AAE3B;sDACsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO;QACL,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,KAAK,oBAAoB,0DAA0D;QACnF,iFAAiF;QACjF,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,uBAAuB;QACvB,8FAA8F;QAC9F,iDAAiD;QACjD,yDAAyD;QACzD,8CAA8C;QAC9C,uDAAuD;QACvD,yBAAyB,OAAO,wDAAwD;QACxF,4BAA4B;QAC5B,oDAAoD;QACpD,kOAAkO;QAClO,QAAQ;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW,CAAC;IACjG,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACrC,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,qEAAqE;YACrE,2EAA2E;YAC3E,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAsC;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB,EAAE,OAAe;IACrE,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAI,QAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAuC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAmC,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,2BAA2B;AAE3B;sDACsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO;QACL,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,KAAK,oBAAoB,0DAA0D;QACnF,iFAAiF;QACjF,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,uBAAuB;QACvB,8FAA8F;QAC9F,iDAAiD;QACjD,yDAAyD;QACzD,8CAA8C;QAC9C,uDAAuD;QACvD,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,oDAAoD;QACpD,yBAAyB,OAAO,yDAAyD;QACzF,4DAA4D,OAAO,6DAA6D;QAChI,8EAA8E;QAC9E,6EAA6E;QAC7E,kEAAkE;QAClE,kHAAkH;QAClH,oDAAoD;QACpD,kOAAkO;QAClO,QAAQ;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW,CAAC;IACjG,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACrC,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,qEAAqE;YACrE,2EAA2E;YAC3E,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAsC;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB,EAAE,OAAe;IACrE,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAI,QAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAuC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAmC,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA4PA,iBAAe,IAAI,kBA6BlB;AA09DD,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAsRA,iBAAe,IAAI,kBA8BlB;AAigED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/cli/main.js

@@ -27,6 +27,7 @@ import { computeAuditFileSet } from './audit.js';
 import { renderAuditHeader } from '../core/audit.js';
 import { runUpdate } from './update.js';
 import { runReviewPrompt } from './review-prompt.js';
+import { runPostCheckRun } from './post-check-run.js';
 import { getPendingWorkflowEdits, makeBranchName, git as gitCmd } from './edit-workflow.js';
 import { applyToRepo as applyAgentDocs } from './agents-md.js';
 import { detectRepo, detectDefaultBranch, getProtectionState, enableConversationResolution } from './branch-protection.js';
@@ -66,6 +67,12 @@ function parseArgs(argv) {
         // (3 `kind: design` skills) and flips the off-by-default `design` block to
         // enabled so the visual review lens runs (local recipe + hosted bot).
         withDesign: false,
+        // rc.18: `clud-bug init --local-only` installs MAX MODE (skills + slash
+        // command + commit hook), but SKIPS the GitHub Action workflows (which run
+        // claude-code-action with ANTHROPIC_API_KEY). For repos that review on a
+        // Claude subscription via the in-session hook, not a billed CI Action.
+        // Implies --with-local-review + --with-hooks.
+        localOnly: false,
         // v0.7.0-rc.4: `clud-bug configure-github` flags.
         // --dry-run prints the diff but skips PATCH; --branch overrides "main".
         dryRun: false,
@@ -117,6 +124,8 @@ function parseArgs(argv) {
             args.withHooks = true;
         else if (a === '--with-design')
             args.withDesign = true;
+        else if (a === '--local-only')
+            args.localOnly = true;
         else if (a === '--dry-run')
             args.dryRun = true;
         else if (a === '--branch')
@@ -125,6 +134,23 @@ function parseArgs(argv) {
             args.trigger = argv[++i];
         else if (a === '--diff-size')
             args.diffSizeBytes = Number(argv[++i]);
+        // H3: `clud-bug post-check-run` flags.
+        else if (a === '--sha')
+            args.sha = argv[++i];
+        else if (a === '--verdict')
+            args.verdict = argv[++i];
+        else if (a === '--critical-count')
+            args.criticalCount = Number(argv[++i]);
+        else if (a === '--source')
+            args.source = argv[++i];
+        else if (a === '--strict')
+            args.strict = true;
+        else if (a === '--no-strict')
+            args.strict = false;
+        else if (a === '--owner')
+            args.owner = argv[++i];
+        else if (a === '--details-url')
+            args.detailsUrl = argv[++i];
         else
             args._.push(a);
     }
@@ -220,6 +246,11 @@ Commands:
                         the session's own subscription. Plans via the shared
                         engine: --trigger commit (default) → a fast single pass;
                         push/pr → the full multi-pass plan. Prints to stdout.
+  post-check-run        Post the \`clud-bug-review\` GitHub check so branch
+                        protection can gate the merge (H3). --verdict
+                        clean|critical|failed --sha <sha> [--critical-count N]
+                        [--source local|ci] [--strict|--no-strict] [--dry-run].
+                        clean→success, critical+strict→failure, else neutral.
 
 Options:
   --offline             Skip skills.sh; pin only the bundled baseline specimens.
@@ -237,6 +268,10 @@ Options:
   --with-design         (init) Install the design-critic kit (3 \`kind: design\`
                         skills) and enable the off-by-default visual review
                         lens — renders changed UI and critiques it. Off by default.
+  --local-only          (init) MAX MODE: install the slash command + commit hook
+                        (implies --with-local-review + --with-hooks) but SKIP the
+                        GitHub Action workflows. Reviews run in your Claude Code
+                        session on your subscription — no API key, no per-review bill.
   --quiet,-q            Token-frugal mode for agent invocations. Suppresses
                         progress chatter; emits exactly one final
                         \`ok <key-value>\` summary line per command. Errors
@@ -298,6 +333,7 @@ async function main() {
         case 'post-inline-threads': return runPostInlineThreads(args);
         case 'resolve-threads': return runResolveThreads(args);
         case 'review-prompt': return runReviewPrompt(args);
+        case 'post-check-run': return runPostCheckRun(args);
         default:
             process.stderr.write(`Unknown command: ${cmd || '(none)'}\n\n${HELP}`);
             process.exit(2);
@@ -1151,27 +1187,37 @@ async function runInit(args) {
             language: templateLanguage(tmplName),
         }),
     });
-    const workflowPath = join(cwd, '.github', 'workflows', 'clud-bug-review.yml');
-    await mkdir(dirname(workflowPath), { recursive: true });
-    await writeFile(workflowPath, workflow);
-    log(`    wrote ${rel(cwd, workflowPath)}`);
-    // Install the audit workflow alongside the per-PR review one.
-    // Manual-trigger by default; users opt into the cron by uncommenting.
-    // Routed through renderFile so {{CCA_VERSION}} substitution pins
-    // claude-code-action consistently with the review workflow.
-    const auditTmpl = await renderFile(join(TEMPLATES, 'audit.yml.tmpl'), {});
-    const auditPath = join(cwd, '.github', 'workflows', 'clud-bug-audit.yml');
-    await writeFile(auditPath, auditTmpl);
-    log(`    wrote ${rel(cwd, auditPath)}`);
-    // Install the self-update workflow. Cron weekly Mondays 12:00 UTC; opens
-    // a PR if a newer clud-bug version is published. Disable by deleting the
-    // file or pinning via .claude/skills/.clud-bug.json.
-    // Routed through renderFile for parity (no CCA ref today but future
-    // tokens should propagate uniformly).
-    const selfUpdateTmpl = await renderFile(join(TEMPLATES, 'self-update.yml.tmpl'), {});
-    const selfUpdatePath = join(cwd, '.github', 'workflows', 'clud-bug-self-update.yml');
-    await writeFile(selfUpdatePath, selfUpdateTmpl);
-    log(`    wrote ${rel(cwd, selfUpdatePath)}`);
+    // --local-only (max mode): SKIP the GitHub Action workflows entirely. The
+    // review + audit workflows run `claude-code-action` with ANTHROPIC_API_KEY
+    // (per-token cost); max mode reviews on the session's own subscription, so a
+    // local-only install must never add a token-billing Action. (self-update is
+    // benign but skipped too — local-only means no clud-bug CI workflows at all.)
+    if (args.localOnly) {
+        log('    skipped GitHub Action workflows (--local-only: max mode runs on the session subscription, no API key)');
+    }
+    else {
+        const workflowPath = join(cwd, '.github', 'workflows', 'clud-bug-review.yml');
+        await mkdir(dirname(workflowPath), { recursive: true });
+        await writeFile(workflowPath, workflow);
+        log(`    wrote ${rel(cwd, workflowPath)}`);
+        // Install the audit workflow alongside the per-PR review one.
+        // Manual-trigger by default; users opt into the cron by uncommenting.
+        // Routed through renderFile so {{CCA_VERSION}} substitution pins
+        // claude-code-action consistently with the review workflow.
+        const auditTmpl = await renderFile(join(TEMPLATES, 'audit.yml.tmpl'), {});
+        const auditPath = join(cwd, '.github', 'workflows', 'clud-bug-audit.yml');
+        await writeFile(auditPath, auditTmpl);
+        log(`    wrote ${rel(cwd, auditPath)}`);
+        // Install the self-update workflow. Cron weekly Mondays 12:00 UTC; opens
+        // a PR if a newer clud-bug version is published. Disable by deleting the
+        // file or pinning via .claude/skills/.clud-bug.json.
+        // Routed through renderFile for parity (no CCA ref today but future
+        // tokens should propagate uniformly).
+        const selfUpdateTmpl = await renderFile(join(TEMPLATES, 'self-update.yml.tmpl'), {});
+        const selfUpdatePath = join(cwd, '.github', 'workflows', 'clud-bug-self-update.yml');
+        await writeFile(selfUpdatePath, selfUpdateTmpl);
+        log(`    wrote ${rel(cwd, selfUpdatePath)}`);
+    }
     // v0.7.0 (Wave 6b): optional local-review slash command. Scaffolds
     // `.claude/commands/clud-bug-review.md` so `/clud-bug-review` works inside a
     // Claude Code session — the agent reviews the current branch's open PR using
@@ -1180,6 +1226,12 @@ async function runInit(args) {
     // `--with-hooks` implies `--with-local-review` — the auto hook and the manual
     // `/clud-bug-review` command are complementary (the hook auto-runs the engine
     // recipe on each commit; the command runs it on demand against the PR).
+    // --local-only IS the max-mode install: the slash command + the commit hook,
+    // minus the GitHub Action workflows (gated above).
+    if (args.localOnly) {
+        args.withLocalReview = true;
+        args.withHooks = true;
+    }
     if (args.withHooks)
         args.withLocalReview = true;
     if (args.withLocalReview) {
@@ -1285,9 +1337,14 @@ async function runInit(args) {
         log('  committing...');
         const toAdd = [
             '.claude',
-            '.github/workflows/clud-bug-review.yml',
-            '.github/workflows/clud-bug-audit.yml',
-            '.github/workflows/clud-bug-self-update.yml',
+            // No GitHub Action workflows under --local-only (none were written).
+            ...(args.localOnly
+                ? []
+                : [
+                    '.github/workflows/clud-bug-review.yml',
+                    '.github/workflows/clud-bug-audit.yml',
+                    '.github/workflows/clud-bug-self-update.yml',
+                ]),
             ...agentDocs.created,
             ...agentDocs.touched,
         ];
@@ -1302,22 +1359,44 @@ async function runInit(args) {
     await runInitBranchProtection(args);
     log('');
     log('Field kit assembled. Next:');
-    log('  1. Set ANTHROPIC_API_KEY in your repo secrets:');
-    log('     Settings → Secrets and variables → Actions → New repository secret');
-    if (!args.commit) {
-        log('  2. git add .claude .github/workflows/clud-bug-*.yml && git commit && git push');
-        log('  3. Open a PR — the naturalist arrives within ~2 minutes.');
+    if (args.localOnly) {
+        log('  Max mode — reviews run inside your Claude Code session on your own');
+        log('  subscription. No API key, no GitHub Action, no per-review bill. On every');
+        log('  commit the hook surfaces a review recipe; or run /clud-bug-review on demand.');
+        if (!args.commit) {
+            log('  → git add .claude && git commit && git push');
+        }
+        else {
+            log('  → git push.');
+        }
     }
     else {
-        log('  2. git push, then open a PR — the naturalist arrives within ~2 minutes.');
+        log('  1. Set ANTHROPIC_API_KEY in your repo secrets:');
+        log('     Settings → Secrets and variables → Actions → New repository secret');
+        if (!args.commit) {
+            log('  2. git add .claude .github/workflows/clud-bug-*.yml && git commit && git push');
+            log('  3. Open a PR — the naturalist arrives within ~2 minutes.');
+        }
+        else {
+            log('  2. git push, then open a PR — the naturalist arrives within ~2 minutes.');
+        }
     }
     log('');
     log('Drop your own .claude/skills/<name>/SKILL.md files anytime — they get pinned automatically.');
-    log('For a whole-repo walk: Actions tab → Clud Bug 🐛 Audit → Run workflow.');
-    log('Self-update is on (weekly Mondays 12:00 UTC). Pin via "pinVersion" in .claude/skills/.clud-bug.json.');
+    // These reference the GitHub Action workflows, which --local-only does not write.
+    if (!args.localOnly) {
+        log('For a whole-repo walk: Actions tab → Clud Bug 🐛 Audit → Run workflow.');
+        log('Self-update is on (weekly Mondays 12:00 UTC). Pin via "pinVersion" in .claude/skills/.clud-bug.json.');
+    }
     log('');
-    log('Strict mode is ON by default (clud-bug-review fails the check on critical findings).');
-    log('  • Add `clud-bug-review` to your branch protection required checks for full enforcement.');
+    if (args.localOnly) {
+        log('Strict mode + branch-protection enforcement apply to the GitHub Action path; max mode is');
+        log('advisory by design — findings surface in your session for you to act on.');
+    }
+    else {
+        log('Strict mode is ON by default (clud-bug-review fails the check on critical findings).');
+        log('  • Add `clud-bug-review` to your branch protection required checks for full enforcement.');
+    }
     log('  • Opt out by setting "strictMode": false in .claude/skills/.clud-bug.json.');
     // v0.6.33 — opt-in unified install (mirror of logmind v0.6.8). When
     // --with-skdd is passed, subprocess to `pip install logmind` + `logmind init`