clud-bug 0.7.0-rc.2 → 0.7.0-rc.21

package/README.md

@@ -257,6 +257,26 @@ Every Clud Bug review opens with a status line that tells you exactly what chang
 
 Same format every time; zero values are always present so the line is easy to scan and parse.
 
+### Auto-resolving review threads (optional PAT)
+
+When you push a fix, Clud Bug re-checks each open review thread and, if it verifies the fix
+landed, posts a **✅ Verified fixed** reply on that thread.
+
+**Closing the thread automatically is optional.** GitHub doesn't let the built-in Actions
+`GITHUB_TOKEN` resolve review threads, so by default Clud Bug posts the "verified fixed"
+reply and you click **Resolve conversation** to dismiss it — no errors, nothing fails.
+
+To have Clud Bug close verified threads for you (matching the hosted App):
+
+1. Create a **fine-grained personal access token** scoped to this repo with **Pull
+   requests: write**.
+2. Add it as a repository secret named **`CLUD_BUG_RESOLVE_PAT`** (Settings → Secrets and
+   variables → Actions → New repository secret).
+
+The next fix-push then auto-closes verified threads. Without the secret everything still
+works; threads just wait for a manual Resolve. The reply is idempotent — re-pushes that
+don't change the code won't re-post, so the thread never gets spammed.
+
 ## Manual install (advanced)
 
 If you don't want to use the CLI, you can install a generic workflow by hand:

package/data/canonical-v1.json

@@ -0,0 +1,37 @@
+{
+  "$comment": "Canonical branch protection ruleset for SkDD-conformant repos. Applied by `logmind init --configure-github`, `clud-bug init --configure-github`, and `reporulez`. Implements thrillmade/protocol SPEC §7. Schema-locked at v1; major bumps require coordinated tool releases.",
+  "version": "v1",
+  "spec_version": "0.1.2",
+  "branch_protection": {
+    "required_status_checks": {
+      "strict": true,
+      "contexts": [
+        "clud-bug-review",
+        "check-decisions",
+        "check-derived-docs",
+        "check-links",
+        "test"
+      ]
+    },
+    "required_pull_request_reviews": {
+      "required_approving_review_count": 1,
+      "dismiss_stale_reviews": false,
+      "require_code_owner_reviews": false
+    },
+    "required_conversation_resolution": true,
+    "enforce_admins": false,
+    "allow_force_pushes": false,
+    "allow_deletions": false,
+    "required_linear_history": false,
+    "allow_auto_merge": true,
+    "delete_branch_on_merge": true,
+    "squash_merge_commit_title": "PR_TITLE",
+    "squash_merge_commit_message": "PR_BODY"
+  },
+  "$notes": {
+    "required_approving_review_count": "1 — auto-satisfied by clud-bug[bot]'s APPROVE vote on clean reviews for org-member PRs (per SPEC §7.2.1). External-contributor PRs still need a human reviewer because the bot's APPROVE on first-time contributors is policy-gated. Repo-owners MAY raise above 1; tools MUST NOT lower below 1.",
+    "enforce_admins": "false so maintainers can land hotfixes outside the gate; the dogfood discipline expects this only for genuine emergencies (clud-bug review still runs but doesn't block)",
+    "contexts": "the four logmind workflow check names + clud-bug-review + a generic 'tests' context. Repos may add more, but MUST keep these. If a context name is renamed in workflow YAML, update the ruleset.",
+    "required_conversation_resolution": "true is the dogfood-defining rule: clud-bug findings must be resolved before merge"
+  }
+}

package/dist/cli/configure-github.d.ts

@@ -0,0 +1,58 @@
+import { loadCanonicalV1, type OctokitLike } from '../core/configure-github.js';
+export interface RunConfigureGithubOptions {
+    /** "owner/repo" target — required. */
+    target?: string | null;
+    /** Target branch (default `main`). */
+    branch?: string;
+    /** Render diff only; skip PATCH calls. */
+    dryRun?: boolean;
+    /** Suppress progress chatter; emit only the final `ok` summary. */
+    quiet?: boolean;
+    /** Emit the SPEC §3.23.1 status payload as JSON instead of key-colon-value. */
+    json?: boolean;
+    /** Resolver for the GitHub token (tests pass a stub). */
+    resolveToken?: () => Promise<string | null>;
+    /** Octokit factory (tests inject a fake; defaults to the gh-adapter). */
+    octokitFactory?: (token: string) => OctokitLike;
+    /** Stdout writer (tests capture). */
+    stdout?: (msg: string) => void;
+    /** Stderr writer (tests capture). */
+    stderr?: (msg: string) => void;
+}
+/** Resolved outcome of a configure-github run, for the §3.23.1 status payload. */
+export interface ConfigureSummary {
+    owner: string;
+    repo: string;
+    /** True when the repo already matches canonical-v1 (idempotent no-op). */
+    alreadyCanonical: boolean;
+    /** True when this was a --dry-run (no PATCH calls made). */
+    dryRun: boolean;
+    /** Number of changes (applied, or pending for dry-run; 0 for a no-op). */
+    changes: number;
+}
+/**
+ * SPEC §3.23.1 (NORMATIVE): emit a single-line status payload carrying
+ * `alreadyCanonical` + `rulesetVersion` as named fields — JSON for machine
+ * consumption, key-colon-value for humans.
+ */
+export declare function formatConfigureSummary(summary: ConfigureSummary, json: boolean): string;
+/**
+ * Entry point — wired into `clud-bug.js` dispatch. Returns a Node-style
+ * exit code so the dispatcher can `process.exit()` deterministically. We
+ * don't call `process.exit` ourselves so tests can drive the function
+ * without taking down the harness.
+ */
+export declare function runConfigureGithub(options: RunConfigureGithubOptions): Promise<number>;
+/**
+ * Builds an `OctokitLike` instance backed by `gh api` shell-outs. This
+ * lets us satisfy the structural interface without pulling in
+ * `@octokit/rest` as a runtime dep (~200KB). The App passes its real
+ * Octokit instance instead.
+ */
+export declare function ghCliOctokit(token: string): OctokitLike;
+/**
+ * Re-exported so callers can preload the ruleset (e.g. for a `--show-ruleset`
+ * flag in future). Currently exists for parity with the App's pattern.
+ */
+export { loadCanonicalV1 };
+//# sourceMappingURL=configure-github.d.ts.map

package/dist/cli/configure-github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-github.d.ts","sourceRoot":"","sources":["../../src/cli/configure-github.ts"],"names":[],"mappings":"AAwBA,OAAO,EAEL,eAAe,EACf,KAAK,WAAW,EAEjB,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;IAChD,qCAAqC;IACrC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qCAAqC;IACrC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAwBD,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAevF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAwFjB;AAkBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAyFvD;AAOD;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/cli/configure-github.js

@@ -0,0 +1,242 @@
+// `clud-bug configure-github` CLI command — applies the SPEC §7 canonical
+// branch protection ruleset to a target repo.
+//
+// External users installing the App expect "best practice branch protection"
+// applied automatically. This command lets them opt in offline + dry-run
+// safely BEFORE the App's auto-setup runs server-side. Same core logic
+// powers both paths (the App imports `applyCanonicalRuleset` from
+// clud-bug/core; this CLI passes a `gh api`-wrapping adapter so users
+// don't need `@octokit/rest` on their machine).
+//
+// Usage:
+//
+//   clud-bug configure-github <owner>/<repo>
+//   clud-bug configure-github <owner>/<repo> --dry-run
+//   clud-bug configure-github <owner>/<repo> --branch develop
+//
+// Auth ladder:
+//
+//   1. `GITHUB_TOKEN` env var (CI-friendly, no `gh` install required)
+//   2. `gh auth token` (developer workstation default)
+//
+// If neither produces a token, exits 1 with a recovery message.
+import { spawn, spawnSync } from 'node:child_process';
+import { applyCanonicalRuleset, loadCanonicalV1, } from '../core/configure-github.js';
+const HELP = `clud-bug configure-github — apply SPEC §7 canonical branch protection.
+
+Usage:
+  clud-bug configure-github <owner>/<repo> [options]
+
+Options:
+  --dry-run         Compute diff and print it, but do NOT call PATCH endpoints.
+  --branch <name>   Target branch (default: main).
+  --quiet,-q        Suppress progress chatter; emit only the final summary.
+  --json            Emit the status payload as JSON (machine consumption).
+  --help,-h         Show this help.
+
+Auth (resolved in order):
+  1. GITHUB_TOKEN env var (CI-friendly)
+  2. \`gh auth token\` (developer workstation)
+
+Exit codes:
+  0  success or already-canonical
+  1  auth missing, PATCH error, or unrecoverable transport failure
+  2  CLI usage error (missing target, bad flag)
+`;
+/**
+ * SPEC §3.23.1 (NORMATIVE): emit a single-line status payload carrying
+ * `alreadyCanonical` + `rulesetVersion` as named fields — JSON for machine
+ * consumption, key-colon-value for humans.
+ */
+export function formatConfigureSummary(summary, json) {
+    const { owner, repo, alreadyCanonical, dryRun, changes } = summary;
+    if (json) {
+        return (JSON.stringify({ owner, repo, alreadyCanonical, rulesetVersion: 'v1', dryRun, changes }) + '\n');
+    }
+    if (alreadyCanonical) {
+        return `ok configure-github: owner: ${owner} repo: ${repo} alreadyCanonical: true rulesetVersion: v1\n`;
+    }
+    const plural = changes === 1 ? '' : 's';
+    if (dryRun) {
+        return `ok configure-github: dry-run on ${owner}/${repo} — ${changes} change${plural} pending\n`;
+    }
+    return `ok configure-github: ${owner}/${repo} converged to canonical-v1 (${changes} change${plural})\n`;
+}
+/**
+ * Entry point — wired into `clud-bug.js` dispatch. Returns a Node-style
+ * exit code so the dispatcher can `process.exit()` deterministically. We
+ * don't call `process.exit` ourselves so tests can drive the function
+ * without taking down the harness.
+ */
+export async function runConfigureGithub(options) {
+    const { target, branch = 'main', dryRun = false, quiet = false, json = false, resolveToken = defaultResolveToken, octokitFactory = ghCliOctokit, stdout = (msg) => process.stdout.write(msg), stderr = (msg) => process.stderr.write(msg), } = options;
+    if (!target) {
+        stderr(HELP);
+        return 2;
+    }
+    const match = /^([^/]+)\/([^/]+)$/.exec(target);
+    if (!match) {
+        stderr(`clud-bug configure-github: target must be in owner/repo form, got "${target}".\n`);
+        return 2;
+    }
+    const [, owner, repo] = match;
+    const token = await resolveToken();
+    if (!token) {
+        stderr('clud-bug configure-github: no GitHub token found.\n' +
+            '  Set GITHUB_TOKEN, or install + auth gh: brew install gh && gh auth login\n');
+        return 1;
+    }
+    if (!quiet) {
+        stdout(`\u{1F41B} configure-github: applying canonical-v1 ruleset to ${owner}/${repo} (branch=${branch})\n`);
+    }
+    // Single-call orchestration: the CLI previously called
+    // applyCanonicalRuleset twice in apply mode (dry-run first to display the
+    // planned changes, then a real call to apply). That two-read pattern
+    // opened a TOCTOU window — concurrent changes between the two reads
+    // could make the displayed list diverge from the actually-applied list,
+    // and the dry-run cost a redundant API round-trip every time. Drop the
+    // preview-first read: pass `dryRun` straight through. The function's
+    // idempotency contract (returns `alreadyCanonical: true` + empty changes
+    // on a no-op) means we don't need a separate "look before you leap"
+    // call. Users who want preview semantics run `--dry-run` first as a
+    // distinct invocation — idiomatic CLI behavior. Surfaced by PR #166
+    // reviewer (CTO follow-up 2026-06-17).
+    const octokit = octokitFactory(token);
+    let result;
+    try {
+        result = await applyCanonicalRuleset(octokit, {
+            owner,
+            repo,
+            branch,
+            dryRun,
+        });
+    }
+    catch (err) {
+        stderr(`clud-bug configure-github: ${dryRun ? 'failed to read current state' : 'PATCH failed'}: ${stringifyError(err)}\n`);
+        return 1;
+    }
+    if (result.alreadyCanonical) {
+        if (!quiet)
+            stdout('  No changes — repo already matches canonical-v1.\n');
+        stdout(formatConfigureSummary({ owner, repo, alreadyCanonical: true, dryRun, changes: 0 }, json));
+        return 0;
+    }
+    if (!quiet) {
+        const verb = dryRun ? 'Planned' : 'Applied';
+        stdout(`  ${verb} changes (${result.changes.length}):\n`);
+        for (const c of result.changes)
+            stdout(`    - ${c}\n`);
+    }
+    if (dryRun) {
+        stdout(formatConfigureSummary({ owner, repo, alreadyCanonical: false, dryRun: true, changes: result.changes.length }, json));
+        return 0;
+    }
+    stdout(formatConfigureSummary({ owner, repo, alreadyCanonical: false, dryRun: false, changes: result.changes.length }, json));
+    return 0;
+}
+/**
+ * Auth ladder: env var first, then `gh auth token`. Surfaces a token
+ * string on success or `null` if neither source has one (caller prints
+ * the recovery hint).
+ */
+async function defaultResolveToken() {
+    const fromEnv = process.env.GITHUB_TOKEN?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const result = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+    if (result.status === 0) {
+        const tok = result.stdout.trim();
+        if (tok)
+            return tok;
+    }
+    return null;
+}
+/**
+ * Builds an `OctokitLike` instance backed by `gh api` shell-outs. This
+ * lets us satisfy the structural interface without pulling in
+ * `@octokit/rest` as a runtime dep (~200KB). The App passes its real
+ * Octokit instance instead.
+ */
+export function ghCliOctokit(token) {
+    // We pass GITHUB_TOKEN through the spawn env so gh's API surface picks
+    // it up consistently whether the user supplied env or gh auth.
+    const env = { ...process.env, GITHUB_TOKEN: token };
+    function ghApi(method, path, body) {
+        return new Promise((resolve, reject) => {
+            const args = ['api', '-X', method];
+            if (body !== undefined) {
+                args.push('--input', '-');
+            }
+            args.push(path);
+            // Add an Accept header so 404s return the structured error, not a
+            // friendlier shell hint. The wrapping err.message detection in
+            // `isBranchNotProtected` keys on the structured form.
+            args.push('-H', 'Accept: application/vnd.github+json');
+            const child = spawn('gh', args, {
+                env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (d) => {
+                stdout += d.toString();
+            });
+            child.stderr.on('data', (d) => {
+                stderr += d.toString();
+            });
+            child.on('error', reject);
+            child.on('close', (code) => {
+                if (code !== 0) {
+                    const httpMatch = /HTTP (\d{3})/.exec(stderr);
+                    const status = httpMatch ? Number(httpMatch[1]) : undefined;
+                    const err = new Error((stderr.trim() || stdout.trim() || `gh api exited ${code}`).slice(0, 500));
+                    if (status !== undefined)
+                        err.status = status;
+                    reject(err);
+                    return;
+                }
+                try {
+                    resolve(stdout ? JSON.parse(stdout) : {});
+                }
+                catch (parseErr) {
+                    reject(parseErr);
+                }
+            });
+            if (body !== undefined) {
+                child.stdin.end(JSON.stringify(body));
+            }
+            else {
+                child.stdin.end();
+            }
+        });
+    }
+    return {
+        repos: {
+            async getBranchProtection({ owner, repo, branch }) {
+                const data = await ghApi('GET', `/repos/${owner}/${repo}/branches/${branch}/protection`);
+                return { data: data };
+            },
+            async updateBranchProtection({ owner, repo, branch, ...rest }) {
+                return ghApi('PUT', `/repos/${owner}/${repo}/branches/${branch}/protection`, rest);
+            },
+            async get({ owner, repo }) {
+                const data = await ghApi('GET', `/repos/${owner}/${repo}`);
+                return { data: data };
+            },
+            async update({ owner, repo, ...rest }) {
+                return ghApi('PATCH', `/repos/${owner}/${repo}`, rest);
+            },
+        },
+    };
+}
+function stringifyError(err) {
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}
+/**
+ * Re-exported so callers can preload the ruleset (e.g. for a `--show-ruleset`
+ * flag in future). Currently exists for parity with the App's pattern.
+ */
+export { loadCanonicalV1 };
+//# sourceMappingURL=configure-github.js.map

package/dist/cli/configure-github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-github.js","sourceRoot":"","sources":["../../src/cli/configure-github.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8CAA8C;AAC9C,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,uEAAuE;AACvE,kEAAkE;AAClE,sEAAsE;AACtE,gDAAgD;AAChD,EAAE;AACF,SAAS;AACT,EAAE;AACF,6CAA6C;AAC7C,uDAAuD;AACvD,8DAA8D;AAC9D,EAAE;AACF,eAAe;AACf,EAAE;AACF,sEAAsE;AACtE,uDAAuD;AACvD,EAAE;AACF,gEAAgE;AAEhE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AAuBrC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;CAoBZ,CAAC;AAcF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB,EAAE,IAAa;IAC7E,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,+BAA+B,KAAK,UAAU,IAAI,8CAA8C,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,mCAAmC,KAAK,IAAI,IAAI,MAAM,OAAO,UAAU,MAAM,YAAY,CAAC;IACnG,CAAC;IACD,OAAO,wBAAwB,KAAK,IAAI,IAAI,+BAA+B,OAAO,UAAU,MAAM,KAAK,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,EACJ,MAAM,EACN,MAAM,GAAG,MAAM,EACf,MAAM,GAAG,KAAK,EACd,KAAK,GAAG,KAAK,EACb,IAAI,GAAG,KAAK,EACZ,YAAY,GAAG,mBAAmB,EAClC,cAAc,GAAG,YAAY,EAC7B,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAC3C,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAC5C,GAAG,OAAO,CAAC;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CACJ,sEAAsE,MAAM,MAAM,CACnF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAA6C,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CACJ,qDAAqD;YACnD,8EAA8E,CACjF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CACJ,gEAAgE,KAAK,IAAI,IAAI,YAAY,MAAM,KAAK,CACrG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,0EAA0E;IAC1E,qEAAqE;IACrE,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,uCAAuC;IACvC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE;YAC5C,KAAK;YACL,IAAI;YACJ,MAAM;YACN,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CACJ,8BAA8B,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,cAAc,KAAK,cAAc,CAAC,GAAG,CAAC,IAAI,CACnH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,qDAAqD,CAAC,CAAC;QAC1E,MAAM,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5C,MAAM,CAAC,KAAK,IAAI,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7H,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAEpD,SAAS,KAAK,CACZ,MAAwC,EACxC,IAAY,EACZ,IAAc;QAEd,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,kEAAkE;YAClE,+DAA+D;YAC/D,sDAAsD;YACtD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;gBAC9B,GAAG;gBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAC/D,CAAC,EACD,GAAG,CACJ,CAC6B,CAAC;oBACjC,IAAI,MAAM,KAAK,SAAS;wBAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;oBAC9C,MAAM,CAAC,GAAG,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAO,CAAC,CAAC,CAAE,EAAQ,CAAC,CAAC;gBAC1D,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,KAAK,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CACtB,KAAK,EACL,UAAU,KAAK,IAAI,IAAI,aAAa,MAAM,aAAa,CACxD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAgF,EAAE,CAAC;YACpG,CAAC;YACD,KAAK,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE;gBAC3D,OAAO,KAAK,CACV,KAAK,EACL,UAAU,KAAK,IAAI,IAAI,aAAa,MAAM,aAAa,EACvD,IAAI,CACL,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CACtB,KAAK,EACL,UAAU,KAAK,IAAI,IAAI,EAAE,CAC1B,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,IAAgE,EAAE,CAAC;YACpF,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;gBACnC,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/cli/hooks.d.ts

@@ -0,0 +1,51 @@
+/** Stable marker embedded in our hook so re-runs — and upgrades from the old,
+ * broken `type: agent` hook — replace it in place. */
+export declare const CLUD_BUG_HOOK_MARKER = "clud-bug-local-review";
+/**
+ * Build the shell `command` of the commit-review hook. Pins to a FLOATING npm
+ * dist-tag (`next` by default) rather than an exact version, so every repo's hook
+ * auto-fetches the latest review recipe — no per-release re-pin rollout. (The
+ * original exact-pin guarded against a `latest` that predated the `review-prompt`
+ * verb; that verb now ships in every channel, so floating is safe + frictionless.)
+ * Max mode is advisory, so "always newest recipe" is the right default for a
+ * review tool. `pin` is overridable for a repo that wants a frozen, exact version.
+ *
+ * The command, in order:
+ *   1. Idempotency — skip if this exact HEAD was already surfaced (avoids a
+ *      re-review on an amend-with-no-change or a double-fire). The reviewed SHA
+ *      is recorded under `.git/` (untracked), reusing the "last-reviewed-sha"
+ *      idea the hosted bot uses on PR comments.
+ *   2. Fetch a fresh recipe tailored to THIS repo: `review-prompt --trigger
+ *      commit` (an instruction recipe — `git show HEAD` + the skills + the
+ *      report format — NOT raw data; it is meant to be FOLLOWED by an agent).
+ *   3. Surface it to the session by printing it and `exit 2`, so `asyncRewake`
+ *      shows it to the main agent as a system reminder. The agent then reviews
+ *      the commit on the session subscription.
+ *   4. Any failure or empty output → `exit 0` (quiet; the commit is never blocked).
+ */
+export declare function buildCommitReviewCommand(pin?: string): string;
+/** One Claude Code hook entry: a tool matcher plus its hook list. */
+export interface HookMatcherEntry {
+    matcher?: string;
+    hooks: Array<Record<string, unknown>>;
+}
+/** Minimal shape of the `.claude/settings.json` we read + merge into. */
+export interface ClaudeSettings {
+    hooks?: Record<string, HookMatcherEntry[]>;
+    [key: string]: unknown;
+}
+/**
+ * Builds the PostToolUse entry that runs the commit-review command: a native
+ * `type: command` hook, backgrounded (`async`), surfacing the recipe back to the
+ * session (`asyncRewake` + exit 2), firing only on `git commit` (`if`).
+ */
+export declare function buildLocalReviewHook(command: string): HookMatcherEntry;
+/**
+ * Merges the clud-bug commit-review hook into an existing `.claude/settings.json`
+ * object. **Idempotent** (replaces any prior clud-bug entry — including the old
+ * `type: agent` one — rather than duplicating) and **non-clobbering** (preserves
+ * every other top-level key, event, and hook). Tolerates a missing/malformed
+ * `existing` value.
+ */
+export declare function mergeLocalReviewHook(existing: unknown, command: string): ClaudeSettings;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/cli/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAkBA;sDACsD;AACtD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAe,GAAG,MAAM,CAgCrE;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CActE;AAcD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAwBvF"}

package/dist/cli/hooks.js

@@ -0,0 +1,138 @@
+// Wave 6b (rc.17 fix) — Claude Code `type: command` commit-review hook scaffolding.
+//
+// `clud-bug init --with-hooks` writes a native Claude Code hook that, on every
+// `git commit`, runs clud-bug's review recipe ON THIS SESSION'S SUBSCRIPTION
+// (no API key), in the background (the commit never blocks).
+//
+// WHY `type: command`, NOT `type: agent`: a Claude Code `type: agent` hook
+// spawns a subagent restricted to Read/Grep/Glob — it has NO Bash and the tool
+// set is not configurable (see code.claude.com/docs/en/hooks: "spawn a subagent
+// that can use tools like Read, Grep, and Glob"). The original Wave 6b hook used
+// `type: agent` and told the subagent to run `npx clud-bug review-prompt` — a
+// Bash CLI call an agent hook can never make — so the review NEVER ran for
+// anyone. A `type: command` hook CAN run the CLI: it fetches the engine's recipe
+// and surfaces it to the session via exit-2 (`asyncRewake`), so the MAIN agent —
+// which has Bash, git, gh, and the subscription — performs the review. The hook
+// exits 0 on any failure, so a review that can't run is a quiet no-op and the
+// commit is NEVER blocked.
+/** Stable marker embedded in our hook so re-runs — and upgrades from the old,
+ * broken `type: agent` hook — replace it in place. */
+export const CLUD_BUG_HOOK_MARKER = 'clud-bug-local-review';
+/**
+ * Build the shell `command` of the commit-review hook. Pins to a FLOATING npm
+ * dist-tag (`next` by default) rather than an exact version, so every repo's hook
+ * auto-fetches the latest review recipe — no per-release re-pin rollout. (The
+ * original exact-pin guarded against a `latest` that predated the `review-prompt`
+ * verb; that verb now ships in every channel, so floating is safe + frictionless.)
+ * Max mode is advisory, so "always newest recipe" is the right default for a
+ * review tool. `pin` is overridable for a repo that wants a frozen, exact version.
+ *
+ * The command, in order:
+ *   1. Idempotency — skip if this exact HEAD was already surfaced (avoids a
+ *      re-review on an amend-with-no-change or a double-fire). The reviewed SHA
+ *      is recorded under `.git/` (untracked), reusing the "last-reviewed-sha"
+ *      idea the hosted bot uses on PR comments.
+ *   2. Fetch a fresh recipe tailored to THIS repo: `review-prompt --trigger
+ *      commit` (an instruction recipe — `git show HEAD` + the skills + the
+ *      report format — NOT raw data; it is meant to be FOLLOWED by an agent).
+ *   3. Surface it to the session by printing it and `exit 2`, so `asyncRewake`
+ *      shows it to the main agent as a system reminder. The agent then reviews
+ *      the commit on the session subscription.
+ *   4. Any failure or empty output → `exit 0` (quiet; the commit is never blocked).
+ */
+export function buildCommitReviewCommand(pin = 'next') {
+    return [
+        // Marker as a `#` comment (NOT a `:` no-op) so its free text can never break
+        // `sh` — a paren / quote / `$` in the marker line would be a syntax error
+        // under `: ...`. The dogfood caught this. `isOurHook` finds the marker here.
+        `# ${CLUD_BUG_HOOK_MARKER} v2 — clud-bug commit review on the session subscription`,
+        // Belt-and-suspenders gate. The `if: Bash(git commit *)` / `Bash(logmind log *)`
+        // field filters at the platform on Claude Code >= 2.1.85; OLDER CC ignores
+        // `if` and would fire this on EVERY Bash call (a review recipe after every
+        // command). Command hooks get the event JSON on stdin — re-check it here. If
+        // stdin is empty (a CC that doesn't pipe it), fall through and trust `if`.
+        `ev=$(cat 2>/dev/null)`,
+        `if [ -n "$ev" ]; then case "$ev" in *'git commit'*|*'logmind log'*) ;; *) exit 0 ;; esac; fi`,
+        `sha=$(git rev-parse HEAD 2>/dev/null) || exit 0`,
+        `gitdir=$(git rev-parse --git-dir 2>/dev/null) || exit 0`,
+        `marker="$gitdir/clud-bug-last-commit-review"`,
+        `[ "$(cat "$marker" 2>/dev/null)" = "$sha" ] && exit 0`,
+        // H4 — one retry on a transient npx/network blip (a stale lock, a slow
+        // registry) before giving up, so a hiccup doesn't silently skip the review.
+        // `|| recipe=` clears it on a NON-ZERO exit so partial/error stdout from a
+        // mid-run crash (or an old npm warning on stdout) is never mistaken for a
+        // valid recipe — only a clean, exit-0 run surfaces.
+        `recipe=$(npx clud-bug@${pin} review-prompt --trigger commit 2>/dev/null) || recipe=`,
+        `if [ -z "$recipe" ]; then sleep 1; recipe=$(npx clud-bug@${pin} review-prompt --trigger commit 2>/dev/null) || recipe=; fi`,
+        // H4 — when the recipe still can't be fetched, leave a diagnostic marker so a
+        // FAILED review is distinguishable from a CLEAN one (a clean review surfaces
+        // the recipe + the agent reports clean). Never blocks the commit.
+        `if [ -z "$recipe" ]; then printf '%s' "$sha" > "$gitdir/clud-bug-review-skipped" 2>/dev/null || true; exit 0; fi`,
+        `printf '%s' "$sha" > "$marker" 2>/dev/null || true`,
+        `printf '%s\\n\\n%s\\n' "clud-bug commit review (max mode — on this session's subscription): a commit was just made. Follow this recipe now — review that commit against the skills it names and surface any findings." "$recipe"`,
+        `exit 2`,
+    ].join('\n');
+}
+/**
+ * Builds the PostToolUse entry that runs the commit-review command: a native
+ * `type: command` hook, backgrounded (`async`), surfacing the recipe back to the
+ * session (`asyncRewake` + exit 2), firing only on `git commit` (`if`).
+ */
+export function buildLocalReviewHook(command) {
+    const base = { type: 'command', async: true, asyncRewake: true, timeout: 180, command };
+    return {
+        matcher: 'Bash',
+        hooks: [
+            { ...base, if: 'Bash(git commit *)' },
+            // thrillmade repos (and any logmind user) commit via `logmind log`, which
+            // wraps `git commit` inside its own binary — so the Bash tool call is
+            // `logmind log ...`, which `Bash(git commit *)` never matches. Fire on it
+            // too, or max mode never triggers in a logmind repo. The idempotency
+            // SHA-marker means whichever path runs, a commit is reviewed exactly once.
+            { ...base, if: 'Bash(logmind log *)' },
+        ],
+    };
+}
+function isOurHook(h) {
+    // Match our marker in `command` (current `type: command` hook) OR `prompt`
+    // (the old, broken `type: agent` hook) so a re-install / `clud-bug update`
+    // replaces either in place.
+    const field = h?.['command'] ?? h?.['prompt'];
+    return typeof field === 'string' && field.includes(CLUD_BUG_HOOK_MARKER);
+}
+function isCludBugReviewEntry(entry) {
+    return !!entry && Array.isArray(entry.hooks) && entry.hooks.some(isOurHook);
+}
+/**
+ * Merges the clud-bug commit-review hook into an existing `.claude/settings.json`
+ * object. **Idempotent** (replaces any prior clud-bug entry — including the old
+ * `type: agent` one — rather than duplicating) and **non-clobbering** (preserves
+ * every other top-level key, event, and hook). Tolerates a missing/malformed
+ * `existing` value.
+ */
+export function mergeLocalReviewHook(existing, command) {
+    const base = existing && typeof existing === 'object' ? { ...existing } : {};
+    const hooks = { ...(base.hooks ?? {}) };
+    const priorPost = Array.isArray(hooks.PostToolUse) ? hooks.PostToolUse : [];
+    // Preserve every non-clud-bug hook — including any the user co-located INSIDE
+    // our own matcher entry: drop only the hook(s) carrying our marker, never the
+    // whole entry.
+    const ours = buildLocalReviewHook(command);
+    const otherEntries = [];
+    const coLocatedUserHooks = [];
+    for (const entry of priorPost) {
+        if (isCludBugReviewEntry(entry)) {
+            for (const h of entry.hooks)
+                if (!isOurHook(h))
+                    coLocatedUserHooks.push(h);
+        }
+        else {
+            otherEntries.push(entry);
+        }
+    }
+    const ourEntry = coLocatedUserHooks.length > 0 ? { ...ours, hooks: [...coLocatedUserHooks, ...ours.hooks] } : ours;
+    hooks.PostToolUse = [...otherEntries, ourEntry];
+    base.hooks = hooks;
+    return base;
+}
+//# sourceMappingURL=hooks.js.map

package/dist/cli/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/cli/hooks.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,2BAA2B;AAE3B;sDACsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc,MAAM;IAC3D,OAAO;QACL,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,KAAK,oBAAoB,0DAA0D;QACnF,iFAAiF;QACjF,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,uBAAuB;QACvB,8FAA8F;QAC9F,iDAAiD;QACjD,yDAAyD;QACzD,8CAA8C;QAC9C,uDAAuD;QACvD,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,oDAAoD;QACpD,yBAAyB,GAAG,yDAAyD;QACrF,4DAA4D,GAAG,6DAA6D;QAC5H,8EAA8E;QAC9E,6EAA6E;QAC7E,kEAAkE;QAClE,kHAAkH;QAClH,oDAAoD;QACpD,kOAAkO;QAClO,QAAQ;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAW,CAAC;IACjG,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,EAAE;YACL,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACrC,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,qEAAqE;YACrE,2EAA2E;YAC3E,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,qBAAqB,EAAE;SACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAsC;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB,EAAE,OAAe;IACrE,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAI,QAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,KAAK,GAAuC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAE5E,8EAA8E;IAC9E,8EAA8E;IAC9E,eAAe;IACf,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,kBAAkB,GAAmC,EAAE,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/index.d.ts

@@ -5,4 +5,5 @@ export { renderBlock, detectSkillRelPath, upsertBlock, hasAgentsMdImport, remove
 export { computeSkillUsageDelta, mergeSkillUsage, assessSkillHealth, formatHealthDashboard, DEFAULT_GH_RUNNER, fetchUsageArtifacts, aggregateUsageStream, type SkillDelta, type SkillUsageEntry, type SkillDeltaMap, type SkillUsageMap, type SkillHealthStatus, type SkillHealthRow, type GhRunResult, type GhRunner, type FetchUsageArtifactsOptions, type UsageArtifactRecord, } from './skill-usage.js';
 export { PRICING, computeReviewCost, costPerLOC, cacheHitRate, extractTokensFromLog, rollup, formatRollup, type ModelPricing, type TokenCounts, type CostParts, type ReviewCost, type ExtractedTokens, type ReviewRecord, type RollupGroupStats, type RollupTotal, type RollupTrend, type RollupOutlier, type UnknownModelReview, type Rollup, type FormatRollupOptions, } from './usage.js';
 export { runUpdate, type RunUpdateOptions, type UpdateChangeRecord, type UpdateSkippedRecord, type RunUpdateResult, } from './update.js';
+export { runConfigureGithub, ghCliOctokit, type RunConfigureGithubOptions, } from './configure-github.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mCAAmC,EACxC,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,GAAG,EACH,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,MAAM,EACN,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,mCAAmC,EACxC,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,GAAG,EACH,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,MAAM,EACN,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC"}

package/dist/cli/index.js

@@ -15,4 +15,5 @@ export { renderBlock, detectSkillRelPath, upsertBlock, hasAgentsMdImport, remove
 export { computeSkillUsageDelta, mergeSkillUsage, assessSkillHealth, formatHealthDashboard, DEFAULT_GH_RUNNER, fetchUsageArtifacts, aggregateUsageStream, } from './skill-usage.js';
 export { PRICING, computeReviewCost, costPerLOC, cacheHitRate, extractTokensFromLog, rollup, formatRollup, } from './usage.js';
 export { runUpdate, } from './update.js';
+export { runConfigureGithub, ghCliOctokit, } from './configure-github.js';
 //# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,iBAAiB;AAEjB,oEAAoE;AACpE,oEAAoE;AACpE,0DAA0D;AAC1D,oCAAoC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,GAW7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,GAAG,GAIJ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GAWrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,MAAM,EACN,YAAY,GAcb,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,GAKV,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0CAA0C;AAC1C,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,iBAAiB;AAEjB,oEAAoE;AACpE,oEAAoE;AACpE,0DAA0D;AAC1D,oCAAoC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,GAW7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,GAAG,GAIJ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,GAGZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GAWrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,MAAM,EACN,YAAY,GAcb,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,GAKV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,kBAAkB,EAClB,YAAY,GAEb,MAAM,uBAAuB,CAAC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AA6KA,iBAAe,IAAI,kBAwBlB;AA0pCD,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAsRA,iBAAe,IAAI,kBAyClB;AAkgED,OAAO,EAAE,IAAI,EAAE,CAAC"}