clud-bug 0.7.0-rc.2 → 0.7.0-rc.21

package/dist/cli/update.js

@@ -5,6 +5,7 @@ import { reviewPrompt } from '../core/prompts.js';
 import { detect, buildDescriptionLine } from '../core/detect.js';
 import { loadBaseline, readManifest, writeManifest } from './skills.js';
 import { applyToRepo as applyAgentDocs } from './agents-md.js';
+import { mergeLocalReviewHook, buildCommitReviewCommand, CLUD_BUG_HOOK_MARKER } from './hooks.js';
 // Returns { changed, unchanged, skipped, ourVersion }.
 export async function runUpdate(opts) {
     const { cwd, templatesDir, baselineDir, ourVersion, refreshRemote = false, loadBaselineOpts } = opts;
@@ -19,17 +20,25 @@ export async function runUpdate(opts) {
     const changed = [];
     const unchanged = [];
     const skipped = [];
-    // 1. Re-render review workflow with the latest template.
-    const signals = await detect(cwd);
-    const tmplName = pickTemplate(signals.languages);
-    // REVIEW_SCHEMA + CCA_VERSION + CLUD_BUG_VERSION come from render.js DEFAULTS.
-    const newReview = await renderFile(join(templatesDir, tmplName), {
-        REVIEW_PROMPT: reviewPrompt({
-            projectDescription: buildDescriptionLine(signals),
-            language: templateLanguage(tmplName),
-        }),
-    });
-    await maybeRefreshVersioned(join(cwd, '.github/workflows/clud-bug-review.yml'), newReview, changed, unchanged, skipped, 'review workflow');
+    // 1. Re-render the review workflow with the latest template — ONLY if it is
+    //    already installed. A `--local-only` (max-mode) repo has no review
+    //    workflow and must NOT have one created by `update`: that would
+    //    re-introduce the ANTHROPIC_API_KEY Action the local install deliberately
+    //    skips (dogfood caught `update` doing exactly this). Mirrors the
+    //    pathExists-gating the audit + self-update workflows already use below.
+    const reviewPath = join(cwd, '.github/workflows/clud-bug-review.yml');
+    if (await pathExists(reviewPath)) {
+        const signals = await detect(cwd);
+        const tmplName = pickTemplate(signals.languages);
+        // REVIEW_SCHEMA + CCA_VERSION + CLUD_BUG_VERSION come from render.js DEFAULTS.
+        const newReview = await renderFile(join(templatesDir, tmplName), {
+            REVIEW_PROMPT: reviewPrompt({
+                projectDescription: buildDescriptionLine(signals),
+                language: templateLanguage(tmplName),
+            }),
+        });
+        await maybeRefreshVersioned(reviewPath, newReview, changed, unchanged, skipped, 'review workflow');
+    }
     // 2. Re-render audit workflow if it's installed (init from v0.3+ ships it).
     // Routed through renderFile (was raw readFile pre-v0.5.11) so
     // {{CCA_VERSION}} substitution lands in audit alongside review.
@@ -91,6 +100,46 @@ export async function runUpdate(opts) {
         changed.push({ path: join(cwd, p), label: `agent docs: created ${p}` });
     for (const p of agentDocs.touched)
         changed.push({ path: join(cwd, p), label: `agent docs: ${p}` });
+    // 5b. Refresh the local-review slash command (Wave 6b) when it was scaffolded
+    //     via `clud-bug init --with-local-review`. Only files carrying the
+    //     `<!-- clud-bug-local-version:` marker are refreshed; a markerless file
+    //     is user-owned (hand-customized) and left untouched.
+    const localReviewPath = join(cwd, '.claude', 'commands', 'clud-bug-review.md');
+    if (await pathExists(localReviewPath)) {
+        const prior = await readSafe(localReviewPath);
+        if (prior && prior.includes('<!-- clud-bug-local-version:')) {
+            const newCommand = await renderFile(join(templatesDir, 'clud-bug-review.md.tmpl'), {});
+            await maybeWrite(localReviewPath, newCommand, changed, unchanged, 'local-review slash command');
+        }
+        else {
+            skipped.push({
+                path: localReviewPath,
+                label: 'local-review slash command',
+                reason: 'markerless (user-customized); delete + `clud-bug init --with-local-review` to refresh',
+            });
+        }
+    }
+    // 5c. Refresh the native commit-review hook (Wave 6b) in place when it was
+    //     scaffolded via `clud-bug init --with-hooks` and our entry is intact (the
+    //     `clud-bug-local-review` marker). settings.json is user-managed — we only
+    //     re-merge OUR marked hook, never touching the user's other hooks/settings.
+    const settingsPath = join(cwd, '.claude', 'settings.json');
+    if (await pathExists(settingsPath)) {
+        const prior = await readSafe(settingsPath);
+        if (prior && prior.includes(CLUD_BUG_HOOK_MARKER)) {
+            try {
+                const merged = mergeLocalReviewHook(JSON.parse(prior), buildCommitReviewCommand());
+                await maybeWrite(settingsPath, JSON.stringify(merged, null, 2) + '\n', changed, unchanged, 'commit-review hook');
+            }
+            catch {
+                skipped.push({
+                    path: settingsPath,
+                    label: 'commit-review hook',
+                    reason: 'settings.json is not valid JSON; left untouched',
+                });
+            }
+        }
+    }
     // 6. Stamp the manifest with the version that ran the update.
     manifest['lastUpdate'] = new Date().toISOString();
     manifest['lastUpdateVersion'] = ourVersion;

package/dist/cli/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/cli/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAA4B,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AA+C/D,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,GAAG,KAAK,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACrG,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,yDAAyD;IACzD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,+EAA+E;IAC/E,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE;QAC/D,aAAa,EAAE,YAAY,CAAC;YAC1B,kBAAkB,EAAE,oBAAoB,CAAC,OAAO,CAAC;YACjD,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;SACrC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAE3I,4EAA4E;IAC5E,8DAA8D;IAC9D,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IACpE,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClG,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IAC/E,IAAI,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,qBAAqB,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAClH,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,WAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,wDAAwD;IACxD,mCAAmC;IACnC,qEAAqE;IACrE,sDAAsD;IACtD,IAAI,aAAa,EAAE,CAAC;QAClB,8DAA8D;QAC9D,gDAAgD;IAClD,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,sDAAsD;IACtD,qEAAqE;IACrE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;QAC1C,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;KAC5C,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3G,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnG,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,QAAQ,CAAC,mBAAmB,CAAC,GAAG,UAAU,CAAC;IAC3C,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,QAAgB,EAChB,OAA6B,EAC7B,SAA+B,EAC/B,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AACnE,kFAAkF;AAClF,kDAAkD;AAClD,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,QAAgB,EAChB,OAA6B,EAC7B,SAA+B,EAC/B,OAA8B,EAC9B,KAAa;IAEb,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,iBAAiB;QACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,gJAAgJ,CAAC,CAAC;IACzL,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,gDAAgD;QAChD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,6DAA6D;QAC7D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,KAAK;YACL,MAAM,EAAE,gFAAgF;SACzF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,kEAAkE;IAClE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,qDAAqD;AACrD,SAAS,sBAAsB,CAAC,IAA+B;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/D,wEAAwE;IACxE,yCAAyC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/cli/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAA4B,MAAM,aAAa,CAAC;AAClG,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AA+ClG,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,GAAG,KAAK,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACrG,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,8EAA8E;IAC9E,qEAAqE;IACrE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACtE,IAAI,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,+EAA+E;QAC/E,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE;YAC/D,aAAa,EAAE,YAAY,CAAC;gBAC1B,kBAAkB,EAAE,oBAAoB,CAAC,OAAO,CAAC;gBACjD,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;aACrC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrG,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IACpE,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClG,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IAC/E,IAAI,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,qBAAqB,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAClH,CAAC;IAED,8DAA8D;IAC9D,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,WAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,wDAAwD;IACxD,mCAAmC;IACnC,qEAAqE;IACrE,sDAAsD;IACtD,IAAI,aAAa,EAAE,CAAC;QAClB,8DAA8D;QAC9D,gDAAgD;IAClD,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,sDAAsD;IACtD,qEAAqE;IACrE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;QAC1C,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;KAC5C,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3G,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnG,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC/E,IAAI,MAAM,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,MAAM,UAAU,CAAC,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,uFAAuF;aAChG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC3D,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBACnF,MAAM,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;YACnH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,oBAAoB;oBAC3B,MAAM,EAAE,iDAAiD;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,QAAQ,CAAC,mBAAmB,CAAC,GAAG,UAAU,CAAC;IAC3C,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,QAAgB,EAChB,OAA6B,EAC7B,SAA+B,EAC/B,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,mEAAmE;AACnE,kFAAkF;AAClF,kDAAkD;AAClD,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,QAAgB,EAChB,OAA6B,EAC7B,SAA+B,EAC/B,OAA8B,EAC9B,KAAa;IAEb,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,iBAAiB;QACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,gJAAgJ,CAAC,CAAC;IACzL,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,gDAAgD;QAChD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,6DAA6D;QAC7D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,KAAK;YACL,MAAM,EAAE,gFAAgF;SACzF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,kEAAkE;IAClE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,qDAAqD;AACrD,SAAS,sBAAsB,CAAC,IAA+B;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/D,wEAAwE;IACxE,yCAAyC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAChE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/core/auto-resolve.d.ts

@@ -0,0 +1,235 @@
+import type { Severity } from './inline-threads.js';
+/** Configuration for `autoResolve` in `.clud-bug.json`. */
+export interface AutoResolveConfig {
+    /**
+     * Which mode the install opted into.
+     * - 'verified' (default): call the verifier per thread.
+     * - 'off': do nothing — all threads stay open, no verifier calls.
+     */
+    mode: 'verified' | 'off';
+    /**
+     * Action to take when the verifier returns UNCERTAIN + the original
+     * finding was 🔴 critical.
+     *
+     * - 'request_changes' (default): keep open + flag REQUEST_CHANGES.
+     * - 'leave_open': keep open with a milder marker, no escalation.
+     */
+    uncertain_critical_action: 'request_changes' | 'leave_open';
+}
+export declare const DEFAULT_AUTO_RESOLVE_CONFIG: AutoResolveConfig;
+/**
+ * One open thread from a prior review pass, plus enough state to verify
+ * it. The CLI verb hands these to `runAutoResolve` after parsing the
+ * GraphQL response + the bot's comment-body markers.
+ */
+export interface PriorThread {
+    /** GitHub review-thread node ID (GraphQL ID). Used to resolve the thread. */
+    threadId: string;
+    /** The prior finding the thread anchors. */
+    finding: PriorFinding;
+    /** Code at the finding anchor BEFORE the fix-push. */
+    codeBefore: string;
+    /** Code at the finding anchor AFTER the fix-push. */
+    codeAfter: string;
+    /** Diff hunk at the anchor (optional). */
+    diffAtAnchor?: string;
+}
+/**
+ * The minimal shape `applyResolutionRules` + the verifier need to
+ * describe a prior finding. The CLI reconstructs this from
+ * `parseThreadBody(comment.body)` + the GraphQL `path`/`line` fields.
+ */
+export interface PriorFinding {
+    severity: Severity;
+    /** The summary line + (optional) reasoning, joined for the verifier prompt. */
+    body: string;
+    /** The skill slug that raised the finding. */
+    skill: string;
+    /** Repo-relative path. */
+    file: string;
+    /** Optional 1-indexed line number. */
+    line?: number;
+}
+/** What the CLI verb should do with the thread. */
+export type ThreadAction = {
+    kind: 'resolve';
+    markerBody: string;
+    verdict: VerifyOutcome;
+} | {
+    kind: 'keep_open';
+    markerBody: string;
+    verdict: VerifyOutcome;
+} | {
+    kind: 'keep_open_request_changes';
+    markerBody: string;
+    verdict: VerifyOutcome;
+    /** True when triggered by UNCERTAIN+🔴 escalation. */
+    escalated: boolean;
+} | {
+    kind: 'skipped';
+    reason: 'off';
+    thread?: PriorThread;
+};
+/** Verdict shape — re-exported from resolve-verifier for ergonomics. */
+export interface VerifyOutcome {
+    verdict: 'ADDRESSED' | 'NOT_ADDRESSED' | 'UNCERTAIN';
+    rationale: string;
+    source: 'model' | 'api-error';
+}
+export interface AutoResolveInput {
+    /** Open threads from prior review passes. May be empty. */
+    priorThreads: PriorThread[];
+    /** Resolved config (after precedence merge). */
+    config: AutoResolveConfig;
+    /**
+     * Whether the caller can actually resolve threads (a dedicated PAT is
+     * present). Drives the addressed-marker wording: PAT → "Auto-resolved";
+     * no-PAT → "Verified fixed — not auto-closed". Defaults to true (the App
+     * path / unit tests, where the App token can resolve).
+     */
+    canResolve?: boolean;
+    /** Verifier callback. Tests inject a stub; CLI provides real Anthropic-call fn. */
+    verifier: (args: {
+        finding: PriorFinding;
+        codeBefore: string;
+        codeAfter: string;
+        diffAtAnchor?: string;
+    }) => Promise<VerifyOutcome>;
+}
+export interface AutoResolveResult {
+    /** One action per input thread, in input order. */
+    actions: ThreadAction[];
+    /** Total verifier calls made. */
+    verifierCallCount: number;
+    /**
+     * True when any action is `keep_open_request_changes`. The CLI verb /
+     * workflow uses this to decide whether to flip the formal review to
+     * REQUEST_CHANGES (one transition covers all flagged threads).
+     */
+    shouldRequestChanges: boolean;
+}
+/**
+ * Reads `autoResolve` from a `.clud-bug.json` payload + merges with
+ * built-in defaults. Returns a fully-resolved `AutoResolveConfig`.
+ *
+ * Unknown fields tolerated (forward compat). Invalid values fall back
+ * to the default for that key + log a warning. NEVER throws — a
+ * config-validation throw on the fix-push hot path would degrade the
+ * whole step to a fail.
+ */
+export declare function resolveAutoResolveConfig(raw: unknown, onWarn?: (msg: string) => void): AutoResolveConfig;
+/**
+ * Convenience: extracts the `autoResolve` block from a top-level
+ * `.clud-bug.json` config blob.
+ */
+export declare function readAutoResolveConfigFromCludBug(config: {
+    autoResolve?: unknown;
+} | null | undefined, onWarn?: (msg: string) => void): AutoResolveConfig;
+/**
+ * For each prior thread, call the injected verifier + apply the
+ * resolution rules. Returns one action per input thread, plus
+ * aggregate stats.
+ *
+ * The CLI verb executes the returned actions (GraphQL mutations);
+ * this function is pure modulo the verifier callback.
+ */
+export declare function runAutoResolve(input: AutoResolveInput): Promise<AutoResolveResult>;
+/**
+ * Maps a verifier verdict + the thread context to the action the CLI
+ * verb should take. Pure function, no I/O.
+ *
+ * Resolution table:
+ *   ADDRESSED, any         → resolve, "Auto-resolved (verified)"
+ *   NOT_ADDRESSED, 🔴      → keep_open_request_changes (escalated=false)
+ *   NOT_ADDRESSED, 🟡      → keep_open, "Re-review found this still applies"
+ *   UNCERTAIN, 🔴, request → keep_open_request_changes (escalated=true)
+ *   UNCERTAIN, 🔴, leave   → keep_open, "Auto-resolve uncertain — human review recommended"
+ *   UNCERTAIN, 🟡          → keep_open, "human review recommended"
+ */
+export declare function applyResolutionRules(args: {
+    thread: PriorThread;
+    verdict: VerifyOutcome;
+    config: AutoResolveConfig;
+    /** Whether the resolve mutation is available (PAT present). Defaults true. */
+    canResolve?: boolean;
+}): ThreadAction;
+type AutoResolveMarkerInput = {
+    kind: 'verified-addressed';
+    rationale?: string;
+    resolved?: boolean;
+} | {
+    kind: 'verified-not-addressed';
+    rationale?: string;
+} | {
+    kind: 'verified-uncertain';
+    rationale?: string;
+    severity: Severity;
+};
+/**
+ * Renders the comment body the CLI verb posts as a reply on the
+ * thread before resolving (or alongside keep-open). Wording mirrors
+ * the App's `renderAutoResolveMarker` so both consumers emit a
+ * uniform audit trail.
+ */
+export declare function renderAutoResolveMarker(input: AutoResolveMarkerInput): string;
+/** Which token the resolve mutation should use, and whether it's a dedicated PAT. */
+export interface ResolveAuth {
+    token: string;
+    source: 'pat' | 'gh_token';
+    hasDedicatedPat: boolean;
+}
+/**
+ * Picks the token for the `resolveReviewThread` GraphQL mutation. A dedicated
+ * fine-grained PAT (`CLUD_BUG_RESOLVE_PAT`, or the `RESOLVE_PAT` alias) is
+ * preferred — the Actions `GITHUB_TOKEN` can't resolve review threads
+ * ("Resource not accessible by integration"). With no PAT the verb keeps using
+ * `GH_TOKEN` for the other gh calls and skips the resolve mutation entirely.
+ *
+ * Empty / whitespace-only values are treated as absent — GitHub renders an
+ * unset secret as the empty string, so `CLUD_BUG_RESOLVE_PAT=''` must NOT
+ * shadow a hand-set `RESOLVE_PAT` alias.
+ */
+export declare function selectResolveAuth(env: {
+    CLUD_BUG_RESOLVE_PAT?: string;
+    RESOLVE_PAT?: string;
+    GH_TOKEN?: string;
+}): ResolveAuth;
+/** Verifier verdict, as embedded in the idempotency marker. */
+export type ResolveVerdict = 'ADDRESSED' | 'NOT_ADDRESSED' | 'UNCERTAIN';
+/**
+ * Hidden HTML-comment marker appended to each auto-resolve reply so a later
+ * fix-push can tell whether it already replied to this thread for the current
+ * (verdict, anchor) — making the reply idempotent instead of one-per-push.
+ */
+export declare function renderResolveMarkerTag(verdict: ResolveVerdict, sig: string): string;
+/** Parses the hidden marker out of a comment body. Null when absent / malformed. */
+export declare function parseResolveMarkerTag(body: string): {
+    verdict: ResolveVerdict;
+    sig: string;
+} | null;
+/**
+ * 8-hex-char signature of a finding's post-fix anchor. Stable while the anchor
+ * is unchanged, changes when `codeAfter` changes — lets the verb skip
+ * re-verifying + re-replying to a thread whose anchor hasn't moved.
+ */
+export declare function anchorSignature(finding: {
+    file?: string;
+    line?: number;
+}, codeAfter: string): string;
+/**
+ * Scans a thread's comments (oldest→newest, as GraphQL returns them) for the
+ * most-recent bot-authored reply carrying a resolve marker. Returns its
+ * `{verdict, sig}` or null. Only bot-authored comments count, so a user pasting
+ * a marker can't spoof the idempotency state.
+ */
+export declare function latestResolveMarker(comments: Array<{
+    author?: {
+        login?: string | null;
+    } | null;
+    body?: string | null;
+} | null | undefined>, botAuthors: Set<string>): {
+    verdict: ResolveVerdict;
+    sig: string;
+} | null;
+export {};
+//# sourceMappingURL=auto-resolve.d.ts.map

package/dist/core/auto-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-resolve.d.ts","sourceRoot":"","sources":["../../src/core/auto-resolve.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAMpD,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,UAAU,GAAG,KAAK,CAAC;IACzB;;;;;;OAMG;IACH,yBAAyB,EAAE,iBAAiB,GAAG,YAAY,CAAC;CAC7D;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAGzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,YAAY,CAAC;IACtB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mDAAmD;AACnD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACjE;IACE,IAAI,EAAE,2BAA2B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;CACpB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEN,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mFAAmF;IACnF,QAAQ,EAAE,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,YAAY,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,iCAAiC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GACvC,iBAAiB,CAmCnB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACpD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC7B,iBAAiB,CAGnB;AAMD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,YAAY,CAmDf;AAMD,KAAK,sBAAsB,GACvB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAuB7E;AAMD,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,WAAW,CAOd;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;AAKzE;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,SAAS,EAAE,MAAM,GAChB,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,KAAK,CACb;IAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CACvF,EACD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUjD"}

package/dist/core/auto-resolve.js

@@ -0,0 +1,293 @@
+// Wave 5b — D.2.6 auto-resolve fidelity, npm-workflow flavor.
+//
+// On every fix-push (`pull_request.synchronize`), for each open thread
+// posted by the bot on a prior pass, decide whether the new commit
+// addressed the original concern, and act accordingly:
+//
+//   ADDRESSED      → resolve the thread + post "Auto-resolved (verified)"
+//   NOT_ADDRESSED  → keep open + post "Re-review found this still applies"
+//                    + flag REQUEST_CHANGES intent if 🔴 critical
+//   UNCERTAIN + 🟡 → keep open + post "human review recommended"
+//   UNCERTAIN + 🔴 → keep open + flag REQUEST_CHANGES + escalate. NEVER dismiss.
+//
+// This module owns the pure rule tables + config merge + marker
+// rendering. The CLI verb in `src/cli/main.ts::runResolveThreads` owns
+// the IO: fetching threads via `gh api graphql`, calling Anthropic
+// Messages API for the verifier, applying these actions via REST/
+// GraphQL mutations.
+//
+// Ported from `clud-bug-app/lib/auto-resolve.ts` (and the marker
+// helpers from `clud-bug-app/lib/comment.ts`). Differences from the
+// App impl:
+//   - DROP `aggregateMultiPassVerdicts` — OSS workflow is single-pass.
+//   - DROP heuristic fallback (`heuristicAction`) — OSS supports only
+//     `mode: 'verified' | 'off'` for now; heuristic adds complexity
+//     without a customer ask. Future Wave 5c can add it back if the
+//     App migrates to consume from core.
+//   - DROP per-PR budget gate — OSS workflow uses the customer's own
+//     `ANTHROPIC_API_KEY`; spend-cap is their concern, not ours.
+import { createHash } from 'node:crypto';
+export const DEFAULT_AUTO_RESOLVE_CONFIG = {
+    mode: 'verified',
+    uncertain_critical_action: 'request_changes',
+};
+// ---------------------------------------------------------------------------
+// Config resolution
+// ---------------------------------------------------------------------------
+/**
+ * Reads `autoResolve` from a `.clud-bug.json` payload + merges with
+ * built-in defaults. Returns a fully-resolved `AutoResolveConfig`.
+ *
+ * Unknown fields tolerated (forward compat). Invalid values fall back
+ * to the default for that key + log a warning. NEVER throws — a
+ * config-validation throw on the fix-push hot path would degrade the
+ * whole step to a fail.
+ */
+export function resolveAutoResolveConfig(raw, onWarn = () => { }) {
+    const defaults = DEFAULT_AUTO_RESOLVE_CONFIG;
+    if (!raw || typeof raw !== 'object')
+        return defaults;
+    const obj = raw;
+    let mode = defaults.mode;
+    if (typeof obj.mode === 'string') {
+        if (obj.mode === 'verified' || obj.mode === 'off') {
+            mode = obj.mode;
+        }
+        else {
+            onWarn(`autoResolve.mode = ${JSON.stringify(obj.mode)} is invalid; falling back to "${defaults.mode}". Valid: verified, off.`);
+        }
+    }
+    let uncertainCritical = defaults.uncertain_critical_action;
+    if (typeof obj.uncertain_critical_action === 'string') {
+        if (obj.uncertain_critical_action === 'request_changes' ||
+            obj.uncertain_critical_action === 'leave_open') {
+            uncertainCritical = obj.uncertain_critical_action;
+        }
+        else {
+            onWarn(`autoResolve.uncertain_critical_action = ${JSON.stringify(obj.uncertain_critical_action)} is invalid; falling back to "${defaults.uncertain_critical_action}".`);
+        }
+    }
+    return {
+        mode,
+        uncertain_critical_action: uncertainCritical,
+    };
+}
+/**
+ * Convenience: extracts the `autoResolve` block from a top-level
+ * `.clud-bug.json` config blob.
+ */
+export function readAutoResolveConfigFromCludBug(config, onWarn) {
+    if (!config)
+        return DEFAULT_AUTO_RESOLVE_CONFIG;
+    return resolveAutoResolveConfig(config.autoResolve, onWarn);
+}
+// ---------------------------------------------------------------------------
+// Main entry point — pure orchestration with injected verifier
+// ---------------------------------------------------------------------------
+/**
+ * For each prior thread, call the injected verifier + apply the
+ * resolution rules. Returns one action per input thread, plus
+ * aggregate stats.
+ *
+ * The CLI verb executes the returned actions (GraphQL mutations);
+ * this function is pure modulo the verifier callback.
+ */
+export async function runAutoResolve(input) {
+    if (input.config.mode === 'off') {
+        return {
+            actions: input.priorThreads.map((thread) => ({
+                kind: 'skipped',
+                reason: 'off',
+                thread,
+            })),
+            verifierCallCount: 0,
+            shouldRequestChanges: false,
+        };
+    }
+    const actions = [];
+    let verifierCallCount = 0;
+    let shouldRequestChanges = false;
+    for (const thread of input.priorThreads) {
+        // Conditionally include `diffAtAnchor` only when present so the
+        // narrowed `verifier` callback type (which forbids `undefined`
+        // under `exactOptionalPropertyTypes`) stays satisfied.
+        const verifierArgs = {
+            finding: thread.finding,
+            codeBefore: thread.codeBefore,
+            codeAfter: thread.codeAfter,
+            ...(thread.diffAtAnchor !== undefined
+                ? { diffAtAnchor: thread.diffAtAnchor }
+                : {}),
+        };
+        const verdict = await input.verifier(verifierArgs);
+        verifierCallCount++;
+        const action = applyResolutionRules({
+            thread,
+            verdict,
+            config: input.config,
+            canResolve: input.canResolve !== false,
+        });
+        actions.push(action);
+        if (action.kind === 'keep_open_request_changes')
+            shouldRequestChanges = true;
+    }
+    return { actions, verifierCallCount, shouldRequestChanges };
+}
+// ---------------------------------------------------------------------------
+// Rule table — pure function from (verdict, finding, config) → action
+// ---------------------------------------------------------------------------
+/**
+ * Maps a verifier verdict + the thread context to the action the CLI
+ * verb should take. Pure function, no I/O.
+ *
+ * Resolution table:
+ *   ADDRESSED, any         → resolve, "Auto-resolved (verified)"
+ *   NOT_ADDRESSED, 🔴      → keep_open_request_changes (escalated=false)
+ *   NOT_ADDRESSED, 🟡      → keep_open, "Re-review found this still applies"
+ *   UNCERTAIN, 🔴, request → keep_open_request_changes (escalated=true)
+ *   UNCERTAIN, 🔴, leave   → keep_open, "Auto-resolve uncertain — human review recommended"
+ *   UNCERTAIN, 🟡          → keep_open, "human review recommended"
+ */
+export function applyResolutionRules(args) {
+    const { verdict, thread, config } = args;
+    const canResolve = args.canResolve !== false;
+    const severity = thread.finding.severity;
+    if (verdict.verdict === 'ADDRESSED') {
+        return {
+            kind: 'resolve',
+            markerBody: renderAutoResolveMarker({
+                kind: 'verified-addressed',
+                rationale: verdict.rationale,
+                resolved: canResolve,
+            }),
+            verdict,
+        };
+    }
+    if (verdict.verdict === 'NOT_ADDRESSED') {
+        const markerBody = renderAutoResolveMarker({
+            kind: 'verified-not-addressed',
+            rationale: verdict.rationale,
+        });
+        if (severity === 'critical') {
+            return {
+                kind: 'keep_open_request_changes',
+                markerBody,
+                verdict,
+                escalated: false,
+            };
+        }
+        return { kind: 'keep_open', markerBody, verdict };
+    }
+    // UNCERTAIN.
+    const markerBody = renderAutoResolveMarker({
+        kind: 'verified-uncertain',
+        rationale: verdict.rationale,
+        severity,
+    });
+    if (severity === 'critical' &&
+        config.uncertain_critical_action === 'request_changes') {
+        return {
+            kind: 'keep_open_request_changes',
+            markerBody,
+            verdict,
+            escalated: true,
+        };
+    }
+    return { kind: 'keep_open', markerBody, verdict };
+}
+/**
+ * Renders the comment body the CLI verb posts as a reply on the
+ * thread before resolving (or alongside keep-open). Wording mirrors
+ * the App's `renderAutoResolveMarker` so both consumers emit a
+ * uniform audit trail.
+ */
+export function renderAutoResolveMarker(input) {
+    const tail = input.rationale ? `: ${input.rationale.trim()}` : '.';
+    switch (input.kind) {
+        case 'verified-addressed':
+            // No PAT → we did NOT resolve the thread, so don't claim "Auto-resolved".
+            // Post an accurate "verified fixed" badge + the manual-Resolve hint.
+            if (input.resolved === false) {
+                return (`**✅ Verified fixed — not auto-closed**${tail} ` +
+                    `_The Actions \`GITHUB_TOKEN\` can't resolve review threads; click ` +
+                    `**Resolve conversation** to dismiss, or add a \`CLUD_BUG_RESOLVE_PAT\` ` +
+                    `secret to auto-close (see README)._`);
+            }
+            return `**✓ Auto-resolved (verified by D.2.6 fix-check)**${tail}`;
+        case 'verified-not-addressed':
+            return `**❌ Re-review found this still applies**${tail}`;
+        case 'verified-uncertain':
+            if (input.severity === 'critical') {
+                return `**⚠ Auto-resolve uncertain on a 🔴 critical — escalated, never silently dismissed**${tail}`;
+            }
+            return `**⚠ Auto-resolve uncertain — human review recommended**${tail}`;
+    }
+}
+/**
+ * Picks the token for the `resolveReviewThread` GraphQL mutation. A dedicated
+ * fine-grained PAT (`CLUD_BUG_RESOLVE_PAT`, or the `RESOLVE_PAT` alias) is
+ * preferred — the Actions `GITHUB_TOKEN` can't resolve review threads
+ * ("Resource not accessible by integration"). With no PAT the verb keeps using
+ * `GH_TOKEN` for the other gh calls and skips the resolve mutation entirely.
+ *
+ * Empty / whitespace-only values are treated as absent — GitHub renders an
+ * unset secret as the empty string, so `CLUD_BUG_RESOLVE_PAT=''` must NOT
+ * shadow a hand-set `RESOLVE_PAT` alias.
+ */
+export function selectResolveAuth(env) {
+    const pat = [env.CLUD_BUG_RESOLVE_PAT, env.RESOLVE_PAT]
+        .map((v) => (v ?? '').trim())
+        .find((v) => v !== '') ?? '';
+    if (pat)
+        return { token: pat, source: 'pat', hasDedicatedPat: true };
+    return { token: (env.GH_TOKEN ?? '').trim(), source: 'gh_token', hasDedicatedPat: false };
+}
+const RESOLVE_MARKER_RE = /<!--\s*clud-bug-resolve\s+v=(ADDRESSED|NOT_ADDRESSED|UNCERTAIN)\s+sig=([a-f0-9]{16})\s*-->/;
+/**
+ * Hidden HTML-comment marker appended to each auto-resolve reply so a later
+ * fix-push can tell whether it already replied to this thread for the current
+ * (verdict, anchor) — making the reply idempotent instead of one-per-push.
+ */
+export function renderResolveMarkerTag(verdict, sig) {
+    return `<!-- clud-bug-resolve v=${verdict} sig=${sig} -->`;
+}
+/** Parses the hidden marker out of a comment body. Null when absent / malformed. */
+export function parseResolveMarkerTag(body) {
+    const m = body.match(RESOLVE_MARKER_RE);
+    if (!m || m[1] === undefined || m[2] === undefined)
+        return null;
+    return { verdict: m[1], sig: m[2] };
+}
+/**
+ * 8-hex-char signature of a finding's post-fix anchor. Stable while the anchor
+ * is unchanged, changes when `codeAfter` changes — lets the verb skip
+ * re-verifying + re-replying to a thread whose anchor hasn't moved.
+ */
+export function anchorSignature(finding, codeAfter) {
+    const file = finding.file ?? '<no-file>';
+    const line = finding.line ?? 0;
+    // 16 hex chars (64-bit), matching `findingId`'s convention — wide enough
+    // that a collision can't suppress a re-review marker.
+    return createHash('sha256').update(`${file}:${line}:${codeAfter}`).digest('hex').slice(0, 16);
+}
+/**
+ * Scans a thread's comments (oldest→newest, as GraphQL returns them) for the
+ * most-recent bot-authored reply carrying a resolve marker. Returns its
+ * `{verdict, sig}` or null. Only bot-authored comments count, so a user pasting
+ * a marker can't spoof the idempotency state.
+ */
+export function latestResolveMarker(comments, botAuthors) {
+    let latest = null;
+    for (const c of comments) {
+        if (!c)
+            continue;
+        const login = c.author?.login ?? '';
+        if (!botAuthors.has(login))
+            continue;
+        const tag = parseResolveMarkerTag(c.body ?? '');
+        if (tag)
+            latest = tag;
+    }
+    return latest;
+}
+//# sourceMappingURL=auto-resolve.js.map