co-maintainer 0.5.0 → 0.5.1-beta.2

package/dist/src/ai/verify.js

@@ -1,4 +1,4 @@
-/** Pre-flight checks for `config set` (CORE-22, F35).
+/** Pre-flight checks for `config set`.
  *
  * A wrong API key or an unknown model used to be accepted by `set` and only
  * surfaced during a review, after the pull request had been fetched and
@@ -7,6 +7,8 @@
  * user's mistake, so it warns and saves instead of refusing. */
 import { CliError, EXIT_USAGE } from "../cli/error.js";
 import { getEnv } from "../util/runtime.js";
+import { openAiBase } from "./openai.js";
+import { anthropicBase, ANTHROPIC_VERSION } from "./anthropic.js";
 /** The chat endpoint the provider uses, with `/chat/completions` removed.
  * `CM_OPENROUTER_URL` points at a local fake in tests, so the base follows it
  * and the verification hits the same server the review would. */
@@ -15,11 +17,11 @@ export function openRouterBase() {
         "https://openrouter.ai/api/v1/chat/completions";
     return endpoint.replace(/\/chat\/completions\/?$/, "");
 }
-async function getJson(url, apiKey) {
+async function getJson(url, apiKey, headers) {
     let response;
     try {
         response = await fetch(url, {
-            headers: { Authorization: `Bearer ${apiKey}` },
+            headers: headers ?? { Authorization: `Bearer ${apiKey}` },
         });
     }
     catch (error) {
@@ -76,3 +78,79 @@ export async function verifyOpenRouter(apiKey, model) {
     }
     return { status: "ok" };
 }
+/** Same shape as {@link verifyOpenRouter}: `/models` both authenticates the
+ * key and, when `model` is given, confirms OpenAI actually has it. */
+export async function verifyOpenAi(apiKey, model) {
+    const base = openAiBase();
+    const models = await getJson(`${base}/models`, apiKey);
+    if ("unreachable" in models) {
+        return { status: "unreachable", reason: models.unreachable };
+    }
+    if (models.status === 401) {
+        return {
+            status: "rejected",
+            error: new CliError("openai_unauthorized", "OpenAI rejected the API key.", "Check the key at https://platform.openai.com/api-keys and pass it again.", EXIT_USAGE),
+        };
+    }
+    if (models.status >= 400) {
+        return {
+            status: "unreachable",
+            reason: `OpenAI returned ${models.status}`,
+        };
+    }
+    if (!model)
+        return { status: "ok" };
+    const rows = models.body?.data;
+    if (!Array.isArray(rows)) {
+        return { status: "unreachable", reason: "OpenAI returned no model list" };
+    }
+    if (!rows.some((row) => row?.id === model)) {
+        return {
+            status: "rejected",
+            error: new CliError("openai_unknown_model", `OpenAI does not know the model ${model}.`, "Pick one at https://platform.openai.com/docs/models and set it with co-maintainer set --high-model=...", EXIT_USAGE),
+        };
+    }
+    return { status: "ok" };
+}
+/** Anthropic authenticates the key and lists models at `/models`, but with its
+ * own headers (`x-api-key` + `anthropic-version`) instead of a Bearer token.
+ * Without a model the call only proves the key; with one it also confirms
+ * Anthropic serves it. */
+export async function verifyAnthropic(apiKey, model) {
+    const base = anthropicBase();
+    const models = await getJson(`${base}/models`, apiKey, {
+        "x-api-key": apiKey,
+        "anthropic-version": ANTHROPIC_VERSION,
+    });
+    if ("unreachable" in models) {
+        return { status: "unreachable", reason: models.unreachable };
+    }
+    if (models.status === 401 || models.status === 403) {
+        return {
+            status: "rejected",
+            error: new CliError("anthropic_unauthorized", "Anthropic rejected the API key.", "Check the key at https://console.anthropic.com/settings/keys and pass it again.", EXIT_USAGE),
+        };
+    }
+    if (models.status >= 400) {
+        return {
+            status: "unreachable",
+            reason: `Anthropic returned ${models.status}`,
+        };
+    }
+    if (!model)
+        return { status: "ok" };
+    const rows = models.body?.data;
+    if (!Array.isArray(rows)) {
+        return {
+            status: "unreachable",
+            reason: "Anthropic returned no model list",
+        };
+    }
+    if (!rows.some((row) => row?.id === model)) {
+        return {
+            status: "rejected",
+            error: new CliError("anthropic_unknown_model", `Anthropic does not know the model ${model}.`, "Pick one at https://docs.anthropic.com/en/docs/about-claude/models and set it with co-maintainer set --high-model=...", EXIT_USAGE),
+        };
+    }
+    return { status: "ok" };
+}

package/dist/src/cli/args.d.ts

@@ -1,5 +1,4 @@
 import type { Options } from "../types.ts";
-export declare const defaultLowModel = "openai/gpt-oss-120b";
-/** Plan §8.7 — `--json` must not prompt. */
+/** `--json` must not prompt. */
 export declare function setCliInteractive(value: boolean): void;
 export declare function parseArgs(args: string[]): Promise<Options>;

package/dist/src/cli/args.js

@@ -2,6 +2,7 @@ import { prepareConfig } from "../config.js";
 import { getEnv } from "../util/runtime.js";
 import { askLine } from "./prompt.js";
 import { die } from "./error.js";
+import { AI_PROVIDERS, providerKeyEnv, rejectRetiredProvider, } from "../ai/provider.js";
 import { detectRemoteRepo } from "../local/git_ops.js";
 import { reviewBlockingFrom } from "../review/blocking.js";
 import { renderCommandHelp, renderGlobalHelp, unknownCommandMessage, unknownOptionMessage, } from "./commands/registry.js";
@@ -13,10 +14,8 @@ function numberOption(value, name) {
     return number;
 }
 const commands = ["probe", "init", "sync", "remake", "review"];
-export const defaultLowModel = "openai/gpt-oss-120b";
-const defaultHighModel = "openai/gpt-5.6-luna";
 let cliInteractive = true;
-/** Plan §8.7 — `--json` must not prompt. */
+/** `--json` must not prompt. */
 export function setCliInteractive(value) {
     cliInteractive = value;
 }
@@ -24,10 +23,10 @@ async function ask(label, fallback, required = false) {
     if (!cliInteractive) {
         if (fallback !== undefined && fallback !== "")
             return fallback;
-        die(`Missing ${label}; pass it as a CLI option when running without an interactive terminal`);
+        die(`Missing ${label}. Pass it as a CLI option when running without an interactive terminal`);
     }
     if (process.stdin.isTTY !== true) {
-        die(`Missing ${label}; pass it as a CLI option when running without an interactive terminal`);
+        die(`Missing ${label}. Pass it as a CLI option when running without an interactive terminal`);
     }
     const value = await askLine(label, fallback);
     if (required && !value)
@@ -57,7 +56,7 @@ export async function parseArgs(args) {
         process.exit(0);
     }
     // `probe` (and only probe, for now) may omit the repo and let the current
-    // directory's git remote name it (CORE-24).
+    // directory's git remote name it.
     let repoName = repo;
     if ((!repoName || repoName.startsWith("-")) && command === "probe") {
         repoName = await detectRemoteRepo(process.cwd());
@@ -168,9 +167,10 @@ export async function parseArgs(args) {
     }
     const explicitAi = rest.some((arg) => arg.startsWith("--ai="));
     const configuredAiRaw = env("CO_MAINTAINER_AI") ?? repoConfig.ai ?? config.ai;
+    rejectRetiredProvider(configuredAiRaw);
     if (configuredAiRaw &&
-        !["none", "openrouter", "hetzner"].includes(configuredAiRaw)) {
-        die("CO_MAINTAINER_AI/config.ai must be none, openrouter, or hetzner");
+        !AI_PROVIDERS.includes(configuredAiRaw)) {
+        die(`CO_MAINTAINER_AI/config.ai must be one of: ${AI_PROVIDERS.join(", ")}`);
     }
     const configuredAi = configuredAiRaw;
     const configuredAuthRaw = env("CO_MAINTAINER_AUTH") ?? repoConfig.auth ?? config.auth;
@@ -187,46 +187,58 @@ export async function parseArgs(args) {
         die("--auth=pat requires a GitHub token. Pass --github-pat=..., set GITHUB_TOKEN/GH_TOKEN, " +
             "or run: co-maintainer set --github-pat=...");
     }
-    let ai = choice("ai", ["none", "openrouter", "hetzner"], configuredAi ?? "none");
+    rejectRetiredProvider(text("ai"));
+    let ai = choice("ai", AI_PROVIDERS, configuredAi ?? "none");
     if (command === "review") {
-        if (explicitAi &&
-            choice("ai", ["none", "openrouter", "hetzner"], "none") !== "openrouter") {
-            die("review supports OpenRouter only");
+        // Review was pinned to OpenRouter only so Hetzner never wrote one. Hetzner
+        // is gone, so review follows the configured provider. With none set it
+        // stays on OpenRouter, which every review before this one used.
+        if (ai === "none") {
+            if (explicitAi) {
+                die(`review needs an AI provider. Pass --ai=${AI_PROVIDERS.filter((p) => p !== "none").join("|")}`);
+            }
+            ai = "openrouter";
         }
-        ai = "openrouter";
     }
     else if (!explicitAi && !configuredAi && command !== "probe") {
-        const selected = await ask("AI provider (openrouter|hetzner)", "openrouter");
-        if (!["openrouter", "hetzner"].includes(selected)) {
-            die("AI provider must be openrouter or hetzner");
+        const selected = await ask(`AI provider (${AI_PROVIDERS.join("|")})`, "openrouter");
+        rejectRetiredProvider(selected);
+        if (!AI_PROVIDERS.includes(selected)) {
+            die(`AI provider must be one of: ${AI_PROVIDERS.join(", ")}`);
         }
         ai = selected;
     }
     let aiToken = text("token") ??
         env("CO_MAINTAINER_TOKEN") ??
-        (ai === "openrouter" ? env("OPENROUTER_API_KEY") : undefined) ??
-        (ai === "hetzner" ? env("HETZNER_API_KEY") : undefined) ??
+        providerKeyEnv(ai, env) ??
         config.token;
+    // The OPENROUTER_ names would hand an OpenRouter model id to another
+    // provider, so they only count when OpenRouter is the one running.
+    const openRouterModelEnv = (name) => ai === "openrouter" ? env(name) : undefined;
     let lowModel = text("low-model") ??
-        env("OPENROUTER_LOW_MODEL") ??
-        env("HETZNER_LOW_MODEL") ??
+        openRouterModelEnv("OPENROUTER_LOW_MODEL") ??
         env("LOW_MODEL") ??
         repoConfig.lowModel ??
         config.lowModel;
     let highModel = text("high-model") ??
-        env("OPENROUTER_HIGH_MODEL") ??
-        env("HETZNER_HIGH_MODEL") ??
+        openRouterModelEnv("OPENROUTER_HIGH_MODEL") ??
         env("HIGH_MODEL") ??
         repoConfig.highModel ??
         config.highModel;
     if (command === "review") {
-        aiToken ??= await ask("openrouter API key", undefined, true);
-        highModel ??= await ask("high model", defaultHighModel, true);
+        aiToken ??= await ask(`${ai} API key`, undefined, true);
+        // Review summarizes large files with the low model, so it needs one just
+        // as init and sync do. Without a default to fall back on, ask here too.
+        lowModel ??= await ask("low model", undefined, true);
+        highModel ??= await ask("high model", undefined, true);
     }
     else if (ai !== "none" && command !== "probe") {
+        // No house pick for any provider: models go stale and a shipped build
+        // cannot fetch a fresher one, so the model to use is the user's call,
+        // set once in config or passed every time (Murat, 2026-09-28).
         aiToken ??= await ask(`${ai} API key`, undefined, true);
-        lowModel ??= await ask("low model", defaultLowModel, true);
-        highModel ??= await ask("high model", defaultHighModel, true);
+        lowModel ??= await ask("low model", undefined, true);
+        highModel ??= await ask("high model", undefined, true);
     }
     if (command !== "review" &&
         ai !== "none" &&

package/dist/src/cli/commands/config.d.ts

@@ -37,7 +37,7 @@ export declare function resolveField(name: string): string;
  * `defaults` are nested maps, not settings, so they are not listed.
  * `satisfies` makes this the type's own vocabulary: a name that is not a
  * `UserConfig` key is a compile error rather than a silently undefined read. */
-export declare const KNOWN_FIELDS: readonly ["auth", "ai", "lowModel", "highModel", "token", "githubPat", "githubAppId", "githubAppPrivateKey", "githubAppPrivateKeyPath", "githubWebhookSecret", "webhookUrl", "githubOAuthClientId", "githubOAuthClientSecret", "githubOAuthAllowedUser", "passwordAuthDisabled", "githubAuthEnabled", "dashboardPasswordHash", "maxConcurrentJobs", "reviewBlocking", "remoteHost", "remoteToken", "remoteNoticeShownFor", "remoteSyncTimeoutSeconds", "maxConcurrentRemoteReviewsPerToken", "remoteToolOutputMaxChars"];
+export declare const KNOWN_FIELDS: readonly ["auth", "ai", "lowModel", "highModel", "token", "githubPat", "githubAppId", "githubAppPrivateKey", "githubAppPrivateKeyPath", "githubWebhookSecret", "webhookUrl", "githubOAuthClientId", "githubOAuthClientSecret", "githubOAuthAllowedUser", "passwordAuthDisabled", "githubAuthEnabled", "dashboardPasswordHash", "maxConcurrentJobs", "reviewBlocking", "remoteHost", "remoteToken", "remoteNoticeShownFor", "remoteSyncTimeoutSeconds", "maxConcurrentRemoteReviewsPerToken", "remoteToolOutputMaxChars", "remoteByok", "remoteByokDefault", "reviewPolicy"];
 /** `co-maintainer config <sub> ...`. `set` is handled by runSet, which this
  * command delegates to so there is one implementation of the write rules. */
 export declare function runConfig(args: string[]): Promise<void>;

package/dist/src/cli/commands/config.js

@@ -1,5 +1,5 @@
 /** The `config` command: read and edit the user config without opening the
- * file (CORE-22, F12). `set` is `config set` under its own name, so both share
+ * file. `set` is `config set` under its own name, so both share
  * the mapping and masking here.
  *
  * The key list is derived from `UserConfig` at runtime where possible: a
@@ -18,6 +18,7 @@ export const SECRET_FIELDS = new Set([
     "githubOAuthClientSecret",
     "remoteToken",
     "dashboardPasswordHash",
+    "remoteByok",
 ]);
 /** `lowModel` -> `low-model`. The inverse of {@link configKey}. */
 export function flagName(field) {
@@ -38,13 +39,15 @@ export function maskSecret(value) {
 /** The env var that supplies each field, mirroring args.ts. Only the fields
  * that actually read env are listed. */
 export const ENV_BY_FIELD = {
-    token: ["CO_MAINTAINER_TOKEN", "OPENROUTER_API_KEY", "HETZNER_API_KEY"],
+    token: ["CO_MAINTAINER_TOKEN", "OPENROUTER_API_KEY", "OPENCODE_API_KEY"],
     githubPat: ["GITHUB_TOKEN", "GH_TOKEN"],
     ai: ["CO_MAINTAINER_AI"],
     auth: ["CO_MAINTAINER_AUTH"],
-    lowModel: ["OPENROUTER_LOW_MODEL", "HETZNER_LOW_MODEL", "LOW_MODEL"],
-    highModel: ["OPENROUTER_HIGH_MODEL", "HETZNER_HIGH_MODEL", "HIGH_MODEL"],
+    lowModel: ["OPENROUTER_LOW_MODEL", "LOW_MODEL"],
+    highModel: ["OPENROUTER_HIGH_MODEL", "HIGH_MODEL"],
     webhookUrl: ["CM_WEBHOOK_URL"],
+    remoteHost: ["CM_REMOTE_HOST"],
+    remoteToken: ["CM_REMOTE_TOKEN"],
     reviewBlocking: ["CO_MAINTAINER_REVIEW_BLOCKING"],
 };
 /** Renders one field for people. A secret is masked; the password hash, which
@@ -151,6 +154,9 @@ export const KNOWN_FIELDS = [
     "remoteSyncTimeoutSeconds",
     "maxConcurrentRemoteReviewsPerToken",
     "remoteToolOutputMaxChars",
+    "remoteByok",
+    "remoteByokDefault",
+    "reviewPolicy",
 ];
 /** `co-maintainer config <sub> ...`. `set` is handled by runSet, which this
  * command delegates to so there is one implementation of the write rules. */

package/dist/src/cli/commands/probe.js

@@ -1,7 +1,7 @@
 import { clientFor, runInitOrRemake } from "../../services/setup.js";
 import { probePlan } from "../../services/probe.js";
 import { log, startHeartbeat } from "../../util/log.js";
-import { estimateInit, readJobHistory } from "../../ai/estimate.js";
+import { estimateCostLine, estimateInit, readJobHistory, } from "../../ai/estimate.js";
 import { loadPrices } from "../../ai/pricing.js";
 import { cacheSet } from "../../store/cache_db.js";
 export async function runProbe(options) {
@@ -25,7 +25,7 @@ export async function runProbe(options) {
     for (const reason of analysis.reasons)
         console.log(`  - ${reason}`);
     // The estimate is separate from the recommendation: the flags say what to
-    // read, this says what that costs in time and dollars (CORE-24). Prices are
+    // read, this says what that costs in time and dollars. Prices are
     // only fetched when an OpenRouter model would actually be billed, so a
     // plain `--ai=none` probe makes no network call.
     const needsPrices = options.ai === "openrouter" &&
@@ -50,15 +50,7 @@ export async function runProbe(options) {
     console.log(`  AI jobs: ${estimate.extract} extract + ${estimate.synth} synth`);
     console.log(`  tokens: ${range(estimate.tokensIn)} in · ${range(estimate.tokensOut)} out`);
     console.log(`  time: ${secondsRange(estimate.seconds)}s`);
-    if (estimate.usd) {
-        console.log(`  cost: $${estimate.usd[0].toFixed(4)}-$${estimate.usd[1].toFixed(4)}`);
-    }
-    else if (needsPrices && prices.source === "unavailable") {
-        console.log("  cost: unknown (could not read OpenRouter prices)");
-    }
-    else {
-        console.log("  cost: set --ai=openrouter with both models to estimate dollars");
-    }
+    console.log(`  cost: ${estimateCostLine(estimate, options.ai, needsPrices && prices.source === "unavailable")}`);
     console.log(`  basis: ${estimate.basis === "history"
         ? "this repository's recorded jobs"
         : "the cm-dx-lab calibration"}; an estimate, not a bill`);

package/dist/src/cli/commands/registry.d.ts

@@ -1,11 +1,3 @@
-/** The command registry (CORE-20).
- *
- * One place that knows every command, its aliases, its usage lines, its flags
- * and its examples. Everything the user reads as help is rendered from here,
- * so a flag cannot drift out of the help and a command cannot be documented
- * twice with different wording. It is also the source CORE-81 will export to
- * the command reference, which is why it is data rather than template strings.
- */
 export type FlagSpec = {
     /** Without the leading dashes, e.g. `include-codebase`. */
     name: string;
@@ -57,6 +49,6 @@ export declare function unknownOptionMessage(input: string, command?: string): s
 export declare function renderGlobalHelp(): string;
 /** One command's help: usage, flags grouped, examples, docs link. */
 export declare function renderCommandHelp(name: string): string | undefined;
-/** The registry as markdown, so CORE-81 can build the command reference from
+/** The registry as markdown, so the command reference can be built from
  * the same data the runtime help uses. */
 export declare function registryToMarkdown(): string;

package/dist/src/cli/commands/registry.js

@@ -1,11 +1,12 @@
-/** The command registry (CORE-20).
+/** The command registry.
  *
  * One place that knows every command, its aliases, its usage lines, its flags
  * and its examples. Everything the user reads as help is rendered from here,
  * so a flag cannot drift out of the help and a command cannot be documented
- * twice with different wording. It is also the source CORE-81 will export to
- * the command reference, which is why it is data rather than template strings.
+ * twice with different wording. It is also the source the command reference is
+ * generated from, which is why it is data rather than template strings.
  */
+import { AI_PROVIDERS } from "../../ai/provider.js";
 const OUTPUT_FLAGS = {
     title: "Output and diagnostics",
     flags: [
@@ -17,12 +18,24 @@ const OUTPUT_FLAGS = {
         { name: "log-time", description: "Print how long each phase took." },
     ],
 };
+/** `review` alone can print for a CI run. */
+const REVIEW_OUTPUT_FLAGS = {
+    title: OUTPUT_FLAGS.title,
+    flags: [
+        ...OUTPUT_FLAGS.flags,
+        {
+            name: "output",
+            value: "github",
+            description: "Print GitHub workflow annotations and write the job summary instead of prose. Cannot be used with --json.",
+        },
+    ],
+};
 const AI_FLAGS = {
     title: "AI",
     flags: [
         {
             name: "ai",
-            value: "none|openrouter|hetzner",
+            value: AI_PROVIDERS.join("|"),
             default: "none",
             description: "Which provider writes the review.",
         },
@@ -35,13 +48,11 @@ const AI_FLAGS = {
         {
             name: "low-model",
             value: "ID",
-            default: "openai/gpt-oss-120b",
             description: "Model for extraction work.",
         },
         {
             name: "high-model",
             value: "ID",
-            default: "openai/gpt-5.6-luna",
             description: "Model for the review itself.",
         },
     ],
@@ -210,7 +221,7 @@ export const COMMANDS = [
     {
         name: "sync",
         // `remake` is the 0.4.13 spelling. It still runs the same handler but is
-        // not advertised, so nothing the user reads says "remake" (CORE-21).
+        // not advertised, so nothing the user reads says "remake".
         aliases: ["remake"],
         summary: "Rebuild the review guides for a repository that already has them.",
         usage: ["co-maintainer sync owner/repo [options]"],
@@ -317,6 +328,14 @@ export const COMMANDS = [
                         value: "TOKEN",
                         description: "Override the configured remote token for this run (needs --remote).",
                     },
+                    {
+                        name: "remote-byok",
+                        description: "Send your own AI key with a remote review (needs --remote).",
+                    },
+                    {
+                        name: "no-remote-byok",
+                        description: "Do not send your own AI key, even if remote-byok-default is on.",
+                    },
                     {
                         name: "sync-before-review",
                         description: "Rebuild the guides before reviewing.",
@@ -338,13 +357,15 @@ export const COMMANDS = [
             },
             AI_FLAGS,
             GITHUB_FLAGS,
-            OUTPUT_FLAGS,
+            REVIEW_OUTPUT_FLAGS,
         ],
         examples: [
             "co-maintainer review owner/repo 42 --json",
             "co-maintainer review --json --disable-codegraph",
             "co-maintainer review --remote --json",
             "co-maintainer review --remote --remote-host=https://review.example.com --remote-token=cmr_...",
+            "co-maintainer review --remote --remote-byok --json",
+            "co-maintainer review --remote --output=github",
         ],
     },
     {
@@ -469,6 +490,33 @@ export const COMMANDS = [
                         value: "TOKEN",
                         description: "The remote review token.",
                     },
+                    {
+                        name: "remote-byok-policy",
+                        value: "off|allow|require",
+                        default: "off",
+                        description: "Whether a remote client may send its own AI key.",
+                    },
+                    {
+                        name: "remote-byok",
+                        value: "KEY",
+                        description: "Your own AI key to send with a remote review.",
+                    },
+                    {
+                        name: "remote-byok-default",
+                        value: "on|off",
+                        default: "off",
+                        description: "Send remote-byok on every --remote review by default.",
+                    },
+                    {
+                        name: "review-policy",
+                        value: "everyone|trusted-auto|on-request-only",
+                        description: "The review policy new repositories start with.",
+                    },
+                    {
+                        name: "review-policy-file",
+                        value: "PATH",
+                        description: "Read a custom review policy from a JSON file and use it as that default.",
+                    },
                     {
                         name: "review-blocking",
                         value: "model|severity",
@@ -492,7 +540,7 @@ export const COMMANDS = [
                     },
                     {
                         name: "no-verify",
-                        description: "Do not check the key and model against OpenRouter.",
+                        description: "Do not check the key and model against the provider.",
                     },
                     {
                         name: "unset",
@@ -555,6 +603,23 @@ export const COMMANDS = [
         ],
         examples: ["co-maintainer serve --port=5000"],
     },
+    {
+        name: "rollback",
+        summary: "Go back to the version before the last upgrade, restoring its data.",
+        usage: ["co-maintainer rollback [--yes]"],
+        groups: [
+            {
+                title: "Rollback",
+                flags: [
+                    {
+                        name: "yes",
+                        description: "Skip the confirmation. Needed when there is no terminal.",
+                    },
+                ],
+            },
+        ],
+        examples: ["co-maintainer rollback", "co-maintainer rollback --yes"],
+    },
     {
         name: "version",
         summary: "Print the version.",
@@ -692,7 +757,7 @@ export function renderCommandHelp(name) {
 function cell(text) {
     return text.replace(/\|/g, "\\|");
 }
-/** The registry as markdown, so CORE-81 can build the command reference from
+/** The registry as markdown, so the command reference can be built from
  * the same data the runtime help uses. */
 export function registryToMarkdown() {
     const lines = [];

package/dist/src/cli/commands/review.js

@@ -1,6 +1,8 @@
 import { parseReviewArgs } from "../review_args.js";
 import { setCliInteractive } from "../args.js";
-import { emptyAiMetrics, recordAiCost } from "../../services/setup.js";
+import { addAiMetrics, emptyAiMetrics, recordAiCost, } from "../../services/setup.js";
+import { costUsage } from "../../util/cost.js";
+import { costLabel } from "../../util/run_summary.js";
 import { reviewPullRequest } from "../../pr/reviewer.js";
 import { GhClient } from "../../github/gh.js";
 import { log, startHeartbeat, timed, withCliLogsToStderr, } from "../../util/log.js";
@@ -11,6 +13,7 @@ import { buildPrReviewJson, resolvedFromFirstReview, reviewExitCodeFromResolved,
 import { parseFindings } from "../../pr/findings.js";
 import { exitWith } from "../error.js";
 import { printRunSummary, summaryFromMetrics } from "../../util/run_summary.js";
+import { emitGithubOutput } from "../review_github.js";
 import { formatHumanReview, humanFindingsFromResolved, } from "../review_result.js";
 export async function runReviewFromCli(args) {
     const parsed = await parseReviewArgs(args);
@@ -27,6 +30,7 @@ export async function runReviewFromCli(args) {
 export async function runReview(options) {
     await runReviewPr(options, {
         json: false,
+        output: undefined,
         disableCodegraph: false,
         allowToolInstall: false,
         remakeBeforeReview: false,
@@ -44,24 +48,18 @@ async function runReviewPr(options, cli) {
             }
             log("review", `reading PR #${options.prNumber} in ${options.repo} via gh`);
             const result = await timed("review GitHub collection and AI", options.logTime, () => reviewPullRequest(new GhClient(options.debug), options, async (response) => {
-                aiMetrics.calls++;
-                aiMetrics.tokensIn += response.tokensIn;
-                aiMetrics.tokensOut += response.tokensOut;
-                if (response.cost === undefined)
-                    aiMetrics.costKnown = false;
-                else
-                    aiMetrics.cost += response.cost;
+                addAiMetrics(aiMetrics, response);
                 await recordAiCost(options.repo, "review_pull_request", response);
             }));
             const durationMs = Math.round(performance.now() - operationStarted);
             const usage = {
                 tokensIn: aiMetrics.tokensIn,
                 tokensOut: aiMetrics.tokensOut,
-                costUsd: aiMetrics.costKnown ? aiMetrics.cost : null,
+                ...costUsage(aiMetrics),
             };
             // The engine reports the codegraph state it actually reached, instead of
             // the old `useCodegraph ? "used" : "disabled"` that claimed "used" while
-            // stderr said codegraph was missing (CORE-43 / F23).
+            // stderr said codegraph was missing.
             const codegraphState = result.codegraphState;
             const resolved = resolvedFromFirstReview(parseFindings(result.text), new Map());
             if (cli.json) {
@@ -77,8 +75,15 @@ async function runReviewPr(options, cli) {
                     reviewBlocking: options.reviewBlocking,
                 }));
             }
+            else if (cli.output === "github") {
+                emitGithubOutput({
+                    title: `${options.repo} · PR #${options.prNumber}`,
+                    findings: humanFindingsFromResolved(resolved, options.reviewBlocking),
+                    run: summaryFromMetrics(aiMetrics, performance.now() - operationStarted),
+                });
+            }
             else {
-                // One presentation layer for local, PR and remote reviews (CORE-43).
+                // One presentation layer for local, PR and remote reviews.
                 console.log("\n" +
                     formatHumanReview({
                         title: `co-maintainer review · ${options.repo} · PR #${options.prNumber}`,
@@ -89,7 +94,7 @@ async function runReviewPr(options, cli) {
                     "\n");
                 printRunSummary(summaryFromMetrics(aiMetrics, performance.now() - operationStarted));
                 if (options.logTime) {
-                    log("time", `AI total · calls=${aiMetrics.calls} · input=${aiMetrics.tokensIn} tokens · output=${aiMetrics.tokensOut} tokens · cost=${aiMetrics.costKnown ? aiMetrics.cost.toFixed(4) : "unknown"}`);
+                    log("time", `AI total · calls=${aiMetrics.calls} · input=${aiMetrics.tokensIn} tokens · output=${aiMetrics.tokensOut} tokens · cost=${costLabel(aiMetrics)}`);
                     console.error(`[time] total review · ${((performance.now() - operationStarted) / 1000).toFixed(2)}s`);
                 }
             }
@@ -100,7 +105,7 @@ async function runReviewPr(options, cli) {
         finally {
             // A heartbeat left running on the error path keeps the event loop alive
             // forever, so the process would never drain and the exit code would never
-            // be applied. CORE-11.
+            // be applied.
             stopHeartbeat();
         }
     });

package/dist/src/cli/commands/rollback.d.ts

@@ -0,0 +1 @@
+export declare function runRollback(args: string[]): Promise<void>;