codetrellis 0.0.0-stage → 0.3.0

package/src/cli/plan-verbs.js

@@ -0,0 +1,259 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var plan_verbs_exports = {};
+__export(plan_verbs_exports, {
+  PLAN_VERBS: () => PLAN_VERBS,
+  ownChanges: () => ownChanges,
+  runPlanVerb: () => runPlanVerb
+});
+module.exports = __toCommonJS(plan_verbs_exports);
+var import_node_child_process = require("node:child_process");
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_args = require("./args");
+var import_conformity = require("./conformity");
+var import_verbs = require("./verbs");
+const PLAN_VERBS = /* @__PURE__ */ new Set(["plan", "commit", "status"]);
+const asObj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function answer(a, ctx, words) {
+  if (a.isError) return { out: a.text, code: 1 };
+  if (ctx.json) return { out: a.json !== null ? JSON.stringify(a.json) : JSON.stringify({ text: a.text }), code: 0 };
+  return { out: a.json !== null ? words(asObj(a.json)) : a.text, code: 0 };
+}
+async function plans(ctx) {
+  const a = await ctx.agent.call("list_plans", { project_path: ctx.root, limit: 100 });
+  return asObj(a.json).plans ?? [];
+}
+async function planOf(ctx) {
+  const named = (0, import_args.flag)(ctx.p, "plan");
+  if (named) return named;
+  const open = (await plans(ctx)).filter((pl) => pl.status !== "archived" && pl.status !== "done");
+  if (open.length === 1) return open[0].uid;
+  if (open.length === 0) throw new import_verbs.UsageError(`No plan in ${ctx.root}. Name one with --plan <uid>.`);
+  throw new import_verbs.UsageError(`Several plans in this project; name one with --plan:
+${open.map((pl) => `  ${pl.uid}  ${pl.title}`).join("\n")}`);
+}
+async function taskOf(ctx, ref, what = "task") {
+  if (!ref) throw new import_verbs.UsageError(`Which ${what}? Give its uid, or the first characters of it.`);
+  const want = ref.replace(/^task\s+/i, "").trim().toLowerCase();
+  if (UUID.test(want)) return want;
+  if (!/^[0-9a-f-]{6,}$/.test(want)) throw new import_verbs.UsageError(`"${ref}" is not a uid or the start of one.`);
+  const found = [];
+  for (const pl of await plans(ctx)) {
+    const a = await ctx.agent.call("list_items", { plan_uid: pl.uid, limit: 500 });
+    for (const it of asObj(a.json).items ?? []) {
+      if (it.uid.toLowerCase().startsWith(want)) found.push(it);
+    }
+  }
+  if (found.length === 1) return found[0].uid;
+  if (found.length === 0) throw new import_verbs.UsageError(`No ${what} starting "${want}" in this project's plans.`);
+  throw new import_verbs.UsageError(`"${want}" names ${found.length} items; give more of the uid:
+${found.map((t) => `  ${t.uid}  ${t.title}`).join("\n")}`);
+}
+async function planShow(ctx) {
+  const a = await ctx.agent.call("get_plan", { plan_uid: await planOf(ctx) });
+  return answer(a, ctx, (j) => {
+    const plan = asObj(j.plan ?? j);
+    const state = asObj(j.state);
+    const lines = [`${String(plan.title ?? "Plan")} (${String(plan.uid ?? "")})${state.progress ? ` \u2014 ${state.progress}` : ""}`];
+    for (const it of state.items ?? []) {
+      if (it.kind !== "action") continue;
+      const by = it.recorded_in ? `, recorded by ${it.recorded_by} in ${it.recorded_in}` : "";
+      lines.push(`  ${it.item_uid.slice(0, 8)}  ${it.title} \u2014 ${it.says}${by}${it.set_at_once ? ` \u26A0 ${it.set_at_once}` : ""}`);
+    }
+    return lines.join("\n");
+  });
+}
+async function planAdd(ctx, title) {
+  if (!title) throw new import_verbs.UsageError("Give the new task a title: codetrellis plan add <title\u2026>");
+  const under = (0, import_args.flag)(ctx.p, "under");
+  const body = (0, import_args.flag)(ctx.p, "body");
+  const a = await ctx.agent.call("add_item", {
+    plan_uid: await planOf(ctx),
+    kind: ctx.p.flags.page ? "object" : "action",
+    title,
+    ...under ? { parent_uid: await taskOf(ctx, under, "parent") } : {},
+    ...body ? { body } : {}
+  });
+  return answer(a, ctx, (j) => {
+    const it = asObj(j.item ?? j);
+    return `Added ${ctx.p.flags.page ? "page" : "task"} "${String(it.title ?? title)}" (${String(it.uid ?? "?")}).`;
+  });
+}
+async function planEdit(ctx, ref) {
+  const uid = await taskOf(ctx, ref);
+  const title = (0, import_args.flag)(ctx.p, "title");
+  const body = (0, import_args.flag)(ctx.p, "body");
+  if (title === void 0 && body === void 0) throw new import_verbs.UsageError("Say what to change: --title <text>, --body <text>, or both.");
+  const a = await ctx.agent.call("update_item", { uid, ...title !== void 0 ? { title } : {}, ...body !== void 0 ? { body } : {} });
+  return answer(a, ctx, (j) => `Changed "${String(asObj(j.item ?? j).title ?? title ?? uid)}".`);
+}
+async function planMove(ctx, ref) {
+  const uid = await taskOf(ctx, ref);
+  const under = (0, import_args.flag)(ctx.p, "under");
+  if (!under && !ctx.p.flags.top) throw new import_verbs.UsageError("Say where: --under <task>, or --top.");
+  const pos = (0, import_args.flag)(ctx.p, "position");
+  if (pos !== void 0 && !/^\d+$/.test(pos)) throw new import_verbs.UsageError("--position takes a whole number.");
+  const a = await ctx.agent.call("move_item", {
+    uid,
+    new_parent_uid: under ? await taskOf(ctx, under, "parent") : "",
+    ...pos !== void 0 ? { new_sort_order: Number(pos) } : {}
+  });
+  return answer(a, ctx, () => `Moved ${uid.slice(0, 8)} ${under ? `under ${under}` : "to the top level"}.`);
+}
+function ownChanges(root) {
+  const out = (0, import_node_child_process.execFileSync)("git", ["-C", root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".codetrellis"], { encoding: "utf8" });
+  const paths = [];
+  const parts = out.split("\0").filter(Boolean);
+  for (let i = 0; i < parts.length; i++) {
+    const entry = parts[i];
+    const status2 = entry.slice(0, 2);
+    const file = entry.slice(3);
+    if (status2.startsWith("R") || status2.startsWith("C")) {
+      paths.push(file);
+      paths.push(parts[++i]);
+      continue;
+    }
+    paths.push(file);
+  }
+  return [...new Set(paths)].filter((p) => p === ".codetrellis" || p.startsWith(".codetrellis/"));
+}
+async function tasksTouched(ctx, files) {
+  const titles = /* @__PURE__ */ new Set();
+  const uids = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    const rec = /^\.codetrellis\/(?:records|reads)\/[^/]+\/([0-9a-f-]{36})\//i.exec(f);
+    if (rec) {
+      uids.add(rec[1]);
+      continue;
+    }
+    if (/\/items\/.+\.ya?ml$/.test(f)) {
+      try {
+        const text = import_node_fs.default.readFileSync(import_node_path.default.join(ctx.root, f), "utf8");
+        const m = /^title:\s*(.+)$/m.exec(text);
+        if (m) titles.add(m[1].replace(/^['"]|['"]$/g, "").trim());
+      } catch {
+      }
+    }
+  }
+  for (const uid of uids) {
+    const a = await ctx.agent.call("get_item", { uid });
+    const t = asObj(asObj(a.json).item ?? a.json).title;
+    if (typeof t === "string") titles.add(t);
+  }
+  return [...titles].sort();
+}
+async function commit(ctx) {
+  const files = ownChanges(ctx.root);
+  if (files.length === 0) return { out: ctx.json ? JSON.stringify({ committed: false, files: [] }) : "Nothing of CodeTrellis's to commit.", code: 0 };
+  const tasks = await tasksTouched(ctx, files);
+  const listed = tasks.length <= 3 ? tasks.join(", ") : `${tasks.slice(0, 3).join(", ")} and ${tasks.length - 3} more`;
+  const subject = (0, import_args.flag)(ctx.p, "m") ?? (0, import_args.flag)(ctx.p, "message") ?? (tasks.length ? `Update the plan: ${listed}` : "Update the plan");
+  const body = tasks.length ? [`Tasks: ${tasks.join("; ")}.`, `CodeTrellis's own files only (${files.length}).`] : [`CodeTrellis's own files only (${files.length}).`];
+  const a = await ctx.agent.call("commit_manifest_changes", {
+    project_root: ctx.root,
+    subject: subject.slice(0, 72),
+    paths: files,
+    body,
+    agent: { agent_type: ctx.agent.name }
+  });
+  if (a.isError) return { out: a.text, code: 1 };
+  const sha = String(asObj(a.json).sha ?? "").slice(0, 7) || /([0-9a-f]{7,40})/.exec(a.text)?.[1]?.slice(0, 7) || "";
+  if (ctx.json) return { out: JSON.stringify({ committed: true, sha, subject, files, tasks }), code: 0 };
+  return { out: `Committed ${files.length} CodeTrellis file${files.length === 1 ? "" : "s"}${sha ? ` as ${sha}` : ""}: ${subject}`, code: 0 };
+}
+async function status(ctx) {
+  const named = (0, import_args.flag)(ctx.p, "plan");
+  const list = named ? [{ uid: named, title: "", status: "" }] : (await plans(ctx)).filter((pl) => pl.status !== "archived");
+  const out = [];
+  for (const pl of list) {
+    const g2 = await ctx.agent.call("get_plan", { plan_uid: pl.uid });
+    if (g2.isError) continue;
+    const j = asObj(g2.json);
+    const state = asObj(j.state);
+    const items = state.items ?? [];
+    const asks = await ctx.agent.call("list_channel_events", { plan_uid: pl.uid, event_types: ["need-decision", "need-context", "stuck"], status: ["open"] });
+    const events = Array.isArray(asks.json) ? asks.json : asObj(asks.json).events ?? [];
+    out.push({
+      uid: pl.uid,
+      title: String(asObj(j.plan ?? j).title ?? pl.title),
+      progress: state.progress ?? null,
+      inProgress: (state.in_progress ?? []).map((w) => ({ uid: w.item_uid, title: w.title, says: w.says })),
+      blocked: items.filter((i) => i.state === "blocked").map((i) => ({ uid: i.item_uid, title: i.title, says: i.says })),
+      waitingOnPerson: events.map((e) => ({
+        uid: String(e.uid),
+        question: String(asObj(e.payload).message ?? e.message ?? ""),
+        item: e.itemUid ?? e.item_uid ?? null
+      }))
+    });
+  }
+  let changed;
+  try {
+    changed = (0, import_conformity.changedFiles)(ctx.root, (0, import_args.flag)(ctx.p, "base"), process.env);
+  } catch (err) {
+    throw new import_verbs.UsageError(err.message);
+  }
+  const g = await (0, import_conformity.gate)(ctx.agent, ctx.root, changed, ctx.p.flags.strict === true, { suite: (0, import_args.flag)(ctx.p, "suite"), rule: (0, import_args.flag)(ctx.p, "rule"), path: (0, import_args.flag)(ctx.p, "path"), tag: (0, import_args.flag)(ctx.p, "tag") });
+  const code = "error" in g ? 1 : g.ok ? 0 : 3;
+  if (ctx.json) return { out: JSON.stringify({ project: ctx.root, plans: out, conformity: g }), code };
+  const lines = [];
+  if (out.length === 0) lines.push(`No plan in ${ctx.root}.`);
+  for (const s of out) {
+    lines.push(`${s.title}${s.progress ? ` \u2014 ${s.progress}` : ""}`);
+    for (const w of s.inProgress) lines.push(`  \u25B6 ${w.title}: ${w.says}`);
+    for (const b of s.blocked) lines.push(`  \u25A0 ${b.title}: ${b.says}`);
+    for (const q of s.waitingOnPerson) lines.push(`  ? ${q.question}`);
+  }
+  lines.push("", "error" in g ? `Could not check conformity: ${g.error}` : (0, import_conformity.gateWords)(g));
+  return { out: lines.join("\n"), code };
+}
+async function runPlanVerb(verb, agent, p, cwd) {
+  const ctx = { agent, p, cwd, json: p.flags.json === true, root: (0, import_verbs.projectRoot)(cwd) };
+  if (verb === "commit") return commit(ctx);
+  if (verb === "status") return status(ctx);
+  const [sub, ...rest] = p.rest;
+  switch (sub) {
+    case "show":
+      return planShow(ctx);
+    case "add":
+      return planAdd(ctx, rest.join(" ").trim());
+    case "edit":
+      return planEdit(ctx, rest[0]);
+    case "move":
+      return planMove(ctx, rest[0]);
+    default:
+      throw new import_verbs.UsageError("codetrellis plan show | add <title\u2026> | edit <task> | move <task>");
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PLAN_VERBS,
+  ownChanges,
+  runPlanVerb
+});

package/src/cli/review-adapters.js

@@ -0,0 +1,220 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var review_adapters_exports = {};
+__export(review_adapters_exports, {
+  ADAPTERS: () => ADAPTERS,
+  OIDC_ENV: () => OIDC_ENV,
+  OIDC_PROVIDERS: () => OIDC_PROVIDERS,
+  adapterFor: () => adapterFor
+});
+module.exports = __toCommonJS(review_adapters_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+const OIDC_PROVIDERS = ["bedrock", "vertex", "foundry"];
+const OIDC_ENV = {
+  bedrock: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_PROFILE", "ANTHROPIC_BEDROCK_BASE_URL"],
+  vertex: ["GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_PROJECT", "CLOUDSDK_CORE_PROJECT", "CLOUD_ML_REGION", "ANTHROPIC_VERTEX_PROJECT_ID", "ANTHROPIC_VERTEX_BASE_URL"],
+  foundry: ["ANTHROPIC_FOUNDRY_RESOURCE", "ANTHROPIC_FOUNDRY_BASE_URL", "AZURE_CLIENT_ID", "AZURE_TENANT_ID", "AZURE_FEDERATED_TOKEN_FILE", "AZURE_AUTHORITY_HOST", "AZURE_CONFIG_DIR"]
+};
+const SINK = "codetrellis_review";
+const oauthToken = (a) => a.kind === "key" && (a.var === "CLAUDE_CODE_OAUTH_TOKEN" || a.value.startsWith("sk-ant-oat"));
+const claudeCode = {
+  id: "claude-code",
+  label: "Claude Code",
+  bin: "claude",
+  binEnv: "CODETRELLIS_REVIEW_CLAUDE",
+  oidc: ["bedrock", "vertex", "foundry"],
+  passEnv: [],
+  env({ auth, endpoint }) {
+    const out = {
+      // No telemetry, error reports or update checks from a review.
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
+    };
+    if (auth.kind === "key") out[oauthToken(auth) ? "CLAUDE_CODE_OAUTH_TOKEN" : "ANTHROPIC_API_KEY"] = auth.value;
+    if (auth.kind === "oidc") out[{ bedrock: "CLAUDE_CODE_USE_BEDROCK", vertex: "CLAUDE_CODE_USE_VERTEX", foundry: "CLAUDE_CODE_USE_FOUNDRY" }[auth.provider]] = "1";
+    if (endpoint) out.ANTHROPIC_BASE_URL = endpoint;
+    return out;
+  },
+  command({ instructions, message, sink, model, maxTurns, dir, auth, tools }) {
+    const withKey = auth.kind === "oidc" || auth.kind === "key" && !oauthToken(auth);
+    const mcp = import_node_path.default.join(dir, "mcp.json");
+    const env = sink.env && Object.keys(sink.env).length ? { env: sink.env } : {};
+    import_node_fs.default.writeFileSync(mcp, JSON.stringify({ mcpServers: { [SINK]: { type: "stdio", command: sink.command, args: sink.args, ...env } } }));
+    const system = import_node_path.default.join(dir, "system.md");
+    import_node_fs.default.writeFileSync(system, instructions);
+    return {
+      args: [
+        "-p",
+        ...withKey ? ["--bare"] : [],
+        "--output-format",
+        "json",
+        "--tools",
+        "",
+        "--strict-mcp-config",
+        "--mcp-config",
+        mcp,
+        "--allowedTools",
+        tools.map((t) => `mcp__${SINK}__${t}`).join(","),
+        "--permission-mode",
+        "dontAsk",
+        "--max-turns",
+        String(maxTurns),
+        "--system-prompt-file",
+        system,
+        ...model ? ["--model", model] : []
+      ],
+      // The message on stdin: the bundle can be larger than an argument may be.
+      stdin: message
+    };
+  },
+  parse(stdout, stderr, code) {
+    let r = null;
+    for (const line of stdout.trim().split("\n").reverse()) {
+      try {
+        const j = JSON.parse(line);
+        if (j && typeof j === "object") {
+          r = j;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (!r) {
+      try {
+        r = JSON.parse(stdout);
+      } catch {
+      }
+    }
+    if (!r) return { finalText: null, refused: [], hitTurns: false, error: code === 0 ? null : (stderr.trim() || `it exited ${code}`).slice(-400), turns: null, tokens: null };
+    const denials = Array.isArray(r.permission_denials) ? r.permission_denials : [];
+    const usage = r.usage ?? {};
+    const subtype = typeof r.subtype === "string" ? r.subtype : "";
+    const hitTurns = subtype === "error_max_turns";
+    const failed = r.is_error === true && !hitTurns;
+    return {
+      finalText: typeof r.result === "string" ? r.result : null,
+      refused: denials.map((d) => `${String(d.tool_name ?? "a tool")}: denied by the CLI (not on the review's allowlist)`),
+      hitTurns,
+      error: failed ? String(r.result ?? r.error ?? subtype ?? "the agent failed").slice(0, 400) : null,
+      turns: typeof r.num_turns === "number" ? r.num_turns : null,
+      tokens: typeof usage.input_tokens === "number" ? (usage.input_tokens ?? 0) + (usage.output_tokens ?? 0) : null
+    };
+  }
+};
+const toml = (v) => JSON.stringify(v);
+const codex = {
+  id: "codex",
+  label: "Codex",
+  bin: "codex",
+  binEnv: "CODETRELLIS_REVIEW_CODEX",
+  oidc: [],
+  passEnv: [],
+  needsAuth: true,
+  env({ auth }) {
+    const out = {};
+    if (auth.kind === "key") out.CODETRELLIS_REVIEW_KEY = auth.value;
+    return out;
+  },
+  command({ instructions, message, sink, model, endpoint, dir, tools }) {
+    const home = import_node_path.default.join(dir, "codex-home");
+    import_node_fs.default.mkdirSync(home, { recursive: true });
+    const server = `mcp_servers.${SINK}`;
+    const set = (k, v) => ["-c", `${k}=${v}`];
+    return {
+      args: [
+        "exec",
+        "--json",
+        "--skip-git-repo-check",
+        "--ephemeral",
+        "--sandbox",
+        "read-only",
+        ...set("features.shell_tool", "false"),
+        ...set("web_search", toml("disabled")),
+        ...set("features.view_image", "false"),
+        ...set("features.multi_agent", "false"),
+        ...set("project_doc_max_bytes", "0"),
+        ...set(`${server}.command`, toml(sink.command)),
+        ...set(`${server}.args`, `[${sink.args.map(toml).join(", ")}]`),
+        ...sink.env && Object.keys(sink.env).length ? set(`${server}.env`, `{ ${Object.entries(sink.env).map(([k, v]) => `${k} = ${toml(v)}`).join(", ")} }`) : [],
+        ...set(`${server}.enabled_tools`, `[${tools.map(toml).join(", ")}]`),
+        ...set(`${server}.default_tools_approval_mode`, toml("approve")),
+        ...set("model_providers.codetrellis_review.name", toml("codetrellis review")),
+        ...set("model_providers.codetrellis_review.base_url", toml(endpoint ?? "https://api.openai.com/v1")),
+        ...set("model_providers.codetrellis_review.env_key", toml("CODETRELLIS_REVIEW_KEY")),
+        ...set("model_provider", toml("codetrellis_review")),
+        ...set("developer_instructions", toml(instructions)),
+        ...model ? ["-m", model] : [],
+        "-"
+      ],
+      stdin: message,
+      env: { CODEX_HOME: home }
+    };
+  },
+  parse(stdout, stderr, code) {
+    let finalText = null;
+    let error = null;
+    let tokens = null;
+    let turns = 0;
+    const refused = [];
+    for (const line of stdout.split("\n")) {
+      let e;
+      try {
+        e = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (e.type === "turn.completed") {
+        turns += 1;
+        const u = e.usage ?? {};
+        tokens = (u.input_tokens ?? 0) + (u.output_tokens ?? 0);
+      } else if (e.type === "turn.failed") error = String(e.error?.message ?? "the turn failed");
+      else if (e.type === "error") error = String(e.message ?? "an error");
+      else if (e.type === "item.completed" && e.item) {
+        const it = e.item;
+        if (it.type === "agent_message" && typeof it.text === "string") finalText = it.text;
+        else if (it.type === "mcp_tool_call" && it.status === "failed") refused.push(`${it.server}.${it.tool}: ${String(it.error?.message ?? "failed")}`);
+        else if (it.type === "command_execution") refused.push(`a shell command: ${String(it.command ?? "").slice(0, 200)}`);
+        else if (it.type === "file_change") refused.push("a file change: refused by the read-only sandbox");
+        else if (it.type === "web_search") refused.push("a web search");
+      }
+    }
+    if (!error && code !== 0 && turns === 0) error = (stderr.trim() || `it exited ${code}`).slice(-400);
+    return { finalText, refused, hitTurns: false, error, turns: turns || null, tokens };
+  }
+};
+const ADAPTERS = [claudeCode, codex];
+function adapterFor(id) {
+  return ADAPTERS.find((a) => a.id === id) ?? null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ADAPTERS,
+  OIDC_ENV,
+  OIDC_PROVIDERS,
+  adapterFor
+});

package/src/cli/review-output.js

@@ -0,0 +1,93 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var review_output_exports = {};
+__export(review_output_exports, {
+  findingWords: () => findingWords,
+  reviewMarkdown: () => reviewMarkdown,
+  reviewSarif: () => reviewSarif,
+  reviewText: () => reviewText
+});
+module.exports = __toCommonJS(review_output_exports);
+const GLYPH = { rule: "\u2717", bug: "\u2717", risk: "\u26A0", question: "?", suspicious: "\u2691" };
+const where = (f) => f.path ? `${f.path}${f.start ? `:${f.start}${f.end && f.end !== f.start ? `\u2013${f.end}` : ""}` : ""}` : "the change";
+function findingWords(f) {
+  return `${GLYPH[f.kind] ?? "\u2022"} ${f.kind}${f.rule ? ` (${f.rule})` : ""} \xB7 ${where(f)}: ${f.says}${f.fix ? ` \u2192 ${f.fix}` : ""}`;
+}
+function reviewText(passes, agent, code) {
+  const lines = [];
+  for (const p of passes) {
+    lines.push(`${p.pass}: ${agent}'s review: ${p.says}`);
+    for (const f of p.kept) lines.push(`  ${findingWords(f)}`);
+    if (p.verify) lines.push(`  ${p.verify}`);
+  }
+  lines.push("", `Kept as check runs; the Checks view opens each.${code ? " Exit 3: --fail-on." : ""}`);
+  return lines.join("\n");
+}
+const md = (s) => s.replace(/([\\`*_[\]<>|])/g, "\\$1");
+function reviewMarkdown(passes, agent) {
+  const out = ["### CodeTrellis review", "", `${md(agent)} reviewed the change on its own model, held to the review's contract; each finding cites the diff and was checked. Advisory.`, ""];
+  for (const p of passes) {
+    out.push(`**${md(p.pass)}**: ${md(p.says)}`, "");
+    for (const f of p.kept) out.push(`- ${GLYPH[f.kind] ?? "\u2022"} **${f.kind}**${f.rule ? ` (\`${f.rule}\`)` : ""} \xB7 \`${where(f)}\`: ${md(f.says)}${f.fix ? ` \u2192 ${md(f.fix)}` : ""}`);
+    if (p.kept.length) out.push("");
+    if (p.verify) out.push(`_${md(p.verify)}_`, "");
+  }
+  return out.join("\n").trimEnd() + "\n";
+}
+function reviewSarif(passes, opts) {
+  const rules = /* @__PURE__ */ new Map();
+  const results = [];
+  for (const p of passes) {
+    for (const f of p.kept) {
+      if (!f.path) continue;
+      const level = f.kind === "rule" ? p.strengths[f.rule ?? ""] === "block" ? "error" : "warning" : f.kind === "bug" ? "warning" : "note";
+      const id = f.kind === "rule" && f.rule ? f.rule : `review/${f.kind}`;
+      if (!rules.has(id)) {
+        rules.set(id, {
+          id,
+          name: id.replace(/[^A-Za-z0-9]+(.)?/g, (_, c) => c ? c.toUpperCase() : ""),
+          shortDescription: { text: f.kind === "rule" ? `The rule ${id}` : `An agent review's ${f.kind} finding` },
+          defaultConfiguration: { level }
+        });
+      }
+      results.push({
+        ruleId: id,
+        level,
+        message: { text: `${p.pass}: ${f.says}${f.fix ? ` \u2192 ${f.fix}` : ""}` },
+        locations: [{ physicalLocation: { artifactLocation: { uri: f.path, uriBaseId: "SRCROOT" }, ...f.start ? { region: { startLine: f.start, ...f.end && f.end >= f.start ? { endLine: f.end } : {} } } : {} } }],
+        partialFingerprints: { codetrellisReview: `${p.pass}|${f.kind}|${f.path}|${f.rule ?? ""}|${f.says}`.slice(0, 500) }
+      });
+    }
+  }
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: { driver: { name: `CodeTrellis review (${opts.agent})`, informationUri: "https://codetrellis.dev", version: opts.version, rules: [...rules.values()] } },
+      originalUriBaseIds: { SRCROOT: { uri: `file://${opts.root.replace(/\\/g, "/").replace(/\/?$/, "/")}` } },
+      results
+    }]
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  findingWords,
+  reviewMarkdown,
+  reviewSarif,
+  reviewText
+});

package/src/cli/review-post.js

@@ -0,0 +1,89 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var review_post_exports = {};
+__export(review_post_exports, {
+  DEFAULT_TOKEN: () => DEFAULT_TOKEN,
+  commentRequest: () => commentRequest,
+  postComment: () => postComment,
+  pullNumber: () => pullNumber
+});
+module.exports = __toCommonJS(review_post_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_github = require("../backend/services/review-host/github");
+var import_gitlab = require("../backend/services/review-host/gitlab");
+var import_bitbucket = require("../backend/services/review-host/bitbucket");
+var import_http = require("../backend/services/review-host/http");
+const DEFAULT_TOKEN = { github: "GITHUB_TOKEN", gitlab: "GITLAB_TOKEN", bitbucket: "BITBUCKET_TOKEN" };
+function pullNumber(env) {
+  const n = (v) => typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : typeof v === "string" && /^\d+$/.test(v) && Number(v) > 0 ? Number(v) : null;
+  if (env.GITHUB_EVENT_PATH) {
+    try {
+      const e = JSON.parse(import_node_fs.default.readFileSync(env.GITHUB_EVENT_PATH, "utf8"));
+      const got = n(e.pull_request?.number) ?? n(e.number);
+      if (got) return got;
+    } catch {
+    }
+  }
+  const ref = /^refs\/pull\/(\d+)\//.exec(env.GITHUB_REF ?? "");
+  return (ref ? Number(ref[1]) : null) ?? n(env.CI_MERGE_REQUEST_IID) ?? n(env.BITBUCKET_PR_ID) ?? n(env.SYSTEM_PULLREQUEST_PULLREQUESTNUMBER) ?? n(env.CHANGE_ID);
+}
+function commentRequest(host, pr, token, body) {
+  if (!host.kind) return { error: `${host.hostname} is not a host the review can post to (GitHub, GitLab or Bitbucket)` };
+  if (!import_http.PART.test(host.owner) && host.kind !== "gitlab") return { error: "the repository's owner is not one the review can name" };
+  if (!import_http.PART.test(host.repo)) return { error: "the repository's name is not one the review can name" };
+  const text = body.slice(0, 6e4);
+  const json = { "Content-Type": "application/json", Accept: "application/json", "User-Agent": "CodeTrellis" };
+  if (host.kind === "github") {
+    return { url: `${(0, import_github.githubApiBase)()}/repos/${encodeURIComponent(host.owner)}/${encodeURIComponent(host.repo)}/issues/${pr}/comments`, headers: { ...json, Authorization: `Bearer ${token}`, "X-GitHub-Api-Version": "2022-11-28" }, body: JSON.stringify({ body: text }) };
+  }
+  if (host.kind === "gitlab") {
+    if (!host.slug.split("/").every((p) => import_http.PART.test(p))) return { error: "the project's path is not one the review can name" };
+    return { url: `${(0, import_gitlab.gitlabApiBase)()}/projects/${encodeURIComponent(host.slug)}/merge_requests/${pr}/notes`, headers: { ...json, Authorization: `Bearer ${token}` }, body: JSON.stringify({ body: text }) };
+  }
+  return { url: `${(0, import_bitbucket.bitbucketApiBase)()}/repositories/${encodeURIComponent(host.owner)}/${encodeURIComponent(host.repo)}/pullrequests/${pr}/comments`, headers: { ...json, Authorization: `Bearer ${token}` }, body: JSON.stringify({ content: { raw: text } }) };
+}
+async function postComment(host, pr, token, body) {
+  const req = commentRequest(host, pr, token, body);
+  if ("error" in req) return { ok: false, says: req.error };
+  const name = { github: "GitHub", gitlab: "GitLab", bitbucket: "Bitbucket" }[host.kind];
+  try {
+    const res = await fetch(req.url, { method: "POST", redirect: "error", signal: AbortSignal.timeout(1e4), headers: req.headers, body: req.body });
+    if (res.ok) return { ok: true, says: `Posted the review on ${name}, on #${pr}.` };
+    if (res.status === 401 || res.status === 403) return { ok: false, says: `${name} refused the token (${res.status}): it needs to write comments on pull requests.` };
+    return { ok: false, says: `${name} answered ${res.status}; the review was not posted.` };
+  } catch (err) {
+    return { ok: false, says: err?.name === "TimeoutError" ? `${name} did not answer in time; the review was not posted.` : `${name} could not be reached; the review was not posted.` };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_TOKEN,
+  commentRequest,
+  postComment,
+  pullNumber
+});