overlane 0.1.124 → 0.1.125

package/dist/overlane.mjs

@@ -4545,7 +4545,7 @@ function isRef(value) {
 function cloneIssues(issues) {
   return issues.map((iss) => iss.path ? { ...iss, path: iss.path.slice() } : { ...iss });
 }
-function isRecursive(inst, stack, resolve13) {
+function isRecursive(inst, stack, resolve14) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -4555,7 +4555,7 @@ function isRecursive(inst, stack, resolve13) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve13);
+      const answer = isRecursive(child, stack, resolve14);
       if (answer > result)
         result = answer;
     }
@@ -4566,7 +4566,7 @@ function isRecursive(inst, stack, resolve13) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve13) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve14) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -4630,7 +4630,7 @@ function isRecursive(inst, stack, resolve13) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve13 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve14 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -20409,7 +20409,14 @@ var init_zod = __esm({
 });
 
 // ../contracts/src/common.ts
-var identifier, TenantId, ProjectId, TaskId, CommitSha, Sha256Digest, Timestamp, SemVer, SchemaVersion;
+function withCompat(fill, schema) {
+  return external_exports.preprocess((raw) => typeof raw === "object" && raw !== null && !Array.isArray(raw) ? fill(raw) : raw, schema);
+}
+function resolveProvider(record3) {
+  if (record3.provider !== void 0) return record3.provider;
+  return record3.repository !== void 0 && record3.repository !== null ? "github" : DEFAULT_PROVIDER;
+}
+var identifier, TenantId, ProjectId, TaskId, CommitSha, Sha256Digest, Timestamp, SemVer, SchemaVersion, PROVIDERS, Provider, DEFAULT_PROVIDER;
 var init_common = __esm({
   "../contracts/src/common.ts"() {
     "use strict";
@@ -20423,6 +20430,9 @@ var init_common = __esm({
     Timestamp = external_exports.iso.datetime({ offset: true });
     SemVer = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/, "must be a semantic version");
     SchemaVersion = external_exports.literal("1");
+    PROVIDERS = ["overlane", "github", "gitlab"];
+    Provider = external_exports.enum(PROVIDERS);
+    DEFAULT_PROVIDER = "overlane";
   }
 });
 
@@ -20448,7 +20458,7 @@ var init_executor = __esm({
 });
 
 // ../contracts/src/evidence.ts
-var EvidenceLevel, EvidenceSubject, InputDigests, recordBase, MachineEvidence, HumanEvidence, EvidenceRecord;
+var EvidenceLevel, EvidenceSubject, InputDigests, recordBase, MachineRunner, MachineEvidence, HumanEvidence, EvidenceRecord;
 var init_evidence = __esm({
   "../contracts/src/evidence.ts"() {
     "use strict";
@@ -20477,15 +20487,20 @@ var init_evidence = __esm({
       recordedAt: Timestamp,
       executor: Executor
     };
+    MachineRunner = withCompat(
+      (runner) => runner["provider"] === void 0 ? { ...runner, provider: runner["environment"] === "github-checks" ? "github" : "overlane" } : runner,
+      external_exports.object({
+        provider: Provider,
+        identity: external_exports.string().min(1),
+        environment: external_exports.string().min(1)
+      }).strict()
+    );
     MachineEvidence = external_exports.object({
       ...recordBase,
       level: external_exports.enum(["L0", "L1", "L2", "L3"]),
       checkId: external_exports.string().min(1),
       checkDefinitionDigest: Sha256Digest,
-      runner: external_exports.object({
-        identity: external_exports.string().min(1),
-        environment: external_exports.string().min(1)
-      }).strict(),
+      runner: MachineRunner,
       startedAt: Timestamp,
       finishedAt: Timestamp,
       exitStatus: external_exports.number().int(),
@@ -20700,7 +20715,21 @@ var init_domain_event = __esm({
 });
 
 // ../contracts/src/api.ts
-var apiPaths, HARNESS_SCOPES, HarnessScope, RepositoryRef, CreateProjectRequest, UpdateProjectRequest, ProjectRecord, WhoAmI, ApiError;
+function checkProviderShape(value, ctx) {
+  const provider = resolveProvider(value);
+  const nested = value.repository?.provider;
+  if (nested !== void 0 && nested !== provider) {
+    ctx.addIssue({ code: "custom", path: ["repository", "provider"], message: "repository.provider must match provider" });
+  }
+  if (provider !== "overlane" && value.repository === void 0) {
+    ctx.addIssue({ code: "custom", path: ["repository"], message: `a ${provider} project needs a repository` });
+  }
+  const host = value.repository?.host;
+  if (host !== void 0 && host !== HOSTS[provider]) {
+    ctx.addIssue({ code: "custom", path: ["repository", "host"], message: `host must be ${HOSTS[provider]} for provider ${provider}; name the provider for a repository that is not on github.com` });
+  }
+}
+var apiPaths, HARNESS_SCOPES, HarnessScope, RepositoryRef, ProjectConnection, HOSTS, ProjectRepository, fillProvider, CreateProjectRequest, UpdateProjectRequest, ProjectRecord, WhoAmI, ApiError;
 var init_api2 = __esm({
   "../contracts/src/api.ts"() {
     "use strict";
@@ -20720,24 +20749,58 @@ var init_api2 = __esm({
       owner: external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/),
       name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/)
     }).strict();
-    CreateProjectRequest = external_exports.object({
-      repository: RepositoryRef,
-      name: external_exports.string().min(1).max(100),
-      /** ADR 0018: the hosted code layer is off unless a project turns it on. Missing means false. */
-      codeLayer: external_exports.boolean().optional()
+    ProjectConnection = external_exports.object({
+      provider: Provider,
+      /** The GitHub App installation number; GitHub only. */
+      installationId: external_exports.number().int().positive().optional(),
+      /** The provider's own identifier for the repository or project. */
+      externalId: external_exports.string().min(1).max(200).optional()
     }).strict();
+    HOSTS = { overlane: "overlane", github: "github.com", gitlab: "gitlab.com" };
+    ProjectRepository = external_exports.object({
+      provider: Provider.optional(),
+      host: external_exports.enum(["github.com", "gitlab.com", "overlane"]).optional(),
+      owner: external_exports.string().min(1).max(200),
+      name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/)
+    }).strict().superRefine((repository, ctx) => {
+      const provider = repository.provider ?? (repository.host === "gitlab.com" ? "gitlab" : repository.host === "overlane" ? "overlane" : "github");
+      if (repository.host !== void 0 && repository.host !== HOSTS[provider]) {
+        ctx.addIssue({ code: "custom", path: ["host"], message: `host must be ${HOSTS[provider]} for provider ${provider}` });
+      }
+      const pattern = provider === "gitlab" ? /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/ : /^[A-Za-z0-9-]{1,39}$/;
+      if (!pattern.test(repository.owner)) ctx.addIssue({ code: "custom", path: ["owner"], message: "owner is not valid for this provider" });
+    });
+    fillProvider = (record3) => record3["provider"] === void 0 ? { ...record3, provider: resolveProvider({ repository: record3["repository"] }) } : record3;
+    CreateProjectRequest = withCompat(
+      fillProvider,
+      external_exports.object({
+        provider: Provider,
+        repository: ProjectRepository.optional(),
+        connection: ProjectConnection.optional(),
+        name: external_exports.string().min(1).max(100),
+        /** ADR 0018: the hosted code layer is off unless a project turns it on. Missing means false. */
+        codeLayer: external_exports.boolean().optional()
+      }).strict().superRefine(checkProviderShape)
+    );
     UpdateProjectRequest = external_exports.object({ codeLayer: external_exports.boolean() }).strict();
-    ProjectRecord = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      name: external_exports.string().min(1).max(100),
-      repository: RepositoryRef,
-      releaseVersion: external_exports.string().min(1),
-      releaseDigest: Sha256Digest,
-      createdAt: Timestamp,
-      /** ADR 0018: registers the MCP `code` tool and opens the code routes. Missing in older records means false. */
-      codeLayer: external_exports.boolean().default(false)
-    }).strict();
+    ProjectRecord = withCompat(
+      fillProvider,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        name: external_exports.string().min(1).max(100),
+        /** Missing in records from before ADR 0050: reads as `github` with a repository, else `overlane`. */
+        provider: Provider,
+        /** Absent for a native project that has no repository yet. */
+        repository: ProjectRepository.optional(),
+        connection: ProjectConnection.optional(),
+        releaseVersion: external_exports.string().min(1),
+        releaseDigest: Sha256Digest,
+        createdAt: Timestamp,
+        /** ADR 0018: registers the MCP `code` tool and opens the code routes. Missing in older records means false. */
+        codeLayer: external_exports.boolean().default(false)
+      }).strict().superRefine(checkProviderShape)
+    );
     WhoAmI = external_exports.object({
       tenantId: TenantId,
       userId: external_exports.string().min(1),
@@ -20813,7 +20876,7 @@ var init_task_api = __esm({
 });
 
 // ../contracts/src/code-index.ts
-var SourceRange, PRECISION, Precision, SYMBOL_KINDS, SymbolKind, IndexedSymbol, Occurrence, FileShard, ManifestEntry, ManifestUploadResponse, ShardUploadRequest, SnapshotManifest, AnswerProvenance, SymbolHit, ReferenceHit, codePaths;
+var SourceRange, PRECISION, Precision, SYMBOL_KINDS, SymbolKind, IndexedSymbol, Occurrence, FileShard, ManifestEntry, ManifestUploadResponse, ShardUploadRequest, SnapshotManifest, AnswerProvenance, SymbolHit, ReferenceHit, projectBase, codePaths;
 var init_code_index = __esm({
   "../contracts/src/code-index.ts"() {
     "use strict";
@@ -20856,13 +20919,14 @@ var init_code_index = __esm({
     SnapshotManifest = external_exports.object({
       schemaVersion: external_exports.literal("1"),
       tenantId: TenantId,
-      repository: RepositoryRef,
+      repository: RepositoryRef.optional(),
+      projectId: ProjectId.optional(),
       commitSha: CommitSha,
       branch: external_exports.string().min(1).optional(),
       indexers: external_exports.array(external_exports.object({ name: external_exports.string().min(1), version: external_exports.string().min(1) }).strict()).min(1),
       files: external_exports.array(ManifestEntry),
       createdAt: Timestamp
-    }).strict();
+    }).strict().refine((manifest) => manifest.repository !== void 0 || manifest.projectId !== void 0, { message: "a manifest names a repository or a projectId" });
     AnswerProvenance = external_exports.object({
       requestedCommit: CommitSha.nullable(),
       indexedCommit: CommitSha.nullable(),
@@ -20874,7 +20938,12 @@ var init_code_index = __esm({
     }).strict();
     SymbolHit = external_exports.object({ path: external_exports.string().min(1), symbol: external_exports.string().min(1), name: external_exports.string().min(1), kind: SymbolKind, range: SourceRange, precision: Precision, source: external_exports.enum(["cloud", "local"]) }).strict();
     ReferenceHit = external_exports.object({ path: external_exports.string().min(1), symbol: external_exports.string().min(1), range: SourceRange, enclosingSymbol: external_exports.string().optional(), source: external_exports.enum(["cloud", "local"]) }).strict();
+    projectBase = (tenantId, projectId) => `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}`;
     codePaths = {
+      projectUploadManifest: (tenantId, projectId) => `${projectBase(tenantId, projectId)}/snapshots`,
+      projectUploadShards: (tenantId, projectId, commit) => `${projectBase(tenantId, projectId)}/snapshots/${commit}/shards`,
+      projectPublish: (tenantId, projectId, commit) => `${projectBase(tenantId, projectId)}/snapshots/${commit}/publish`,
+      projectQuery: (tenantId, projectId, tool) => `${projectBase(tenantId, projectId)}/code/${tool}`,
       uploadManifest: (tenantId, owner, repo) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots`,
       uploadShards: (tenantId, owner, repo, commit) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots/${commit}/shards`,
       publish: (tenantId, owner, repo, commit) => `/v1/tenants/${encodeURIComponent(tenantId)}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/snapshots/${commit}/publish`,
@@ -21938,7 +22007,7 @@ function forAgent(issue2) {
   const source = issue2.external?.source ?? "overlane";
   return AgentIssueView.parse({ ...issue2, title: { trust: "untrusted_data", source, text: issue2.title }, description: { trust: "untrusted_data", source, text: issue2.description }, notice: UNTRUSTED_NOTICE });
 }
-var prefixed, IssueId, WorkProjectId, CycleId, LabelId, ViewId, LoopId, RequestId3, Title, Description, Name, ISSUE_STATUSES, IssueStatus, SettableIssueStatus, ASSIGNEE_TYPES, AssigneeType, Assignee, ACTOR_TYPES, ActorType, Actor, TASK_LINK_STATES, IssueTaskLink, IssueTaskLinks, IssueLinks, ISSUE_SOURCES, IssueSource, ExternalRef, record2, Label, WorkProject, Cycle, Issue, UNTRUSTED_NOTICE, UntrustedText, AgentIssueView, ISSUE_FIELDS, IssueField, FieldChangeEvent, VIEW_FIELDS, ViewField, ViewCondition, ViewDefinition, SavedView, ViewGroup, ViewResult, SyncFields, SyncEnvelope, SYNC_MODES, SyncMode, SyncConfig, SetSyncConfigRequest, SyncOutcome, SyncResult, LoopTrigger, LoopDefinition, LOOP_STOP_REASONS, LoopStopReason, LoopRun, IMPORT_SOURCES, ImportSource, ImportRequest, ImportReport, CreateIssueRequest, UpdateIssueRequest, AssignIssueRequest, AssignResult, CreateLabelRequest, CreateWorkProjectRequest, UpdateWorkProjectRequest, CreateCycleRequest, CreateViewRequest, CreateLoopRequest, UpdateLoopRequest, FireLoopRequest, IssueList, LabelList, WorkProjectList, CycleList, ViewList, LoopList, IssueEventList, base2, issuePaths;
+var prefixed, IssueId, WorkProjectId, CycleId, LabelId, ViewId, LoopId, RequestId3, Title, Description, Name, ISSUE_STATUSES, IssueStatus, SettableIssueStatus, ASSIGNEE_TYPES, AssigneeType, Assignee, ACTOR_TYPES, ActorType, Actor, TASK_LINK_STATES, IssueTaskLink, IssueTaskLinks, IssueLinks, ISSUE_SOURCES, IssueSource, ExternalRef, record2, Label, WorkProject, Cycle, Issue, UNTRUSTED_NOTICE, UntrustedText, AgentIssueView, ISSUE_FIELDS, IssueField, FieldChangeEvent, VIEW_FIELDS, ViewField, ViewCondition, ViewDefinition, SavedView, ViewGroup, ViewResult, SyncFields, SYNC_PROVIDERS, SyncProvider, SyncEnvelope, SYNC_MODES, SyncMode, SyncConfig, SetSyncConfigRequest, SyncOutcome, SyncResult, LoopTrigger, LoopDefinition, LOOP_STOP_REASONS, LoopStopReason, LoopRun, IMPORT_SOURCES, ImportSource, ImportRequest, ImportReport, CreateIssueRequest, UpdateIssueRequest, AssignIssueRequest, AssignResult, CreateLabelRequest, CreateWorkProjectRequest, UpdateWorkProjectRequest, CreateCycleRequest, CreateViewRequest, CreateLoopRequest, UpdateLoopRequest, FireLoopRequest, IssueList, LabelList, WorkProjectList, CycleList, ViewList, LoopList, IssueEventList, base2, issuePaths;
 var init_issues = __esm({
   "../contracts/src/issues.ts"() {
     "use strict";
@@ -22050,35 +22119,47 @@ var init_issues = __esm({
     ViewGroup = external_exports.object({ key: external_exports.string(), issues: external_exports.array(Issue) }).strict();
     ViewResult = external_exports.object({ tenantId: TenantId, viewId: ViewId.nullable(), total: external_exports.number().int().nonnegative(), groups: external_exports.array(ViewGroup) }).strict();
     SyncFields = external_exports.object({ title: Title.optional(), description: Description.optional(), status: SettableIssueStatus.optional(), labels: external_exports.array(external_exports.string().min(1).max(100)).optional(), assigneeLogin: external_exports.string().max(100).nullable().optional() }).strict();
-    SyncEnvelope = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      /** Unique per delivery or change; a second arrival does nothing. */
-      idempotencyKey: external_exports.string().min(8).max(200),
-      /** Per issue, from the source. A change at or below the highest applied sequence is late. */
-      sequence: external_exports.number().int().nonnegative(),
-      source: external_exports.enum(["github", "overlane"]),
-      /** The source's own clock; resolves a conflict inside the sync window with the server receive time. */
-      sourceTimestamp: Timestamp,
-      issue: external_exports.object({ externalId: external_exports.string().min(1).max(200), url: external_exports.string().url().max(500).optional() }).strict(),
-      change: external_exports.discriminatedUnion("kind", [
-        external_exports.object({ kind: external_exports.literal("upsert"), fields: SyncFields }).strict(),
-        /** A close carries the issue's other fields too: deliveries are snapshots, so a late earlier edit loses nothing. */
-        external_exports.object({ kind: external_exports.literal("external_close"), fields: SyncFields.optional() }).strict(),
-        external_exports.object({ kind: external_exports.literal("external_reopen"), fields: SyncFields.optional() }).strict()
-      ])
-    }).strict();
+    SYNC_PROVIDERS = [...PROVIDERS, "linear", "jira"];
+    SyncProvider = external_exports.enum(SYNC_PROVIDERS);
+    SyncEnvelope = withCompat(
+      (envelope) => envelope["provider"] === void 0 ? { ...envelope, provider: envelope["source"] } : envelope,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        /** Unique per delivery or change; a second arrival does nothing. */
+        idempotencyKey: external_exports.string().min(8).max(200),
+        /** Per issue, from the source. A change at or below the highest applied sequence is late. */
+        sequence: external_exports.number().int().nonnegative(),
+        source: external_exports.enum(["github", "overlane"]),
+        /** The system on the other side of the sync. Missing reads as `source` (github or overlane); linear, jira and gitlab name themselves here. */
+        provider: SyncProvider,
+        /** The source's own clock; resolves a conflict inside the sync window with the server receive time. */
+        sourceTimestamp: Timestamp,
+        issue: external_exports.object({ externalId: external_exports.string().min(1).max(200), url: external_exports.string().url().max(500).optional() }).strict(),
+        change: external_exports.discriminatedUnion("kind", [
+          external_exports.object({ kind: external_exports.literal("upsert"), fields: SyncFields }).strict(),
+          /** A close carries the issue's other fields too: deliveries are snapshots, so a late earlier edit loses nothing. */
+          external_exports.object({ kind: external_exports.literal("external_close"), fields: SyncFields.optional() }).strict(),
+          external_exports.object({ kind: external_exports.literal("external_reopen"), fields: SyncFields.optional() }).strict()
+        ])
+      }).strict()
+    );
     SYNC_MODES = ["off", "read_only", "write_back"];
     SyncMode = external_exports.enum(SYNC_MODES);
-    SyncConfig = external_exports.object({
-      tenantId: TenantId,
-      projectId: ProjectId,
-      repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/).nullable(),
-      mode: SyncMode,
-      updatedBy: external_exports.string().nullable(),
-      updatedAt: Timestamp.nullable()
-    }).strict();
-    SetSyncConfigRequest = external_exports.object({ requestId: RequestId3, repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/), mode: SyncMode }).strict();
+    SyncConfig = withCompat(
+      (config2) => config2["provider"] === void 0 ? { ...config2, provider: config2["repository"] === null || config2["repository"] === void 0 ? "overlane" : "github" } : config2,
+      external_exports.object({
+        tenantId: TenantId,
+        projectId: ProjectId,
+        /** Missing reads as `github` when a repository is set, otherwise `overlane` (ADR 0050). */
+        provider: SyncProvider,
+        repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/).nullable(),
+        mode: SyncMode,
+        updatedBy: external_exports.string().nullable(),
+        updatedAt: Timestamp.nullable()
+      }).strict()
+    );
+    SetSyncConfigRequest = external_exports.object({ requestId: RequestId3, provider: SyncProvider.optional(), repository: external_exports.string().regex(/^[\w.-]+\/[\w.-]+$/), mode: SyncMode }).strict();
     SyncOutcome = external_exports.enum(["applied", "replayed", "late", "ignored_off", "conflict_resolved", "external_close_recorded"]);
     SyncResult = external_exports.object({ tenantId: TenantId, outcome: SyncOutcome, issueId: IssueId.nullable(), idempotencyKey: external_exports.string() }).strict();
     LoopTrigger = external_exports.discriminatedUnion("kind", [
@@ -22192,13 +22273,23 @@ var init_issues = __esm({
 });
 
 // ../contracts/src/onboarding.ts
+function readLegacyRepoChoice(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return raw;
+  const { kind, installationId, ...rest } = raw;
+  if (kind === void 0 && installationId === void 0) return raw;
+  const out2 = { ...rest };
+  if (out2["provider"] === void 0 && kind !== void 0) out2["provider"] = kind === "native" ? "overlane" : kind;
+  if (out2["provider"] === void 0 && installationId !== void 0) out2["provider"] = "github";
+  if (installationId !== void 0 && out2["connection"] === void 0) out2["connection"] = { installationId };
+  return out2;
+}
 function initialSteps() {
   return STEP_NAMES.map((step2, i2) => ({ step: step2, status: i2 === 0 ? "done" : i2 === 1 ? "active" : "pending" }));
 }
 function newProgress(tenantId, userId, at) {
   return { tenantId, userId, step: "agents", steps: initialSteps(), data: {}, version: 0, complete: false, updatedAt: at };
 }
-var STEP_NAMES, StepName, StepStatus, RepairAction, FAILURE_REPAIRS, FAILURE_CODES, FailureCodeSchema, StepState, Slug, RepoChoice, OnboardingData, OnboardingProgress, AdvanceRequest, AdvanceResponse, OnboardingEvent, FirstReview, onboardingPaths, PROGRESS_FIXTURE;
+var STEP_NAMES, StepName, StepStatus, RepairAction, FAILURE_REPAIRS, FAILURE_CODES, FailureCodeSchema, StepState, Slug, RepoChoiceShape, RepoChoice, OnboardingData, OnboardingProgress, AdvanceRequest, AdvanceResponse, OnboardingEvent, FirstReview, onboardingPaths, PROGRESS_FIXTURE;
 var init_onboarding = __esm({
   "../contracts/src/onboarding.ts"() {
     "use strict";
@@ -22212,8 +22303,8 @@ var init_onboarding = __esm({
       "sign-in-cancelled": { id: "retry-sign-in", text: "Sign-in was cancelled. Try again, or use the email link." },
       "agent-not-connected": { id: "retry-connect", text: "The agent has not connected yet. Run the plugin command shown, then check again." },
       "agent-oauth-denied": { id: "reauthorise", text: "Access was denied in the agent's own sign-in. Approve it there, then check again." },
-      "install-cancelled": { id: "retry-install", text: "The GitHub App install was cancelled. Retry the install, or use a native repository." },
-      "repo-unreachable": { id: "pick-another-repo", text: "That repository could not be read. Pick another, or re-run the install to grant access." },
+      "install-cancelled": { id: "retry-install", text: "The GitHub App install was cancelled. Retry the install, or continue with a native Overlane project (no GitHub account needed)." },
+      "repo-unreachable": { id: "pick-another-repo", text: "That repository could not be read. Pick another, continue with a native Overlane project, or re-run the connection to grant access." },
       "task-failed": { id: "retry-task", text: "The first task did not finish. Retry it, or pick a smaller template." },
       "review-unavailable": { id: "reload-review", text: "The review is not ready. Reload it, or open the task to see its evidence." },
       "invite-failed": { id: "retry-invite", text: "An invitation could not be sent. Check the address and try again, or skip this step." }
@@ -22227,13 +22318,14 @@ var init_onboarding = __esm({
       repair: RepairAction.optional()
     }).strict().refine((s) => s.status === "failed" === (s.repair !== void 0 && s.failure !== void 0), { message: "a failed step carries a failure code and a repair action, and no other step does" });
     Slug = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/);
-    RepoChoice = external_exports.object({
-      kind: external_exports.enum(["github", "native"]),
+    RepoChoiceShape = external_exports.object({
+      provider: Provider.default("overlane"),
       owner: external_exports.string().regex(/^[A-Za-z0-9-]{1,39}$/),
       name: external_exports.string().regex(/^[A-Za-z0-9._-]{1,100}$/),
-      /** The GitHub App installation number; absent for a native repository. */
-      installationId: external_exports.number().int().positive().optional()
+      /** Absent for a native repository. */
+      connection: external_exports.object({ installationId: external_exports.number().int().positive().optional(), externalId: external_exports.string().min(1).max(200).optional() }).strict().optional()
     }).strict();
+    RepoChoice = external_exports.preprocess(readLegacyRepoChoice, RepoChoiceShape);
     OnboardingData = external_exports.object({
       agents: external_exports.array(Slug).max(20).optional(),
       bots: external_exports.array(Slug).max(20).optional(),
@@ -22505,7 +22597,7 @@ var init_docs_service = __esm({
 function base3(tenantId, projectId) {
   return `/v1/tenants/${encodeURIComponent(tenantId)}/projects/${encodeURIComponent(projectId)}/review`;
 }
-var SEVERITIES, Severity, FINDING_STATUSES, FindingStatus, counts, Finding, REVIEW_SKIP_REASONS, SkipEntry, SkipList, TokenCapNotice, REVIEW_MODES, ReviewMode, REVIEW_TRIGGERS, REVIEW_STATUSES, ReviewSummary, ReviewRun, REVIEW_PRIVACY_TEXT, ReviewSettings, UpdateReviewSettingsRequest, PullFile, PullRequestSnapshot, ReviewRunRequest, ReviewRunResponse, ReviewStatusResponse, ReviewFindingsResponse, FEEDBACK_KINDS, FeedbackRequest, LearnedRule, FeedbackResponse, AutofixRequest, AutofixResponse, RawFinding, reviewPaths;
+var SEVERITIES, Severity, FINDING_STATUSES, FindingStatus, counts, Finding, REVIEW_SKIP_REASONS, SkipEntry, SkipList, TokenCapNotice, REVIEW_MODES, ReviewMode, REVIEW_TRIGGERS, REVIEW_STATUSES, ReviewSummary, ReviewRun, REVIEW_PRIVACY_TEXT, ReviewSettings, UpdateReviewSettingsRequest, PullFile, PullRequestSnapshot, MAX_PATCH_BYTES, ReviewRunRequest, ReviewRunResponse, ReviewStatusResponse, ReviewFindingsResponse, FEEDBACK_KINDS, FeedbackRequest, LearnedRule, FeedbackResponse, AutofixRequest, AutofixResponse, RawFinding, reviewPaths;
 var init_review = __esm({
   "../contracts/src/review.ts"() {
     "use strict";
@@ -22520,6 +22612,9 @@ var init_review = __esm({
       tenantId: TenantId,
       id: external_exports.string().min(1),
       projectId: ProjectId,
+      /** Where the change lives. A record from before ADR 0050 has none: read it with `reviewProvider`, which gives `github`. */
+      provider: Provider.optional(),
+      /** The repository key: `owner/name` for a connection, `overlane/<projectId>` or `patch/<projectId>` for native reviews. */
       repository: external_exports.string().min(1),
       pullNumber: external_exports.number().int().positive(),
       path: external_exports.string().min(1),
@@ -22573,6 +22668,7 @@ var init_review = __esm({
       tenantId: TenantId,
       id: external_exports.string().min(1),
       projectId: ProjectId,
+      provider: Provider.optional(),
       repository: external_exports.string().min(1),
       pullNumber: external_exports.number().int().positive(),
       headSha: CommitSha,
@@ -22613,6 +22709,7 @@ var init_review = __esm({
       patch: external_exports.string().max(4e5).optional()
     }).strict();
     PullRequestSnapshot = external_exports.object({
+      provider: Provider.optional(),
       repository: external_exports.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
       number: external_exports.number().int().positive(),
       headSha: CommitSha,
@@ -22623,10 +22720,20 @@ var init_review = __esm({
       fork: external_exports.boolean().default(false),
       files: external_exports.array(PullFile).max(3e3)
     }).strict();
+    MAX_PATCH_BYTES = 2e6;
     ReviewRunRequest = external_exports.object({
       requestId: external_exports.string().min(1).max(128),
       trigger: external_exports.enum(REVIEW_TRIGGERS).default("manual"),
       source: external_exports.discriminatedUnion("kind", [
+        external_exports.object({
+          kind: external_exports.literal("patch"),
+          diff: external_exports.string().min(1).max(MAX_PATCH_BYTES),
+          title: external_exports.string().max(500).optional(),
+          /** Names this change so a re-review of the same change merges its findings; defaults to `patch`. */
+          label: external_exports.string().regex(/^[A-Za-z0-9._-]{1,64}$/).optional(),
+          author: external_exports.string().min(1).max(100).optional()
+        }).strict(),
+        external_exports.object({ kind: external_exports.literal("overlane"), number: external_exports.number().int().positive(), repository: external_exports.string().min(1).optional() }).strict(),
         external_exports.object({ kind: external_exports.literal("github"), repository: external_exports.string().min(1), number: external_exports.number().int().positive() }).strict(),
         external_exports.object({ kind: external_exports.literal("inline"), pull: PullRequestSnapshot }).strict()
       ])
@@ -30784,25 +30891,25 @@ var require_dist = __commonJS({
 });
 
 // src/assets.ts
-import { basename as basename4, join as join24, resolve as resolve10 } from "node:path";
+import { basename as basename5, join as join24, resolve as resolve11 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageRoot(env = process.env) {
   const override = env["MVRX_PACKAGE_ROOT"];
   if (override !== void 0 && override !== "") return override;
-  return resolve10(fileURLToPath(new URL(".", import.meta.url)), "..");
+  return resolve11(fileURLToPath(new URL(".", import.meta.url)), "..");
 }
 function assetDir(env = process.env) {
   const override = env["MVRX_ASSET_DIR"];
   return override !== void 0 && override !== "" ? override : join24(packageRoot(env), "assets");
 }
 function assetFile(name2) {
-  return join24(assetDir(), basename4(name2));
+  return join24(assetDir(), basename5(name2));
 }
 var VERSION;
 var init_assets = __esm({
   "src/assets.ts"() {
     "use strict";
-    VERSION = true ? "0.1.124" : "0.0.0-dev";
+    VERSION = true ? "0.1.125" : "0.0.0-dev";
   }
 });
 
@@ -32220,7 +32327,7 @@ function createFileRegistry(...args2) {
         if (seen.has(protoFileName)) {
           continue;
         }
-        const dep = resolve13(protoFileName);
+        const dep = resolve14(protoFileName);
         if (!dep) {
           throw new Error(`Unable to resolve ${protoFileName}, imported by ${file2.name}`);
         }
@@ -32234,7 +32341,7 @@ function createFileRegistry(...args2) {
       return deps.concat(...deps.map(recurseDeps));
     };
     const input2 = args2[0];
-    const resolve13 = args2[1];
+    const resolve14 = args2[1];
     const seen = /* @__PURE__ */ new Set();
     for (const file2 of [input2, ...recurseDeps(input2)].reverse()) {
       addFile(file2, registry2);
@@ -34647,13 +34754,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url2) => {
         if (isFileURI(url2)) {
-          return new Promise((resolve13, reject) => {
+          return new Promise((resolve14, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url2, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve13(xhr.response);
+                resolve14(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -34849,9 +34956,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info2 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve13, reject) => {
+      return new Promise((resolve14, reject) => {
         Module["instantiateWasm"](info2, (mod, inst) => {
-          resolve13(receiveInstance(mod, inst));
+          resolve14(receiveInstance(mod, inst));
         });
       });
     }
@@ -36184,8 +36291,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve13, reject) => {
-      readyPromiseResolve = resolve13;
+    moduleRtn = new Promise((resolve14, reject) => {
+      readyPromiseResolve = resolve14;
       readyPromiseReject = reject;
     });
   }
@@ -38812,7 +38919,8 @@ async function buildSnapshot(options) {
   const manifest = SnapshotManifest.parse({
     schemaVersion: "1",
     tenantId: options.tenantId,
-    repository: options.repository,
+    ...options.repository !== void 0 ? { repository: options.repository } : {},
+    ...options.projectId !== void 0 ? { projectId: options.projectId } : {},
     commitSha: options.commitSha,
     ...options.branch !== void 0 ? { branch: options.branch } : {},
     indexers: [...indexers.values()].sort((a, b) => compareStrings(a.name, b.name) || compareStrings(a.version, b.version)),
@@ -38843,7 +38951,9 @@ async function uploadSnapshot(options) {
   const doFetch = options.fetch ?? fetch;
   const base4 = options.serviceUrl.replace(/\/+$/, "");
   const manifest = SnapshotManifest.parse(options.manifest);
-  const { tenantId, repository, commitSha } = manifest;
+  const { tenantId, repository, projectId, commitSha } = manifest;
+  const byProject = projectId !== void 0 && (repository === void 0 || options.byProject === true);
+  if (!byProject && repository === void 0) throw new Error("the manifest names neither a repository nor a project");
   const headers = { authorization: `Bearer ${options.token}`, "content-type": "application/json" };
   const send2 = async (path, body2) => {
     for (let attempt2 = 1; ; attempt2 += 1) {
@@ -38861,16 +38971,17 @@ async function uploadSnapshot(options) {
         failure4 = error62 instanceof Error ? error62.message : String(error62);
         if (attempt2 >= ATTEMPTS) throw new Error(`POST ${path} failed: ${failure4}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, (options.retryDelayMs ?? 500) * attempt2));
+      await new Promise((resolve14) => setTimeout(resolve14, (options.retryDelayMs ?? 500) * attempt2));
     }
   };
-  const manifestResponse = await send2(codePaths.uploadManifest(tenantId, repository.owner, repository.name), JSON.stringify(manifest));
+  const manifestPath = byProject ? codePaths.projectUploadManifest(tenantId, projectId ?? "") : codePaths.uploadManifest(tenantId, repository?.owner ?? "", repository?.name ?? "");
+  const manifestResponse = await send2(manifestPath, JSON.stringify(manifest));
   const { missing } = ManifestUploadResponse.parse(await manifestResponse.json());
   const wanted = new Set(missing);
   for (const hash2 of options.existing ?? []) wanted.delete(hash2);
   const maxShards = options.maxBatchShards ?? MAX_BATCH_SHARDS;
   const maxBytes = options.maxBatchBytes ?? MAX_BATCH_BYTES;
-  const shardsPath = codePaths.uploadShards(tenantId, repository.owner, repository.name, commitSha);
+  const shardsPath = byProject ? codePaths.projectUploadShards(tenantId, projectId ?? "", commitSha) : codePaths.uploadShards(tenantId, repository?.owner ?? "", repository?.name ?? "", commitSha);
   let batch = [];
   let batchBytes = 0;
   let uploadedShards = 0;
@@ -38894,7 +39005,7 @@ async function uploadSnapshot(options) {
     batchBytes += size;
   }
   await flush();
-  await send2(codePaths.publish(tenantId, repository.owner, repository.name, commitSha), "{}");
+  await send2(byProject ? codePaths.projectPublish(tenantId, projectId ?? "", commitSha) : codePaths.publish(tenantId, repository?.owner ?? "", repository?.name ?? "", commitSha), "{}");
   return { missing: missing.length, uploadedShards, batches };
 }
 var MAX_BATCH_SHARDS, MAX_BATCH_BYTES, ATTEMPTS, HttpError;
@@ -38939,7 +39050,7 @@ var init_oidc = __esm({
 // ../index-builder/src/run.ts
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readdir as readdir4, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join26, resolve as resolve11 } from "node:path";
+import { join as join26, resolve as resolve12 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 import { promisify as promisify2 } from "node:util";
 async function git3(root, args2) {
@@ -38960,9 +39071,11 @@ async function repositoryFromRemote(root) {
   }
 }
 async function snapshotFromArgs(values, env) {
-  const root = resolve11(typeof values["root"] === "string" ? values["root"] : process.cwd());
-  const repoText = (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
-  if (!repoText) throw new UsageError2("cannot determine the repository; pass --repo owner/name");
+  const root = resolve12(typeof values["root"] === "string" ? values["root"] : process.cwd());
+  const projectId = typeof values["project"] === "string" ? values["project"] : void 0;
+  if (projectId !== void 0 && !ProjectId.safeParse(projectId).success) throw new UsageError2(`--project must be a project identifier, got "${projectId}"`);
+  const repoText = projectId !== void 0 ? typeof values["repo"] === "string" ? values["repo"] : void 0 : (typeof values["repo"] === "string" ? values["repo"] : void 0) ?? env["GITHUB_REPOSITORY"] ?? await repositoryFromRemote(root);
+  if (!repoText && projectId === void 0) throw new UsageError2("cannot determine the repository; pass --project ID, or --repo owner/name");
   const commit = (typeof values["commit"] === "string" ? values["commit"] : void 0) ?? env["GITHUB_SHA"] ?? await git3(root, ["rev-parse", "HEAD"]);
   const branch = typeof values["branch"] === "string" ? values["branch"] : void 0;
   const tenant = (typeof values["tenant"] === "string" ? values["tenant"] : void 0) ?? env["HARNESS_TENANT"];
@@ -38970,9 +39083,10 @@ async function snapshotFromArgs(values, env) {
   const scip = Array.isArray(values["scip"]) ? values["scip"] : [];
   return buildSnapshot({
     repoRoot: root,
-    scipFiles: scip.map((file2) => resolve11(file2)),
+    scipFiles: scip.map((file2) => resolve12(file2)),
     tenantId: tenant,
-    repository: parseRepository(repoText),
+    ...repoText ? { repository: parseRepository(repoText) } : {},
+    ...projectId !== void 0 ? { projectId } : {},
     commitSha: commit,
     ...branch !== void 0 ? { branch } : {}
   });
@@ -38985,17 +39099,18 @@ async function runCli2(argv, env, out2 = console.log, err2 = console.error) {
       const outDir = values.out;
       if (!outDir) throw new UsageError2("build needs --out DIR");
       const built = await snapshotFromArgs({ ...values, tenant: values.tenant ?? env["HARNESS_TENANT"] ?? "local" }, env);
-      await writeSnapshot(resolve11(outDir), built);
-      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve11(outDir)}`);
+      await writeSnapshot(resolve12(outDir), built);
+      out2(`built ${built.shards.length} shards (${built.uncovered.length} files uncovered) into ${resolve12(outDir)}`);
       return 0;
     }
     if (command === "upload") {
       const service = values.service;
       if (!service) throw new UsageError2("upload needs --service URL");
       const built = await snapshotFromArgs(values, env);
-      const token = env["ACTIONS_ID_TOKEN_REQUEST_URL"] ? await getOidcToken(values.audience ?? service, env) : env["HARNESS_TOKEN"];
-      if (!token) throw new UsageError2("no credentials: run in GitHub Actions with id-token: write, or set HARNESS_TOKEN");
-      const result = await uploadSnapshot({ serviceUrl: service, token, manifest: built.manifest, shards: built.shards });
+      const byProject = values.project !== void 0;
+      const token = !byProject && env["ACTIONS_ID_TOKEN_REQUEST_URL"] ? await getOidcToken(values.audience ?? service, env) : env["HARNESS_TOKEN"];
+      if (!token) throw new UsageError2(byProject ? "no credentials: set HARNESS_TOKEN" : "no credentials: run in GitHub Actions with id-token: write, or set HARNESS_TOKEN");
+      const result = await uploadSnapshot({ serviceUrl: service, token, manifest: built.manifest, shards: built.shards, ...byProject ? { byProject: true } : {} });
       out2(`published ${built.manifest.commitSha}: ${built.shards.length} shards, ${result.missing} new, ${result.batches} batches`);
       return 0;
     }
@@ -39030,10 +39145,12 @@ var init_run = __esm({
     init_upload();
     execFileAsync2 = promisify2(execFile2);
     USAGE = `usage:
-  mvrx-index build  --scip FILE [--scip FILE ...] --out DIR [--repo owner/name] [--tenant ID] [--commit SHA] [--branch B] [--root DIR]
-  mvrx-index upload --service URL --tenant ID --repo owner/name --commit SHA [--branch B] [--scip FILE ...] [--root DIR] [--audience URL]
+  mvrx-index build  --scip FILE [--scip FILE ...] --out DIR [--project ID | --repo owner/name] [--tenant ID] [--commit SHA] [--branch B] [--root DIR]
+  mvrx-index upload --service URL --tenant ID (--project ID | --repo owner/name) --commit SHA [--branch B] [--scip FILE ...] [--root DIR] [--audience URL]
 
-Authentication for upload: the GitHub Actions OIDC token when ACTIONS_ID_TOKEN_REQUEST_URL is set, otherwise HARNESS_TOKEN.
+--project indexes an Overlane project (no GitHub repository needed) and uploads with HARNESS_TOKEN.
+--repo names a GitHub repository; in GitHub Actions the OIDC token is used when ACTIONS_ID_TOKEN_REQUEST_URL is set.
+Authentication for upload: HARNESS_TOKEN (always for --project), or the GitHub Actions OIDC token for --repo.
 `;
     UsageError2 = class extends Error {
     };
@@ -39043,6 +39160,7 @@ Authentication for upload: the GitHub Actions OIDC token when ACTIONS_ID_TOKEN_R
       service: { type: "string" },
       tenant: { type: "string" },
       repo: { type: "string" },
+      project: { type: "string" },
       commit: { type: "string" },
       branch: { type: "string" },
       root: { type: "string" },
@@ -42614,14 +42732,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve13();
+      resolve14();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -44417,7 +44535,7 @@ var init_src_CX2iR2pK = __esm({
         const flowStartedAt = Date.now();
         let onAbort;
         let cleanupMessageId;
-        return new Promise((resolve13, reject) => {
+        return new Promise((resolve14, reject) => {
           const earlyReject = (error62) => {
             reject(error62);
           };
@@ -44485,7 +44603,7 @@ var init_src_CX2iR2pK = __esm({
             }
             if (decoded.kind === "invalid") return reject(decoded.error);
             if (decoded.kind === "input_required") {
-              if (options?.allowInputRequired === true) return resolve13(manualInputRequiredValue(decoded));
+              if (options?.allowInputRequired === true) return resolve14(manualInputRequiredValue(decoded));
               const flow = {
                 codec: codec2,
                 request,
@@ -44497,11 +44615,11 @@ var init_src_CX2iR2pK = __esm({
                   params
                 }, resultSchema2, legOptions)
               };
-              return resolve13(this._resolveNonCompleteResult(decoded, flow));
+              return resolve14(this._resolveNonCompleteResult(decoded, flow));
             }
             const result = decoded.result;
             validateStandardSchema(resultSchema2, result).then((parseResult) => {
-              if (parseResult.success) resolve13(parseResult.data);
+              if (parseResult.success) resolve14(parseResult.data);
               else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
             }, reject);
           });
@@ -47317,7 +47435,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
         const schOrFunc = root.refs[ref];
         if (schOrFunc) return schOrFunc;
-        let _sch = resolve13.call(this, root, ref);
+        let _sch = resolve14.call(this, root, ref);
         if (_sch === void 0) {
           const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
           const { schemaId } = this.opts;
@@ -47343,7 +47461,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       function sameSchemaEnv(s1, s2) {
         return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
       }
-      function resolve13(root, ref) {
+      function resolve14(root, ref) {
         let sch;
         while (typeof (sch = this.refs[ref]) == "string") ref = sch;
         return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -47793,7 +47911,7 @@ var init_ajvProvider_CEoC_sr = __esm({
         else if (typeof uri === "object") uri = parse5(serialize(uri, options), options);
         return uri;
       }
-      function resolve13(baseURI, relativeURI, options) {
+      function resolve14(baseURI, relativeURI, options) {
         const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
         const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
         schemelessOptions.skipEscape = true;
@@ -47967,7 +48085,7 @@ var init_ajvProvider_CEoC_sr = __esm({
       const fastUri = {
         SCHEMES,
         normalize,
-        resolve: resolve13,
+        resolve: resolve14,
         resolveComponent,
         equal,
         serialize,
@@ -53664,7 +53782,7 @@ var init_stdio = __esm({
       }
       send(message) {
         if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-        return new Promise((resolve13, reject) => {
+        return new Promise((resolve14, reject) => {
           const json2 = serializeMessage(message);
           let settled = false;
           const onError = (error62) => {
@@ -53679,14 +53797,14 @@ var init_stdio = __esm({
             settled = true;
             this._stdout.off("error", onError);
             this._stdout.off("drain", onDrain);
-            resolve13();
+            resolve14();
           };
           this._stdout.once("error", onError);
           if (this._stdout.write(json2)) {
             if (settled) return;
             settled = true;
             this._stdout.off("error", onError);
-            resolve13();
+            resolve14();
           } else if (!settled) this._stdout.once("drain", onDrain);
         });
       }
@@ -53740,14 +53858,14 @@ var init_stdio = __esm({
       */
       async whenRequestsAnswered(timeoutMs) {
         if (this._closed || this._pendingRequests.size === 0) return true;
-        return await new Promise((resolve13) => {
+        return await new Promise((resolve14) => {
           const waiter = () => {
             clearTimeout(timer);
-            resolve13(true);
+            resolve14(true);
           };
           const timer = setTimeout(() => {
             this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-            resolve13(false);
+            resolve14(false);
           }, timeoutMs);
           this._drainWaiters.push(waiter);
         });
@@ -53972,9 +54090,9 @@ var init_config = __esm({
 
 // ../code-shim/src/local.ts
 import { readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve12, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve13, sep as sep2 } from "node:path";
 function resolveInside(root, path) {
-  const absolute = resolve12(root, path);
+  const absolute = resolve13(root, path);
   const rel = relative3(root, absolute);
   if (rel.length === 0 || rel.startsWith("..") || isAbsolute2(rel)) return null;
   return absolute;
@@ -55448,19 +55566,19 @@ function pkcePair() {
   return { verifier, challenge: base64url3(createHash("sha256").update(verifier).digest()) };
 }
 function listen(server, port) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const onError = (error62) => reject(error62);
     server.once("error", onError);
     server.listen(port, "127.0.0.1", () => {
       server.off("error", onError);
-      resolve13();
+      resolve14();
     });
   });
 }
 async function startLoopback(preferredPort, state) {
   let settle2;
-  const code2 = new Promise((resolve13, reject) => {
-    settle2 = { resolve: resolve13, reject };
+  const code2 = new Promise((resolve14, reject) => {
+    settle2 = { resolve: resolve14, reject };
   });
   code2.catch(() => void 0);
   const server = createServer((request, response) => {
@@ -55648,7 +55766,7 @@ async function requireToken(deps, serviceUrl) {
 
 // ../cli/src/project.ts
 init_src();
-import { join as join5 } from "node:path";
+import { basename, join as join5 } from "node:path";
 var REMOTE_PATTERNS = [
   /^(?:https?|git|ssh):\/\/(?:[^@/]+@)?github\.com(?::\d+)?\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i,
   /^(?:[^@/]+@)?github\.com:([^/]+)\/([^/]+?)(?:\.git)?\/?$/i
@@ -55663,21 +55781,49 @@ function parseGitHubRemote(url2) {
   }
   return null;
 }
-async function detectProject(deps) {
+function parseProvider(value) {
+  if (value === void 0) return void 0;
+  if (PROVIDERS.includes(value)) return value;
+  throw new UsageError(`--provider must be one of ${PROVIDERS.join(", ")}`, { hint: "overlane connect --provider overlane" });
+}
+function safeName(text) {
+  const cleaned = text.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[-.]+|-+$/g, "");
+  return cleaned.slice(0, 100) === "" ? "project" : cleaned.slice(0, 100);
+}
+function projectLabel(project) {
+  return project.repository === void 0 ? project.name : `${project.repository.owner}/${project.repository.name}`;
+}
+function projectSummary(project) {
+  return { provider: project.provider, ...project.repository === void 0 ? {} : { owner: project.repository.owner }, name: project.repository?.name ?? project.name, root: project.root };
+}
+function projectRequest(project) {
+  if (project.provider === "github" && project.repository !== void 0) {
+    return { provider: "github", repository: project.repository, name: project.name };
+  }
+  return { provider: "overlane", name: project.name };
+}
+async function detectProject(deps, choice = {}) {
   const top = await deps.exec("git", ["rev-parse", "--show-toplevel"], { cwd: deps.paths.cwd });
   if (top.code !== 0 || top.stdout.trim().length === 0) {
-    throw new UsageError("not inside a git repository (or git is not installed); run overlane from a GitHub-hosted project");
+    throw new UsageError("not inside a git repository (or git is not installed); run overlane from your project folder (`git init` makes one)");
   }
   const root = top.stdout.trim();
+  if (choice.name !== void 0 && (choice.name.trim().length === 0 || choice.name.length > 100)) throw new UsageError("--name must be 1 to 100 characters");
   const remote = await deps.exec("git", ["remote", "get-url", "origin"], { cwd: root });
-  if (remote.code !== 0 || remote.stdout.trim().length === 0) {
-    throw new UsageError("the repository has no `origin` remote; add the GitHub remote and run overlane again");
+  const originUrl = remote.code === 0 ? remote.stdout.trim() : "";
+  const github = originUrl.length === 0 ? null : parseGitHubRemote(originUrl);
+  const wanted = choice.provider;
+  if (wanted === "gitlab") {
+    throw new UsageError("--provider gitlab is not available from the CLI yet; use --provider overlane (the default) and connect GitLab from the web app", { hint: "overlane connect --provider overlane" });
+  }
+  if (wanted === "github" && github === null) {
+    const why = originUrl.length === 0 ? "this repository has no `origin` remote" : `origin is ${originUrl}, which is not a github.com repository`;
+    throw new UsageError(`--provider github needs a github.com origin, and ${why}. Leave --provider off to make a native Overlane project, or add the GitHub remote first`, { hint: "overlane connect --provider overlane" });
   }
-  const repository = parseGitHubRemote(remote.stdout);
-  if (repository === null) {
-    throw new UsageError(`origin is ${remote.stdout.trim()}, which is not a github.com repository; only GitHub projects are supported`);
+  if (github !== null && wanted !== "overlane") {
+    return { root, provider: "github", name: choice.name ?? github.name, repository: github };
   }
-  return { root, repository };
+  return { root, provider: "overlane", name: choice.name ?? (basename(root).slice(0, 100) || "project") };
 }
 async function headCommit(deps, root) {
   const head = await deps.exec("git", ["rev-parse", "HEAD"], { cwd: root });
@@ -55917,7 +56063,7 @@ var DEFAULT_SERVICE_URL = "https://api.overlane.dev";
 var CONNECT_STEPS = {
   "sign-up": "sign in through the browser (OAuth with PKCE), or use HARNESS_TOKEN",
   agents: "register the plugin with each agent's own commands (no vendor token is asked for)",
-  repo: "bind this GitHub project to the service",
+  repo: "bind this project to the service: a native Overlane project by default, or your GitHub repository",
   "first-task": 'start your first task with `overlane task new "<title>"`',
   "first-review": "read the first review in the web app",
   invite: "invite teammates from the web app (optional, never blocks)"
@@ -55966,10 +56112,9 @@ async function connect(deps, options) {
   if (active.length === 0) {
     throw new CliError("none of the selected agents is installed, so there is nothing to connect", { code: "no_agent", exit: EXIT.conflict, hint: "overlane doctor" });
   }
-  const project = await detectProject(deps);
+  const project = await detectProject(deps, { name: options.name, provider: options.provider });
   const root = project.root;
-  const { repository } = project;
-  say(deps, `Project: ${repository.owner}/${repository.name} at ${root}`);
+  say(deps, `Project: ${projectLabel(project)}${project.provider === "overlane" ? " (native Overlane project; no GitHub account needed)" : " (GitHub)"} at ${root}`);
   const existing = readBindingFile(root);
   const serviceInput = options.service ?? deps.env["HARNESS_SERVICE_URL"] ?? (existing.kind === "ok" ? existing.binding.serviceUrl : DEFAULT_SERVICE_URL);
   if (serviceInput === void 0 || serviceInput.length === 0) {
@@ -56017,7 +56162,7 @@ async function connect(deps, options) {
   say(deps, `Steps (the same names as the web onboarding): ${STEP_NAMES.join(", ")}`);
   say(deps, "Plan");
   say(deps, `  sign-in: ${existingToken === null ? `browser sign-in to ${serviceUrl} (OAuth with PKCE), token kept in the OS keychain or a 0600 file in your user config directory` : `${describeStore(deps, existingToken.source)}`}`);
-  say(deps, `  service: GET ${serviceUrl}/v1/me, then create or look up the project for ${repository.owner}/${repository.name}`);
+  say(deps, `  service: GET ${serviceUrl}/v1/me, then create or look up the project ${projectLabel(project)}`);
   for (const step2 of steps) say(deps, `  ${step2.agent}: ${step2.summary}
     $ ${formatCommand(step2)}`);
   if (codexEdit !== null) {
@@ -56045,7 +56190,7 @@ async function connect(deps, options) {
       service: serviceUrl,
       requests: [
         { method: "GET", path: apiPaths.whoami, note: existingToken === null ? "after browser sign-in" : "with the stored token" },
-        { method: "POST", path: apiPaths.projects("<tenantId from /v1/me>"), body: { repository, name: repository.name }, note: "creates the project or returns the existing one" },
+        { method: "POST", path: apiPaths.projects("<tenantId from /v1/me>"), body: projectRequest(project), note: "creates the project or returns the existing one" },
         { method: "GET", path: releasePaths.publicKey(), note: "the release-signing key; a failure here does not fail connect" }
       ],
       commands: steps.map((step2) => formatCommand(step2)),
@@ -56065,7 +56210,7 @@ async function connect(deps, options) {
     }
     if (!await deps.confirm("Apply this plan?")) {
       say(deps, "Cancelled; nothing changed.");
-      return { data: emptyResult(repository, root, serviceUrl, infos, true) };
+      return { data: emptyResult(project, serviceUrl, infos, true) };
     }
   }
   const token = await ensureToken(deps, serviceUrl);
@@ -56074,8 +56219,7 @@ async function connect(deps, options) {
   const wrote = [];
   const applied = [];
   const me = await whoAmI(deps, serviceUrl, token.token);
-  const request = { repository, name: repository.name };
-  const record3 = await createProject(deps, serviceUrl, me.tenantId, token.token, request);
+  const record3 = await createProject(deps, serviceUrl, me.tenantId, token.token, projectRequest(project));
   if (record3.tenantId !== me.tenantId) throw new CliError("the service returned a project for another tenant");
   const servicePublicKey = await fetchServicePublicKey(deps, serviceUrl, token.token) ?? (existing.kind === "ok" ? existing.binding.servicePublicKey ?? null : null);
   const binding = ProjectBinding.parse({
@@ -56114,7 +56258,7 @@ async function connect(deps, options) {
     owned.binding = true;
     if (excludeNeeded && await addExclude(deps, root)) owned.excludeLine = true;
     say(deps, `[repo] ${CONNECT_STEPS.repo}: done`);
-    const next = await reportStep(deps, serviceUrl, token.token, me.tenantId, "repo", { repo: { kind: "github", owner: repository.owner, name: repository.name } });
+    const next = await reportStep(deps, serviceUrl, token.token, me.tenantId, "repo", { repo: repoChoice(project) });
     if (next !== null) say(deps, `Next in onboarding: ${next === "repo" ? "first-task" : next} (${CONNECT_STEPS[next === "repo" ? "first-task" : next]})`);
   } finally {
     if (previousOwned !== null || owned.binding || owned.claude !== void 0 || owned.codex !== void 0) writeOwned(root, owned);
@@ -56128,7 +56272,7 @@ async function connect(deps, options) {
   for (const line2 of renderReports(reports)) say(deps, `  ${line2}`);
   return {
     data: {
-      project: { owner: repository.owner, name: repository.name, root },
+      project: projectSummary(project),
       serviceUrl,
       tenantId: binding.tenantId,
       projectId: binding.projectId,
@@ -56142,9 +56286,13 @@ async function connect(deps, options) {
     }
   };
 }
-function emptyResult(repository, root, serviceUrl, infos, cancelled) {
+function repoChoice(project) {
+  if (project.provider === "github" && project.repository !== void 0) return { provider: "github", owner: project.repository.owner, name: project.repository.name };
+  return { provider: "overlane", owner: "native", name: safeName(project.name) };
+}
+function emptyResult(project, serviceUrl, infos, cancelled) {
   return {
-    project: { owner: repository.owner, name: repository.name, root },
+    project: projectSummary(project),
     serviceUrl,
     credentials: "unchanged",
     agents: infos.map((info2) => ({ agent: info2.agent, installed: info2.installed, detail: info2.detail })),
@@ -56207,8 +56355,8 @@ function withTimeout(deps, ms) {
 }
 async function attempt(deps, ms, work) {
   let timer;
-  const deadline = new Promise((resolve13) => {
-    timer = setTimeout(() => resolve13("unreachable"), ms);
+  const deadline = new Promise((resolve14) => {
+    timer = setTimeout(() => resolve14("unreachable"), ms);
   });
   try {
     return await Promise.race([work(withTimeout(deps, ms)).catch((error62) => error62 instanceof ServiceError && error62.exit === EXIT.auth ? "unauthenticated" : "unreachable"), deadline]);
@@ -57347,13 +57495,13 @@ async function readPlan(repoDir) {
 init_src();
 init_zod();
 import { mkdir as mkdir2, readdir as readdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname7, join as join17, resolve as resolve6 } from "node:path";
+import { basename as basename3, dirname as dirname7, join as join17, resolve as resolve6 } from "node:path";
 
 // ../kit/src/detect.ts
 var import_yaml2 = __toESM(require_dist(), 1);
 init_src();
 import { readdir as readdir2, readFile as readFile2 } from "node:fs/promises";
-import { basename, join as join16, resolve as resolve5 } from "node:path";
+import { basename as basename2, join as join16, resolve as resolve5 } from "node:path";
 var KINDS = ["typecheck", "lint", "build", "test"];
 async function readOptional(file2) {
   try {
@@ -57498,7 +57646,7 @@ async function draftPlanForExisting(repoDir, opts = {}) {
     } catch {
     }
   }
-  const name2 = (opts.name ?? pkgName ?? basename(root)).slice(0, 100);
+  const name2 = (opts.name ?? pkgName ?? basename2(root)).slice(0, 100);
   const milestone = opts.milestoneId ?? "M1";
   const allowedPaths = opts.allowedPaths ?? ["."];
   const tasks = [];
@@ -57696,7 +57844,7 @@ async function importSpecKit(repoDir) {
   const constitution = await findConstitution(root);
   const parsedConstitution = constitution ? parseConstitution(constitution.text) : void 0;
   const firstInput = /\*\*Input\*\*:\s*User description:\s*"(.*)"/.exec(features[0]?.specText ?? "")?.[1];
-  const name2 = (parsedConstitution?.name ?? basename2(root)).slice(0, 100);
+  const name2 = (parsedConstitution?.name ?? basename3(root)).slice(0, 100);
   const goal = (parsedConstitution?.goal ?? firstInput ?? `Deliver ${name2}.`).slice(0, 2e3);
   const multi = features.length > 1;
   const counts2 = /* @__PURE__ */ new Map();
@@ -59069,7 +59217,7 @@ var contextCommand = defineCommand({
 init_src();
 init_zod();
 import { existsSync as existsSync4, readFileSync as readFileSync7 } from "node:fs";
-import { basename as basename3, resolve as resolve7 } from "node:path";
+import { basename as basename4, resolve as resolve7 } from "node:path";
 var SERVICE_FLAG = { name: "service", type: "string", value: "URL", description: "The service address (default: HARNESS_SERVICE_URL, then the project's binding, then the hosted service)" };
 var TEAM_FLAG = { name: "team", type: "string", value: "TENANT_ID", description: "The team (tenant) to act on (default: the one your token belongs to)" };
 var ECOSYSTEM_FLAG = { name: "ecosystem", type: "string", enum: DOCS_ECOSYSTEMS, default: "npm", description: "Where the library is published" };
@@ -59181,7 +59329,7 @@ function readLockfiles(paths) {
   const files = paths.length > 0 ? paths : DEFAULT_LOCKFILES.filter((name2) => existsSync4(resolve7(name2)));
   if (files.length === 0) throw new UsageError("no lockfile found in this directory", { hint: "overlane lib pins --project <id> --lockfile pnpm-lock.yaml" });
   return files.map((file2) => {
-    const kind = LOCKFILES.find(([pattern]) => pattern.test(basename3(file2)))?.[1];
+    const kind = LOCKFILES.find(([pattern]) => pattern.test(basename4(file2)))?.[1];
     if (kind === void 0) throw new UsageError(`${file2} is not a lockfile this command reads`, { hint: "supported: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, uv.lock, Cargo.lock, go.sum" });
     try {
       return { kind, content: readFileSync7(resolve7(file2), "utf8") };
@@ -59277,7 +59425,7 @@ var libAddCommand = defineCommand({
     if (version2 === void 0 || files.length === 0) throw new UsageError("add needs --version and at least one --file", { hint: "overlane lib add <library> --version 1.0.0 --file README.md" });
     const pages = files.map((file2) => {
       try {
-        return { title: basename3(file2), text: readFileSync7(resolve7(file2), "utf8") };
+        return { title: basename4(file2), text: readFileSync7(resolve7(file2), "utf8") };
       } catch {
         throw new UsageError(`cannot read ${file2}`);
       }
@@ -59353,7 +59501,7 @@ async function post(deps, base4, path, body2) {
   return { status: response.status, json: json2 };
 }
 function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 async function deviceLogin(deps, service, options) {
   const started = await post(deps, service, "/auth/device", {});
@@ -60951,6 +61099,7 @@ var loopCommands = [loopListCommand, loopNewCommand, loopSetCommand, loopFireCom
 // ../cli/src/commands/review.ts
 init_src();
 import { randomUUID as randomUUID7 } from "node:crypto";
+import { resolve as resolve9 } from "node:path";
 var common7 = { needsAuth: true, needsNetwork: true };
 var requestId7 = () => `cli-${randomUUID7()}`;
 async function connected3(inv) {
@@ -60969,9 +61118,38 @@ async function repositoryOf(inv) {
   }
   const remote = await inv.deps.exec("git", ["remote", "get-url", "origin"], { cwd: inv.deps.paths.cwd });
   const match = /github\.com[:/]([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\s*$/.exec(remote.stdout.trim());
-  if (remote.code !== 0 || match === null) throw new UsageError("could not read the repository from the origin remote", { hint: "overlane review run 7 --repo OWNER/NAME" });
+  if (remote.code !== 0 || match === null) throw new UsageError("could not read a GitHub repository from the origin remote; to review a change without one, give the diff", { hint: "overlane review run --diff change.patch" });
   return `${match[1]}/${match[2]}`;
 }
+async function diffOf(inv) {
+  const flag = textFlag(inv, "diff");
+  const pull = inv.positionals[0];
+  if (flag !== void 0 && pull !== void 0) throw new UsageError("give a pull request number or --diff, not both", { hint: "overlane review run --diff change.patch" });
+  let from;
+  let text;
+  if (flag !== void 0) {
+    if (flag === "-") {
+      if (inv.deps.stdin === void 0) throw new UsageError("--diff - reads standard input, which is not available here", { hint: "overlane review run --diff change.patch" });
+      from = "standard input";
+      text = await inv.deps.stdin.read();
+    } else {
+      from = flag;
+      text = readText(resolve9(inv.deps.paths.cwd, flag));
+      if (text === null) throw new UsageError(`could not read the diff file ${flag}`, { hint: "git diff > change.patch && overlane review run --diff change.patch" });
+    }
+  } else if (pull === void 0) {
+    if (inv.deps.stdin === void 0 || inv.deps.stdin.isTTY) {
+      throw new UsageError("nothing to review: give a diff (--diff change.patch, or pipe one in) or a pull request number", { hint: "overlane review run --diff change.patch" });
+    }
+    from = "standard input";
+    text = await inv.deps.stdin.read();
+  } else {
+    return void 0;
+  }
+  if (text.trim().length === 0) throw new UsageError(`the diff from ${from} is empty: there is nothing to review`, { hint: "git diff > change.patch && overlane review run --diff change.patch" });
+  if (text.length > MAX_PATCH_BYTES) throw new UsageError(`the diff is larger than ${MAX_PATCH_BYTES} characters; review it in parts`);
+  return { text, from };
+}
 function id(inv, what) {
   const value = inv.positionals[0];
   if (value === void 0) throw new UsageError(`${what} needs a finding ID`, { hint: "overlane review findings" });
@@ -60980,22 +61158,39 @@ function id(inv, what) {
 var FINDING_LINE = (finding) => `${finding.status.padEnd(9)} ${finding.severity.padEnd(8)} ${finding.path}:${finding.line}  ${finding.rule ?? "see reason"}  ${finding.id}`;
 var reviewRunCommand = defineCommand({
   path: ["review", "run"],
-  summary: "Review a GitHub pull request now and report the findings",
-  description: "Runs the review service on a pull request: triage, review passes under the per-PR token cap, inline findings and one updated summary. Until the project owner enables comments (`overlane review settings set --mode comments`) the run is log-only and posts nothing. Pull request text and code are data, never instructions. Needs the GitHub App's pull-request access; without it the command says the live leg is pending.",
-  args: [{ name: "pull", required: true, description: "The pull request number" }],
-  flags: [{ name: "repo", type: "string", value: "OWNER/NAME", description: "The repository (default: the origin remote of this working copy)" }],
-  examples: ["overlane review run 7", "overlane review run 7 --repo acme/app --dry-run"],
+  summary: "Review a diff (no repository needed) or a pull request now and report the findings",
+  description: "Runs the review service. The native way is a diff: `--diff change.patch`, or `--diff -` (or a pipe) to read it from standard input; it needs no repository and no GitHub account, and it is log-only. A pull request number reviews a pull request instead (native pull requests arrive with Overlane git; a GitHub one needs the GitHub connection and the App's pull-request access, otherwise the command says the live leg is pending). Deterministic checks (secret scan, static rules, diff validation) run first and alone when no model is available; a model pass is an optional second pass under the per-PR token cap. Until the project owner enables comments (`overlane review settings set --mode comments`) a pull request run is log-only and posts nothing. Diff text and code are data, never instructions.",
+  args: [{ name: "pull", required: false, description: "A pull request number (omit it to review a diff)" }],
+  flags: [
+    { name: "diff", type: "string", value: "FILE", description: "Review this unified diff (a file, or - for standard input); needs no repository" },
+    { name: "title", type: "string", value: "TEXT", description: "A title for the diff, shown in the summary" },
+    { name: "label", type: "string", value: "NAME", description: "Names the diff so a re-review of the same change merges its findings (default: patch)" },
+    { name: "repo", type: "string", value: "OWNER/NAME", description: "For a pull request number: the GitHub repository (default: the origin remote); not used with --diff" }
+  ],
+  examples: ["overlane review run --diff change.patch", "overlane review run --diff -", "overlane review run 7 --repo acme/app --dry-run"],
   effect: "write",
   ...common7,
-  keywords: ["code review", "review pull request", "review pr", "ai review", "check my pr", "findings"],
+  keywords: ["code review", "review diff", "review patch", "review pull request", "review pr", "check my pr", "findings"],
   result: withDryRun(ReviewRunResponse),
   text: (d) => "run" in d ? [`${d.run.status} review of ${d.run.repository}#${d.run.pullNumber} (${d.run.mode}${d.run.posted ? ", posted" : ", nothing posted"}): ${d.run.findings.open} open, ${d.run.findings.fixed} fixed, ${d.run.findings.dismissed} dismissed.`, ...d.findings.filter((finding) => finding.status === "open").map(FINDING_LINE)] : [],
   handler: async (inv) => {
+    const diff = await diffOf(inv);
+    if (diff !== void 0) {
+      const title = textFlag(inv, "title");
+      const label = textFlag(inv, "label");
+      const source = { kind: "patch", diff: diff.text, ...title === void 0 ? {} : { title }, ...label === void 0 ? {} : { label } };
+      const patchBody = { requestId: requestId7(), trigger: "manual", source };
+      if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, { ...patchBody, source: { ...source, diff: `<${diff.text.length} characters from ${diff.from}>` } }, "runs the deterministic checks on the diff, then an optional model pass; nothing is posted");
+      const sent = await connected3(inv);
+      const patched = await sent.call(ReviewRunResponse, "POST", reviewPaths.runs(sent.tenantId, sent.projectId), patchBody);
+      if (patched.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
+      return { data: patched };
+    }
     const number4 = Number(inv.positionals[0]);
-    if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number", { hint: "overlane review run 7" });
+    if (!Number.isInteger(number4) || number4 < 1) throw new UsageError("run needs a pull request number, or a diff with --diff", { hint: "overlane review run --diff change.patch" });
     const repository = await repositoryOf(inv);
     const body2 = { requestId: requestId7(), trigger: "manual", source: { kind: "github", repository, number: number4 } };
-    if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub App and runs the review");
+    if (inv.dryRun) return planned3(inv, "POST", reviewPaths.runs, body2, "reads the pull request through the GitHub connection and runs the review");
     const { call: call2, tenantId, projectId } = await connected3(inv);
     const result = await call2(ReviewRunResponse, "POST", reviewPaths.runs(tenantId, projectId), body2);
     if (result.run.status === "partial") say(inv.deps, "Partial review: the token cap was reached. The summary lists what was not covered.");
@@ -61106,7 +61301,7 @@ var reviewSettingsCommand = defineCommand({
 var reviewSettingsSetCommand = defineCommand({
   path: ["review", "settings", "set"],
   summary: "Change the review mode, token cap or skip patterns",
-  description: "Sets how review behaves for the project. Enabling comments (`--mode comments`) lets review post inline comments and the summary on GitHub; it is log-only until then. An agent or a person can change them; a read-only viewer cannot.",
+  description: "Sets how review behaves for the project. Enabling comments (`--mode comments`) lets review post inline comments and the summary on the pull request (GitHub today; native pull requests with Overlane git); it is log-only until then. A diff review never posts. An agent or a person can change them; a read-only viewer cannot.",
   flags: [
     { name: "mode", type: "string", enum: ["log_only", "comments"], description: "log_only records findings only; comments posts them" },
     { name: "token-cap", type: "string", value: "N", description: "Most tokens one pull request may use (1,000 to 2,000,000)" },
@@ -61192,7 +61387,7 @@ function rootHelp(specs, version2) {
   const lines = [
     ROOT_FIRST_LINE,
     "",
-    `overlane${version2 === "" ? "" : ` ${version2}`} - connect a GitHub project to Overlane, and run its tasks`,
+    `overlane${version2 === "" ? "" : ` ${version2}`} - connect a project to Overlane (no GitHub account needed), and run its tasks`,
     "",
     "Usage: overlane <command> [flags]      overlane <command> --help      overlane schema <command>",
     "",
@@ -61503,7 +61698,7 @@ init_zod();
 // ../cli/src/connect-result.ts
 init_zod();
 var ConnectResult = external_exports.object({
-  project: external_exports.object({ owner: external_exports.string(), name: external_exports.string(), root: external_exports.string() }),
+  project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
   serviceUrl: external_exports.string(),
   tenantId: external_exports.string().optional(),
   projectId: external_exports.string().optional(),
@@ -61648,10 +61843,10 @@ async function disconnect(deps, options) {
 }
 
 // ../cli/src/doctor.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 init_zod();
 var DoctorResult = external_exports.object({
-  project: external_exports.object({ owner: external_exports.string(), name: external_exports.string(), root: external_exports.string() }),
+  project: external_exports.object({ provider: external_exports.enum(["overlane", "github", "gitlab"]).optional(), owner: external_exports.string().optional(), name: external_exports.string(), root: external_exports.string() }),
   binding: external_exports.enum(["ok", "missing", "invalid"]),
   service: external_exports.string().optional(),
   credentials: external_exports.string().optional(),
@@ -61668,13 +61863,13 @@ async function doctor(deps, options) {
   const root = project.root;
   const binding = readBindingFile(root);
   const owned = readOwned(root);
-  const marketplaceRoot2 = resolve9(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
+  const marketplaceRoot2 = resolve10(options.marketplaceRoot ?? owned?.marketplaceRoot ?? deps.paths.defaultMarketplaceRoot);
   const infos = await detectAgents(deps, options.agents, root);
   let service = "reachable";
   let hasToken = false;
   let credentials;
   let checked2 = false;
-  say(deps, `Project: ${project.repository.owner}/${project.repository.name} at ${root}`);
+  say(deps, `Project: ${projectLabel(project)} at ${root}`);
   if (binding.kind === "ok") {
     const { serviceUrl } = binding.binding;
     const token = await findToken(deps, serviceUrl);
@@ -61698,7 +61893,7 @@ async function doctor(deps, options) {
   const installedStates = reports.filter((report2, index) => infos[index]?.installed === true).map((report2) => report2.state);
   const ready = installedStates.length > 0 && installedStates.every((state) => state === "ready");
   const data = {
-    project: { owner: project.repository.owner, name: project.repository.name, root },
+    project: projectSummary(project),
     binding: binding.kind,
     ...binding.kind === "ok" ? { service: binding.binding.serviceUrl } : {},
     ...credentials === void 0 ? {} : { credentials },
@@ -61818,7 +62013,7 @@ function newPlan(name2, goal, withCiTask) {
         id: "T001",
         title: "Add CI",
         milestone: "M1",
-        outcome: "A GitHub Actions workflow runs the project's install, typecheck and test commands on every push and pull request.",
+        outcome: "A CI workflow (GitHub Actions today; Overlane CI once native CI is available) runs the project's install, typecheck and test commands on every push and pull request.",
         allowedPaths: [".github/**"],
         acceptance: ["A workflow in .github/workflows runs on push and pull_request"],
         verification: ['test -n "$(ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null)"'],
@@ -61857,7 +62052,8 @@ function schedulerSetup(projectId) {
 }
 async function connectKit(deps, options) {
   if (options.mode === "new" && (options.goal === void 0 || options.goal.trim().length === 0)) throw new UsageError("--kit new needs --goal TEXT");
-  const { root, repository } = await detectProject(deps);
+  const project = await detectProject(deps, { name: options.name, provider: options.provider });
+  const { root } = project;
   if (await headCommit(deps, root) === null) throw new CliError("the repository has no commit yet; make an initial commit first");
   const planDir = join22(root, PLAN_DIR);
   const planExists = existsSync6(join22(planDir, "project.md"));
@@ -61869,7 +62065,7 @@ async function connectKit(deps, options) {
       plan3 = await readPlan(root);
       planSource = `${PLAN_DIR}/ already exists; kept as it is`;
     } else if (options.mode === "new") {
-      plan3 = newPlan(repository.name, options.goal ?? "", !ciExists);
+      plan3 = newPlan(project.name, options.goal ?? "", !ciExists);
       planSource = "minimal plan from --goal";
     } else if (hasSpecKit(root)) {
       plan3 = await importSpecKit(root);
@@ -61892,7 +62088,7 @@ async function connectKit(deps, options) {
   const touched = [...INSTRUCTION_FILES, CI_FILE];
   const unsaved = await dirty(deps, root, touched);
   if (unsaved.length > 0 && !options.dryRun) throw new CliError(`uncommitted changes in ${unsaved.join(", ")}; commit or stash them so the kit commit holds only its own lines`);
-  say(deps, `Kit setup (${options.mode}) for ${repository.owner}/${repository.name}`);
+  say(deps, `Kit setup (${options.mode}) for ${projectLabel(project)}`);
   say(deps, `  branch: create ${KIT_BRANCH}`);
   say(deps, `  plan: ${planSource} (${plan3.milestones.length} milestone(s), ${plan3.tasks.length} task(s))${planExists ? "" : `, written to ${PLAN_DIR}/`}`);
   say(deps, ciExists ? "  ci: a workflow already exists; left alone" : workflow === null ? "  ci: no install, typecheck or test command detected, so no workflow is written (the plan task adds it)" : `  ci: write ${CI_FILE} (pinned actions; runs ${[detected.install, ...detected.typecheck ?? [], ...detected.test].filter((c) => c !== void 0).join("; ")})`);
@@ -61969,7 +62165,7 @@ async function connectKit(deps, options) {
   say(deps, `Run policy set (build-ahead limit ${firstMilestone}).`);
   const synced = await kit.syncPlan(PlanSyncRequest.parse({ requestId: `cli-${randomUUID8()}`, sourceCommit: sha, plan: await readPlan(root) }));
   say(deps, `Plan synced: ${synced.created.length} created, ${synced.updated.length} updated, ${synced.unchanged.length} unchanged, ${synced.deferred.length} deferred.`);
-  const pr = await openPullRequest(deps, root, repository.name);
+  const pr = await openPullRequest(deps, root, project.name);
   say(deps);
   for (const line2 of schedulerSetup(binding.binding.projectId)) say(deps, line2);
   return {
@@ -62015,18 +62211,20 @@ var AGENTS_FLAG = { name: "agents", type: "string", value: "claude,codex", descr
 var ROOT_FLAG = { name: "marketplace-root", type: "string", value: "DIR", description: "Folder holding the built claude/ and codex/ plugin marketplaces" };
 var connectCommand = defineCommand({
   path: ["connect"],
-  summary: "Connect this GitHub project: sign in, bind it, register the plugin; --kit also sets up a plan",
-  description: "Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .harness/project.json and records what it added in .harness/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
+  summary: "Connect this project (native Overlane, or your GitHub repository): sign in, bind it, register the plugin; --kit also sets up a plan",
+  description: "Works in any git project, with no GitHub account: without a GitHub origin the project is a native Overlane project named after the folder (--name renames it). With a github.com origin it binds that repository instead (--provider overlane keeps it native). Detects the installed agents, previews the plan, then (with --yes) signs in through the browser, creates or looks up the project on the service, runs the agents' native plugin commands, writes .harness/project.json and records what it added in .harness/owned.json so `overlane disconnect` removes only that. With --kit existing|new it also drafts the plan files, CI and a pull request. Without a terminal it never prompts: pass --yes, or --dry-run to preview.",
   flags: [
     { name: "service", type: "string", value: "URL", description: "Service address (https); default is the hosted service or HARNESS_SERVICE_URL" },
     ROOT_FLAG,
     AGENTS_FLAG,
     { name: "dry-run", type: "boolean", description: "Print the plan, the requests it would send and the files it would write; change nothing. Needs no credentials." },
     { name: "yes", type: "boolean", description: "Apply the plan without asking (required when there is no terminal)" },
+    { name: "name", type: "string", value: "NAME", description: "The project name (default: the GitHub repository name, else this folder's name)" },
+    { name: "provider", type: "string", enum: ["overlane", "github"], description: "Where the project lives: overlane (native, the default without a GitHub origin) or github (needs a github.com origin)" },
     { name: "kit", type: "string", enum: ["existing", "new"], description: "Also set up the project kit: plan files, CI, instruction blocks and one pull request" },
     { name: "goal", type: "string", value: "TEXT", description: "The project's goal; required with --kit new" }
   ],
-  examples: ["overlane connect --dry-run", "overlane connect --yes", 'overlane connect --kit new --goal "A rundown service" --yes', "overlane connect --kit existing --yes"],
+  examples: ["overlane connect --dry-run", "overlane connect --yes", "overlane connect --name my-app --yes", "overlane connect --provider github --yes", 'overlane connect --kit new --goal "A rundown service" --yes', "overlane connect --kit existing --yes"],
   effect: "write",
   needsNetwork: true,
   keywords: ["setup", "install", "bind", "link", "onboard", "register plugin", "bootstrap", "autonomous", "plan", "kit", "get started", "initialise", "enable harness", "ci workflow", "pull request"],
@@ -62037,7 +62235,9 @@ var connectCommand = defineCommand({
       marketplaceRoot: textFlag(inv, "marketplace-root"),
       agents: parseAgentList(textFlag(inv, "agents")),
       dryRun: inv.dryRun,
-      yes: boolFlag(inv, "yes")
+      yes: boolFlag(inv, "yes"),
+      name: textFlag(inv, "name"),
+      provider: parseProvider(textFlag(inv, "provider"))
     };
     const kit = textFlag(inv, "kit");
     const goal = textFlag(inv, "goal");