review-council 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Ströck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,210 @@
+# review-council
+
+> Multi-model AI code review in your terminal — many models, many roles, one consensus.
+
+![npm](https://img.shields.io/npm/v/review-council) ![license](https://img.shields.io/npm/l/review-council) ![node](https://img.shields.io/node/v/review-council)
+
+---
+
+## Install
+
+```bash
+npm install -g review-council
+```
+
+Requires Node.js >= 18.
+
+---
+
+## Quick Start
+
+```bash
+# Review a GitHub PR with default models and roles
+rcl review owner/repo#42
+
+# Review with specific roles and post findings as a PR comment
+rcl review owner/repo#42 --roles security-auditor,bug-hunter --post
+
+# Review a local patch file; fail CI if critical/important findings exist
+rcl review changes.patch --ci --markdown report.md
+```
+
+---
+
+## Built-in Roles
+
+| Role | Description |
+|------|-------------|
+| 🔍 `general` | Comprehensive review covering all dimensions |
+| 🔒 `security-auditor` | Auth, injection, XSS, CSRF, IDOR, and sensitive data exposure |
+| ⚡ `performance-engineer` | N+1 queries, caching, algorithmic complexity, and memory efficiency |
+| 📐 `api-design` | API contracts, breaking changes, REST/gRPC conventions |
+| 🧪 `test-coverage` | Missing tests, edge cases, flawed test logic |
+| ✏️ `dx-critic` | Readability, naming, documentation, and developer ergonomics |
+| 🏗️ `architecture` | Module boundaries, coupling, and architectural patterns |
+| 🐛 `bug-hunter` | Logic errors, null paths, race conditions, off-by-one |
+| ♿ `accessibility-auditor` | WCAG compliance, ARIA roles, keyboard navigation |
+| 📋 `project-rules` | Enforces repo conventions from `AGENTS.md`, `CLAUDE.md`, etc. |
+| 📄 `spec-compliance` | Checks implementation against a spec or plan file |
+
+List roles in the terminal:
+
+```bash
+rcl roles list
+rcl roles show security-auditor
+```
+
+---
+
+## CLI Reference
+
+### `rcl review <target>`
+
+Review a PR or local diff.
+
+**Target formats:**
+- `owner/repo#N` — GitHub PR number
+- GitHub PR URL
+- Path to a `.patch` or `.diff` file
+
+**Options:**
+
+| Flag | Description |
+|------|-------------|
+| `--role <name>` | Use a single named role |
+| `--roles <names>` | Comma-separated list of roles |
+| `--reviewer <model:role>` | Explicit model:role pair (repeatable) |
+| `--models <models>` | Comma-separated list of models to use |
+| `--context <path>` | Context file or directory (repeatable) |
+| `--spec <path>` | Specification file for `spec-compliance` role |
+| `--focus <areas>` | Comma-separated focus areas |
+| `--post` | Post review as a GitHub PR comment |
+| `--json` | Print JSON output to stdout |
+| `--json-file <path>` | Write JSON output to a file |
+| `--markdown <path>` | Write Markdown report to a file |
+| `--ci` | Exit non-zero if critical/important findings exist |
+| `--config <path>` | Path to a config file |
+
+`--role`, `--roles`, and `--reviewer` are mutually exclusive.
+
+**Examples:**
+
+```bash
+# Use explicit model:role pairs
+rcl review owner/repo#7 \
+  --reviewer claude-opus-4-6:security-auditor \
+  --reviewer gpt-5.4:bug-hunter
+
+# Spec compliance review with context
+rcl review ./feature.patch --role spec-compliance --spec SPEC.md --context src/
+
+# Output JSON for downstream processing
+rcl review owner/repo#99 --json > findings.json
+```
+
+---
+
+### `rcl roles`
+
+```bash
+rcl roles list             # List all built-in roles
+rcl roles show <name>      # Show system prompt and details for a role
+```
+
+---
+
+## Config File
+
+Place `.review-council.yml` in your project root (or any parent directory). All fields are optional.
+
+```yaml
+# Models to use (provider-prefixed names)
+models:
+  - anthropic/claude-opus-4-6
+  - openai/gpt-5.4
+  - google/gemini-2.5-pro
+
+# Default roles to run
+roles:
+  - security-auditor
+  - bug-hunter
+  - test-coverage
+
+# Or pin explicit model:role pairs
+reviewers:
+  - model: anthropic/claude-opus-4-6
+    role: security-auditor
+  - model: openai/gpt-5.4
+    role: bug-hunter
+
+# Custom role overrides (extends a built-in or creates new)
+customRoles:
+  - name: my-style-guide
+    focus: [best-practices]
+    systemPrompt: |
+      Enforce our team style guide. Flag any deviation from snake_case
+      variable names and require docstrings on all public functions.
+
+# Consensus and deduplication thresholds
+thresholds:
+  minConsensusScore: 0.4   # 0–1; findings below this are dropped
+  minConfidence: 0.2
+  dedupeLineWindow: 5      # lines within which findings are merged
+  jaccardThreshold: 0.3    # token-overlap threshold for deduplication
+
+# Output defaults
+output:
+  markdown: true
+  markdownPath: review-report.md
+
+# Concurrency and reliability
+concurrency: 6
+timeout: 120000       # ms per model call
+maxRetries: 3
+
+# Context files to attach to every review
+context:
+  - ARCHITECTURE.md
+  - docs/api.md
+
+# Spec file for spec-compliance role
+spec: SPEC.md
+
+# GitHub token (prefer GITHUB_TOKEN env var instead)
+# githubToken: ghp_...
+```
+
+Supported config file names: `.review-council.yml`, `.review-council.yaml`, `.review-council.json`, `review-council.config.js`.
+
+---
+
+## How Consensus Works
+
+When multiple models and roles review the same diff, their findings are:
+
+1. **Deduplicated** — findings on the same file, overlapping line range, and similar category are grouped together using Jaccard token overlap.
+2. **Scored** — each group receives a consensus score based on three dimensions: reviewer diversity (how many distinct models and roles flagged it), role relevance (whether the reporting role specialises in that finding type), and isolation (what fraction of relevant reviewers flagged it).
+3. **Classified** — groups are assigned a confidence band (Very High → Minimal) and a final severity, with upward elevation when multiple high-relevance roles agree.
+4. **Filtered** — groups below `minConsensusScore` or `minConfidence` are dropped.
+
+The result is a ranked list of findings that rewards agreement across independent reviewers and penalises noise from a single model.
+
+For the full algorithm, see [CONSENSUS_V2_SPEC.md](./CONSENSUS_V2_SPEC.md).
+
+---
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `ANTHROPIC_API_KEY` | API key for Claude models |
+| `OPENAI_API_KEY` | API key for OpenAI models |
+| `GEMINI_API_KEY` | API key for Google Gemini models |
+| `GITHUB_TOKEN` | GitHub personal access token (PR fetch and post) |
+| `RCL_DEBUG` | Set to any value to print full error stack traces |
+
+---
+
+## License
+
+MIT © 2026 Michael Ströck

package/dist/config/defaults.d.ts

@@ -0,0 +1,17 @@
+export declare const DEFAULT_MODELS: readonly ["anthropic/claude-opus-4-6", "openai/gpt-5.4", "google/gemini-2.5-pro"];
+export declare const DEFAULT_THRESHOLDS: {
+    readonly minConsensusScore: 0.4;
+    readonly minConfidence: 0.2;
+    readonly dedupeLineWindow: 5;
+    readonly jaccardThreshold: 0.3;
+};
+export declare const DEFAULT_TIMEOUT_MS = 120000;
+export declare const DEFAULT_MAX_RETRIES = 3;
+export declare const DEFAULT_CONCURRENCY = 6;
+export declare const DEFAULT_SEVERITY_ORDER: readonly ["critical", "important", "minor", "nitpick"];
+export declare const CONFIDENCE_THRESHOLDS: {
+    readonly veryHigh: 0.8;
+    readonly high: 0.6;
+    readonly medium: 0.4;
+    readonly low: 0.2;
+};

package/dist/config/defaults.js

@@ -0,0 +1,27 @@
+export const DEFAULT_MODELS = [
+    'anthropic/claude-opus-4-6',
+    'openai/gpt-5.4',
+    'google/gemini-2.5-pro',
+];
+export const DEFAULT_THRESHOLDS = {
+    minConsensusScore: 0.4,
+    minConfidence: 0.2,
+    dedupeLineWindow: 5,
+    jaccardThreshold: 0.3,
+};
+export const DEFAULT_TIMEOUT_MS = 120_000;
+export const DEFAULT_MAX_RETRIES = 3;
+export const DEFAULT_CONCURRENCY = 6;
+export const DEFAULT_SEVERITY_ORDER = [
+    'critical',
+    'important',
+    'minor',
+    'nitpick',
+];
+export const CONFIDENCE_THRESHOLDS = {
+    veryHigh: 0.8,
+    high: 0.6,
+    medium: 0.4,
+    low: 0.2,
+};
+//# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,2BAA2B;IAC3B,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,2 @@
+import { type Config } from './schema.js';
+export declare function loadConfig(configPath?: string): Promise<Config>;

package/dist/config/loader.js

@@ -0,0 +1,66 @@
+import { cosmiconfig } from 'cosmiconfig';
+import { ConfigSchema } from './schema.js';
+import { DEFAULT_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, } from './defaults.js';
+const explorer = cosmiconfig('review-council', {
+    searchPlaces: [
+        '.review-council.yml',
+        '.review-council.yaml',
+        '.review-council.json',
+        '.review-council.js',
+        '.review-council.cjs',
+        'review-council.config.js',
+        'review-council.config.cjs',
+    ],
+});
+export async function loadConfig(configPath) {
+    try {
+        const result = configPath
+            ? await explorer.load(configPath)
+            : await explorer.search();
+        if (!result || result.isEmpty) {
+            return buildDefaultConfig();
+        }
+        const parsed = ConfigSchema.safeParse(result.config);
+        if (!parsed.success) {
+            console.warn('Warning: config validation errors:', parsed.error.format());
+            return buildDefaultConfig();
+        }
+        return mergeWithDefaults(parsed.data);
+    }
+    catch (err) {
+        if (configPath) {
+            throw new Error(`Failed to load config from ${configPath}: ${String(err)}`);
+        }
+        return buildDefaultConfig();
+    }
+}
+function buildDefaultConfig() {
+    return {
+        models: [...DEFAULT_MODELS],
+        thresholds: { ...DEFAULT_THRESHOLDS },
+        timeout: DEFAULT_TIMEOUT_MS,
+        maxRetries: DEFAULT_MAX_RETRIES,
+        concurrency: DEFAULT_CONCURRENCY,
+    };
+}
+function mergeWithDefaults(config) {
+    return {
+        models: config.models ?? [...DEFAULT_MODELS],
+        roles: config.roles,
+        reviewers: config.reviewers,
+        customRoles: config.customRoles,
+        thresholds: {
+            ...DEFAULT_THRESHOLDS,
+            ...config.thresholds,
+        },
+        output: config.output,
+        timeout: config.timeout ?? DEFAULT_TIMEOUT_MS,
+        maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+        concurrency: config.concurrency ?? DEFAULT_CONCURRENCY,
+        githubToken: config.githubToken ?? process.env['GITHUB_TOKEN'],
+        context: config.context,
+        spec: config.spec,
+        focus: config.focus,
+    };
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;IAC7C,YAAY,EAAE;QACZ,qBAAqB;QACrB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,qBAAqB;QACrB,0BAA0B;QAC1B,2BAA2B;KAC5B;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU;YACvB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;QAC3B,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,cAAc,CAAC;QAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+export declare const SeveritySchema: z.ZodEnum<{
+    critical: "critical";
+    important: "important";
+    minor: "minor";
+    nitpick: "nitpick";
+}>;
+export declare const CategorySchema: z.ZodEnum<{
+    security: "security";
+    correctness: "correctness";
+    "best-practices": "best-practices";
+    tests: "tests";
+    "api-design": "api-design";
+}>;
+export declare const ReviewerPairSchema: z.ZodObject<{
+    model: z.ZodString;
+    role: z.ZodString;
+}, z.core.$strip>;
+export declare const RoleConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    systemPrompt: z.ZodOptional<z.ZodString>;
+    focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    severityBias: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+}, z.core.$strip>;
+export declare const ThresholdsSchema: z.ZodObject<{
+    minConsensusScore: z.ZodOptional<z.ZodNumber>;
+    minConfidence: z.ZodOptional<z.ZodNumber>;
+    dedupeLineWindow: z.ZodOptional<z.ZodNumber>;
+    jaccardThreshold: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const OutputSchema: z.ZodObject<{
+    terminal: z.ZodOptional<z.ZodBoolean>;
+    json: z.ZodOptional<z.ZodBoolean>;
+    markdown: z.ZodOptional<z.ZodBoolean>;
+    github: z.ZodOptional<z.ZodBoolean>;
+    jsonPath: z.ZodOptional<z.ZodString>;
+    markdownPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const ConfigSchema: z.ZodObject<{
+    models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reviewers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        model: z.ZodString;
+        role: z.ZodString;
+    }, z.core.$strip>>>;
+    customRoles: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        systemPrompt: z.ZodOptional<z.ZodString>;
+        focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        severityBias: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, z.core.$strip>>>;
+    thresholds: z.ZodOptional<z.ZodObject<{
+        minConsensusScore: z.ZodOptional<z.ZodNumber>;
+        minConfidence: z.ZodOptional<z.ZodNumber>;
+        dedupeLineWindow: z.ZodOptional<z.ZodNumber>;
+        jaccardThreshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    output: z.ZodOptional<z.ZodObject<{
+        terminal: z.ZodOptional<z.ZodBoolean>;
+        json: z.ZodOptional<z.ZodBoolean>;
+        markdown: z.ZodOptional<z.ZodBoolean>;
+        github: z.ZodOptional<z.ZodBoolean>;
+        jsonPath: z.ZodOptional<z.ZodString>;
+        markdownPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+    maxRetries: z.ZodOptional<z.ZodNumber>;
+    concurrency: z.ZodOptional<z.ZodNumber>;
+    githubToken: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    spec: z.ZodOptional<z.ZodString>;
+    focus: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type Config = z.infer<typeof ConfigSchema>;
+export type ReviewerPair = z.infer<typeof ReviewerPairSchema>;
+export type RoleConfig = z.infer<typeof RoleConfigSchema>;
+export type Thresholds = z.infer<typeof ThresholdsSchema>;
+export type Severity = z.infer<typeof SeveritySchema>;
+export type Category = z.infer<typeof CategorySchema>;

package/dist/config/schema.js

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+export const SeveritySchema = z.enum(['critical', 'important', 'minor', 'nitpick']);
+export const CategorySchema = z.enum([
+    'security',
+    'correctness',
+    'best-practices',
+    'tests',
+    'api-design',
+]);
+export const ReviewerPairSchema = z.object({
+    model: z.string(),
+    role: z.string(),
+});
+export const RoleConfigSchema = z.object({
+    name: z.string(),
+    systemPrompt: z.string().optional(),
+    focus: z.array(z.string()).optional(),
+    severityBias: z.record(z.string(), z.number()).optional(),
+});
+export const ThresholdsSchema = z.object({
+    minConsensusScore: z.number().min(0).max(1).optional(),
+    minConfidence: z.number().min(0).max(1).optional(),
+    dedupeLineWindow: z.number().int().positive().optional(),
+    jaccardThreshold: z.number().min(0).max(1).optional(),
+});
+export const OutputSchema = z.object({
+    terminal: z.boolean().optional(),
+    json: z.boolean().optional(),
+    markdown: z.boolean().optional(),
+    github: z.boolean().optional(),
+    jsonPath: z.string().optional(),
+    markdownPath: z.string().optional(),
+});
+export const ConfigSchema = z.object({
+    models: z.array(z.string()).optional(),
+    roles: z.array(z.string()).optional(),
+    reviewers: z.array(ReviewerPairSchema).optional(),
+    customRoles: z.array(RoleConfigSchema).optional(),
+    thresholds: ThresholdsSchema.optional(),
+    output: OutputSchema.optional(),
+    timeout: z.number().positive().optional(),
+    maxRetries: z.number().int().nonnegative().optional(),
+    concurrency: z.number().int().positive().optional(),
+    githubToken: z.string().optional(),
+    context: z.array(z.string()).optional(),
+    spec: z.string().optional(),
+    focus: z.array(z.string()).optional(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}

package/dist/consensus/deduper.d.ts

@@ -0,0 +1,6 @@
+import type { ModelReview, DeduplicatedGroup } from './types.js';
+/**
+ * Compute Jaccard similarity between two strings (word-level tokenization)
+ */
+export declare function jaccardSimilarity(a: string, b: string): number;
+export declare function deduplicateFindings(reviews: ModelReview[], jaccardThreshold?: number, lineWindow?: number): DeduplicatedGroup[];

package/dist/consensus/deduper.js

@@ -0,0 +1,127 @@
+const LINE_WINDOW = 5;
+/**
+ * Compute Jaccard similarity between two strings (word-level tokenization)
+ */
+export function jaccardSimilarity(a, b) {
+    const tokenize = (s) => {
+        return new Set(s
+            .toLowerCase()
+            .replace(/[^a-z0-9\s]/g, ' ')
+            .split(/\s+/)
+            .filter((t) => t.length > 2));
+    };
+    const setA = tokenize(a);
+    const setB = tokenize(b);
+    if (setA.size === 0 && setB.size === 0)
+        return 1.0;
+    if (setA.size === 0 || setB.size === 0)
+        return 0.0;
+    let intersection = 0;
+    for (const token of setA) {
+        if (setB.has(token))
+            intersection++;
+    }
+    const union = setA.size + setB.size - intersection;
+    return intersection / union;
+}
+function linesOverlap(a, b, window) {
+    const aStart = Math.max(0, a.startLine - window);
+    const aEnd = a.endLine + window;
+    const bStart = Math.max(0, b.startLine - window);
+    const bEnd = b.endLine + window;
+    return aStart <= bEnd && bStart <= aEnd;
+}
+function areSameFile(a, b) {
+    return a.file === b.file;
+}
+function sameCategory(a, b) {
+    return a.category === b.category;
+}
+function areDuplicates(a, b, jaccardThreshold, lineWindow) {
+    if (!areSameFile(a, b))
+        return false;
+    if (!sameCategory(a, b))
+        return false;
+    if (!linesOverlap(a, b, lineWindow))
+        return false;
+    const titleSim = jaccardSimilarity(a.title, b.title);
+    const descSim = jaccardSimilarity(a.description, b.description);
+    const maxSim = Math.max(titleSim, descSim);
+    return maxSim >= jaccardThreshold;
+}
+/**
+ * Choose the representative finding from a group:
+ * - Prefer higher severity
+ * - Break ties by description length (more detail wins)
+ */
+function chooseRepresentative(members) {
+    const severityOrder = { critical: 0, important: 1, minor: 2, nitpick: 3 };
+    return members.reduce((best, curr) => {
+        const bestScore = severityOrder[best.finding.severity];
+        const currScore = severityOrder[curr.finding.severity];
+        if (currScore < bestScore)
+            return curr;
+        if (currScore === bestScore && curr.finding.description.length > best.finding.description.length)
+            return curr;
+        return best;
+    }).finding;
+}
+export function deduplicateFindings(reviews, jaccardThreshold = 0.3, lineWindow = LINE_WINDOW) {
+    // Flatten all findings with attribution
+    const all = [];
+    for (const review of reviews) {
+        if (review.status !== 'success')
+            continue;
+        for (const finding of review.findings) {
+            all.push({ finding, model: review.model, role: review.role });
+        }
+    }
+    if (all.length === 0)
+        return [];
+    // Union-Find style grouping
+    const groupOf = new Array(all.length).fill(-1);
+    for (let i = 0; i < all.length; i++) {
+        for (let j = i + 1; j < all.length; j++) {
+            if (areDuplicates(all[i].finding, all[j].finding, jaccardThreshold, lineWindow)) {
+                // Merge groups: find root of i
+                let rootI = i;
+                while (groupOf[rootI] !== -1)
+                    rootI = groupOf[rootI];
+                let rootJ = j;
+                while (groupOf[rootJ] !== -1)
+                    rootJ = groupOf[rootJ];
+                if (rootI !== rootJ) {
+                    groupOf[rootJ] = rootI;
+                }
+            }
+        }
+    }
+    // Collect groups
+    const groups = new Map();
+    for (let i = 0; i < all.length; i++) {
+        let root = i;
+        while (groupOf[root] !== -1)
+            root = groupOf[root];
+        const existing = groups.get(root) ?? [];
+        existing.push(all[i]);
+        groups.set(root, existing);
+    }
+    const result = [];
+    for (const members of groups.values()) {
+        result.push({
+            representative: chooseRepresentative(members),
+            members,
+        });
+    }
+    // Sort by severity then file
+    const severityOrder = { critical: 0, important: 1, minor: 2, nitpick: 3 };
+    result.sort((a, b) => {
+        const sevDiff = severityOrder[a.representative.severity] -
+            severityOrder[b.representative.severity];
+        if (sevDiff !== 0)
+            return sevDiff;
+        return a.representative.file.localeCompare(b.representative.file);
+    });
+    return result;
+}
+//# sourceMappingURL=deduper.js.map

package/dist/consensus/deduper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deduper.js","sourceRoot":"","sources":["../../src/consensus/deduper.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAe,EAAE;QAC1C,OAAO,IAAI,GAAG,CACZ,CAAC;aACE,WAAW,EAAE;aACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEnD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IACnD,OAAO,YAAY,GAAG,KAAK,CAAC;AAC9B,CAAC;AAQD,SAAS,YAAY,CAAC,CAAU,EAAE,CAAU,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;IAChC,OAAO,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,CAAU;IACzC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,CAAU,EAAE,CAAU;IAC1C,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CACpB,CAAU,EACV,CAAU,EACV,gBAAwB,EACxB,UAAkB;IAElB,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE3C,OAAO,MAAM,IAAI,gBAAgB,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAwB;IACpD,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAE1E,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,SAAS,GAAG,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM;YAC9F,OAAO,IAAI,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC,OAAO,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAsB,EACtB,gBAAgB,GAAG,GAAG,EACtB,UAAU,GAAG,WAAW;IAExB,wCAAwC;IACxC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,4BAA4B;IAC5B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAS,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,IACE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAC7E,CAAC;gBACD,+BAA+B;gBAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;gBACtD,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;gBAEtD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;oBACpB,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC;YAC7C,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,OAAO,GACX,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC;YACxC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAClC,OAAO,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/consensus/parser.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from './types.js';
+export interface ParseResult {
+    findings: Finding[];
+    warnings: string[];
+}
+export declare function parseReviewOutput(rawOutput: string, model: string, role: string): ParseResult;