review-council 1.4.0 → 1.8.0

package/README.md

@@ -58,19 +58,22 @@ rcl roles show security-auditor
 
 ## CLI Reference
 
-### `rcl review <target>`
+### `rcl review [target]`
 
-Review a PR or local diff.
+Review a PR, a local diff, or uncommitted work.
 
 **Target formats:**
 - `owner/repo#N` — GitHub PR number
 - GitHub PR URL
 - Path to a `.patch` or `.diff` file
+- No target with `--staged` or `--working-tree` — review uncommitted changes in the current repository
 
 **Options:**
 
 | Flag | Description |
 |------|-------------|
+| `--staged` | Review staged changes (`git diff --cached`) |
+| `--working-tree` | Review all uncommitted changes (`git diff HEAD`, staged + unstaged) |
 | `--role <name>` | Use a single named role |
 | `--roles <names>` | Comma-separated list of roles |
 | `--reviewer <model:role>` | Explicit model:role pair (repeatable) |
@@ -85,7 +88,7 @@ Review a PR or local diff.
 | `--ci` | Exit non-zero if critical/important findings exist |
 | `--config <path>` | Path to a config file |
 
-`--role`, `--roles`, and `--reviewer` are mutually exclusive.
+`--role`, `--roles`, and `--reviewer` are mutually exclusive. So are a positional target, `--staged`, and `--working-tree` — pick exactly one review source. Untracked files are invisible to `git diff` and therefore not reviewed.
 
 **Examples:**
 
@@ -100,8 +103,45 @@ rcl review ./feature.patch --role spec-compliance --spec SPEC.md --context src/
 
 # Output JSON for downstream processing
 rcl review owner/repo#99 --json > findings.json
+
+# Review your uncommitted work before committing
+rcl review --staged
+rcl review --working-tree --roles security-auditor,bug-hunter
+```
+
+---
+
+### `rcl review-plan <file>`
+
+Council-review an implementation plan document (PRD, BUILD_PLAN.md, design doc) **before any code exists** — the cheapest bugs to fix are the ones caught in the plan.
+
+```bash
+rcl review-plan docs/plan.md
+rcl review-plan docs/plan.md --focus risks       # feasibility | completeness | risks | timeline
+rcl review-plan docs/plan.md --spec PRD.md       # also check the plan against a spec
+```
+
+The plan flows through the normal pipeline — multi-model dispatch, dedup, consensus, agreement-tier report — with plan-adapted prompts. Finding line numbers refer to the plan document's own lines. Categories are reinterpreted for plans (`correctness` = infeasible/contradictory steps, `tests` = missing validation strategy, `best-practices` = process gaps like rollback/migration, …).
+
+Default roles are a plan-suited subset (`general`, `architecture`, `edge-case-hunter`, plus `spec-compliance` when a spec is given); `--role`/`--roles`/`--reviewer` and config `roles` override as usual. Shares `--context`, `--models`, `--json`, `--json-file`, `--markdown`, and `--config` with `rcl review`. `--post` and `--ci` are not offered (no PR to post to; plan findings are judgment calls, not gates).
+
+---
+
+### `rcl discuss`
+
+Ask the models that flagged a finding a follow-up question — one round, reconstructed from a saved report. Useful when triaging: "is this actually exploitable given the sanitizer at line 40?" goes to the reviewers who raised it (especially valuable for **disputed** findings, where the report shows each model's position).
+
+```bash
+rcl review --staged --json-file report.json
+rcl discuss --report report.json --finding f003 "Is this exploitable given the sanitizer at line 40?"
+
+# Attach code as context, or ask different models
+rcl discuss --report report.json --finding f003 --context src/auth.ts "Does the middleware at line 12 not already cover this?"
+rcl discuss --report report.json --finding f003 --models anthropic/claude-fable-5 "Summarize the strongest counterargument."
 ```
 
+Model-generated finding ids can collide; when `--finding <id>` is ambiguous the error lists `<id>:<n>` disambiguators. Findings in the below-threshold appendix are addressable too. Answers come back in parallel, respecting the configured `timeout`, `maxRetries`, and `reasoningEffort`. There is no session state: each `discuss` is one independent round built from the report file.
+
 ---
 
 ### `rcl roles`
@@ -123,6 +163,8 @@ models:
   - anthropic/claude-opus-4-6
   - openai/gpt-5.4
   - google/gemini-2.5-pro
+  # Any model on https://openrouter.ai — keep the vendor segment after the prefix
+  - openrouter/moonshotai/kimi-k3
 
 # Default roles to run
 roles:
@@ -147,7 +189,7 @@ customRoles:
 
 # Consensus and deduplication thresholds
 thresholds:
-  minConsensusScore: 0.4   # 0–1; findings below this are dropped
+  minConsensusScore: 0.4   # 0–1; findings below this are demoted to the appendix
   minConfidence: 0.2
   dedupeLineWindow: 5      # lines within which findings are merged
   jaccardThreshold: 0.3    # weighted title+description similarity threshold for dedup
@@ -156,12 +198,19 @@ thresholds:
 output:
   markdown: true
   markdownPath: review-report.md
+  belowThresholdAppendix: true  # false drops below-threshold findings outright
 
 # Concurrency and reliability
 concurrency: 6
-timeout: 120000       # ms per model call
+timeout: 600000       # ms per model call (reasoning models need headroom on real diffs)
 maxRetries: 3
 
+# Reasoning budget for providers that support it (currently OpenRouter).
+# low | medium | high — default medium. Unbounded reasoning makes these
+# models spend the whole completion budget thinking before they answer;
+# raise to 'high' for deeper review at the cost of latency and tokens.
+reasoningEffort: medium
+
 # Context files to attach to every review
 context:
   - ARCHITECTURE.md
@@ -182,12 +231,12 @@ Supported config file names: `.review-council.yml`, `.review-council.yaml`, `.re
 
 When multiple models and roles review the same diff, their findings are:
 
-1. **Deduplicated** — findings on the same file and overlapping line range are grouped by weighted title+description token similarity; findings in different categories can still merge, but need stronger similarity (models disagree on category boundaries constantly). Repeats within a single review are collapsed first. Findings that clearly reach opposite conclusions are kept as separate, disputed findings; subtler contradictions merge but are flagged as disputed.
+1. **Deduplicated** — findings on the same file and overlapping line range are grouped by weighted title+description token similarity; findings in different categories can still merge, but need stronger similarity (models disagree on category boundaries constantly). Findings whose line ranges strictly overlap and that name the same issue concept (sql injection, IDOR, hardcoded secret, …) merge regardless of wording — models phrase the same issue too differently for token overlap alone. Repeats within a single review are collapsed first. Findings that clearly reach opposite conclusions are kept as separate, disputed findings; subtler contradictions merge but are flagged as disputed.
 2. **Scored** — each group receives a consensus score based on three dimensions: reviewer diversity (how many distinct models and roles flagged it, saturating at half the fleet so large configurations aren't penalized), role relevance (whether a role specialised in that finding type confirmed it), and isolation (what fraction of relevant reviewers flagged it).
-3. **Classified** — groups are assigned a confidence band (Very High → Minimal) and a final severity. Severity is the most common rating across reviewers; when reviewers disagree, high-confidence agreement elevates it, but only to a severity at least two reviewers independently assigned — a lone outlier rating is surfaced as a dispute instead.
-4. **Filtered** — groups below `minConsensusScore` or `minConfidence` are dropped.
+3. **Classified** — groups are assigned a confidence band (Very High → Minimal) and a final severity. Severity is the most common rating across reviewers; when reviewers disagree, high-confidence agreement elevates it, but only to a severity at least two reviewers independently assigned — a lone outlier rating is surfaced as a dispute instead. Each group also gets an **agreement tier** measured over distinct models — `unanimous` (every successful model), `majority` (at least half), `minority` (2+, under half), `single` (one model) — because roles share a model's blind spots, so model count is the evidence axis.
+4. **Filtered** — groups below `minConsensusScore` or `minConfidence` are demoted (blocking severities are never dropped). Demoted findings land in a collapsed "worth checking" appendix at the bottom of the report and in the JSON `belowThresholdFindings` field — never in severity totals or CI gating. Set `output.belowThresholdAppendix: false` to drop them outright instead.
 
-The result is a ranked list of findings that rewards agreement across independent reviewers and penalises noise from a single model.
+The report is organized by agreement tier — unanimous first, then majority, minority, **disputed** (reviewers reached materially different conclusions; rendered as per-model positions so you can judge), and single-model last. Within each tier, findings sort by severity. The tier structure is the point of a multi-model council: it tells you which findings are independently confirmed and where to spend your own judgment.
 
 For the full algorithm, see [CONSENSUS_V2_SPEC.md](./CONSENSUS_V2_SPEC.md).
 
@@ -200,8 +249,40 @@ For the full algorithm, see [CONSENSUS_V2_SPEC.md](./CONSENSUS_V2_SPEC.md).
 | `ANTHROPIC_API_KEY` | API key for Claude models |
 | `OPENAI_API_KEY` | API key for OpenAI models |
 | `GEMINI_API_KEY` | API key for Google Gemini models |
+| `OPENROUTER_API_KEY` | API key for [OpenRouter](https://openrouter.ai) models (`openrouter/…` prefix) |
 | `GITHUB_TOKEN` | GitHub personal access token (PR fetch and post) |
 | `RCL_DEBUG` | Set to any value to print full error stack traces |
+| `RCL_NO_HARNESS_KEYS` | Set to any value to disable Harness key distribution (below) |
+
+The default model fleet includes OpenRouter-hosted models. If `OPENROUTER_API_KEY`
+is not set, those entries are dropped from the defaults with a warning naming the
+surviving fleet (models you configure explicitly still fail loudly instead). The
+default secondary list is entirely OpenRouter-hosted, so without the key it is
+empty and specialist roles are spread across the primary models only — set
+`secondaryModels:` explicitly if you want a secondary tier without OpenRouter. Note that when the key is set,
+default reviews send diff and context content to OpenRouter — an aggregator and
+an additional data processor beyond the direct model providers — as well as to
+Anthropic, OpenAI, and Google. Configure `models:` explicitly if that matters
+for your repository.
+
+### Key distribution via Harness
+
+Repos that carry a committed `.harness-cli/config.json` (discovered git-style,
+walking up from the working directory) can get their provider keys from a
+[Harness](https://harness.infra.one) backend instead of every teammate managing
+them by hand: run `harness login` once, and any provider key **missing from the
+environment** is fetched from `GET /api/v1/model-keys` on the host that minted
+the stored login token, and injected for the run.
+
+- Environment variables always win — only missing keys are injected.
+- The stored credential is only ever sent to the host it was minted for, never
+  to a URL named by the repo's own config (untrusted input in a cloned repo).
+- Any failure — not logged in, offline, older backend without the endpoint —
+  falls back silently to the plain-environment behavior above. The fetch runs
+  under a 3-second timeout and keys are never written to disk or logs.
+- Which providers the backend serves is server configuration
+  (`HARNESS_MODEL_KEYS` on the backend); `RCL_NO_HARNESS_KEYS` disables the
+  whole mechanism client-side.
 
 ---
 

package/dist/config/defaults.d.ts

@@ -1,7 +1,12 @@
 /** SOTA models — run the general role + participate in specialized round-robin */
-export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5", "openai/gpt-5.5", "google/gemini-3.5-flash"];
-/** Previous-gen models — specialized round-robin only, no general role */
-export declare const DEFAULT_SECONDARY_MODELS: readonly ["anthropic/claude-opus-4-8", "openai/gpt-5.4", "google/gemini-2.5-pro"];
+export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5", "openai/gpt-5.6-sol", "google/gemini-3.6-flash", "openrouter/moonshotai/kimi-k3"];
+/**
+ * Secondary models — specialized round-robin only, no general role.
+ * Chosen for training-lineage diversity: with the four SOTA models above,
+ * every default voter comes from a different lab, so cross-model consensus
+ * always reflects independent confirmation.
+ */
+export declare const DEFAULT_SECONDARY_MODELS: readonly ["openrouter/qwen/qwen3.8-max", "openrouter/deepseek/deepseek-v4-flash-0731", "openrouter/x-ai/grok-4.5"];
 export declare const DEFAULT_THRESHOLDS: {
     readonly minConsensusScore: 0.4;
     readonly minConfidence: 0.2;
@@ -17,8 +22,22 @@ export declare const DEFAULT_THRESHOLDS: {
      */
     readonly jaccardThreshold: 0.3;
 };
-export declare const DEFAULT_TIMEOUT_MS = 120000;
+/**
+ * Reasoning-heavy models (kimi-k3, qwen3.8-max, deepseek-v4, grok-4.5)
+ * routinely need several minutes to review a real diff: at 120s the entire
+ * OpenRouter wing of the default fleet timed out, and at 300s most
+ * specialist runs still did (successful calls measured 217–291s, with no
+ * headroom). Dogfooded on this repo's own diffs.
+ */
+export declare const DEFAULT_TIMEOUT_MS = 600000;
 export declare const DEFAULT_MAX_RETRIES = 3;
+/**
+ * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
+ * whole completion budget (and many minutes) thinking before emitting any
+ * findings; 'medium' is calibrated against this repo's own diffs, where it
+ * took the council from 10/17 to 17/17 completed reviews.
+ */
+export declare const DEFAULT_REASONING_EFFORT = "medium";
 export declare const DEFAULT_CONCURRENCY = 6;
 export declare const DEFAULT_SEVERITY_ORDER: readonly ["critical", "important", "minor", "nitpick"];
 export declare const CONFIDENCE_THRESHOLDS: {

package/dist/config/defaults.js

@@ -1,14 +1,20 @@
 /** SOTA models — run the general role + participate in specialized round-robin */
 export const DEFAULT_MODELS = [
     'anthropic/claude-fable-5',
-    'openai/gpt-5.5',
-    'google/gemini-3.5-flash',
+    'openai/gpt-5.6-sol',
+    'google/gemini-3.6-flash',
+    'openrouter/moonshotai/kimi-k3',
 ];
-/** Previous-gen models — specialized round-robin only, no general role */
+/**
+ * Secondary models — specialized round-robin only, no general role.
+ * Chosen for training-lineage diversity: with the four SOTA models above,
+ * every default voter comes from a different lab, so cross-model consensus
+ * always reflects independent confirmation.
+ */
 export const DEFAULT_SECONDARY_MODELS = [
-    'anthropic/claude-opus-4-8',
-    'openai/gpt-5.4',
-    'google/gemini-2.5-pro',
+    'openrouter/qwen/qwen3.8-max',
+    'openrouter/deepseek/deepseek-v4-flash-0731',
+    'openrouter/x-ai/grok-4.5',
 ];
 export const DEFAULT_THRESHOLDS = {
     minConsensusScore: 0.4,
@@ -25,8 +31,22 @@ export const DEFAULT_THRESHOLDS = {
      */
     jaccardThreshold: 0.3,
 };
-export const DEFAULT_TIMEOUT_MS = 120_000;
+/**
+ * Reasoning-heavy models (kimi-k3, qwen3.8-max, deepseek-v4, grok-4.5)
+ * routinely need several minutes to review a real diff: at 120s the entire
+ * OpenRouter wing of the default fleet timed out, and at 300s most
+ * specialist runs still did (successful calls measured 217–291s, with no
+ * headroom). Dogfooded on this repo's own diffs.
+ */
+export const DEFAULT_TIMEOUT_MS = 600_000;
 export const DEFAULT_MAX_RETRIES = 3;
+/**
+ * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
+ * whole completion budget (and many minutes) thinking before emitting any
+ * findings; 'medium' is calibrated against this repo's own diffs, where it
+ * took the council from 10/17 to 17/17 completed reviews.
+ */
+export const DEFAULT_REASONING_EFFORT = 'medium';
 export const DEFAULT_CONCURRENCY = 6;
 export const DEFAULT_SEVERITY_ORDER = [
     'critical',

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,0BAA0B;IAC1B,gBAAgB;IAChB,yBAAyB;CACjB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,2BAA2B;IAC3B,gBAAgB;IAChB,uBAAuB;CACf,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,0BAA0B;IAC1B,oBAAoB;IACpB,yBAAyB;IACzB,+BAA+B;CACvB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,6BAA6B;IAC7B,4CAA4C;IAC5C,0BAA0B;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}

package/dist/config/harness.d.ts

@@ -0,0 +1,26 @@
+export interface HarnessKeyResult {
+    /** Providers whose keys were injected into the env. */
+    injected: string[];
+    /** One human-readable line worth showing, when there is something to say. */
+    note?: string;
+}
+export interface HarnessKeyOptions {
+    cwd?: string;
+    /** Injectable for tests; defaults to process.env and is MUTATED on inject. */
+    env?: Record<string, string | undefined>;
+    credentialsPath?: string;
+    fetchImpl?: typeof fetch;
+}
+/** Walk up from `startDir` looking for `.harness-cli/config.json`. */
+export declare function findHarnessRepoConfig(startDir: string): string | null;
+/**
+ * The credential `harness login` stores. The format is frozen on the
+ * harness-cli side (exactly {url, token}) — see its core/credentials.ts.
+ */
+export declare function defaultCredentialsPath(env: Record<string, string | undefined>): string;
+/**
+ * The one entry point: called before config loading (default-model
+ * degradation for a missing OPENROUTER_API_KEY happens there, so the key
+ * must exist earlier). No-op unless keys are missing AND the repo opted in.
+ */
+export declare function applyHarnessModelKeys(options?: HarnessKeyOptions): Promise<HarnessKeyResult>;

package/dist/config/harness.js

@@ -0,0 +1,150 @@
+import { accessSync } from 'fs';
+import { readFile } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, isAbsolute, join, parse } from 'path';
+/**
+ * Key distribution via Harness. When the repo under review carries a
+ * committed `.harness-cli/config.json` (the "this repo belongs to the org"
+ * signal, discovered git-style by walking up from the working directory)
+ * and the user has run `harness login`, provider API keys missing from the
+ * environment are fetched from the Harness backend
+ * (GET /api/v1/model-keys) and injected into the process environment.
+ *
+ * Rules this module must never break:
+ * - The environment always wins: only keys absent from the env are injected.
+ * - The stored {url, token} credential pair is indivisible: the token is
+ *   only ever sent to the host that minted it — NEVER to a URL named by the
+ *   repo's own config, which is attacker-controlled input in a cloned repo.
+ * - Every failure degrades silently to today's behavior (missing keys warn
+ *   or fail exactly as before); the fetch runs under a short timeout so an
+ *   offline machine never hangs a review.
+ * - Keys land in the (injected) env only — never on disk, never in logs.
+ */
+/** Provider names the backend may serve, mapped to the env var rcl reads. */
+const PROVIDER_ENV_VARS = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    google: 'GEMINI_API_KEY',
+    openrouter: 'OPENROUTER_API_KEY',
+};
+/** Long enough for a healthy backend, short enough to never stall a review. */
+const FETCH_TIMEOUT_MS = 3_000;
+/** Walk up from `startDir` looking for `.harness-cli/config.json`. */
+export function findHarnessRepoConfig(startDir) {
+    let dir = startDir;
+    const { root } = parse(startDir);
+    for (;;) {
+        const candidate = join(dir, '.harness-cli', 'config.json');
+        try {
+            // Presence is the signal; the file's contents (team, url) are not
+            // trusted for anything here.
+            accessSync(candidate);
+            return candidate;
+        }
+        catch {
+            // keep walking
+        }
+        if (dir === root)
+            return null;
+        dir = dirname(dir);
+    }
+}
+/**
+ * The credential `harness login` stores. The format is frozen on the
+ * harness-cli side (exactly {url, token}) — see its core/credentials.ts.
+ */
+export function defaultCredentialsPath(env) {
+    const xdg = env['XDG_CONFIG_HOME'];
+    const base = xdg !== undefined && xdg !== '' && isAbsolute(xdg) ? xdg : join(homedir(), '.config');
+    return join(base, 'harness', 'credentials.json');
+}
+async function readStoredCredentials(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf-8'));
+        if (typeof parsed === 'object' && parsed !== null) {
+            const { url, token } = parsed;
+            if (typeof url === 'string' && typeof token === 'string' && url !== '' && token !== '') {
+                return { url: url.replace(/\/+$/, ''), token };
+            }
+        }
+    }
+    catch {
+        // Missing or malformed reads as "not logged in".
+    }
+    return null;
+}
+async function fetchModelKeys(baseUrl, token, fetchImpl) {
+    try {
+        const response = await fetchImpl(`${baseUrl}/api/v1/model-keys`, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        const keys = body?.data?.keys;
+        if (typeof keys !== 'object' || keys === null)
+            return null;
+        const out = {};
+        for (const [provider, key] of Object.entries(keys)) {
+            if (typeof key === 'string' && key !== '')
+                out[provider] = key;
+        }
+        return out;
+    }
+    catch {
+        // Timeout, offline, older backend without the endpoint — all read as
+        // "no keys from Harness".
+        return null;
+    }
+}
+function missingProviders(env) {
+    const isSet = (name) => (env[name] ?? '').trim() !== '';
+    return Object.entries(PROVIDER_ENV_VARS)
+        .filter(([provider, envVar]) => {
+        // The Google adapter reads either variable; respect both.
+        if (provider === 'google' && isSet('GOOGLE_API_KEY'))
+            return false;
+        return !isSet(envVar);
+    })
+        .map(([provider]) => provider);
+}
+/**
+ * The one entry point: called before config loading (default-model
+ * degradation for a missing OPENROUTER_API_KEY happens there, so the key
+ * must exist earlier). No-op unless keys are missing AND the repo opted in.
+ */
+export async function applyHarnessModelKeys(options = {}) {
+    const env = options.env ?? process.env;
+    if ((env['RCL_NO_HARNESS_KEYS'] ?? '') !== '')
+        return { injected: [] };
+    const missing = missingProviders(env);
+    if (missing.length === 0)
+        return { injected: [] };
+    if (findHarnessRepoConfig(options.cwd ?? process.cwd()) === null)
+        return { injected: [] };
+    const credentials = await readStoredCredentials(options.credentialsPath ?? defaultCredentialsPath(env));
+    if (credentials === null) {
+        return {
+            injected: [],
+            note: `Missing ${missing.map((p) => PROVIDER_ENV_VARS[p]).join(', ')} — this repo is Harness-managed; run \`harness login\` and rcl will fetch the keys for you.`,
+        };
+    }
+    const keys = await fetchModelKeys(credentials.url, credentials.token, options.fetchImpl ?? fetch);
+    if (keys === null) {
+        return { injected: [], note: `Could not fetch model keys from ${credentials.url} — continuing with the environment as-is.` };
+    }
+    const injected = [];
+    for (const provider of missing) {
+        const key = keys[provider];
+        if (key !== undefined) {
+            env[PROVIDER_ENV_VARS[provider]] = key;
+            injected.push(provider);
+        }
+    }
+    return {
+        injected,
+        note: injected.length > 0 ? `Using ${injected.join(', ')} key(s) from Harness (${credentials.url}).` : undefined,
+    };
+}
+//# sourceMappingURL=harness.js.map

package/dist/config/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/config/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AAEH,6EAA6E;AAC7E,MAAM,iBAAiB,GAA2B;IAChD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAiB/B,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,kEAAkE;YAClE,6BAA6B;YAC7B,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAuC;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAiC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACvF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,KAAa,EACb,SAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,oBAAoB,EAAE;YAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAI,IAAsC,EAAE,IAAI,EAAE,IAAI,CAAC;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuC;IAC/D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7B,0DAA0D;QAC1D,IAAI,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAA6B,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAElD,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE1F,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAC7C,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,GAAG,CAAC,CACvD,CAAC;IACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SAClK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,mCAAmC,WAAW,CAAC,GAAG,2CAA2C,EAAE,CAAC;IAC/H,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAE,CAAC,GAAG,GAAG,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjH,CAAC;AACJ,CAAC"}

package/dist/config/loader.js

@@ -1,6 +1,6 @@
 import { cosmiconfig } from 'cosmiconfig';
 import { ConfigSchema } from './schema.js';
-import { DEFAULT_MODELS, DEFAULT_SECONDARY_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, } from './defaults.js';
+import { DEFAULT_MODELS, DEFAULT_SECONDARY_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, DEFAULT_REASONING_EFFORT, } from './defaults.js';
 /**
  * A config file was found but could not be used. Never silently recover
  * from this: falling back to defaults would send code to cloud providers
@@ -53,20 +53,47 @@ export async function loadConfig(configPath, searchFrom) {
     }
     return mergeWithDefaults(parsed.data);
 }
+/**
+ * The default fleet includes openrouter/ models. When OPENROUTER_API_KEY is
+ * absent those voters would fail on every run (the runner refuses to fall
+ * back to OPENAI_API_KEY), silently breaking upgrades from pre-OpenRouter
+ * versions whose users only hold the big-three keys. Defaults therefore
+ * degrade gracefully: openrouter/ entries are dropped with a warning.
+ * Models the user configured explicitly are never filtered — those still
+ * fail loudly per review.
+ */
+function dropOpenRouterDefaultsWithoutKey(models, listName) {
+    if (process.env['OPENROUTER_API_KEY']?.trim())
+        return [...models];
+    const kept = models.filter((m) => !m.startsWith('openrouter/'));
+    const dropped = models.length - kept.length;
+    if (dropped > 0) {
+        // Name the resulting fleet, not just the count: the default secondary
+        // list is entirely openrouter/, so without the key it degrades to
+        // empty and every specialist role falls back to the primary models.
+        const remaining = kept.length > 0 ? kept.join(', ') : '(none)';
+        console.warn(`OPENROUTER_API_KEY is not set — dropping ${dropped} openrouter/ model(s) from the default ${listName}; remaining: ${remaining}. Set the key to run the full default fleet.`);
+    }
+    return kept;
+}
 function buildDefaultConfig() {
     return {
-        models: [...DEFAULT_MODELS],
-        secondaryModels: [...DEFAULT_SECONDARY_MODELS],
+        models: dropOpenRouterDefaultsWithoutKey(DEFAULT_MODELS, 'models'),
+        secondaryModels: dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models'),
         thresholds: { ...DEFAULT_THRESHOLDS },
         timeout: DEFAULT_TIMEOUT_MS,
         maxRetries: DEFAULT_MAX_RETRIES,
         concurrency: DEFAULT_CONCURRENCY,
+        reasoningEffort: DEFAULT_REASONING_EFFORT,
     };
 }
 function mergeWithDefaults(config) {
     return {
-        models: config.models ?? [...DEFAULT_MODELS],
-        secondaryModels: config.secondaryModels ?? (config.models ? [] : [...DEFAULT_SECONDARY_MODELS]),
+        models: config.models ?? dropOpenRouterDefaultsWithoutKey(DEFAULT_MODELS, 'models'),
+        secondaryModels: config.secondaryModels ??
+            (config.models
+                ? []
+                : dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models')),
         roles: config.roles,
         reviewers: config.reviewers,
         customRoles: config.customRoles,
@@ -78,6 +105,7 @@ function mergeWithDefaults(config) {
         timeout: config.timeout ?? DEFAULT_TIMEOUT_MS,
         maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
         concurrency: config.concurrency ?? DEFAULT_CONCURRENCY,
+        reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,
         githubToken: config.githubToken ?? process.env['GITHUB_TOKEN'],
         context: config.context,
         spec: config.spec,

package/dist/config/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE,UAAmB;IACvE,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;QAC7C,YAAY,EAAE,aAAa;QAC3B,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU;YACjB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACzE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;QAC3B,eAAe,EAAE,CAAC,GAAG,wBAAwB,CAAC;QAC9C,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,cAAc,CAAC;QAC5C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC;QAC/F,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE,UAAmB;IACvE,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;QAC7C,YAAY,EAAE,aAAa;QAC3B,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU;YACjB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACzE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gCAAgC,CACvC,MAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,4CAA4C,OAAO,0CAA0C,QAAQ,gBAAgB,SAAS,8CAA8C,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAClE,eAAe,EAAE,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QAC/F,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QACnF,eAAe,EACb,MAAM,CAAC,eAAe;YACtB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QACrF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,wBAAwB;QACnE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/config/schema.d.ts

@@ -35,7 +35,13 @@ export declare const OutputSchema: z.ZodObject<{
     github: z.ZodOptional<z.ZodBoolean>;
     jsonPath: z.ZodOptional<z.ZodString>;
     markdownPath: z.ZodOptional<z.ZodString>;
+    belowThresholdAppendix: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
+export declare const ReasoningEffortSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+}>;
 export declare const ConfigSchema: z.ZodObject<{
     models: z.ZodOptional<z.ZodArray<z.ZodString>>;
     secondaryModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -63,10 +69,16 @@ export declare const ConfigSchema: z.ZodObject<{
         github: z.ZodOptional<z.ZodBoolean>;
         jsonPath: z.ZodOptional<z.ZodString>;
         markdownPath: z.ZodOptional<z.ZodString>;
+        belowThresholdAppendix: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     timeout: z.ZodOptional<z.ZodNumber>;
     maxRetries: z.ZodOptional<z.ZodNumber>;
     concurrency: z.ZodOptional<z.ZodNumber>;
+    reasoningEffort: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
     githubToken: z.ZodOptional<z.ZodString>;
     context: z.ZodOptional<z.ZodArray<z.ZodString>>;
     spec: z.ZodOptional<z.ZodString>;
@@ -77,4 +89,5 @@ export type ReviewerPair = z.infer<typeof ReviewerPairSchema>;
 export type RoleConfig = z.infer<typeof RoleConfigSchema>;
 export type Thresholds = z.infer<typeof ThresholdsSchema>;
 export type Severity = z.infer<typeof SeveritySchema>;
+export type ReasoningEffort = z.infer<typeof ReasoningEffortSchema>;
 export type Category = z.infer<typeof CategorySchema>;

package/dist/config/schema.js

@@ -30,7 +30,14 @@ export const OutputSchema = z.object({
     github: z.boolean().optional(),
     jsonPath: z.string().optional(),
     markdownPath: z.string().optional(),
+    /**
+     * Carry below-threshold findings into the report's demoted "worth
+     * checking" appendix (and the JSON `belowThresholdFindings` field).
+     * Default true; set false to drop them outright as before 1.6.0.
+     */
+    belowThresholdAppendix: z.boolean().optional(),
 });
+export const ReasoningEffortSchema = z.enum(['low', 'medium', 'high']);
 export const ConfigSchema = z.object({
     models: z.array(z.string()).optional(),
     secondaryModels: z.array(z.string()).optional(),
@@ -42,6 +49,8 @@ export const ConfigSchema = z.object({
     timeout: z.number().positive().optional(),
     maxRetries: z.number().int().nonnegative().optional(),
     concurrency: z.number().int().positive().optional(),
+    /** Reasoning budget for providers that support it (currently OpenRouter). */
+    reasoningEffort: ReasoningEffortSchema.optional(),
     githubToken: z.string().optional(),
     context: z.array(z.string()).optional(),
     spec: z.string().optional(),

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}

package/dist/consensus/deduper.d.ts

@@ -26,5 +26,16 @@ export declare function combinedSimilarity(a: Finding, b: Finding): number;
  * adds a warning.
  */
 export declare function hasOpposingSentiment(a: Finding, b: Finding, specificOnly?: boolean): boolean;
+/**
+ * Concept-level similarity: 0.8+ when both findings name the same issue
+ * concept AND their line ranges strictly overlap. Proximity within the
+ * dedup window is deliberately NOT enough — two different SQL injections a
+ * few lines apart share the concept but are different findings, and the
+ * fixture corpus shows genuine cross-model duplicates point at overlapping
+ * ranges. Benchmarked in the RCL-9 PR: fixture recall 0.70 → 1.00 at
+ * precision 1.00, no new false merges on adversarial same-concept pairs
+ * (the ungated code-council version added one).
+ */
+export declare function conceptSimilarity(a: Finding, b: Finding): number;
 export declare function linesOverlap(a: Finding, b: Finding, window: number): boolean;
 export declare function deduplicateFindings(reviews: ModelReview[], jaccardThreshold?: number, lineWindow?: number): DeduplicatedGroup[];