strikethroo 3.14.3 → 3.16.0

package/templates/harness/skills/st-full-workflow/SKILL.md

@@ -417,6 +417,8 @@ If `taskCount` is 0 or `blueprintExists` is `no`:
 
 Run `scripts/create-feature-branch.cjs <plan-id>` once before phase execution. Branch creation is best-effort: when the script reports that it skipped creation (for example, not on `main`/`master`), continue on the current branch and do not retry or create a branch manually. Uncommitted or untracked changes are permitted only when every change is inside the repository-root `.ai/strikethroo` subtree, so a newly generated plan and tasks can remain uncommitted before execution. When the script exits with an error—including changes anywhere outside that subtree or an inability to inspect Git status on `main`/`master`—halt and report the error. Do not treat a skipped branch as a failure or spend effort working around a skip.
 
+After the branch step, run `scripts/capture-base-commit.cjs <plan-id>` once. It records the commit the review gate diffs against. A `skipped` result is not a failure — continue execution and note that the review gate will skip. Only an `error` result halts.
+
 #### 4. Load execution blueprint
 
 Read these files in order:
@@ -505,6 +507,51 @@ Read `<root>/config/hooks/POST_EXECUTION.md` and execute its instructions. If va
 
 Before declaring execution complete, apply the evidence gate in `<root>/config/shared/verification-gate.md` to the plan's Success Criteria and Self Validation steps.
 
+##### Run the code review gate
+
+After `POST_EXECUTION.md` reports green and before appending the execution summary, follow the `st-code-review` skill and run one review round with its bundled mechanism:
+
+```text
+code-review.cjs <plan-id> <current-harness> <round>
+```
+
+`code-review.cjs` ships with the `st-code-review` skill and lives in that skill's own `scripts` directory, a sibling of this one. Resolve it there; it is not bundled with this skill. If the `st-code-review` skill is not installed on this harness, record that as the review outcome in the execution summary and continue to the summary and archival.
+
+`<current-harness>` is the exact supported harness identifier running this skill. `<round>` is `1` on the first invocation, and thereafter the exact `decision.nextRound` the previous round returned. The command emits exactly one JSON line on stdout. Read its `kind`, then — when `kind` is `reviewed` — its `decision.kind`, and do exactly what the matching row states.
+
+| Result | What you do |
+| --- | --- |
+| `skipped` | The gate is disabled or unconfigured. Record `reason` and `detail` verbatim in the execution summary, then continue to the summary and archival. A skip is never a failure. |
+| `reviewed`, `decision.kind` = `gate-passed` | The gate passed. Record `findingsGate.recorded` and `findingsGate.aboveFloorWithoutSuggestion` — real findings deliberately not applied — then continue to the summary and archival. |
+| `reviewed`, `decision.kind` = `fix-and-continue` | Apply the `actionable` set from `<plan-dir>/review/round-<n>/findings.json` on the implementer route. Re-run `POST_EXECUTION.md` in full. Then run the gate again with `<round>` set to `decision.nextRound`. |
+| `reviewed`, `decision.kind` = `budget-exhausted` | Halt exactly as any mechanical gate failure. Leave the plan in `plans/`, do not append a completion summary, do not archive, and report the outstanding findings with actionable next steps. |
+| `reviewed`, `decision.kind` = `round-failed` | The round was not certified — the findings document was absent or invalid, or no validator was available. Halt and report `decision.detail`. Never report an uncertified round as clean. |
+| `budget-exhausted` | A round past the enforced budget was requested and no reviewer was dispatched. Halt exactly as `decision.kind` = `budget-exhausted` above. |
+| `launched-failure` | The reviewer harness exited non-zero. Halt and report `detail`. |
+| `fallback` | The reviewer never ran — the harness was unavailable or authentication failed. Record `reason` and `detail` verbatim in the execution summary, then continue to the summary and archival. |
+| `infrastructure-failure` | A real error. Halt and report `detail`. Do not retry on a different route. |
+
+<details>
+<summary>Applying an actionable finding</summary>
+
+`<plan-dir>/review/round-<n>/findings.json` holds that round's partition. Its `actionable` array is the only set you apply. Its `recorded` array is inspection material and is never applied.
+
+Each actionable entry names a file, a location, and a suggestion whose `original-code` was copied verbatim from that file. Apply it as an exact text replacement of `original-code` by `proposed-code`, and change nothing else. When `original-code` no longer matches the file, record the finding as not applied and move to the next one. Do not reconstruct the fix, widen it, or refactor around it.
+
+Dispatch every fix on the implementer route. Earlier rounds' rulings are carried into the next round by the mechanism itself, which reads the partitions it already wrote; do not pass them back on the command line.
+
+</details>
+
+Hard rules:
+
+- The gate creates no task files.
+- The gate never mutates the Execution Blueprint.
+- The gate is terminal only — never per phase, never per task.
+- The reviewer never fixes its own findings. Detection runs on the reviewer route, fixes run on the implementer route.
+- Any applied fix invalidates the green build that preceded it. Re-run `POST_EXECUTION.md` in full — lint, tests, and Self Validation — before the gate runs again. Never re-verify against the prior green build.
+- Whether another round runs is `decision.kind`'s to state and yours to obey. Do not count rounds, reason about the budget, or invoke a round the mechanism did not name.
+- A green gate is not a correctness guarantee. It reduces the exposure a human PR approval reduces, and it leaves the same exposure behind.
+
 #### 7. Append execution summary
 
 Append an execution summary section to the plan document using the format described in `<root>/config/templates/EXECUTION_SUMMARY_TEMPLATE.md`. Populate:
@@ -512,7 +559,7 @@ Append an execution summary section to the plan document using the format descri
 - **Status**: Completed Successfully
 - **Completed Date**: current date
 - **Results**: brief summary of deliverables
-- **Noteworthy Events**: all decisions, issues, and outcomes encountered during execution. If none occurred, state "No significant issues encountered."
+- **Noteworthy Events**: all decisions, issues, and outcomes encountered during execution. Always record the review gate's outcome here: the reviewer harness, the number of rounds run, and the counts of findings recorded versus applied — or, when the gate did not run, its `reason` and `detail` verbatim. If nothing else occurred, state "No significant issues encountered." after the review outcome.
 - **Necessary follow-ups**: any follow-up actions or optimizations
 
 #### 8. Archive the plan

package/templates/harness/skills/st-full-workflow/scripts/capture-base-commit.cjs

@@ -0,0 +1,325 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/skill-scripts/capture-base-commit.ts
+var capture_base_commit_exports = {};
+__export(capture_base_commit_exports, {
+  _isGitRepo: () => _isGitRepo,
+  _isValidSha: () => _isValidSha,
+  _readExistingBaseCommit: () => _readExistingBaseCommit,
+  main: () => main
+});
+module.exports = __toCommonJS(capture_base_commit_exports);
+var fs4 = __toESM(require("fs"));
+var path4 = __toESM(require("path"));
+
+// src/skill-scripts/shared/git-utils.ts
+var import_child_process = require("child_process");
+var execGit = (command) => {
+  try {
+    return (0, import_child_process.execSync)(command, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch (_error) {
+    return null;
+  }
+};
+
+// src/skill-scripts/shared/plan-resolve.ts
+var fs3 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+
+// src/skill-scripts/shared/root.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var EXPECTED_SCHEMA = true ? 4 : 4;
+var isValidStrikethrooRoot = (strikethrooPath) => {
+  try {
+    if (!fs.existsSync(strikethrooPath)) return false;
+    if (!fs.lstatSync(strikethrooPath).isDirectory()) return false;
+    const metadataPath = path.join(strikethrooPath, ".init-metadata.json");
+    if (!fs.existsSync(metadataPath)) return false;
+    const metadata = JSON.parse(fs.readFileSync(metadataPath, "utf8"));
+    return metadata && typeof metadata === "object" && "version" in metadata;
+  } catch (_err) {
+    return false;
+  }
+};
+var getStrikethrooAt = (directory) => {
+  const strikethrooPath = path.join(directory, ".ai", "strikethroo");
+  return isValidStrikethrooRoot(strikethrooPath) ? strikethrooPath : null;
+};
+var getParentPaths = (currentPath, acc = []) => {
+  const absolutePath = path.resolve(currentPath);
+  const nextAcc = [...acc, absolutePath];
+  const parentPath = path.dirname(absolutePath);
+  if (parentPath === absolutePath) return nextAcc;
+  return getParentPaths(parentPath, nextAcc);
+};
+var checkWorkspaceSchema = (metadataPath) => {
+  let metadata;
+  try {
+    metadata = JSON.parse(fs.readFileSync(metadataPath, "utf8"));
+  } catch {
+    return;
+  }
+  const actual = typeof metadata.workspaceSchemaVersion === "number" ? metadata.workspaceSchemaVersion : 1;
+  if (actual === EXPECTED_SCHEMA) return;
+  if (actual < EXPECTED_SCHEMA) {
+    process.stderr.write(
+      `Workspace schema v${actual} is older than this skill requires (v${EXPECTED_SCHEMA}). Re-run \`npx strikethroo init\` with the latest CLI to update.
+`
+    );
+  } else {
+    process.stderr.write(
+      `This skill (built for workspace schema v${EXPECTED_SCHEMA}) is older than the workspace (v${actual}). Re-run \`npx skills add e0ipso/strikethroo\` to update skills.
+`
+    );
+  }
+  process.exit(1);
+};
+var findStrikethrooRoot = (startPath = process.cwd()) => {
+  const paths = getParentPaths(startPath);
+  const found = paths.find((p) => getStrikethrooAt(p));
+  if (!found) return null;
+  const root = getStrikethrooAt(found);
+  if (root) checkWorkspaceSchema(path.join(root, ".init-metadata.json"));
+  return root;
+};
+
+// src/skill-scripts/shared/plan-scan.ts
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+
+// src/skill-scripts/shared/frontmatter.ts
+var ID_PATTERNS = [
+  /^\s*["']?id["']?\s*:\s*["']?([+-]?\d+)["']?\s*(?:#.*)?$/im,
+  /^\s*id\s*:\s*([+-]?\d+)\s*(?:#.*)?$/im,
+  /^\s*["']?id["']?\s*:\s*"([+-]?\d+)"\s*(?:#.*)?$/im,
+  /^\s*["']?id["']?\s*:\s*'([+-]?\d+)'\s*(?:#.*)?$/im,
+  /^\s*["']id["']\s*:\s*([+-]?\d+)\s*(?:#.*)?$/im,
+  /^\s*id\s*:\s*[|>]\s*([+-]?\d+)\s*$/im
+];
+var validateId = (rawId) => {
+  const id = parseInt(rawId, 10);
+  if (Number.isNaN(id) || id < 0 || id > Number.MAX_SAFE_INTEGER) return null;
+  return id;
+};
+var extractIdFromMarkdown = (content) => {
+  const frontmatterMatch = content.match(/^---\s*\r?\n([\s\S]*?)\r?\n---/);
+  if (!frontmatterMatch || !frontmatterMatch[1]) return null;
+  const block = frontmatterMatch[1];
+  for (const pattern of ID_PATTERNS) {
+    const match = block.match(pattern);
+    if (match && match[1]) {
+      const id = validateId(match[1]);
+      if (id !== null) return id;
+    }
+  }
+  return null;
+};
+var extractPlanId = (content, _filePath) => {
+  return extractIdFromMarkdown(content);
+};
+
+// src/skill-scripts/shared/plan-scan.ts
+var PLAN_EXTENSIONS = [".md"];
+var scanPlanDir = (planDirPath, dirName, isArchive) => {
+  let entries;
+  try {
+    entries = fs2.readdirSync(planDirPath, { withFileTypes: true });
+  } catch (_err) {
+    return [];
+  }
+  return entries.filter((e) => e.isFile() && PLAN_EXTENSIONS.some((ext) => e.name.endsWith(ext))).flatMap((e) => {
+    const filePath = path2.join(planDirPath, e.name);
+    try {
+      const content = fs2.readFileSync(filePath, "utf8");
+      const id = extractPlanId(content, filePath);
+      if (id === null) return [];
+      return [{ id, file: filePath, dir: planDirPath, isArchive, name: dirName }];
+    } catch (_err) {
+      return [];
+    }
+  });
+};
+var getAllPlans = (taskManagerRoot) => {
+  const sources = [
+    { dir: path2.join(taskManagerRoot, "plans"), isArchive: false },
+    { dir: path2.join(taskManagerRoot, "archive"), isArchive: true }
+  ];
+  return sources.flatMap(({ dir, isArchive }) => {
+    if (!fs2.existsSync(dir)) return [];
+    let entries;
+    try {
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
+    } catch (_err) {
+      return [];
+    }
+    return entries.filter((e) => e.isDirectory()).flatMap((e) => scanPlanDir(path2.join(dir, e.name), e.name, isArchive));
+  });
+};
+
+// src/skill-scripts/shared/plan-resolve.ts
+var isValidRootDir = (strikethrooPath) => {
+  try {
+    if (!fs3.existsSync(strikethrooPath)) return false;
+    if (!fs3.lstatSync(strikethrooPath).isDirectory()) return false;
+    const metadataPath = path3.join(strikethrooPath, ".init-metadata.json");
+    if (!fs3.existsSync(metadataPath)) return false;
+    const metadata = JSON.parse(fs3.readFileSync(metadataPath, "utf8"));
+    return metadata && typeof metadata === "object" && "version" in metadata;
+  } catch (_err) {
+    return false;
+  }
+};
+var checkStandardRootShortcut = (filePath) => {
+  const planDir = path3.dirname(filePath);
+  const parentDir = path3.dirname(planDir);
+  const possibleRoot = path3.dirname(parentDir);
+  const parentBase = path3.basename(parentDir);
+  if (parentBase !== "plans" && parentBase !== "archive") return null;
+  if (path3.basename(possibleRoot) !== "strikethroo") return null;
+  const dotAiDir = path3.dirname(possibleRoot);
+  if (path3.basename(dotAiDir) !== ".ai") return null;
+  return isValidRootDir(possibleRoot) ? possibleRoot : null;
+};
+var resolveByPath = (absolutePath) => {
+  let content;
+  try {
+    content = fs3.readFileSync(absolutePath, "utf8");
+  } catch (_err) {
+    return null;
+  }
+  const planId = extractPlanId(content, absolutePath);
+  if (planId === null) return null;
+  const tmRoot = checkStandardRootShortcut(absolutePath) || findStrikethrooRoot(path3.dirname(absolutePath));
+  if (!tmRoot) return null;
+  return {
+    planFile: absolutePath,
+    planDir: path3.dirname(absolutePath),
+    strikethrooRoot: tmRoot,
+    planId
+  };
+};
+var resolveByIdInAncestry = (planId, startPath, searched = /* @__PURE__ */ new Set()) => {
+  const tmRoot = findStrikethrooRoot(startPath);
+  if (!tmRoot) return null;
+  const normalized = path3.normalize(tmRoot);
+  if (searched.has(normalized)) return null;
+  searched.add(normalized);
+  const plans = getAllPlans(tmRoot);
+  const match = plans.find((p) => p.id === planId);
+  if (match) {
+    return {
+      planFile: match.file,
+      planDir: match.dir,
+      strikethrooRoot: tmRoot,
+      planId
+    };
+  }
+  const parentOfRoot = path3.dirname(path3.dirname(tmRoot));
+  if (parentOfRoot === tmRoot) return null;
+  return resolveByIdInAncestry(planId, parentOfRoot, searched);
+};
+var resolvePlan = (input, startPath = process.cwd()) => {
+  if (input === null || input === void 0 || input === "") return null;
+  const inputStr = String(input);
+  if (inputStr.startsWith("/")) {
+    return resolveByPath(inputStr);
+  }
+  const planId = parseInt(inputStr, 10);
+  if (Number.isNaN(planId)) return null;
+  return resolveByIdInAncestry(planId, startPath);
+};
+
+// src/skill-scripts/capture-base-commit.ts
+var SHA_RE = /^[0-9a-f]{40}$/i;
+var emit = (result, exitCode) => {
+  process.stdout.write(`${JSON.stringify(result)}
+`);
+  process.exit(exitCode);
+};
+var _isGitRepo = () => execGit("git rev-parse --is-inside-work-tree") === "true";
+var _isValidSha = (value) => typeof value === "string" && SHA_RE.test(value);
+var _readExistingBaseCommit = (filePath) => {
+  let raw;
+  try {
+    raw = fs4.readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && _isValidSha(parsed.baseCommit)) {
+      return parsed.baseCommit;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+};
+var main = (startPath = process.cwd()) => {
+  if (!_isGitRepo()) {
+    emit({ kind: "skipped", reason: "not-a-git-repository" }, 0);
+  }
+  const head = execGit("git rev-parse HEAD");
+  if (!_isValidSha(head)) {
+    emit({ kind: "skipped", reason: "no-commits" }, 0);
+  }
+  const inputId = process.argv[2] ?? "";
+  const resolved = resolvePlan(inputId, startPath);
+  if (!resolved) {
+    emit({ kind: "error", detail: `Plan "${inputId}" not found or invalid` }, 2);
+  }
+  const { planDir } = resolved;
+  const reviewDir = path4.join(planDir, "review");
+  const filePath = path4.join(reviewDir, "base-commit.json");
+  const existing = _readExistingBaseCommit(filePath);
+  if (existing) {
+    emit({ kind: "already-captured", baseCommit: existing, file: filePath }, 0);
+  }
+  fs4.mkdirSync(reviewDir, { recursive: true });
+  const record = {
+    version: 1,
+    baseCommit: head,
+    capturedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  fs4.writeFileSync(filePath, `${JSON.stringify(record)}
+`, "utf8");
+  emit({ kind: "captured", baseCommit: head, file: filePath }, 0);
+};
+if (require.main === module) {
+  main();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  _isGitRepo,
+  _isValidSha,
+  _readExistingBaseCommit,
+  main
+});

package/templates/harness/skills/st-full-workflow/scripts/dispatch-task-execution.cjs

@@ -3654,8 +3654,9 @@ var command = (executable, argv, request) => ({
   executable,
   argv,
   cwd: request.workspace,
-  stdin: taskPrompt(request)
+  stdin: request.prompt
 });
+var modelArgv = (model) => model === void 0 ? [] : ["--model", model];
 var EXTERNAL_HARNESS_ADAPTERS = {
   claude: {
     executable: "claude",
@@ -3663,8 +3664,7 @@ var EXTERNAL_HARNESS_ADAPTERS = {
       "claude",
       [
         "-p",
-        "--model",
-        request.model,
+        ...modelArgv(request.model),
         ...request.reasoningEffort === void 0 ? [] : ["--effort", request.reasoningEffort]
       ],
       request
@@ -3677,8 +3677,7 @@ var EXTERNAL_HARNESS_ADAPTERS = {
       "codex",
       [
         "exec",
-        "--model",
-        request.model,
+        ...modelArgv(request.model),
         ...request.reasoningEffort === void 0 ? [] : ["--config", `model_reasoning_effort=${request.reasoningEffort}`],
         "-"
       ],
@@ -3688,17 +3687,19 @@ var EXTERNAL_HARNESS_ADAPTERS = {
   },
   cursor: {
     executable: "cursor-agent",
-    buildCommand: (request) => command("cursor-agent", ["--print", "--model", request.model], request),
+    buildCommand: (request) => command("cursor-agent", ["--print", ...modelArgv(request.model)], request),
     authenticationArgv: () => ["status"]
   },
   gemini: {
     executable: "gemini",
-    buildCommand: (request) => command("gemini", ["--prompt", "", "--model", request.model], request),
+    // The empty positional prompt is the existing contract — content travels on
+    // stdin. It stays even when the model pair is dropped.
+    buildCommand: (request) => command("gemini", ["--prompt", "", ...modelArgv(request.model)], request),
     authenticationArgv: () => ["auth", "status"]
   },
   copilot: {
     executable: "copilot",
-    buildCommand: (request) => command("copilot", ["-p", "", "--model", request.model], request),
+    buildCommand: (request) => command("copilot", ["-p", "", ...modelArgv(request.model)], request),
     authenticationArgv: () => ["auth", "status"]
   },
   opencode: {
@@ -3707,8 +3708,7 @@ var EXTERNAL_HARNESS_ADAPTERS = {
       "opencode",
       [
         "run",
-        "--model",
-        request.model,
+        ...modelArgv(request.model),
         ...request.reasoningEffort === void 0 ? [] : ["--variant", request.reasoningEffort],
         "-"
       ],
@@ -3722,6 +3722,12 @@ var harnessKeys = [...SUPPORTED_HARNESSES].sort();
 if (adapterKeys.join("\0") !== harnessKeys.join("\0")) {
   throw new Error("External harness adapter registry does not cover SUPPORTED_HARNESSES exactly.");
 }
+var taskCommandRequest = (request) => ({
+  model: request.model,
+  reasoningEffort: request.reasoningEffort,
+  workspace: request.workspace,
+  prompt: taskPrompt(request)
+});
 var executableOnPath = (executable) => (process.env.PATH ?? "").split(path2.delimiter).some((directory) => {
   if (!directory) return false;
   const candidate = path2.join(directory, executable);
@@ -3782,23 +3788,17 @@ var dependencies = {
   launch: (commandSpec) => runProcess(commandSpec.executable, commandSpec.argv, commandSpec.cwd, commandSpec.stdin, true)
 };
 var errorMessage = (error) => error instanceof Error ? error.message : String(error);
-var dispatchExternalTask = async (request, overrides = {}) => {
-  const adapter = EXTERNAL_HARNESS_ADAPTERS[request.harness];
+var prepareLaunch = async (harness, input, active, guard) => {
+  const adapter = EXTERNAL_HARNESS_ADAPTERS[harness];
   if (!adapter) {
     return {
       kind: "fallback",
       reason: "adapter-unavailable",
-      detail: `No adapter is registered for ${request.harness}.`
-    };
-  }
-  const active = { ...dependencies, ...overrides };
-  if (request.reasoningEffort !== void 0 && (request.harness === "cursor" || request.harness === "gemini" || request.harness === "copilot")) {
-    return {
-      kind: "fallback",
-      reason: "unsupported-reasoning-effort",
-      detail: `${request.harness} does not support a generic reasoning_effort override.`
+      detail: `No adapter is registered for ${harness}.`
     };
   }
+  const blocked = guard?.();
+  if (blocked) return blocked;
   if (!active.executableExists(adapter.executable)) {
     return {
       kind: "fallback",
@@ -3806,7 +3806,7 @@ var dispatchExternalTask = async (request, overrides = {}) => {
       detail: `${adapter.executable} is unavailable.`
     };
   }
-  const commandSpec = adapter.buildCommand(request);
+  const commandSpec = adapter.buildCommand(input);
   const authentication = await active.authenticate(commandSpec, adapter);
   if (!authentication.ok) {
     return {
@@ -3815,16 +3815,35 @@ var dispatchExternalTask = async (request, overrides = {}) => {
       detail: authentication.detail ?? `${adapter.executable} authentication check failed.`
     };
   }
+  return { kind: "ready", command: commandSpec };
+};
+var launchPrepared = async (prepared, active, label) => {
+  if (prepared.kind === "fallback") return prepared;
   try {
-    const launched = await active.launch(commandSpec);
+    const launched = await active.launch(prepared.command);
     return launched.exitCode === 0 ? { kind: "launched-success", exitCode: 0 } : { kind: "launched-failure", exitCode: launched.exitCode };
   } catch (error) {
     return {
       kind: "infrastructure-failure",
-      detail: `External task process failed: ${errorMessage(error)}`
+      detail: `External ${label} process failed: ${errorMessage(error)}`
     };
   }
 };
+var unsupportedReasoningEffort = (request) => request.reasoningEffort !== void 0 && (request.harness === "cursor" || request.harness === "gemini" || request.harness === "copilot") ? {
+  kind: "fallback",
+  reason: "unsupported-reasoning-effort",
+  detail: `${request.harness} does not support a generic reasoning_effort override.`
+} : void 0;
+var dispatchExternalTask = async (request, overrides = {}) => {
+  const active = { ...dependencies, ...overrides };
+  const prepared = await prepareLaunch(
+    request.harness,
+    taskCommandRequest(request),
+    active,
+    () => unsupportedReasoningEffort(request)
+  );
+  return launchPrepared(prepared, active, "task");
+};
 
 // src/skill-scripts/shared/harness-availability.ts
 var fs2 = __toESM(require("fs"));
@@ -6509,7 +6528,7 @@ var main = async () => {
     );
   }
   const handoff = decodeHandoff(handoffArg);
-  const result = await dispatchExternalTask({
+  const routed = {
     harness: handoff.harness,
     model: handoff.model,
     ...handoff.reasoningEffort === void 0 ? {} : { reasoningEffort: handoff.reasoningEffort },
@@ -6518,7 +6537,8 @@ var main = async () => {
     taskId: validTaskId,
     taskFile: taskPath,
     taskMarkdown
-  });
+  };
+  const result = await dispatchExternalTask(routed);
   emit(
     result,
     result.kind === "infrastructure-failure" ? 2 : result.kind === "launched-failure" ? 1 : 0

package/templates/strikethroo/config/hooks/CODE_REVIEW.md

@@ -0,0 +1,60 @@
+# CODE_REVIEW Hook
+
+## Automated Code Review Gate
+
+This hook governs an unattended review loop that runs at the end of blueprint execution, after mechanical gates (lint, tests, Self Validation) report success. A reviewer on a discovered external harness critiques the plan's cumulative diff and emits findings; findings at or above the severity and confidence floors trigger automatic remediation, followed by a full re-run of the mechanical gates and re-verification.
+
+The gate terminates on exhausted round budget or when no findings above threshold remain.
+
+## Mandate: Conformance and Defects Only
+
+The reviewer checks the diff against the **plan's stated requirements** and for **demonstrable defects**. It does **not** raise general code-quality opinions, style notes, design critiques, or taste judgments — the linter owns style. Every finding must cite concrete evidence and trace to:
+
+- An explicit requirement stated in the plan, **or**
+- A demonstrable defect in the code as written
+
+Anything else is out of scope and must not be included in findings.
+
+## Finding Categories In Scope
+
+- **Requirement conformance** — the code does not implement what the plan explicitly asked for
+- **Demonstrable defects** — the code fails at runtime, produces wrong behaviour, violates a contract it declares, has a security hole, causes data loss, or breaks something else in the plan
+
+## Severity Floor: `major`
+
+Findings below `major` are recorded in the review output but never auto-applied. The severity levels, ordered from most to least consequential:
+
+- `critical` — causes data loss, security hole, crash, or corruption on a path real usage reaches
+- `major` — produces wrong behaviour or breaks a documented contract; nothing destroyed
+- `minor` — real but bounded (mishandled edge case, missing test, maintenance hazard); behaviour correct today
+- `info` — no defect (style, naming, question for author, recorded context)
+
+If a finding omits the severity attribute, it falls below the floor and is never auto-applied.
+
+## Confidence Floor: `high`
+
+Findings below `high` are recorded but never auto-applied. The confidence levels, ordered from most to least sure:
+
+- `high` — evidence is in the code that was read; failure can be traced from the diff alone, no assumptions needed
+- `medium` — likely real, but rests on one assumption not verified (how a caller behaves, what a dependency guarantees, what a requirement was)
+- `low` — speculative (failure scenario imagined, not traced; constraint invented; intent could not be inferred)
+
+If a finding omits the confidence attribute, it falls below the floor and is never auto-applied.
+
+This attribute has no schema default on purpose. Findings that omit confidence are treated as falling below any floor. An automated consumer relies on confidence being lowered honestly; LLM reviewers systematically overstate certainty.
+
+## Round Budget: 3
+
+The gate runs up to three detect-and-fix cycles:
+
+1. Reviewer critiques the cumulative diff → findings
+2. If findings above floor exist: implement fixes, re-run mechanical gates, verify
+3. Reviewer re-checks → repeat until no new findings above floor or budget exhausted
+
+This value expressed here is advisory prose only. **Termination is enforced in code and cannot be bypassed by editing this file.** If the round budget is exhausted, the gate halts exactly as any mechanical gate failure does: the plan stays in `plans/`, findings are recorded, and the failure is documented.
+
+## Disable the Gate
+
+**Emptying this file, or deleting it, disables the review gate cleanly.** The gate skips with no error and records the skip in the execution summary. This is the documented sentinel for "do not review this plan"; there is no undefined behaviour and no error.
+
+Users who already have a code review step in their workflow disable this feature by editing or emptying the hook, matching the pattern of `PRE_TASK_EXECUTION` which ships an overridable default discipline.