thurview 0.8.3 → 0.10.0

package/dist/cli.js

@@ -2,7 +2,7 @@ import { runAxiCli, AxiError, installSessionStartHooks, sessionStartHookStatus,
 import { encode } from "@toon-format/toon";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { cp, mkdir, symlink, lstat, rm } from "node:fs/promises";
+import { cp, mkdir, symlink, lstat, rm, readdir } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
@@ -18,6 +18,8 @@ import { replyThread, setThreadStatus, needsAgent } from "./threads.js";
 import { attach } from "./presence.js";
 import { startServer } from "./server/server.js";
 import { parseFlags, helpFor, str, bool } from "./flags.js";
+import { forgeFor, repoOf, summariseCi, } from "./forge/index.js";
+import { parseSubmission, longComments } from "./forge/submission.js";
 import { VERSION } from "./version.js";
 const execFileP = promisify(execFile);
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -46,10 +48,27 @@ function targetLabel(t) {
         return `map ${t.node}`;
     return "review";
 }
+/** `PR #12` or `MR !12`, because the forge's own word is what the reader knows. */
+function bindingLabel(b) {
+    if (b.kind !== "pr")
+        return b.name;
+    return b.forge === "gitlab" ? `MR !${b.name}` : `PR #${b.name}`;
+}
 function lastMessage(t) {
     const m = t.messages[t.messages.length - 1];
     return m ? `${m.role}: ${truncate(m.body.replace(/\s+/g, " "), 120)}` : "";
 }
+function skillsRoot() {
+    return resolve(HERE, "..", "skills");
+}
+/** Every skill this package ships, so a new one installs without a code change. */
+async function bundledSkills() {
+    const entries = await readdir(skillsRoot(), { withFileTypes: true });
+    return entries
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name)
+        .sort();
+}
 async function worktreeOf(cwd) {
     try {
         return await g.repoRoot(cwd);
@@ -84,6 +103,33 @@ async function resolveReview(idOpt) {
         "Run `thurview scaffold` to create one",
     ]);
 }
+/**
+ * Which change request, on which forge, read once. `--change` names it
+ * outright; otherwise the active review's binding does, which is what keeps a
+ * pass anchored to the commits the document was written against.
+ */
+async function forgeContext(p) {
+    const explicit = str(p, "change");
+    const review = !explicit || str(p, "review") ? await resolveReview(str(p, "review")) : null;
+    let ref = explicit;
+    if (!ref) {
+        if (review.binding.kind !== "pr")
+            throw new AxiError(`review ${short(review.id)} is bound to ${review.binding.name}, not to a change request`, "VALIDATION_ERROR", [
+                "Pass --change <number|url>",
+                `Or re-pin it: \`thurview scaffold --pr <ref> --update --review ${short(review.id)}\``,
+            ]);
+        ref = review.binding.name;
+    }
+    const repoFlag = str(p, "repo");
+    const worktree = review?.worktree ?? (await worktreeOf(process.cwd()));
+    if (!worktree && !repoFlag)
+        throw new AxiError("not inside a git repository", "VALIDATION_ERROR", [
+            "Run inside the source worktree, or pass --repo host/path",
+        ]);
+    const repo = await repoOf(worktree ?? process.cwd(), repoFlag);
+    const forge = await forgeFor(repo.host, str(p, "forge"));
+    return { forge, repo, cr: await forge.get(repo, ref), review };
+}
 async function reviewRow(r, fields) {
     const t = await readThreads(r.id);
     const row = {
@@ -96,7 +142,7 @@ async function reviewRow(r, fields) {
         needsAgent: t.threads.filter(needsAgent).length,
     };
     if (fields.has("all") || fields.has("binding"))
-        row["binding"] = r.binding.kind === "pr" ? `PR #${r.binding.name}` : r.binding.name;
+        row["binding"] = bindingLabel(r.binding);
     if (fields.has("all") || fields.has("pins"))
         row["pins"] =
             kindOf(r) === "explainer"
@@ -169,22 +215,43 @@ async function ensureServer() {
 function reviewUrl(base, id, view) {
     return `${base}/review/${id}${view ? `#/${view}` : ""}`;
 }
+function pinnedOf(review) {
+    return { worktree: review.worktree, pins: review.pins, dir: reviewDir(review.id) };
+}
 /**
- * The interface delta at a review's pins. The graphs are cached per commit under
- * the review directory, so publish and `graph interfaces` build them once between
+ * Base and head as `--base` and `--head` name them. Head defaults to HEAD and
+ * base to where head forked from trunk, so a branch is diffed against what it
+ * branched from rather than against wherever trunk has moved since.
+ */
+async function pinRange(worktree, base, head, usage) {
+    try {
+        const h = await g.revParse(worktree, head ?? "HEAD");
+        const b = base
+            ? await g.revParse(worktree, base)
+            : await g.mergeBase(worktree, await g.trunkRef(worktree), h);
+        return { base: b, head: h };
+    }
+    catch (e) {
+        throw new AxiError(e.message, "VALIDATION_ERROR", [
+            `Pass resolvable refs: \`${usage}\``,
+        ]);
+    }
+}
+/**
+ * The interface delta at two pinned commits. The graphs are cached per commit
+ * under `at.dir`, so publish and `graph interfaces` build them once between
  * them; both modules load lazily to keep tree-sitter off every other command's path.
  */
-async function deltaFor(review, base, head) {
+async function deltaFor(at, base, head) {
     const graph = await import("./graph.js");
     const { interfaceDelta } = await import("./interfaces.js");
-    const dir = reviewDir(review.id);
-    const b = base ?? (await graph.graphAt(review.worktree, review.pins.base, dir));
-    const h = head ?? (await graph.graphAt(review.worktree, review.pins.head, dir));
-    const changes = await g.lineChanges(review.worktree, review.pins.base, review.pins.head);
-    const changed = await g.changedFiles(review.worktree, review.pins.base, review.pins.head);
+    const b = base ?? (await graph.graphAt(at.worktree, at.pins.base, at.dir));
+    const h = head ?? (await graph.graphAt(at.worktree, at.pins.head, at.dir));
+    const changes = await g.lineChanges(at.worktree, at.pins.base, at.pins.head);
+    const changed = await g.changedFiles(at.worktree, at.pins.base, at.pins.head);
     return interfaceDelta({
-        cwd: review.worktree,
-        pins: review.pins,
+        cwd: at.worktree,
+        pins: at.pins,
         base: b,
         head: h,
         impact: graph.impact(b, h, changes, 1),
@@ -272,13 +339,21 @@ const SPECS = {
     scaffold: {
         description: "Create a review pinned to exact base and head commits, or re-pin one",
         flags: {
-            pr: { kind: "string", help: "review a GitHub pull request (number or URL, needs gh)" },
+            pr: {
+                kind: "string",
+                help: "review a pull or merge request (number or URL, needs gh or glab)",
+            },
             base: { kind: "string", help: "base revision (default: trunk fork point)" },
             head: { kind: "string", help: "head revision (default: current branch)" },
             title: { kind: "string", help: "initial title" },
             new: { kind: "boolean", help: "create another review even if one matches the binding" },
             update: { kind: "boolean", help: "re-pin an existing review from its binding" },
             review: { kind: "string", help: "review to update (id prefix)" },
+            forge: {
+                kind: "string",
+                help: "github or gitlab, when the host is not one of the two known ones",
+            },
+            repo: { kind: "string", help: "host/path, when `origin` is not the repository to post to" },
         },
         examples: [
             "thurview scaffold",
@@ -384,17 +459,55 @@ const SPECS = {
         args: "interfaces|impact|callers <name>|tests-for <name>|architecture",
         flags: {
             review: { kind: "string", help: "review id prefix" },
+            base: {
+                kind: "string",
+                help: "instead of --review: base revision (default: trunk fork point)",
+            },
+            head: { kind: "string", help: "instead of --review: head revision (default: HEAD)" },
             graph: { kind: "string", help: "callers, tests-for: head or base", default: "head" },
             depth: { kind: "string", help: "how many caller hops to follow", default: "2" },
         },
         examples: [
             "thurview graph interfaces",
             "thurview graph impact",
+            "thurview graph impact --base main --head HEAD",
             "thurview graph callers login",
             "thurview graph tests-for login --graph base",
             "thurview graph architecture",
         ],
     },
+    forge: {
+        description: "Read a pull or merge request through its forge, and post the review back to it",
+        args: 'status|prior|submit --file <path>|reply <threadId> --body "<text>"',
+        flags: {
+            review: { kind: "string", help: "review id prefix; its binding names the change request" },
+            change: { kind: "string", help: "change request number or URL, instead of a review binding" },
+            forge: {
+                kind: "string",
+                help: "github or gitlab, when the host is not one of the two known ones",
+            },
+            repo: { kind: "string", help: "host/path, when `origin` is not the repository to post to" },
+            file: { kind: "string", help: "submit: the JSON submission to post" },
+            body: { kind: "string", help: "reply: the answer text" },
+            resolve: { kind: "boolean", help: "reply: resolve the thread as well as answering it" },
+            at: { kind: "string", help: "reply --resolve: the commit the point was verified at" },
+            confirm: { kind: "boolean", help: "submit: required to post an approve" },
+            "dry-run": { kind: "boolean", help: "submit: validate and report, post nothing" },
+            "max-lines": {
+                kind: "string",
+                help: "submit: warn above this many lines per comment",
+                default: "5",
+            },
+            mine: { kind: "boolean", help: "prior: only threads this account wrote" },
+            full: { kind: "boolean", help: "prior, status: do not truncate or filter" },
+        },
+        examples: [
+            "thurview forge status --change 123",
+            "thurview forge prior --change 123 --mine",
+            "thurview forge submit --file pass.json --dry-run",
+            'thurview forge reply <threadId> --body "<answer>" --resolve --at <sha>',
+        ],
+    },
     delete: {
         description: "Delete a review and everything stored for it (the code is untouched)",
         flags: { review: { kind: "string", help: "review id prefix (required)" } },
@@ -480,47 +593,31 @@ const commands = {
         const pr = str(p, "pr");
         if (pr || b?.kind === "pr") {
             const ref = pr ?? b.name;
-            let info;
-            try {
-                const { stdout } = await execFileP("gh", ["pr", "view", ref, "--json", "number,title,url,baseRefName,headRefOid"], { cwd: worktree });
-                info = JSON.parse(stdout);
-            }
-            catch (e) {
-                throw new AxiError(`could not read pull request ${ref}: ${e.message.split("\n")[0]}`, "PR_ERROR", [
-                    "Check `gh auth status` and the PR number",
-                    "Or run `thurview scaffold --base <ref> --head <ref>`",
-                ]);
-            }
+            const repo = await repoOf(worktree, str(p, "repo"));
+            const forge = await forgeFor(repo.host, str(p, "forge") ?? b?.forge);
+            const cr = await forge.get(repo, ref);
+            // A fork's head is not a branch in this checkout, so fetch it by the
+            // ref the forge publishes it under before anything tries to resolve it.
             await g
-                .fetch(worktree, "origin", `refs/pull/${info.number}/head`, `refs/heads/${info.baseRefName}`)
+                .fetch(worktree, "origin", forge.fetchRef(cr), `refs/heads/${cr.baseBranch}`)
                 .catch(() => { });
-            head = info.headRefOid;
-            let baseRef = `origin/${info.baseRefName}`;
+            head = cr.head;
+            let baseRef = `origin/${cr.baseBranch}`;
             try {
                 await g.revParse(worktree, baseRef);
             }
             catch {
-                baseRef = info.baseRefName;
+                baseRef = cr.baseBranch;
             }
             base = await g.mergeBase(worktree, baseRef, head);
-            binding = { kind: "pr", name: String(info.number), url: info.url };
-            title ||= info.title;
+            binding = { kind: "pr", name: cr.number, url: cr.url, forge: forge.id };
+            title ||= cr.title;
         }
         else if (str(p, "base") || str(p, "head") || b?.kind === "range") {
             const [bb, hh] = b?.kind === "range" && !str(p, "base") && !str(p, "head")
                 ? b.name.split("..")
                 : [str(p, "base"), str(p, "head")];
-            try {
-                head = await g.revParse(worktree, hh ?? "HEAD");
-                base = bb
-                    ? await g.revParse(worktree, bb)
-                    : await g.mergeBase(worktree, await g.trunkRef(worktree), head);
-            }
-            catch (e) {
-                throw new AxiError(e.message, "VALIDATION_ERROR", [
-                    "Pass resolvable refs: `thurview scaffold --base <ref> --head <ref>`",
-                ]);
-            }
+            ({ base, head } = await pinRange(worktree, bb, hh, "thurview scaffold --base <ref> --head <ref>"));
             binding = { kind: "range", name: `${base.slice(0, 12)}..${head.slice(0, 12)}` };
         }
         else {
@@ -602,7 +699,7 @@ const commands = {
                 title: review.title,
                 status: review.status,
                 rev: review.revision,
-                binding: binding.kind === "pr" ? `PR #${binding.name}` : binding.name,
+                binding: bindingLabel(binding),
                 base,
                 head,
                 worktree,
@@ -816,7 +913,7 @@ const commands = {
         let interfaces = null;
         if (kind === "review") {
             try {
-                interfaces = await deltaFor(review);
+                interfaces = await deltaFor(pinnedOf(review));
             }
             catch (e) {
                 diags.push({
@@ -1149,17 +1246,37 @@ const commands = {
         const side = str(p, "graph") ?? "head";
         if (side !== "head" && side !== "base")
             throw new AxiError("--graph must be head or base", "VALIDATION_ERROR", help);
+        const baseRef = str(p, "base");
+        const headRef = str(p, "head");
+        const commits = baseRef !== undefined || headRef !== undefined;
+        if (commits && str(p, "review"))
+            throw new AxiError("pass --review or --base/--head, not both", "VALIDATION_ERROR", help);
         const graph = await import("./graph.js");
-        const review = await resolveReview(str(p, "review"));
-        if (kindOf(review) === "explainer" && (sub === "interfaces" || sub === "impact"))
+        const review = commits ? null : await resolveReview(str(p, "review"));
+        let t;
+        if (review)
+            t = pinnedOf(review);
+        else {
+            const worktree = await worktreeOf(process.cwd());
+            if (!worktree)
+                throw new AxiError("not inside a git repository", "VALIDATION_ERROR", [
+                    "Run inside the source worktree, or pass --review <id>",
+                ]);
+            // No review directory owns these graphs, and a commit's graph is the same
+            // whoever asks, so they share one cache under the thurview home.
+            const pins = await pinRange(worktree, baseRef, headRef, "thurview graph impact --base <ref>");
+            t = { worktree, pins, dir: home() };
+        }
+        // A next step has to name the same commits, or it answers about another change.
+        const again = review ? "" : ` --base ${short(t.pins.base)} --head ${short(t.pins.head)}`;
+        if (review && kindOf(review) === "explainer" && (sub === "interfaces" || sub === "impact"))
             throw new AxiError(`graph ${sub} compares two commits; an explainer is pinned to one`, "VALIDATION_ERROR", [
                 `Run \`thurview graph architecture --review ${short(review.id)}\` for the structure at that commit`,
                 `Run \`thurview graph callers <name> --review ${short(review.id)}\` to follow one symbol`,
             ]);
-        const dir = reviewDir(review.id);
-        const at = (commit) => graph.graphAt(review.worktree, commit, dir);
+        const at = (commit) => graph.graphAt(t.worktree, commit, t.dir);
         if (sub === "callers" || sub === "tests-for") {
-            const g = await at(side === "base" ? review.pins.base : review.pins.head);
+            const g = await at(side === "base" ? t.pins.base : t.pins.head);
             const pins = {
                 graph: side,
                 commit: short(g.commit),
@@ -1171,25 +1288,25 @@ const commands = {
                     ...pins,
                     symbol: name,
                     callers: graph.callers(g, name),
-                    help: [`Run \`thurview graph tests-for ${name}\` to see what exercises it`],
+                    help: [`Run \`thurview graph tests-for ${name}${again}\` to see what exercises it`],
                 };
             return {
                 ...pins,
                 symbol: name,
                 depth,
                 tests: graph.testsFor(g, name, depth),
-                help: [`Run \`thurview graph callers ${name}\` for every reference`],
+                help: [`Run \`thurview graph callers ${name}${again}\` for every reference`],
             };
         }
-        const base = await at(review.pins.base);
-        const head = await at(review.pins.head);
+        const base = await at(t.pins.base);
+        const head = await at(t.pins.head);
         const pins = {
             base: short(base.commit),
             head: short(head.commit),
             languages: graph.LANGUAGES.join(","),
         };
         if (sub === "interfaces") {
-            const delta = await deltaFor(review, base, head);
+            const delta = await deltaFor(t, base, head);
             return {
                 ...pins,
                 verdict: delta.verdict,
@@ -1207,29 +1324,31 @@ const commands = {
                 unreadable: delta.unreadable,
                 truncated: delta.truncated,
                 help: [
-                    "Write one capability line per entry in data.yaml under `interfaces`, keyed by id",
-                    "Run `thurview graph callers <name>` to see who a removed or changed interface reached",
+                    ...(review
+                        ? ["Write one capability line per entry in data.yaml under `interfaces`, keyed by id"]
+                        : []),
+                    `Run \`thurview graph callers <name>${again}\` to see who a removed or changed interface reached`,
                 ],
             };
         }
         if (sub === "impact") {
-            const changes = await g.lineChanges(review.worktree, review.pins.base, review.pins.head);
+            const changes = await g.lineChanges(t.worktree, t.pins.base, t.pins.head);
             return {
                 ...pins,
                 depth,
                 ...graph.impact(base, head, changes, depth),
                 help: [
-                    "Run `thurview graph callers <name>` to follow one symbol",
-                    "Run `thurview graph architecture` for the module structure and its diff",
+                    `Run \`thurview graph callers <name>${again}\` to follow one symbol`,
+                    `Run \`thurview graph architecture${again}\` for the module structure and its diff`,
                 ],
             };
         }
         // An explainer is scoped to a path, so its structure is that path's, not the
         // repository's: the same bound the Coverage tab accounts for.
-        if (kindOf(review) === "explainer") {
+        if (review && kindOf(review) === "explainer") {
             const scope = review.binding.name;
             const g0 = scopeGraph(head, scope);
-            const allFiles = await g.listFiles(review.worktree, review.pins.head);
+            const allFiles = await g.listFiles(t.worktree, t.pins.head);
             const { diff: _diff, truncated: _truncated, ...rest } = graph.architecture(g0, g0);
             return {
                 commit: short(head.commit),
@@ -1375,6 +1494,247 @@ const commands = {
             ],
         };
     },
+    async forge(args) {
+        const sub = args[0];
+        const s = spec("forge").flags;
+        const usage = [
+            "thurview forge status [--change <ref>] [--review <id>]",
+            "thurview forge prior [--change <ref>] [--mine] [--full]",
+            "thurview forge submit --file <path> [--dry-run] [--confirm]",
+            'thurview forge reply <threadId> --body "<text>" [--resolve --at <sha>]',
+        ];
+        if (!sub || !["status", "prior", "submit", "reply"].includes(sub))
+            throw new AxiError(`unknown forge command${sub ? ` ${sub}` : ""}`, "VALIDATION_ERROR", usage);
+        const common = {
+            review: s["review"],
+            change: s["change"],
+            forge: s["forge"],
+            repo: s["repo"],
+        };
+        const rest = args.slice(1);
+        if (sub === "status") {
+            const p = parseFlags("forge status", rest, { ...common, full: s["full"] });
+            const ctx = await forgeContext(p);
+            const checks = await ctx.forge.checks(ctx.repo, ctx.cr);
+            const baseline = await ctx.forge.baseline(ctx.repo, ctx.cr.baseBranch).catch(() => null);
+            const ci = summariseCi(checks, baseline, ctx.cr.baseBranch);
+            const shown = bool(p, "full") ? checks : checks.filter((c) => c.state !== "passed");
+            const hidden = checks.length - shown.length;
+            const help = [
+                `Quote \`ci.verdict\` in the review; do not read "nothing failed" as "the tests passed"`,
+                `Run \`thurview forge prior --change ${ctx.cr.number}\` to read the previous pass before writing a new one`,
+            ];
+            if (hidden && !bool(p, "full"))
+                help.push(`${hidden} passing checks hidden; pass --full to list them`);
+            if (ctx.review && ctx.review.pins.head !== ctx.cr.head)
+                help.unshift(`The head moved since this review was pinned; run \`thurview scaffold --update --review ${short(ctx.review.id)}\` and diff only what moved`);
+            return {
+                change: {
+                    forge: ctx.forge.id,
+                    repo: `${ctx.repo.host}/${ctx.repo.path}`,
+                    number: ctx.cr.number,
+                    title: ctx.cr.title,
+                    url: ctx.cr.url,
+                    state: ctx.cr.state,
+                    author: ctx.cr.author,
+                    draft: ctx.cr.draft,
+                    fromFork: ctx.cr.fromFork,
+                    head: ctx.cr.head,
+                    headBranch: ctx.cr.headBranch,
+                    baseBranch: ctx.cr.baseBranch,
+                },
+                ci,
+                checks: shown.length
+                    ? shown.map((c) => ({ name: c.name, state: c.state, raw: c.raw }))
+                    : `0 of ${checks.length} checks need attention`,
+                ...(ctx.review
+                    ? {
+                        review: {
+                            id: short(ctx.review.id),
+                            pinnedHead: ctx.review.pins.head,
+                            movedSincePin: ctx.review.pins.head !== ctx.cr.head,
+                        },
+                    }
+                    : {}),
+                permalink: ctx.forge.permalink(ctx.repo, ctx.cr.head, "<path>", 10, 20),
+                help,
+            };
+        }
+        if (sub === "prior") {
+            const p = parseFlags("forge prior", rest, {
+                ...common,
+                mine: s["mine"],
+                full: s["full"],
+            });
+            const ctx = await forgeContext(p);
+            const prior = await ctx.forge.prior(ctx.repo, ctx.cr);
+            const { threads } = prior;
+            // A forge wraps inline comments in a pass of its own with an empty
+            // body. That envelope is not something to answer; the thread under it
+            // is, and it is already in `threads`.
+            const passes = prior.passes.filter((x) => x.body.trim() !== "" || x.verdict !== "commented");
+            const me = await ctx.forge.whoami(ctx.repo).catch(() => "");
+            const full = bool(p, "full");
+            const rows = (bool(p, "mine") ? threads.filter((t) => t.author === me) : threads).map((t) => {
+                const last = t.messages[t.messages.length - 1];
+                return {
+                    id: t.id,
+                    author: t.author,
+                    at: t.path ? `${t.path}${t.line ? `:${t.line}` : ""}` : "(change request)",
+                    resolved: t.resolved,
+                    outdated: t.outdated,
+                    atHead: t.commit ? t.commit === ctx.cr.head : null,
+                    messages: t.messages.length,
+                    last: last ? (full ? last.body : truncate(last.body.replace(/\s+/g, " "), 160)) : "",
+                };
+            });
+            const open = rows.filter((r) => !r.resolved).length;
+            return {
+                summary: {
+                    passes: passes.length,
+                    threads: rows.length,
+                    open,
+                    resolved: rows.length - open,
+                    mine: me ? threads.filter((t) => t.author === me).length : null,
+                    notAtHead: rows.filter((r) => r.atHead === false).length,
+                    head: ctx.cr.head,
+                },
+                passes: passes.length
+                    ? passes.map((x) => ({
+                        author: x.author,
+                        verdict: x.verdict,
+                        at: x.at,
+                        commit: x.commit ?? "",
+                        body: full ? x.body : truncate(x.body.replace(/\s+/g, " "), 200),
+                    }))
+                    : "0 (nobody has reviewed this change request yet)",
+                threads: rows.length ? rows : "0 (no review thread on this change request)",
+                help: passes.length || rows.length
+                    ? [
+                        "Go through every open thread point by point: addressed, partially addressed, or untouched",
+                        'Answer one with `thurview forge reply <threadId> --body "<text>"`, and add --resolve --at <sha> only once you verified the point at that head',
+                        full ? "" : "Pass --full for the untruncated bodies",
+                    ].filter(Boolean)
+                    : ["This is the first pass; there is no prior review to answer"],
+            };
+        }
+        if (sub === "submit") {
+            const p = parseFlags("forge submit", rest, {
+                ...common,
+                file: s["file"],
+                confirm: s["confirm"],
+                "dry-run": s["dry-run"],
+                "max-lines": s["max-lines"],
+            });
+            const file = str(p, "file");
+            if (!file)
+                throw new AxiError("--file is required", "VALIDATION_ERROR", [
+                    "thurview forge submit --file <path>",
+                ]);
+            const text = await readText(resolve(process.cwd(), file));
+            if (text === null)
+                throw new AxiError(`${file} not found`, "NOT_FOUND", [
+                    'Write the pass as JSON: {"verdict": "comment", "body": "<summary>", "comments": []}',
+                ]);
+            const submission = parseSubmission(text, file);
+            const max = Number(str(p, "max-lines"));
+            const warnings = longComments(submission, Number.isFinite(max) && max > 0 ? max : 5);
+            const consequences = submission.verdict === "approve"
+                ? [
+                    "Approving dismisses any standing request for changes, which is what makes this mergeable",
+                    "Where auto-merge is armed, approving merges the code with no further human read",
+                    "Say that to the user before you pass --confirm",
+                ]
+                : [];
+            const dry = bool(p, "dry-run");
+            if (submission.verdict === "approve" && !bool(p, "confirm") && !dry)
+                throw new AxiError("approving is a state change, so it needs --confirm", "VALIDATION_ERROR", [...consequences, "Re-run with --confirm, or submit with verdict comment instead"]);
+            const ctx = await forgeContext(p);
+            if (dry)
+                return {
+                    dryRun: {
+                        forge: ctx.forge.id,
+                        change: `${ctx.repo.path}#${ctx.cr.number}`,
+                        head: ctx.cr.head,
+                        verdict: submission.verdict,
+                        comments: submission.comments.length,
+                        bodyLines: submission.body.trimEnd().split("\n").length,
+                    },
+                    comments: submission.comments.length
+                        ? submission.comments.map((c) => ({
+                            at: `${c.path}:${c.startLine && c.startLine < c.line ? `${c.startLine}-${c.line}` : c.line}`,
+                            side: c.side ?? "head",
+                            lines: c.body.trimEnd().split("\n").length,
+                        }))
+                        : "0 (a summary-only pass)",
+                    warnings: warnings.length ? warnings : "0 (every comment is within the line budget)",
+                    ...(consequences.length ? { consequences } : {}),
+                    help: [
+                        "Nothing was posted; re-run without --dry-run to post it",
+                        "Check every anchor is a line the diff actually touches, or the forge refuses the comment",
+                    ],
+                };
+            const posted = await ctx.forge.submit(ctx.repo, ctx.cr, submission);
+            return {
+                submitted: {
+                    forge: ctx.forge.id,
+                    change: `${ctx.repo.path}#${ctx.cr.number}`,
+                    head: ctx.cr.head,
+                    verdict: posted.verdict,
+                    comments: posted.posted,
+                    url: posted.url ?? ctx.cr.url,
+                },
+                warnings: warnings.length ? warnings : "0 (every comment is within the line budget)",
+                notes: posted.notes.length ? posted.notes : "0 (the forge did exactly what was asked)",
+                help: [
+                    `Record ${ctx.cr.head.slice(0, 12)} as the head you reviewed; a later pass diffs against it`,
+                    "Never merge, close or push to the change request; that decision is the maintainer's",
+                ],
+            };
+        }
+        const p = parseFlags("forge reply", rest, { ...common, body: s["body"], resolve: s["resolve"], at: s["at"] }, 1);
+        const threadId = p.positional[0];
+        if (!threadId)
+            throw new AxiError("forge reply needs a thread id", "VALIDATION_ERROR", [
+                'thurview forge reply <threadId> --body "<text>"',
+                "Run `thurview forge prior` for the thread ids",
+            ]);
+        const body = str(p, "body");
+        const wantResolve = bool(p, "resolve");
+        if (!body && !wantResolve)
+            throw new AxiError("forge reply needs --body, --resolve, or both", "VALIDATION_ERROR", [
+                'thurview forge reply <threadId> --body "<text>" --resolve --at <sha>',
+            ]);
+        const ctx = await forgeContext(p);
+        if (wantResolve) {
+            const at = str(p, "at");
+            if (!at)
+                throw new AxiError("--resolve needs --at <sha>", "VALIDATION_ERROR", [
+                    "Resolving tells the author the point is verified; --at is the commit you verified it at",
+                    `The current head is ${ctx.cr.head}`,
+                ]);
+            if (at.length < 7 || !ctx.cr.head.startsWith(at))
+                throw new AxiError(`--at ${at} is not the current head of ${ctx.repo.path}#${ctx.cr.number}`, "CONFLICT", [
+                    `The head is ${ctx.cr.head}`,
+                    "Re-read the point at that head before resolving; a thread resolved against an older head tells the author a point was accepted that nobody checked",
+                ]);
+        }
+        const done = await ctx.forge.reply(ctx.repo, ctx.cr, threadId, body, wantResolve);
+        return {
+            thread: {
+                id: threadId,
+                change: `${ctx.repo.path}#${ctx.cr.number}`,
+                replied: done.replied,
+                resolved: done.resolved,
+                verifiedAt: wantResolve ? ctx.cr.head : "",
+            },
+            notes: done.notes.length ? done.notes : "0 (the forge did exactly what was asked)",
+            help: [
+                "Leave a thread open when the point is only partially addressed, and say which part",
+                `Run \`thurview forge prior --change ${ctx.cr.number}\` to see what is still open`,
+            ],
+        };
+    },
     async delete(args) {
         const p = parseFlags("delete", args, spec("delete").flags);
         const idOpt = str(p, "review");
@@ -1427,7 +1787,7 @@ const commands = {
         }
         if (sub === "skill") {
             const p = parseFlags("setup skill", args.slice(1), { targets: s["targets"] });
-            const src = resolve(HERE, "..", "skills", "thurview");
+            const names = await bundledSkills();
             const dirs = {
                 claude: join(homedir(), ".claude", "skills"),
                 agents: join(homedir(), ".agents", "skills"),
@@ -1444,27 +1804,29 @@ const commands = {
                         "thurview setup skill --targets claude,agents,cursor",
                     ]);
                 await mkdir(d, { recursive: true });
-                const dst = join(d, "thurview");
-                try {
-                    const stt = await lstat(dst);
-                    if (stt.isSymbolicLink())
-                        await rm(dst);
-                    else
-                        throw new AxiError(`${dst} exists and is not a symlink`, "CONFLICT", [
-                            `Remove ${dst} and run \`thurview setup skill\` again`,
-                        ]);
-                }
-                catch (e) {
-                    if (e instanceof AxiError)
-                        throw e;
+                for (const name of names) {
+                    const dst = join(d, name);
+                    try {
+                        const stt = await lstat(dst);
+                        if (stt.isSymbolicLink())
+                            await rm(dst);
+                        else
+                            throw new AxiError(`${dst} exists and is not a symlink`, "CONFLICT", [
+                                `Remove ${dst} and run \`thurview setup skill\` again`,
+                            ]);
+                    }
+                    catch (e) {
+                        if (e instanceof AxiError)
+                            throw e;
+                    }
+                    await symlink(join(skillsRoot(), name), dst, "dir");
                 }
-                await symlink(src, dst, "dir");
-                installed[t] = dst;
+                installed[t] = `${join(d, `{${names.join(",")}}`)}`;
             }
             return {
                 skill: installed,
                 help: [
-                    "Invoke it as /thurview in Claude Code, or by name in other agents",
+                    "Invoke them as /thurview and /review-fix in Claude Code, or by name in other agents",
                     "Run `thurview setup hooks` for ambient context at session start",
                 ],
             };
@@ -1473,10 +1835,12 @@ const commands = {
         const st = sessionStartHookStatus({ ...identity, scope: "user" });
         const skill = {};
         for (const [t, d] of Object.entries({
-            claude: join(homedir(), ".claude", "skills", "thurview"),
-            agents: join(homedir(), ".agents", "skills", "thurview"),
-        }))
-            skill[t] = existsSync(d) ? d : "not installed";
+            claude: join(homedir(), ".claude", "skills"),
+            agents: join(homedir(), ".agents", "skills"),
+        })) {
+            const there = (await bundledSkills()).filter((n) => existsSync(join(d, n)));
+            skill[t] = there.length ? there.map((n) => join(d, n)).join(", ") : "not installed";
+        }
         return {
             hooks: {
                 claude: st.claude.installed ? st.claude.path : "not installed",
@@ -1489,7 +1853,14 @@ const commands = {
     },
     async skill(args) {
         parseFlags("skill", args, {});
-        return { skill: resolve(HERE, "..", "skills", "thurview", "SKILL.md") };
+        const skills = {};
+        for (const name of await bundledSkills())
+            skills[name] = join(skillsRoot(), name, "SKILL.md");
+        return {
+            skill: skills["thurview"],
+            skills,
+            help: ["Read the SKILL.md of the one that matches the request, and its references beside it"],
+        };
     },
 };
 function topLevelHelp() {