thurview 0.8.3 → 0.9.0

package/README.md

@@ -73,6 +73,7 @@ reads the Agent Skills format:
 
 ```sh
 npx skills add Thurbeen/thurview --skill thurview
+npx skills add Thurbeen/thurview --skill forge-review   # optional, see below
 ```
 
 That form tracks this repository's default branch: `skills update` takes
@@ -89,8 +90,8 @@ that matches the command you have installed. Use that when you want the two to
 move together.
 
 The skill drives the `thurview` command, which needs Node 22 or later and
-git (`gh` for pull requests). Install it, or let the skill reach it through
-`npx`:
+git (`gh` for pull requests, `glab` for merge requests). Install it, or let
+the skill reach it through `npx`:
 
 ```sh
 npm install -g thurview     # or: pnpm add -g thurview
@@ -168,19 +169,20 @@ bar.
 
 ## CLI
 
-| Command                                                               | Purpose                                                          |
-| --------------------------------------------------------------------- | ---------------------------------------------------------------- |
-| `thurview scaffold [--pr N \| --base R --head R]`                     | Create a review pinned to exact commits (`--update` re-pins)     |
-| `thurview explain [<path>] [--commit R]`                              | Create a code explainer of a codebase or subsystem at one commit |
-| `thurview info [--all]`                                               | Reviews bound to this worktree                                   |
-| `thurview publish --review ID [--view T] [--open]`                    | Validate the document and map, seal a revision                   |
-| `thurview open --review ID [--view T]`                                | Start the server if needed and open the browser                  |
-| `thurview wait --review ID [--timeout S]`                             | Block until the reader needs the agent                           |
-| `thurview threads list\|get\|reply\|resolve`                          | Read and answer threads                                          |
-| `thurview graph interfaces\|impact\|callers\|tests-for\|architecture` | Ask the code graph at the pinned commits                         |
-| `thurview serve` / `thurview stop`                                    | Run the server in the foreground / stop the background one       |
-| `thurview setup hooks\|skill\|status`                                 | Session hooks, agent skill, install state                        |
-| `thurview update`                                                     | Self-update from npm                                             |
+| Command                                                               | Purpose                                                           |
+| --------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `thurview scaffold [--pr N \| --base R --head R]`                     | Create a review pinned to exact commits (`--update` re-pins)      |
+| `thurview explain [<path>] [--commit R]`                              | Create a code explainer of a codebase or subsystem at one commit  |
+| `thurview info [--all]`                                               | Reviews bound to this worktree                                    |
+| `thurview publish --review ID [--view T] [--open]`                    | Validate the document and map, seal a revision                    |
+| `thurview open --review ID [--view T]`                                | Start the server if needed and open the browser                   |
+| `thurview wait --review ID [--timeout S]`                             | Block until the reader needs the agent                            |
+| `thurview threads list\|get\|reply\|resolve`                          | Read and answer threads                                           |
+| `thurview graph interfaces\|impact\|callers\|tests-for\|architecture` | Ask the code graph at the pinned commits                          |
+| `thurview forge status\|prior\|submit\|reply`                         | Read a change request through its forge, and post the review back |
+| `thurview serve` / `thurview stop`                                    | Run the server in the foreground / stop the background one        |
+| `thurview setup hooks\|skill\|status`                                 | Session hooks, agent skill, install state                         |
+| `thurview update`                                                     | Self-update from npm                                              |
 
 thurview is an [AXI](https://axi.md): built for agents that drive it through a
 shell. Output is [TOON](https://toonformat.dev) on stdout, errors are
@@ -192,6 +194,38 @@ arguments shows live state for the current directory instead of a manual.
 `thurview <command> --help` is the fallback. Progress and diagnostics go to
 stderr.
 
+## Posting the review to the forge
+
+A thurview review is read in the browser. When the change is a pull request on
+GitHub or a merge request on GitLab, the `forge-review` skill posts it there as
+well: inline comments anchored to lines, a summary, and a verdict.
+
+```sh
+thurview forge status --change 123    # what CI actually did, and whether it is a gate at all
+thurview forge prior  --change 123    # the previous pass, thread by thread
+thurview forge submit --change 123 --file pass.json --dry-run
+thurview forge reply <threadId> --change 123 --body "<answer>" --resolve --at <head>
+```
+
+`status` counts passed, failed, cancelled, skipped and running checks
+separately, and compares them against what the target branch's own tip runs -
+a change request from a fork typically runs a fraction of them, and a
+cancelled job shows no failure while asserting nothing. `ci.trustworthy` is
+the only field that means the tests really passed.
+
+`submit` takes one JSON file so a human can read the pass before it is posted,
+refuses an `approve` without `--confirm`, and warns about comments too long to
+be read. `reply --resolve` takes `--at <sha>` and refuses any commit but the
+current head, so a thread is never closed against code nobody looked at. There
+is no merge, close or push command, deliberately.
+
+GitHub goes through `gh`, GitLab through `glab`; hosts other than github.com
+and gitlab.com are matched against what those CLIs are authenticated for, and
+an unmatched host is refused rather than guessed. The differences that survive
+the seam - GitLab has no changes-requested state, no atomic review and no
+multi-line comment anchor - are listed in
+[skills/forge-review/references/forges.md](skills/forge-review/references/forges.md).
+
 ## Authoring format
 
 The agent writes three files in `~/.thurview/reviews/<id>/`:

package/dist/cli.js

@@ -2,7 +2,7 @@ import { runAxiCli, AxiError, installSessionStartHooks, sessionStartHookStatus,
 import { encode } from "@toon-format/toon";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { cp, mkdir, symlink, lstat, rm } from "node:fs/promises";
+import { cp, mkdir, symlink, lstat, rm, readdir } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
@@ -18,6 +18,8 @@ import { replyThread, setThreadStatus, needsAgent } from "./threads.js";
 import { attach } from "./presence.js";
 import { startServer } from "./server/server.js";
 import { parseFlags, helpFor, str, bool } from "./flags.js";
+import { forgeFor, repoOf, summariseCi, } from "./forge/index.js";
+import { parseSubmission, longComments } from "./forge/submission.js";
 import { VERSION } from "./version.js";
 const execFileP = promisify(execFile);
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -46,10 +48,27 @@ function targetLabel(t) {
         return `map ${t.node}`;
     return "review";
 }
+/** `PR #12` or `MR !12`, because the forge's own word is what the reader knows. */
+function bindingLabel(b) {
+    if (b.kind !== "pr")
+        return b.name;
+    return b.forge === "gitlab" ? `MR !${b.name}` : `PR #${b.name}`;
+}
 function lastMessage(t) {
     const m = t.messages[t.messages.length - 1];
     return m ? `${m.role}: ${truncate(m.body.replace(/\s+/g, " "), 120)}` : "";
 }
+function skillsRoot() {
+    return resolve(HERE, "..", "skills");
+}
+/** Every skill this package ships, so a new one installs without a code change. */
+async function bundledSkills() {
+    const entries = await readdir(skillsRoot(), { withFileTypes: true });
+    return entries
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name)
+        .sort();
+}
 async function worktreeOf(cwd) {
     try {
         return await g.repoRoot(cwd);
@@ -84,6 +103,33 @@ async function resolveReview(idOpt) {
         "Run `thurview scaffold` to create one",
     ]);
 }
+/**
+ * Which change request, on which forge, read once. `--change` names it
+ * outright; otherwise the active review's binding does, which is what keeps a
+ * pass anchored to the commits the document was written against.
+ */
+async function forgeContext(p) {
+    const explicit = str(p, "change");
+    const review = !explicit || str(p, "review") ? await resolveReview(str(p, "review")) : null;
+    let ref = explicit;
+    if (!ref) {
+        if (review.binding.kind !== "pr")
+            throw new AxiError(`review ${short(review.id)} is bound to ${review.binding.name}, not to a change request`, "VALIDATION_ERROR", [
+                "Pass --change <number|url>",
+                `Or re-pin it: \`thurview scaffold --pr <ref> --update --review ${short(review.id)}\``,
+            ]);
+        ref = review.binding.name;
+    }
+    const repoFlag = str(p, "repo");
+    const worktree = review?.worktree ?? (await worktreeOf(process.cwd()));
+    if (!worktree && !repoFlag)
+        throw new AxiError("not inside a git repository", "VALIDATION_ERROR", [
+            "Run inside the source worktree, or pass --repo host/path",
+        ]);
+    const repo = await repoOf(worktree ?? process.cwd(), repoFlag);
+    const forge = await forgeFor(repo.host, str(p, "forge"));
+    return { forge, repo, cr: await forge.get(repo, ref), review };
+}
 async function reviewRow(r, fields) {
     const t = await readThreads(r.id);
     const row = {
@@ -96,7 +142,7 @@ async function reviewRow(r, fields) {
         needsAgent: t.threads.filter(needsAgent).length,
     };
     if (fields.has("all") || fields.has("binding"))
-        row["binding"] = r.binding.kind === "pr" ? `PR #${r.binding.name}` : r.binding.name;
+        row["binding"] = bindingLabel(r.binding);
     if (fields.has("all") || fields.has("pins"))
         row["pins"] =
             kindOf(r) === "explainer"
@@ -272,13 +318,21 @@ const SPECS = {
     scaffold: {
         description: "Create a review pinned to exact base and head commits, or re-pin one",
         flags: {
-            pr: { kind: "string", help: "review a GitHub pull request (number or URL, needs gh)" },
+            pr: {
+                kind: "string",
+                help: "review a pull or merge request (number or URL, needs gh or glab)",
+            },
             base: { kind: "string", help: "base revision (default: trunk fork point)" },
             head: { kind: "string", help: "head revision (default: current branch)" },
             title: { kind: "string", help: "initial title" },
             new: { kind: "boolean", help: "create another review even if one matches the binding" },
             update: { kind: "boolean", help: "re-pin an existing review from its binding" },
             review: { kind: "string", help: "review to update (id prefix)" },
+            forge: {
+                kind: "string",
+                help: "github or gitlab, when the host is not one of the two known ones",
+            },
+            repo: { kind: "string", help: "host/path, when `origin` is not the repository to post to" },
         },
         examples: [
             "thurview scaffold",
@@ -395,6 +449,38 @@ const SPECS = {
             "thurview graph architecture",
         ],
     },
+    forge: {
+        description: "Read a pull or merge request through its forge, and post the review back to it",
+        args: 'status|prior|submit --file <path>|reply <threadId> --body "<text>"',
+        flags: {
+            review: { kind: "string", help: "review id prefix; its binding names the change request" },
+            change: { kind: "string", help: "change request number or URL, instead of a review binding" },
+            forge: {
+                kind: "string",
+                help: "github or gitlab, when the host is not one of the two known ones",
+            },
+            repo: { kind: "string", help: "host/path, when `origin` is not the repository to post to" },
+            file: { kind: "string", help: "submit: the JSON submission to post" },
+            body: { kind: "string", help: "reply: the answer text" },
+            resolve: { kind: "boolean", help: "reply: resolve the thread as well as answering it" },
+            at: { kind: "string", help: "reply --resolve: the commit the point was verified at" },
+            confirm: { kind: "boolean", help: "submit: required to post an approve" },
+            "dry-run": { kind: "boolean", help: "submit: validate and report, post nothing" },
+            "max-lines": {
+                kind: "string",
+                help: "submit: warn above this many lines per comment",
+                default: "5",
+            },
+            mine: { kind: "boolean", help: "prior: only threads this account wrote" },
+            full: { kind: "boolean", help: "prior, status: do not truncate or filter" },
+        },
+        examples: [
+            "thurview forge status --change 123",
+            "thurview forge prior --change 123 --mine",
+            "thurview forge submit --file pass.json --dry-run",
+            'thurview forge reply <threadId> --body "<answer>" --resolve --at <sha>',
+        ],
+    },
     delete: {
         description: "Delete a review and everything stored for it (the code is untouched)",
         flags: { review: { kind: "string", help: "review id prefix (required)" } },
@@ -480,31 +566,25 @@ const commands = {
         const pr = str(p, "pr");
         if (pr || b?.kind === "pr") {
             const ref = pr ?? b.name;
-            let info;
-            try {
-                const { stdout } = await execFileP("gh", ["pr", "view", ref, "--json", "number,title,url,baseRefName,headRefOid"], { cwd: worktree });
-                info = JSON.parse(stdout);
-            }
-            catch (e) {
-                throw new AxiError(`could not read pull request ${ref}: ${e.message.split("\n")[0]}`, "PR_ERROR", [
-                    "Check `gh auth status` and the PR number",
-                    "Or run `thurview scaffold --base <ref> --head <ref>`",
-                ]);
-            }
+            const repo = await repoOf(worktree, str(p, "repo"));
+            const forge = await forgeFor(repo.host, str(p, "forge") ?? b?.forge);
+            const cr = await forge.get(repo, ref);
+            // A fork's head is not a branch in this checkout, so fetch it by the
+            // ref the forge publishes it under before anything tries to resolve it.
             await g
-                .fetch(worktree, "origin", `refs/pull/${info.number}/head`, `refs/heads/${info.baseRefName}`)
+                .fetch(worktree, "origin", forge.fetchRef(cr), `refs/heads/${cr.baseBranch}`)
                 .catch(() => { });
-            head = info.headRefOid;
-            let baseRef = `origin/${info.baseRefName}`;
+            head = cr.head;
+            let baseRef = `origin/${cr.baseBranch}`;
             try {
                 await g.revParse(worktree, baseRef);
             }
             catch {
-                baseRef = info.baseRefName;
+                baseRef = cr.baseBranch;
             }
             base = await g.mergeBase(worktree, baseRef, head);
-            binding = { kind: "pr", name: String(info.number), url: info.url };
-            title ||= info.title;
+            binding = { kind: "pr", name: cr.number, url: cr.url, forge: forge.id };
+            title ||= cr.title;
         }
         else if (str(p, "base") || str(p, "head") || b?.kind === "range") {
             const [bb, hh] = b?.kind === "range" && !str(p, "base") && !str(p, "head")
@@ -602,7 +682,7 @@ const commands = {
                 title: review.title,
                 status: review.status,
                 rev: review.revision,
-                binding: binding.kind === "pr" ? `PR #${binding.name}` : binding.name,
+                binding: bindingLabel(binding),
                 base,
                 head,
                 worktree,
@@ -1375,6 +1455,247 @@ const commands = {
             ],
         };
     },
+    async forge(args) {
+        const sub = args[0];
+        const s = spec("forge").flags;
+        const usage = [
+            "thurview forge status [--change <ref>] [--review <id>]",
+            "thurview forge prior [--change <ref>] [--mine] [--full]",
+            "thurview forge submit --file <path> [--dry-run] [--confirm]",
+            'thurview forge reply <threadId> --body "<text>" [--resolve --at <sha>]',
+        ];
+        if (!sub || !["status", "prior", "submit", "reply"].includes(sub))
+            throw new AxiError(`unknown forge command${sub ? ` ${sub}` : ""}`, "VALIDATION_ERROR", usage);
+        const common = {
+            review: s["review"],
+            change: s["change"],
+            forge: s["forge"],
+            repo: s["repo"],
+        };
+        const rest = args.slice(1);
+        if (sub === "status") {
+            const p = parseFlags("forge status", rest, { ...common, full: s["full"] });
+            const ctx = await forgeContext(p);
+            const checks = await ctx.forge.checks(ctx.repo, ctx.cr);
+            const baseline = await ctx.forge.baseline(ctx.repo, ctx.cr.baseBranch).catch(() => null);
+            const ci = summariseCi(checks, baseline, ctx.cr.baseBranch);
+            const shown = bool(p, "full") ? checks : checks.filter((c) => c.state !== "passed");
+            const hidden = checks.length - shown.length;
+            const help = [
+                `Quote \`ci.verdict\` in the review; do not read "nothing failed" as "the tests passed"`,
+                `Run \`thurview forge prior --change ${ctx.cr.number}\` to read the previous pass before writing a new one`,
+            ];
+            if (hidden && !bool(p, "full"))
+                help.push(`${hidden} passing checks hidden; pass --full to list them`);
+            if (ctx.review && ctx.review.pins.head !== ctx.cr.head)
+                help.unshift(`The head moved since this review was pinned; run \`thurview scaffold --update --review ${short(ctx.review.id)}\` and diff only what moved`);
+            return {
+                change: {
+                    forge: ctx.forge.id,
+                    repo: `${ctx.repo.host}/${ctx.repo.path}`,
+                    number: ctx.cr.number,
+                    title: ctx.cr.title,
+                    url: ctx.cr.url,
+                    state: ctx.cr.state,
+                    author: ctx.cr.author,
+                    draft: ctx.cr.draft,
+                    fromFork: ctx.cr.fromFork,
+                    head: ctx.cr.head,
+                    headBranch: ctx.cr.headBranch,
+                    baseBranch: ctx.cr.baseBranch,
+                },
+                ci,
+                checks: shown.length
+                    ? shown.map((c) => ({ name: c.name, state: c.state, raw: c.raw }))
+                    : `0 of ${checks.length} checks need attention`,
+                ...(ctx.review
+                    ? {
+                        review: {
+                            id: short(ctx.review.id),
+                            pinnedHead: ctx.review.pins.head,
+                            movedSincePin: ctx.review.pins.head !== ctx.cr.head,
+                        },
+                    }
+                    : {}),
+                permalink: ctx.forge.permalink(ctx.repo, ctx.cr.head, "<path>", 10, 20),
+                help,
+            };
+        }
+        if (sub === "prior") {
+            const p = parseFlags("forge prior", rest, {
+                ...common,
+                mine: s["mine"],
+                full: s["full"],
+            });
+            const ctx = await forgeContext(p);
+            const prior = await ctx.forge.prior(ctx.repo, ctx.cr);
+            const { threads } = prior;
+            // A forge wraps inline comments in a pass of its own with an empty
+            // body. That envelope is not something to answer; the thread under it
+            // is, and it is already in `threads`.
+            const passes = prior.passes.filter((x) => x.body.trim() !== "" || x.verdict !== "commented");
+            const me = await ctx.forge.whoami(ctx.repo).catch(() => "");
+            const full = bool(p, "full");
+            const rows = (bool(p, "mine") ? threads.filter((t) => t.author === me) : threads).map((t) => {
+                const last = t.messages[t.messages.length - 1];
+                return {
+                    id: t.id,
+                    author: t.author,
+                    at: t.path ? `${t.path}${t.line ? `:${t.line}` : ""}` : "(change request)",
+                    resolved: t.resolved,
+                    outdated: t.outdated,
+                    atHead: t.commit ? t.commit === ctx.cr.head : null,
+                    messages: t.messages.length,
+                    last: last ? (full ? last.body : truncate(last.body.replace(/\s+/g, " "), 160)) : "",
+                };
+            });
+            const open = rows.filter((r) => !r.resolved).length;
+            return {
+                summary: {
+                    passes: passes.length,
+                    threads: rows.length,
+                    open,
+                    resolved: rows.length - open,
+                    mine: me ? threads.filter((t) => t.author === me).length : null,
+                    notAtHead: rows.filter((r) => r.atHead === false).length,
+                    head: ctx.cr.head,
+                },
+                passes: passes.length
+                    ? passes.map((x) => ({
+                        author: x.author,
+                        verdict: x.verdict,
+                        at: x.at,
+                        commit: x.commit ?? "",
+                        body: full ? x.body : truncate(x.body.replace(/\s+/g, " "), 200),
+                    }))
+                    : "0 (nobody has reviewed this change request yet)",
+                threads: rows.length ? rows : "0 (no review thread on this change request)",
+                help: passes.length || rows.length
+                    ? [
+                        "Go through every open thread point by point: addressed, partially addressed, or untouched",
+                        'Answer one with `thurview forge reply <threadId> --body "<text>"`, and add --resolve --at <sha> only once you verified the point at that head',
+                        full ? "" : "Pass --full for the untruncated bodies",
+                    ].filter(Boolean)
+                    : ["This is the first pass; there is no prior review to answer"],
+            };
+        }
+        if (sub === "submit") {
+            const p = parseFlags("forge submit", rest, {
+                ...common,
+                file: s["file"],
+                confirm: s["confirm"],
+                "dry-run": s["dry-run"],
+                "max-lines": s["max-lines"],
+            });
+            const file = str(p, "file");
+            if (!file)
+                throw new AxiError("--file is required", "VALIDATION_ERROR", [
+                    "thurview forge submit --file <path>",
+                ]);
+            const text = await readText(resolve(process.cwd(), file));
+            if (text === null)
+                throw new AxiError(`${file} not found`, "NOT_FOUND", [
+                    'Write the pass as JSON: {"verdict": "comment", "body": "<summary>", "comments": []}',
+                ]);
+            const submission = parseSubmission(text, file);
+            const max = Number(str(p, "max-lines"));
+            const warnings = longComments(submission, Number.isFinite(max) && max > 0 ? max : 5);
+            const consequences = submission.verdict === "approve"
+                ? [
+                    "Approving dismisses any standing request for changes, which is what makes this mergeable",
+                    "Where auto-merge is armed, approving merges the code with no further human read",
+                    "Say that to the user before you pass --confirm",
+                ]
+                : [];
+            const dry = bool(p, "dry-run");
+            if (submission.verdict === "approve" && !bool(p, "confirm") && !dry)
+                throw new AxiError("approving is a state change, so it needs --confirm", "VALIDATION_ERROR", [...consequences, "Re-run with --confirm, or submit with verdict comment instead"]);
+            const ctx = await forgeContext(p);
+            if (dry)
+                return {
+                    dryRun: {
+                        forge: ctx.forge.id,
+                        change: `${ctx.repo.path}#${ctx.cr.number}`,
+                        head: ctx.cr.head,
+                        verdict: submission.verdict,
+                        comments: submission.comments.length,
+                        bodyLines: submission.body.trimEnd().split("\n").length,
+                    },
+                    comments: submission.comments.length
+                        ? submission.comments.map((c) => ({
+                            at: `${c.path}:${c.startLine && c.startLine < c.line ? `${c.startLine}-${c.line}` : c.line}`,
+                            side: c.side ?? "head",
+                            lines: c.body.trimEnd().split("\n").length,
+                        }))
+                        : "0 (a summary-only pass)",
+                    warnings: warnings.length ? warnings : "0 (every comment is within the line budget)",
+                    ...(consequences.length ? { consequences } : {}),
+                    help: [
+                        "Nothing was posted; re-run without --dry-run to post it",
+                        "Check every anchor is a line the diff actually touches, or the forge refuses the comment",
+                    ],
+                };
+            const posted = await ctx.forge.submit(ctx.repo, ctx.cr, submission);
+            return {
+                submitted: {
+                    forge: ctx.forge.id,
+                    change: `${ctx.repo.path}#${ctx.cr.number}`,
+                    head: ctx.cr.head,
+                    verdict: posted.verdict,
+                    comments: posted.posted,
+                    url: posted.url ?? ctx.cr.url,
+                },
+                warnings: warnings.length ? warnings : "0 (every comment is within the line budget)",
+                notes: posted.notes.length ? posted.notes : "0 (the forge did exactly what was asked)",
+                help: [
+                    `Record ${ctx.cr.head.slice(0, 12)} as the head you reviewed; a later pass diffs against it`,
+                    "Never merge, close or push to the change request; that decision is the maintainer's",
+                ],
+            };
+        }
+        const p = parseFlags("forge reply", rest, { ...common, body: s["body"], resolve: s["resolve"], at: s["at"] }, 1);
+        const threadId = p.positional[0];
+        if (!threadId)
+            throw new AxiError("forge reply needs a thread id", "VALIDATION_ERROR", [
+                'thurview forge reply <threadId> --body "<text>"',
+                "Run `thurview forge prior` for the thread ids",
+            ]);
+        const body = str(p, "body");
+        const wantResolve = bool(p, "resolve");
+        if (!body && !wantResolve)
+            throw new AxiError("forge reply needs --body, --resolve, or both", "VALIDATION_ERROR", [
+                'thurview forge reply <threadId> --body "<text>" --resolve --at <sha>',
+            ]);
+        const ctx = await forgeContext(p);
+        if (wantResolve) {
+            const at = str(p, "at");
+            if (!at)
+                throw new AxiError("--resolve needs --at <sha>", "VALIDATION_ERROR", [
+                    "Resolving tells the author the point is verified; --at is the commit you verified it at",
+                    `The current head is ${ctx.cr.head}`,
+                ]);
+            if (at.length < 7 || !ctx.cr.head.startsWith(at))
+                throw new AxiError(`--at ${at} is not the current head of ${ctx.repo.path}#${ctx.cr.number}`, "CONFLICT", [
+                    `The head is ${ctx.cr.head}`,
+                    "Re-read the point at that head before resolving; a thread resolved against an older head tells the author a point was accepted that nobody checked",
+                ]);
+        }
+        const done = await ctx.forge.reply(ctx.repo, ctx.cr, threadId, body, wantResolve);
+        return {
+            thread: {
+                id: threadId,
+                change: `${ctx.repo.path}#${ctx.cr.number}`,
+                replied: done.replied,
+                resolved: done.resolved,
+                verifiedAt: wantResolve ? ctx.cr.head : "",
+            },
+            notes: done.notes.length ? done.notes : "0 (the forge did exactly what was asked)",
+            help: [
+                "Leave a thread open when the point is only partially addressed, and say which part",
+                `Run \`thurview forge prior --change ${ctx.cr.number}\` to see what is still open`,
+            ],
+        };
+    },
     async delete(args) {
         const p = parseFlags("delete", args, spec("delete").flags);
         const idOpt = str(p, "review");
@@ -1427,7 +1748,7 @@ const commands = {
         }
         if (sub === "skill") {
             const p = parseFlags("setup skill", args.slice(1), { targets: s["targets"] });
-            const src = resolve(HERE, "..", "skills", "thurview");
+            const names = await bundledSkills();
             const dirs = {
                 claude: join(homedir(), ".claude", "skills"),
                 agents: join(homedir(), ".agents", "skills"),
@@ -1444,27 +1765,29 @@ const commands = {
                         "thurview setup skill --targets claude,agents,cursor",
                     ]);
                 await mkdir(d, { recursive: true });
-                const dst = join(d, "thurview");
-                try {
-                    const stt = await lstat(dst);
-                    if (stt.isSymbolicLink())
-                        await rm(dst);
-                    else
-                        throw new AxiError(`${dst} exists and is not a symlink`, "CONFLICT", [
-                            `Remove ${dst} and run \`thurview setup skill\` again`,
-                        ]);
+                for (const name of names) {
+                    const dst = join(d, name);
+                    try {
+                        const stt = await lstat(dst);
+                        if (stt.isSymbolicLink())
+                            await rm(dst);
+                        else
+                            throw new AxiError(`${dst} exists and is not a symlink`, "CONFLICT", [
+                                `Remove ${dst} and run \`thurview setup skill\` again`,
+                            ]);
+                    }
+                    catch (e) {
+                        if (e instanceof AxiError)
+                            throw e;
+                    }
+                    await symlink(join(skillsRoot(), name), dst, "dir");
                 }
-                catch (e) {
-                    if (e instanceof AxiError)
-                        throw e;
-                }
-                await symlink(src, dst, "dir");
-                installed[t] = dst;
+                installed[t] = `${join(d, `{${names.join(",")}}`)}`;
             }
             return {
                 skill: installed,
                 help: [
-                    "Invoke it as /thurview in Claude Code, or by name in other agents",
+                    "Invoke them as /thurview and /forge-review in Claude Code, or by name in other agents",
                     "Run `thurview setup hooks` for ambient context at session start",
                 ],
             };
@@ -1473,10 +1796,12 @@ const commands = {
         const st = sessionStartHookStatus({ ...identity, scope: "user" });
         const skill = {};
         for (const [t, d] of Object.entries({
-            claude: join(homedir(), ".claude", "skills", "thurview"),
-            agents: join(homedir(), ".agents", "skills", "thurview"),
-        }))
-            skill[t] = existsSync(d) ? d : "not installed";
+            claude: join(homedir(), ".claude", "skills"),
+            agents: join(homedir(), ".agents", "skills"),
+        })) {
+            const there = (await bundledSkills()).filter((n) => existsSync(join(d, n)));
+            skill[t] = there.length ? there.map((n) => join(d, n)).join(", ") : "not installed";
+        }
         return {
             hooks: {
                 claude: st.claude.installed ? st.claude.path : "not installed",
@@ -1489,7 +1814,14 @@ const commands = {
     },
     async skill(args) {
         parseFlags("skill", args, {});
-        return { skill: resolve(HERE, "..", "skills", "thurview", "SKILL.md") };
+        const skills = {};
+        for (const name of await bundledSkills())
+            skills[name] = join(skillsRoot(), name, "SKILL.md");
+        return {
+            skill: skills["thurview"],
+            skills,
+            help: ["Read the SKILL.md of the one that matches the request, and its references beside it"],
+        };
     },
 };
 function topLevelHelp() {