tide-commander 1.94.0 → 1.96.0

package/dist/assets/{web-CGYGq80f.js → web-CLuvtqCm.js}

@@ -1 +1 @@
-import{ck as a}from"./main-CteALl_G.js";import{ImpactStyle as i,NotificationType as r}from"./index-Dk2THz0j.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{ck as a}from"./main-9uTEp9Lr.js";import{ImpactStyle as i,NotificationType as r}from"./index-CLr8DpLX.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/assets/{web-BZa7rL0p.js → web-D-a3phls.js}

@@ -1 +1 @@
-import{ck as t}from"./main-CteALl_G.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{ck as t}from"./main-9uTEp9Lr.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/assets/{web-DtevCxzm.js → web-DM2bFWBN.js}

@@ -1 +1 @@
-import{ck as s}from"./main-CteALl_G.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{ck as s}from"./main-9uTEp9Lr.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/index.html

@@ -22,7 +22,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-CteALl_G.js"></script>
+    <script type="module" crossorigin src="/assets/main-9uTEp9Lr.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
     <link rel="stylesheet" crossorigin href="/assets/main-BfT_95fk.css">

package/dist/src/packages/server/app.js

@@ -53,6 +53,20 @@ export function createApp() {
     const app = express();
     // Middleware
     app.use(cors());
+    // Webhook routes need the raw request bytes for HMAC signature verification.
+    // Bitbucket and GitHub compute the signature over the exact bytes they send,
+    // so re-serializing via JSON.stringify(req.body) can produce a different
+    // digest (key ordering / whitespace) and falsely reject valid deliveries.
+    // The path-scoped JSON parser below runs first; it parses the body AND
+    // stashes the raw buffer on req.rawBody. Once req._body is set, the global
+    // express.json that follows is a no-op for these requests, so the raw
+    // buffer is only retained for webhook deliveries — not every JSON request.
+    app.use('/api/triggers/webhook', express.json({
+        limit: '50mb',
+        verify: (req, _res, buf) => {
+            req.rawBody = buf;
+        },
+    }));
     app.use(express.json({ limit: '50mb' })); // Increased for audio uploads (STT)
     // Request logging & timing
     app.use((req, res, next) => {

package/dist/src/packages/server/data/builtin-skills/bitbucket-pr-review.js

@@ -0,0 +1,431 @@
+export const bitbucketPRReview = {
+    slug: 'bitbucket-pr-review',
+    name: 'Bitbucket PR Review',
+    description: 'Read pull request diffs, post review comments (inline or summary), approve or request-changes on Bitbucket Cloud PRs using API token authentication. Use this skill when an automated reviewer agent needs to evaluate a PR and record a verdict.',
+    allowedTools: ['Bash(curl:*)', 'Read', 'Grep', 'Glob'],
+    content: `# Bitbucket Pull Request Reviewer
+
+Read PR diffs, post review comments, and set verdict (approve / request-changes / clear) on Bitbucket Cloud pull requests via the REST API 2.0.
+
+> **Note:** Bitbucket deprecated App Passwords in September 2025 (disabled June 9, 2026). This skill uses API tokens with scopes.
+
+## Required Secrets
+
+| Secret Key | Description |
+|------------|-------------|
+| \`BITBUCKET_EMAIL\` | Atlassian account email for the reviewer identity |
+| \`BITBUCKET_TOKEN\` | Bitbucket API token with PR review scopes |
+
+**Required scopes:**
+- \`read:repository:bitbucket\` — fetch diff
+- \`read:pullrequest:bitbucket\` — read PR + comments + participants
+- \`write:pullrequest:bitbucket\` — comments, approve/unapprove, request-changes/unrequest-changes
+
+Do **not** request \`write:repository:bitbucket\` — a reviewer must never push.
+
+**Authentication:** HTTP Basic, built from the secret placeholders:
+\`\`\`bash
+curl -s -u "{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}" ...
+\`\`\`
+
+---
+
+## CRITICAL: All API Calls Must Use Streaming Exec
+
+Secret placeholders \`{{BITBUCKET_EMAIL}}\` / \`{{BITBUCKET_TOKEN}}\` are **only** interpolated when commands run through the Streaming Exec API (\`/api/exec\`). Direct Bash curl calls will send the raw \`{{...}}\` placeholders and 401.
+
+**Wrap every curl command:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/diff"}'
+\`\`\`
+
+If you get a 401, the most likely cause is calling curl directly instead of through \`/api/exec\`.
+
+---
+
+## Common Variables
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| \`WORKSPACE\` | Bitbucket workspace slug | \`mycompany\` |
+| \`REPO_SLUG\` | Repository slug | \`wind\` |
+| \`PR_ID\` | Pull request id | \`42\` |
+
+These typically arrive in the trigger payload (extracted from \`repository.full_name\` and \`pullrequest.id\` by the webhook trigger).
+
+\`\`\`bash
+# Split workspace/repo from full_name="myws/wind"
+WORKSPACE=$(echo "$REPO_FULL_NAME" | cut -d/ -f1)
+REPO_SLUG=$(echo "$REPO_FULL_NAME" | cut -d/ -f2)
+\`\`\`
+
+Base URL: \`https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG\`
+
+---
+
+## Action: fetch_pr_diff
+
+Retrieve the unified diff for a pull request.
+
+**Endpoint:** \`GET /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/diff\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id"],
+  "properties": {
+    "workspace":       { "type": "string", "description": "Bitbucket workspace slug" },
+    "repo_slug":       { "type": "string", "description": "Repository slug" },
+    "pull_request_id": { "type": "integer", "description": "PR id" },
+    "max_bytes":       { "type": "integer", "default": 204800, "description": "Truncate diff at this many bytes (default 200 KB)" }
+  }
+}
+\`\`\`
+
+**Call (200 KB cap, returns JSON \`{ diff, truncated, byte_count }\`):**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"set -euo pipefail; MAX=\${MAX_BYTES:-204800}; RAW=$(curl -s -H \\"Accept: text/plain\\" -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/diff\\"); LEN=\${#RAW}; if [ \\"$LEN\\" -gt \\"$MAX\\" ]; then DIFF=\${RAW:0:$MAX}; TRUNC=true; else DIFF=$RAW; TRUNC=false; fi; jq -nc --arg d \\"$DIFF\\" --argjson t $TRUNC --argjson l $LEN \\"{diff:\\$d, truncated:\\$t, byte_count:\\$l}\\""}'
+\`\`\`
+
+**Output (JSON):**
+\`\`\`json
+{ "diff": "<unified diff text, truncated to max_bytes>", "truncated": false, "byte_count": 12345 }
+\`\`\`
+
+If \`truncated:true\`, include a note in the summary comment that the review was based on a partial diff and recommend splitting the PR.
+
+---
+
+## Action: fetch_pr_diffstat
+
+Retrieve per-file change statistics (additions/removals, file paths). Use as a pre-flight gate before \`fetch_pr_diff\` to skip oversized PRs early.
+
+**Endpoint:** \`GET /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/diffstat\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" },
+    "pagelen":         { "type": "integer", "default": 100, "description": "Page size (max 100)" }
+  }
+}
+\`\`\`
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/diffstat?pagelen=100\\""}'
+\`\`\`
+
+**Output (Bitbucket paginated response):**
+\`\`\`json
+{
+  "values": [
+    { "type": "diffstat", "status": "modified", "lines_added": 12, "lines_removed": 3,
+      "old": { "path": "src/foo.ts" }, "new": { "path": "src/foo.ts" } }
+  ],
+  "page": 1, "pagelen": 100, "size": 1, "next": null
+}
+\`\`\`
+
+If the result spans multiple pages, follow \`next\` URLs to fetch the rest.
+
+---
+
+## Action: post_inline_comment
+
+Post a comment anchored to a specific line in a file in the PR diff.
+
+**Endpoint:** \`POST /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id", "path", "line", "side", "text"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" },
+    "path":            { "type": "string", "description": "File path inside the repo (e.g. src/foo.ts)" },
+    "line":            { "type": "integer", "description": "Line number in the file (1-indexed)" },
+    "side":            { "type": "string", "enum": ["to", "from"], "description": "'to' = line in destination/new file; 'from' = line in source/old file" },
+    "text":            { "type": "string", "description": "Comment body (markdown)" }
+  }
+}
+\`\`\`
+
+**Body shape (the \`inline\` object distinguishes inline from summary comments):**
+\`\`\`json
+{
+  "content": { "raw": "<text>" },
+  "inline":  { "path": "<path>", "to": <line> }
+}
+\`\`\`
+Use \`"from"\` instead of \`"to"\` when commenting on a removed/old line.
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X POST -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" -H \\"Content-Type: application/json\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/comments\\" -d \\"{\\\\\\"content\\\\\\":{\\\\\\"raw\\\\\\":\\\\\\"$TEXT\\\\\\"},\\\\\\"inline\\\\\\":{\\\\\\"path\\\\\\":\\\\\\"$PATH\\\\\\",\\\\\\"$SIDE\\\\\\":$LINE}}\\""}'
+\`\`\`
+
+**Output:** Bitbucket comment object with \`id\`, \`content.raw\`, \`inline\`, \`user\`, \`created_on\`.
+
+---
+
+## Action: post_summary_comment
+
+Post a top-level (non-inline) comment summarizing the review.
+
+**Endpoint:** \`POST /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments\` (same endpoint, body omits \`inline\`)
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id", "text"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" },
+    "text":            { "type": "string", "description": "Summary comment body (markdown)" }
+  }
+}
+\`\`\`
+
+**Body:**
+\`\`\`json
+{ "content": { "raw": "## Verdict\\n\\nLGTM — approving.\\n..." } }
+\`\`\`
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X POST -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" -H \\"Content-Type: application/json\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/comments\\" -d \\"{\\\\\\"content\\\\\\":{\\\\\\"raw\\\\\\":\\\\\\"$TEXT\\\\\\"}}\\""}'
+\`\`\`
+
+Tip: tag the verdict so re-reviews can find it via \`list_existing_comments\` (e.g. start the body with \`<!-- tide-commander-verdict -->\`).
+
+---
+
+## Action: approve
+
+Set the calling user's participant state to \`approved\`.
+
+**Endpoint:** \`POST /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/approve\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" }
+  }
+}
+\`\`\`
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X POST -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/approve\\""}'
+\`\`\`
+
+**Output:** participant object with \`approved: true\`, \`state: "approved"\`.
+
+If a prior pass called \`request_changes\`, also call \`unrequest_changes\` so the participant state isn't ambiguous.
+
+---
+
+## Action: unapprove
+
+Clear the calling user's \`approved\` state.
+
+**Endpoint:** \`DELETE /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/approve\`
+
+**Input Schema:** identical to \`approve\`.
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X DELETE -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/approve\\""}'
+\`\`\`
+
+**Output:** \`204 No Content\` on success.
+
+---
+
+## Action: request_changes
+
+Set the calling user's participant state to \`changes_requested\` (native Bitbucket Cloud endpoint — not emulated).
+
+**Endpoint:** \`POST /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/request-changes\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" }
+  }
+}
+\`\`\`
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X POST -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/request-changes\\""}'
+\`\`\`
+
+**Output:** participant object with \`state: "changes_requested"\`.
+
+If a prior pass called \`approve\`, also call \`unapprove\` so the participant state isn't ambiguous.
+
+---
+
+## Action: unrequest_changes
+
+Clear the calling user's \`changes_requested\` state.
+
+**Endpoint:** \`DELETE /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/request-changes\`
+
+**Input Schema:** identical to \`request_changes\`.
+
+**Call:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -X DELETE -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/request-changes\\""}'
+\`\`\`
+
+**Output:** \`204 No Content\` on success.
+
+---
+
+## Action: list_existing_comments
+
+List all comments on a PR. Use to detect prior reviewer verdict comments (idempotency for \`pullrequest:updated\` retries) and to avoid duplicate inline comments.
+
+**Endpoint:** \`GET /2.0/repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/comments?pagelen=100\`
+
+**Input Schema:**
+\`\`\`json
+{
+  "type": "object",
+  "required": ["workspace", "repo_slug", "pull_request_id"],
+  "properties": {
+    "workspace":       { "type": "string" },
+    "repo_slug":       { "type": "string" },
+    "pull_request_id": { "type": "integer" },
+    "pagelen":         { "type": "integer", "default": 100, "description": "Page size (max 100)" },
+    "follow_pagination": { "type": "boolean", "default": true, "description": "If true, follow 'next' URLs and concatenate all pages" }
+  }
+}
+\`\`\`
+
+**Call (single page):**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/exec \\
+  -H "Content-Type: application/json" \\
+  -d '{"agentId":"YOUR_AGENT_ID","command":"curl -s -u \\"{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}\\" \\"https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/comments?pagelen=100\\""}'
+\`\`\`
+
+**Pagination loop (concatenate all pages into one JSON array):**
+\`\`\`bash
+URL="https://api.bitbucket.org/2.0/repositories/$WORKSPACE/$REPO_SLUG/pullrequests/$PR_ID/comments?pagelen=100"
+ALL="[]"
+while [ -n "$URL" ] && [ "$URL" != "null" ]; do
+  PAGE=$(curl -s -u "{{BITBUCKET_EMAIL}}:{{BITBUCKET_TOKEN}}" "$URL")
+  ALL=$(jq -c --argjson page "$PAGE" '. + $page.values' <<<"$ALL")
+  URL=$(jq -r '.next // empty' <<<"$PAGE")
+done
+echo "$ALL"
+\`\`\`
+
+**Output:** array of comment objects with \`id\`, \`content.raw\`, \`inline\` (for inline comments), \`user.account_id\`, \`created_on\`, \`updated_on\`, \`deleted\`.
+
+To find a prior verdict comment, filter for \`content.raw\` starting with the \`<!-- tide-commander-verdict -->\` marker.
+
+---
+
+## Verdict Workflow
+
+Symmetric, two-state verdict — these always run together so the participant state stays consistent:
+
+| Verdict | Calls |
+|---------|-------|
+| Approve | \`post_summary_comment\` + \`approve\` + (if prior pass requested changes) \`unrequest_changes\` |
+| Request changes | \`post_summary_comment\` + \`request_changes\` + (if prior pass approved) \`unapprove\` |
+
+On a \`pullrequest:updated\` event, first call \`list_existing_comments\` and look for the \`<!-- tide-commander-verdict -->\` marker to decide whether to update an existing verdict (delete + repost) vs add a new one.
+
+---
+
+## Idempotency Rules
+
+1. The webhook payload includes \`X-Request-UUID\`. Persist the last-handled UUID per PR and skip re-processing the same delivery.
+2. Before posting a summary comment, call \`list_existing_comments\` and check for the \`<!-- tide-commander-verdict -->\` marker. If found, delete the prior comment first (\`DELETE …/comments/{comment_id}\`) before posting the new one.
+3. Inline comments are harder to dedupe — match on \`{path, line, side}\` and skip if a comment from the reviewer account already exists at that anchor.
+
+---
+
+## Error Handling
+
+| HTTP | Meaning | Action |
+|------|---------|--------|
+| 401 | Unauthorized | Verify \`BITBUCKET_EMAIL\` / \`BITBUCKET_TOKEN\` are set; confirm the curl ran via \`/api/exec\` |
+| 403 | Forbidden | Token is missing \`write:pullrequest:bitbucket\` (or \`read:pullrequest:bitbucket\` for reads) |
+| 404 | Not Found | Wrong workspace/repo/PR id — re-extract from the trigger payload |
+| 400 | Bad Request | JSON body malformed (commonly an unescaped quote in the comment body) |
+| 429 | Rate limited | Bitbucket rate-limits per-user; back off and retry the failed action only |
+
+---
+
+## Safety Rules
+
+1. **Never push code, never merge, never decline** — those are not reviewer responsibilities. Required scopes intentionally exclude \`write:repository:bitbucket\`.
+2. **Always check for an existing verdict comment** before posting (idempotency).
+3. **Never post on a PR authored by the reviewer account** — filter \`pullrequest.author\` against the \`BITBUCKET_EMAIL\` identity to avoid loops.
+4. **Honor the diff-size gate** — if \`fetch_pr_diffstat\` shows a PR over the configured threshold, post a summary comment explaining the skip and **do not** approve or request changes.
+5. **Do not include secret values in comment bodies or logs.**
+
+---
+
+## Quick Reference
+
+| Action | Endpoint | Method |
+|--------|----------|--------|
+| fetch_pr_diff | \`/pullrequests/{id}/diff\` | GET |
+| fetch_pr_diffstat | \`/pullrequests/{id}/diffstat\` | GET |
+| post_inline_comment | \`/pullrequests/{id}/comments\` | POST (with \`inline\`) |
+| post_summary_comment | \`/pullrequests/{id}/comments\` | POST (no \`inline\`) |
+| approve | \`/pullrequests/{id}/approve\` | POST |
+| unapprove | \`/pullrequests/{id}/approve\` | DELETE |
+| request_changes | \`/pullrequests/{id}/request-changes\` | POST |
+| unrequest_changes | \`/pullrequests/{id}/request-changes\` | DELETE |
+| list_existing_comments | \`/pullrequests/{id}/comments?pagelen=100\` | GET |
+
+Base URL: \`https://api.bitbucket.org/2.0/repositories/{workspace}/{repo_slug}\``,
+};