feat: register /review and /security-review via registerBundledSkill

Replace indirect Skill-tool-based routing with direct bundled skill
registration using SKILL_FILES, matching /strict:review approach.

- reviewSkills.ts registers all four commands (review, security-review,
  strict:review, strict:security-review) with embedded files
- Remove review command from commands.ts (now bundled skill)
- Simplify review.ts to only export ultrareview
- Update mcp.ts to get review command from bundled skills

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/commands.ts

@@ -38,7 +38,7 @@ import pr_comments from './commands/pr_comments/index.js'
 import releaseNotes from './commands/release-notes/index.js'
 import rename from './commands/rename/index.js'
 import resume from './commands/resume/index.js'
-import review, { ultrareview } from './commands/review.js'
+import { ultrareview } from './commands/review.js'
 import session from './commands/session/index.js'
 import share from './commands/share/index.js'
 import skills from './commands/skills/index.js'
@@ -351,7 +351,6 @@ const COMMANDS = memoize((): Command[] => [
   favorite,
   theme,
   feedback,
-  review,
   ultrareview,
   rewind,
   terminalSetup,

src/commands/review.ts

@@ -1,27 +1,13 @@
-import type { ContentBlockParam } from '@anthropic-ai/sdk/resources/messages.js'
 import type { Command } from '../commands.js'
-import type { ToolUseContext } from '../Tool.js'
 import { isUltrareviewEnabled } from './review/ultrareviewEnabled.js'
-import { CommandLocale } from 'src/costrict/command/locales/index.js'
 
 // Legal wants the explicit surface name plus a docs link visible before the
 // user triggers, so the description carries "Claude Code on the web" + URL.
 const CCR_TERMS_URL = 'https://costrict.ai/docs/en/claude-code-on-the-web'
 
-// /review is registered as a bundled skill via extract-to-disk mechanism,
-// discovered by the standard skill scanner. Here we provide a prompt-based
-// command that routes to the Skill tool for non-skill contexts (e.g. MCP).
-const review: Command = {
-  type: 'prompt',
-  name: 'review',
-  description: 'Review code for defects, security vulnerabilities, memory issues, and logic errors',
-  progressMessage: 'reviewing code',
-  contentLength: 0,
-  source: 'builtin',
-  async getPromptForCommand(args, _context): Promise<ContentBlockParam[]> {
-    return [{ type: 'text', text: CommandLocale.get('review').replace('$ARGUMENTS', args) }]
-  },
-}
+// /review is registered as a bundled skill via registerReviewSkills() in
+// src/costrict/skills/reviewSkills.ts, which provides the full SKILL.md
+// content and reference files. This file only provides /ultrareview.
 
 // /ultrareview is the ONLY entry point to the remote bughunter path —
 // /review stays purely local. local-jsx type renders the overage permission
@@ -34,5 +20,4 @@ const ultrareview: Command = {
   load: () => import('./review/ultrareviewCommand.js'),
 }
 
-export default review
 export { ultrareview }

src/costrict/skills/reviewSkills.ts

@@ -23,11 +23,12 @@ const ALLOWED_TOOLS = [
   'Agent',
 ]
 
-function registerStrictReviewSkill(
+function registerReviewSkill(
   name: string,
   skillKey: string,
   files: Record<string, string>,
   description: string,
+  forked: boolean,
 ): void {
   registerBundledSkill({
     name,
@@ -36,7 +37,7 @@ function registerStrictReviewSkill(
     userInvocable: true,
     disableModelInvocation: true,
     allowedTools: ALLOWED_TOOLS,
-    context: 'fork',
+    context: forked ? 'fork' : undefined,
     files,
     async getPromptForCommand(args) {
       const template = CommandLocale.get(skillKey)
@@ -48,7 +49,7 @@ function registerStrictReviewSkill(
   })
 }
 
-export function registerStrictReviewSkills(): void {
+export function registerReviewSkills(): void {
   const locale = getLocale()
   const localeFiles = SKILL_FILES[locale]
   const localeMetadata = SKILL_METADATA[locale]
@@ -58,6 +59,10 @@ export function registerStrictReviewSkills(): void {
     const meta = localeMetadata[skillKey]
     if (!meta || !files) continue
 
-    registerStrictReviewSkill(`strict:${skillKey}`, skillKey, files, meta.description)
+    // /review, /security-review — inline in main session
+    registerReviewSkill(meta.name, skillKey, files, meta.description, false)
+
+    // /strict:review, /strict:security-review — forked sub-agent
+    registerReviewSkill(`strict:${skillKey}`, skillKey, files, meta.description, true)
   }
 }

src/entrypoints/mcp.ts

@@ -8,7 +8,7 @@ import {
   type Tool,
 } from '@modelcontextprotocol/sdk/types.js'
 import { getDefaultAppState } from 'src/state/AppStateStore.js'
-import review from '../commands/review.js'
+import { getBundledSkills } from 'src/skills/bundledSkills.js'
 import type { Command } from '../commands.js'
 import {
   findToolByName,
@@ -30,7 +30,7 @@ import { zodToJsonSchema } from '../utils/zodToJsonSchema.js'
 type ToolInput = Tool['inputSchema']
 type ToolOutput = Tool['outputSchema']
 
-const MCP_COMMANDS: Command[] = [review]
+const MCP_COMMANDS: Command[] = getBundledSkills().filter(c => c.name === 'review')
 
 export async function startMCPServer(
   cwd: string,

src/skills/bundled/index.ts

@@ -17,7 +17,7 @@ import { registerUpdateConfigSkill } from './updateConfig.js'
 import { registerVerifySkill } from './verify.js'
 import { registerStrictPlanSkill } from 'src/costrict/skills/strictPlan.js'
 import { registerStrictSpecSkill } from 'src/costrict/skills/strictSpec.js'
-import { registerStrictReviewSkills } from 'src/costrict/skills/strictReview.js'
+import { registerReviewSkills } from 'src/costrict/skills/reviewSkills.js'
 import { registerProjectWikiSkill } from 'src/costrict/skills/projectWiki.js'
 import { registerTddSkill } from 'src/costrict/skills/tdd.js'
 
@@ -39,7 +39,7 @@ export function initBundledSkills(): void {
   registerTddSkill()
   registerStrictPlanSkill()
   registerStrictSpecSkill()
-  registerStrictReviewSkills()
+  registerReviewSkills()
   registerKeybindingsSkill()
   registerVerifySkill()
   registerDebugSkill()