Add /swarm:review --pr: review a PR diff and post the result

.claude-plugin/marketplace.json

@@ -29,8 +29,8 @@
     {
       "name": "swarm",
       "source": "./plugins/swarm",
-      "description": "Local mixture-of-agents code review for Claude Code. Fans a diff across Claude lenses plus the codex and grok CLIs (grok-build + composer models), merges by mechanism with cross-family consensus, verifies solo findings, and presents one ranked report. Optional --fix / --loop applies the findings you agreed with. Skills: /swarm:review, /swarm:agents.",
-      "version": "0.3.1"
+      "description": "Local mixture-of-agents code review for Claude Code. Fans a diff across Claude lenses plus the codex and grok CLIs (grok-build + composer models), merges by mechanism with cross-family consensus, verifies solo findings, and presents one ranked report. Optional --fix / --loop applies the findings you agreed with; --pr reviews a GitHub PR diff and posts the result. Skills: /swarm:review, /swarm:agents.",
+      "version": "0.4.0"
     }
   ]
 }

.claude/knowledge/_index.md

@@ -14,7 +14,7 @@
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
 - `features/task-archiving-on-close.md` — `/close` archives (not deletes) the task file; adaptive commit + ff-push to main
 - `features/swarm-backend-adapter.md` — Verified codex/grok CLI facts (schema-enforced JSON, effort mapping, stdin hang, composer defensive-parse voice) behind `swarm`'s adapter script
-- `features/swarm-review-pipeline.md` — `/swarm:review` P2 pipeline (skill↔Workflow wiring, family-consensus, minimal security) + P5 `--fix`/`--loop` (in-session orchestration between workflow runs; deterministic termination + close-out box in `loop-closeout.py`)
+- `features/swarm-review-pipeline.md` — `/swarm:review` P2 pipeline (skill↔Workflow wiring, family-consensus, minimal security) + P5 `--fix`/`--loop` (in-session orchestration between workflow runs; deterministic termination + close-out box in `loop-closeout.py`) + `--pr` (review a PR diff, post via `gh` under the user's identity so pr-flow's `claude`-author poll ignores it)
 
 ## Deployment
 - `deployment/ci-structure-checks.md` — `check-structure.py` as the single automated guard for a build-less repo

.claude/knowledge/features/swarm-review-pipeline.md

@@ -1,9 +1,9 @@
 ---
 title: "Swarm Review Pipeline (/swarm:review)"
 createdAt: 2026-07-08
-updatedAt: 2026-07-12
+updatedAt: 2026-07-13
 createdFrom: "PR #24"
-updatedFrom: "session: 2026-07-12"
+updatedFrom: "session: 2026-07-13"
 pluginVersion: 1.8.2
 prime: false
 reindexedAt: 2026-07-12
@@ -101,6 +101,31 @@ the diff out of the script, above). Claude applies edits between rounds.
   (`gpt-5.6-sol`@xhigh + grok `--effort max` end-to-end) — the "no silent fail
   on a non-existent model/effort" rule.
 
+## `--pr`: review a PR diff and post the result (swarm 0.4.0)
+
+`/swarm:review --pr [<number>]` runs the **same** pipeline against a GitHub PR's
+diff instead of the local tree. It rides the existing seam: the diff already
+arrives as a temp-file path (above), so `--pr` only swaps *how that file is
+filled* — `gh pr diff <n>` (bare `--pr` resolves the current branch's PR via
+`gh pr view`) instead of `git diff`. The **workflow is untouched**; only step 1
+(diff source) and a new **step 5 (publish)** differ.
+
+- **pr-flow compatibility is the load-bearing design point.** The comment is
+  posted with `gh pr comment` under the **user's own gh identity**, not
+  `author.login == "claude"`. pr-flow's `claude-review.sh` polls *only* for
+  `claude`-authored comments, so a swarm comment is invisible to `/cycle`/`/check`
+  — it can't be mistaken for an `@claude` review or stall a running PR loop. The
+  `## 🐝 Swarm review (local ensemble)` marker header keeps it visually distinct too.
+- **Only output-gated findings are ever posted** — the body is built from the
+  gated `findings`/`balance`, never raw backend output. Posting is outward-facing,
+  so it **confirms once** before publishing (the flag authorizes the review, not
+  silent publishing).
+- **`--pr` is read-only and mutually exclusive with `--fix`/`--loop`** — a
+  local-edit loop has no meaning against a remote diff; the two lifecycles need
+  their own design (deferred). Auto-review-on-push (a self-built Action running
+  `agents.sh` with `XAI_API_KEY`) stays a deliberate non-goal — only the user's
+  machine triggers a review.
+
 ## Future idea (P3+): per-lens external prompts
 
 Today externals run ONE broad multi-lens review each; Claude fans out per lens.

README.md

@@ -30,9 +30,9 @@ PR review feedback loop. Create PRs with readiness checks, commit + push + trigg
 
 ### Swarm
 
-Local mixture-of-agents code review. Fans out one review across Claude lens subagents plus the `codex` and `grok` CLIs (grok in `grok-build` + `composer` modes), merges and verifies their findings, and presents a single ranked report — before anything is pushed. With `--fix` / `--loop` it also applies the findings you agreed with (only Claude edits; the external agents stay review-only). Complementary to PR Flow's GitHub-side loop. *(Phase 5: `/swarm:review` pipeline + fix loop.)*
+Local mixture-of-agents code review. Fans out one review across Claude lens subagents plus the `codex` and `grok` CLIs (grok in `grok-build` + `composer` modes), merges and verifies their findings, and presents a single ranked report — before anything is pushed. With `--fix` / `--loop` it also applies the findings you agreed with (only Claude edits; the external agents stay review-only). `--pr [<number>]` runs the same ensemble against a GitHub PR's diff and posts the gated result as a PR comment (via your own `gh` auth, after one confirmation) — no CI or API-token setup. Complementary to PR Flow's GitHub-side loop. *(Phase 5: `/swarm:review` pipeline + fix loop + PR posting.)*
 
-**Commands:** `/swarm:review [--fix | --loop[=N]] [--max]`, `/swarm:agents` *(more to come: `/swarm:adversarial`, `/swarm:style`, `/swarm:security`)*
+**Commands:** `/swarm:review [--fix | --loop[=N]] [--max]`, `/swarm:review --pr [<number>]`, `/swarm:agents` *(more to come: `/swarm:adversarial`, `/swarm:style`, `/swarm:security`)*
 
 [Documentation →](plugins/swarm/)
 

plugins/swarm/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "swarm",
-  "description": "Local mixture-of-agents code review for Claude Code. Fans a diff across Claude lenses plus the codex and grok CLIs (grok-build + composer models), merges by mechanism with cross-family consensus, verifies solo findings, and presents one ranked report. Optional --fix / --loop applies the findings you agreed with. Skills: /swarm:review, /swarm:agents.",
-  "version": "0.3.1",
+  "description": "Local mixture-of-agents code review for Claude Code. Fans a diff across Claude lenses plus the codex and grok CLIs (grok-build + composer models), merges by mechanism with cross-family consensus, verifies solo findings, and presents one ranked report. Optional --fix / --loop applies the findings you agreed with; --pr reviews a GitHub PR diff and posts the result. Skills: /swarm:review, /swarm:agents.",
+  "version": "0.4.0",
   "author": {
     "name": "gering"
   },

plugins/swarm/README.md

@@ -27,6 +27,13 @@ with `--fix` / `--loop` — applies the findings you agreed with.
   (cap default `10`); `--max` runs the deepest-effort profile (codex
   `gpt-5.6-sol`/`xhigh`, grok `max`, Claude lenses + verifier `xhigh`) — slower,
   more thorough, composes with `--fix`/`--loop`.
+- `/swarm:review --pr [<number>]` — run the same ensemble against a **GitHub
+  PR's diff** (`gh pr diff`; bare `--pr` resolves the current branch's PR) and,
+  after a single confirmation, post the output-gated result as a PR comment via
+  `gh pr comment` — the codex/grok/Claude voice on GitHub with no CI, repo
+  secrets, or API-token cost. Read-only (never edits the tree); mutually
+  exclusive with `--fix`/`--loop`. The comment is posted under your own `gh`
+  identity, so it does not disturb pr-flow's `@claude` review polling.
 - `/swarm:agents` — show which review backends are installed, authenticated,
   and ready.