xnaut-review

xNaut is a Tauri-native terminal + worktree review app. When the user opens a diff pane (the side-by-side / unified view with a worktree path), this skill lets an AI agent leave inline annotations that float beside the changed lines.

The diff viewer is for the user — do NOT run your own viewer. Use the local-loopback HTTP broker at http://127.0.0.1:<port>/v1/notes to inspect and control the live session. The port is the same one xNaut prints on startup as Agent hook listener at http://127.0.0.1:<port>/v1/hook — replace /v1/hook with /v1/notes.

Action vocabulary

Every request is a POST with Content-Type: application/json. The action field discriminates:

curl -X POST http://127.0.0.1:<port>/v1/notes \
  -H "X-Xnaut-Session: $XNAUT_HOOK_TOKEN" \
  -H 'content-type: application/json' \
  --data '{ "action": "<verb>", ...payload }'

The session header is required. The route took no credential at all until XNAUT-350, which meant anyone who could reach the port could run a git diff in any directory they named and write notes into it. XNAUT_HOOK_TOKEN is injected into every agent xNAUT launches, so it is already in your environment; without it the broker answers 401.

Your note is signed by that session, not by an author field in the body. One supplied in the payload is ignored.

Read

• { "action": "list" } — placeholder; xNaut doesn't track all known worktrees yet.
• { "action": "get", "worktree": "<abs path>" } — full notes document.
• { "action": "review", "worktree": "<abs path>", "includePatch": true, "includeNotes": true } — diff + existing notes together. Call this first before authoring any new comment so you know the line numbers and structure.

Annotate

• { "action": "comment-add", "worktree": "<abs>", "filePath": "src/foo.rs", "side": "new", "line": 42, "summary": "<headline>", "rationale": "<why, optional>", "author": "claude", "reveal": true } — single inline note.
• { "action": "comment-apply", "worktree": "<abs>", "comments": [{ ... }, { ... }], "revealMode": "first" } — batch. Validates the whole list before mutating, so a single bad item doesn't half-apply.
• { "action": "comment-rm", "worktree": "<abs>", "commentId": "<uuid>" } — remove a single annotation.
• { "action": "comment-clear", "worktree": "<abs>", "filePath": null, "includeUser": false } — clear AI/agent notes. With includeUser: true, also drops the user's own annotations.
• { "action": "comment-list", "worktree": "<abs>", "filePath": null } — list current notes.