@expo/code-review-cli 0.1.0

package/build/commands/init.js

@@ -0,0 +1,82 @@
+import { cp, mkdir, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CONFIG_DIRNAME } from '../config/load.js';
+import { repoRoot } from '../core/exec.js';
+import { errorMessage } from '../core/util.js';
+const TEMPLATES_DIR = fileURLToPath(new URL('../../templates/', import.meta.url));
+const USAGE = `ecr init — scaffold .expo-code-review/ in the current repo
+
+Usage:
+  ecr init [--with-workflow] [--force]
+
+Options:
+  --with-workflow   Also write .github/workflows/expo-code-review.yml
+  --force           Overwrite existing files
+  -h, --help        Show this help
+`;
+export async function initCommand(argv) {
+    if (argv.includes('-h') || argv.includes('--help')) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    try {
+        await scaffold(argv);
+    }
+    catch (error) {
+        process.stderr.write(`init failed: ${errorMessage(error)}\n`);
+        process.exitCode = 2;
+    }
+}
+/** Scaffold .expo-code-review/ (and optionally the CI workflow) into the repo. */
+async function scaffold(argv) {
+    const force = argv.includes('--force');
+    const withWorkflow = argv.includes('--with-workflow');
+    const root = (await repoRoot()) ?? process.cwd();
+    const configDir = path.join(root, CONFIG_DIRNAME);
+    // Create only the config dir; let copyInto create prompts/ so it reports
+    // accurately as created vs skipped.
+    await mkdir(configDir, { recursive: true });
+    const created = [];
+    const skipped = [];
+    await copyInto(path.join(TEMPLATES_DIR, 'config.jsonc'), path.join(configDir, 'config.jsonc'), force, created, skipped, root);
+    await copyInto(path.join(TEMPLATES_DIR, 'shared.md'), path.join(configDir, 'shared.md'), force, created, skipped, root);
+    await copyInto(path.join(TEMPLATES_DIR, 'coordinator.md'), path.join(configDir, 'coordinator.md'), force, created, skipped, root);
+    await copyInto(path.join(TEMPLATES_DIR, 'agents'), path.join(configDir, 'agents'), force, created, skipped, root);
+    const gitignorePath = path.join(configDir, '.gitignore');
+    if (force || !existsSync(gitignorePath)) {
+        await writeFile(gitignorePath, '.runs/\n', 'utf8');
+        created.push(path.relative(root, gitignorePath));
+    }
+    else {
+        skipped.push(path.relative(root, gitignorePath));
+    }
+    if (withWorkflow) {
+        const workflowDir = path.join(root, '.github', 'workflows');
+        await mkdir(workflowDir, { recursive: true });
+        await copyInto(path.join(TEMPLATES_DIR, 'workflow.yml'), path.join(workflowDir, 'expo-code-review.yml'), force, created, skipped, root);
+    }
+    for (const file of created) {
+        process.stdout.write(`  created  ${file}\n`);
+    }
+    for (const file of skipped) {
+        process.stdout.write(`  skipped  ${file} (exists; use --force to overwrite)\n`);
+    }
+    process.stdout.write([
+        '',
+        'Next steps:',
+        `  1. Customize ${CONFIG_DIRNAME}/agents/*.md (and shared.md, coordinator.md) for this repo.`,
+        '  2. Configure a model provider in OpenCode (or set REVIEWER_MODEL).',
+        '  3. Run `ecr doctor`, then `ecr review`.',
+        withWorkflow
+            ? '  4. Add the model-key secret referenced by the workflow.'
+            : '  4. Run `ecr init --with-workflow` to add the CI workflow.',
+        '',
+    ].join('\n'));
+}
+async function copyInto(src, dest, force, created, skipped, root) {
+    const existed = existsSync(dest);
+    await cp(src, dest, { recursive: true, force, errorOnExist: false });
+    (existed && !force ? skipped : created).push(path.relative(root, dest));
+}

package/build/commands/review.js

@@ -0,0 +1,191 @@
+import { loadReviewConfig } from '../config/load.js';
+import { repoRoot, resolveRepo } from '../core/exec.js';
+import { errorMessage } from '../core/util.js';
+import { runReview } from '../core/review.js';
+import { LocalGitSource } from '../sources/local-git.js';
+import { GitHubPRSource } from '../sources/github-pr.js';
+import { TerminalReporter } from '../reporters/terminal.js';
+import { GitHubReporter } from '../reporters/github.js';
+const USAGE = `ecr review — AI code review, printed to your terminal
+
+Usage:
+  ecr review [options]                 review local changes
+  ecr review --pr <n> [--post]         review a GitHub PR by number
+
+Source (pick one):
+  (default)          diff the working tree against the merge-base
+  --base <ref>       base ref to diff against
+  --head <ref>       head ref to diff
+  --staged           review only staged changes
+  --pr <n>           review GitHub PR #n by number (diff fetched via \`gh\`, no
+                     checkout needed); can't be combined with --base/--head/--staged
+
+Options:
+  --repo <owner/repo>  repo for --pr (default: inferred from the current checkout)
+  --post               with --pr: also post the result as the PR comment (needs
+                       \`gh\` auth). Omit to only preview here; re-run with --post
+                       to publish.
+  --agents <a,b>       run only these agents (comma-separated ids); default: all
+  --route              let the router pick relevant agents from the diff
+  --json               emit machine-readable JSON on stdout
+  --no-fail            always exit 0, even on request-changes
+  -h, --help           show this help
+
+Note: agents read the local working tree for surrounding context, so --pr uses the
+PR's diff (authoritative) but your checked-out files for context. For full fidelity
+on a PR, \`gh pr checkout <n>\` first, then run a plain \`ecr review\`.
+
+Exit codes: 0 approve / approve-with-comments, 1 request-changes, 2 error.
+`;
+function requireValue(flag, value) {
+    if (value === undefined || value.startsWith('--')) {
+        throw new Error(`${flag} requires a value`);
+    }
+    return value;
+}
+function parseArgs(argv) {
+    const args = {
+        staged: false,
+        post: false,
+        route: false,
+        json: false,
+        noFail: false,
+        help: false,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        switch (arg) {
+            case '--base':
+                args.base = requireValue(arg, argv[++i]);
+                break;
+            case '--head':
+                args.head = requireValue(arg, argv[++i]);
+                break;
+            case '--staged':
+                args.staged = true;
+                break;
+            case '--pr': {
+                const value = requireValue(arg, argv[++i]);
+                const number = Number(value);
+                if (!Number.isInteger(number) || number <= 0) {
+                    throw new Error(`--pr requires a positive PR number (got "${value}")`);
+                }
+                args.pr = number;
+                break;
+            }
+            case '--repo':
+                args.repo = requireValue(arg, argv[++i]);
+                break;
+            case '--post':
+                args.post = true;
+                break;
+            case '--agents':
+                args.agents = requireValue(arg, argv[++i])
+                    .split(',')
+                    .map(id => id.trim())
+                    .filter(Boolean);
+                break;
+            case '--route':
+                args.route = true;
+                break;
+            case '--json':
+                args.json = true;
+                break;
+            case '--no-fail':
+                args.noFail = true;
+                break;
+            case '-h':
+            case '--help':
+                args.help = true;
+                break;
+            default:
+                throw new Error(`Unknown argument: ${arg}`);
+        }
+    }
+    return args;
+}
+export async function reviewCommand(argv) {
+    let args;
+    try {
+        args = parseArgs(argv);
+    }
+    catch (error) {
+        process.stderr.write(`${errorMessage(error)}\n\n${USAGE}`);
+        process.exitCode = 2;
+        return;
+    }
+    if (args.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    try {
+        validateArgs(args);
+    }
+    catch (error) {
+        process.stderr.write(`${errorMessage(error)}\n\n${USAGE}`);
+        process.exitCode = 2;
+        return;
+    }
+    // The OpenCode server roots at process.cwd(); run from the repo root so agents
+    // can read the whole checkout and diff paths resolve correctly.
+    const root = await repoRoot();
+    if (root && root !== process.cwd()) {
+        process.chdir(root);
+    }
+    try {
+        const config = await loadReviewConfig(process.cwd());
+        const cwd = process.cwd();
+        const source = args.pr != null
+            ? new GitHubPRSource({ prNumber: args.pr, repo: args.repo, cwd })
+            : new LocalGitSource({ base: args.base, head: args.head, staged: args.staged, cwd });
+        const review = await runReview(source, {
+            config,
+            mode: 'local',
+            agents: args.agents,
+            route: args.route,
+            onProgress: message => process.stderr.write(`${message}\n`),
+        });
+        // Always print the result here first.
+        await new TerminalReporter({ json: args.json, noFail: args.noFail }).report(review);
+        // Then, only if asked, publish the same result to the PR.
+        if (args.post && args.pr != null) {
+            const repo = args.repo ?? (await resolveRepo(cwd));
+            const reporter = new GitHubReporter({
+                prNumber: args.pr,
+                repo,
+                commentTag: config.commentTag,
+                breakGlassMarker: config.breakGlassMarker,
+                cwd,
+            });
+            // Respect the author's break-glass opt-out, same as the CI path.
+            let breakGlass = false;
+            try {
+                breakGlass = await reporter.checkBreakGlass();
+            }
+            catch {
+                breakGlass = false;
+            }
+            if (breakGlass) {
+                process.stderr.write(`\nNot posting: ${config.breakGlassMarker} is set on ${repo}#${args.pr} (break-glass).\n`);
+            }
+            else {
+                await reporter.report(review);
+                process.stderr.write(`\nPosted review to ${repo}#${args.pr}.\n`);
+            }
+        }
+    }
+    catch (error) {
+        process.stderr.write(`AI review failed: ${errorMessage(error)}\n`);
+        process.exitCode = 2;
+    }
+}
+/** Reject flag combinations that don't make sense together. */
+function validateArgs(args) {
+    if (args.pr != null && (args.base || args.head || args.staged)) {
+        throw new Error('--pr reviews a PR by its diff and cannot be combined with --base/--head/--staged.');
+    }
+    if (args.pr == null && (args.repo || args.post)) {
+        throw new Error('--repo/--post only apply together with --pr.');
+    }
+}
+/** Resolve owner/repo from the current checkout via gh (for --post). */

package/build/config/load.js

@@ -0,0 +1,205 @@
+import { readdir, readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { ReviewConfigSchema } from './schema.js';
+import { toolMap } from '../core/tools.js';
+export const CONFIG_DIRNAME = '.expo-code-review';
+/** Default OpenCode tool toggles for a reviewer: read the repo, never mutate it. */
+const DEFAULT_AGENT_TOOLS = toolMap(['read', 'grep', 'glob', 'list']);
+export function configDirFor(repoRoot) {
+    return path.join(repoRoot, CONFIG_DIRNAME);
+}
+export function hasConfig(repoRoot) {
+    const dir = configDirFor(repoRoot);
+    return existsSync(path.join(dir, 'config.jsonc')) || existsSync(path.join(dir, 'config.json'));
+}
+/**
+ * Discover and fully resolve a repo's review config from `.expo-code-review/`:
+ * parse config.jsonc, read every prompt file, and resolve models (with an
+ * optional REVIEWER_MODEL env override applied to all agents + the coordinator).
+ */
+export async function loadReviewConfig(repoRoot) {
+    const dir = configDirFor(repoRoot);
+    const configPath = ['config.jsonc', 'config.json']
+        .map(name => path.join(dir, name))
+        .find(candidate => existsSync(candidate));
+    if (!configPath) {
+        throw new Error(`No ${CONFIG_DIRNAME}/config.jsonc found in ${repoRoot}. Run \`ecr init\` to scaffold one.`);
+    }
+    const raw = await readFile(configPath, 'utf8');
+    const parsed = ReviewConfigSchema.parse(JSON.parse(stripTrailingCommas(stripJsonComments(raw))));
+    const override = process.env.REVIEWER_MODEL;
+    const defaultModel = override ?? parsed.model;
+    const resolveModel = (frontmatterModel) => override ?? frontmatterModel ?? defaultModel;
+    const resolveTemp = (value, fallback) => {
+        const n = value == null ? NaN : Number(value);
+        return Number.isFinite(n) ? n : fallback;
+    };
+    // shared.md is optional; the coordinator is required.
+    const sharedPath = path.join(dir, 'shared.md');
+    const sharedPromptText = existsSync(sharedPath)
+        ? parseFrontmatter(await readFile(sharedPath, 'utf8')).body
+        : '';
+    const coordinatorPath = path.join(dir, 'coordinator.md');
+    if (!existsSync(coordinatorPath)) {
+        throw new Error(`Missing ${CONFIG_DIRNAME}/coordinator.md`);
+    }
+    const coordinatorMd = parseFrontmatter(await readFile(coordinatorPath, 'utf8'));
+    // Every markdown file in agents/ is a reviewer agent (id = filename).
+    const agentsDir = path.join(dir, 'agents');
+    if (!existsSync(agentsDir)) {
+        throw new Error(`Missing ${CONFIG_DIRNAME}/agents/ directory. Run \`ecr init\`.`);
+    }
+    const agentFiles = (await readdir(agentsDir)).filter(name => name.endsWith('.md')).sort();
+    if (agentFiles.length === 0) {
+        throw new Error(`No agent markdown files in ${CONFIG_DIRNAME}/agents/.`);
+    }
+    const agents = [];
+    for (const file of agentFiles) {
+        const md = parseFrontmatter(await readFile(path.join(agentsDir, file), 'utf8'));
+        const id = file.replace(/\.md$/, '');
+        agents.push({
+            id,
+            description: md.data.description ?? '',
+            alwaysRun: /^(true|yes|1)$/i.test(md.data.alwaysRun ?? ''),
+            model: resolveModel(md.data.model),
+            temperature: resolveTemp(md.data.temperature, 0.1),
+            tools: DEFAULT_AGENT_TOOLS,
+            promptText: md.body,
+        });
+    }
+    return {
+        configDir: dir,
+        sharedPromptText,
+        agents,
+        coordinator: {
+            model: resolveModel(coordinatorMd.data.model),
+            temperature: resolveTemp(coordinatorMd.data.temperature, 0),
+            promptText: coordinatorMd.body,
+        },
+        policy: parsed.policy,
+        chunk: parsed.chunk,
+        noise: parsed.noise,
+        breakGlassMarker: parsed.breakGlass.marker,
+        commentTag: parsed.commentTag,
+        auth: {
+            mode: parsed.auth.mode,
+            provider: parsed.auth.provider,
+            tokenEnv: parsed.auth.tokenEnv,
+        },
+    };
+}
+/**
+ * Parse optional YAML-ish frontmatter (simple `key: value` scalars) from the top
+ * of a markdown file. Returns the parsed keys and the body with frontmatter
+ * stripped. Supports per-agent overrides like `model:` and `temperature:`.
+ */
+export function parseFrontmatter(md) {
+    if (!md.startsWith('---')) {
+        return { data: {}, body: md };
+    }
+    const end = md.indexOf('\n---', 3);
+    if (end === -1) {
+        return { data: {}, body: md };
+    }
+    const header = md.slice(3, end).trim();
+    const body = md.slice(end + 4).replace(/^\r?\n/, '');
+    const data = {};
+    for (const line of header.split('\n')) {
+        const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+        if (match) {
+            data[match[1]] = match[2].trim().replace(/^["']|["']$/g, '');
+        }
+    }
+    return { data, body };
+}
+/**
+ * Strip // line and /* *\/ block comments from JSONC, ignoring anything inside
+ * string literals. The config is trusted (in-repo), so a light scanner suffices.
+ */
+export function stripJsonComments(input) {
+    let out = '';
+    let inString = false;
+    let inLine = false;
+    let inBlock = false;
+    for (let i = 0; i < input.length; i++) {
+        const char = input[i];
+        const next = input[i + 1];
+        if (inLine) {
+            if (char === '\n') {
+                inLine = false;
+                out += char;
+            }
+            continue;
+        }
+        if (inBlock) {
+            if (char === '*' && next === '/') {
+                inBlock = false;
+                i++;
+            }
+            continue;
+        }
+        if (inString) {
+            out += char;
+            if (char === '\\') {
+                out += input[i + 1] ?? '';
+                i++;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            out += char;
+        }
+        else if (char === '/' && next === '/') {
+            inLine = true;
+            i++;
+        }
+        else if (char === '/' && next === '*') {
+            inBlock = true;
+            i++;
+        }
+        else {
+            out += char;
+        }
+    }
+    return out;
+}
+/** Remove trailing commas before `}`/`]` (JSONC), ignoring string contents. */
+export function stripTrailingCommas(input) {
+    let out = '';
+    let inString = false;
+    for (let i = 0; i < input.length; i++) {
+        const char = input[i];
+        if (inString) {
+            out += char;
+            if (char === '\\') {
+                out += input[i + 1] ?? '';
+                i++;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            out += char;
+            continue;
+        }
+        if (char === ',') {
+            let j = i + 1;
+            while (j < input.length && /\s/.test(input[j])) {
+                j++;
+            }
+            if (input[j] === '}' || input[j] === ']') {
+                continue; // drop the trailing comma
+            }
+        }
+        out += char;
+    }
+    return out;
+}

package/build/config/schema.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+export const ReviewConfigSchema = z.object({
+    /** Default model for every agent + the coordinator. Override per-agent via
+     * frontmatter in the agent's markdown, or globally via REVIEWER_MODEL. */
+    model: z.string().default('anthropic/claude-sonnet-5'),
+    policy: z
+        .object({
+        includeSuggestions: z.boolean().default(false),
+        maxFindings: z.number().int().positive().optional(),
+    })
+        .default({ includeSuggestions: false }),
+    chunk: z
+        .object({
+        // Chunking is bounded by changed lines (added + removed), not file count —
+        // "how much code the model must actually reason about" is what dilutes
+        // attention, and 20 one-line tweaks are nothing like 3 files of 800 lines.
+        //
+        // A diff whose total changed lines fit in one chunk is reviewed in a single
+        // full-context pass (no chunking, no cross-cutting overhead). Larger diffs
+        // split into focused chunks, plus a cross-cutting pass for diff-spanning
+        // issues.
+        //
+        // Why 1000: it's a heuristic, not a measured optimum. Most real PRs change
+        // well under ~1000 lines, so they get a single full-context pass and skip
+        // chunking; only genuinely large PRs split. It also keeps each chunk small
+        // enough that the reasoning-heavy correctness agent finishes within its time
+        // cap — on real 50-file PRs a 1500-line chunk pushed correctness past 15 min,
+        // so smaller/more chunks (each finishing faster, run in parallel) beat fewer/
+        // larger ones. Coupled to `model`.
+        //
+        // When to tweak:
+        //  - LOWER it if passes hit their time cap on large PRs, if the reviewer
+        //    misses issues, or if you use a cheaper/smaller/faster model.
+        //  - RAISE it to cut the number of passes when the model handles big diffs
+        //    well and passes finish comfortably within their caps.
+        //  - Re-tune from real-PR data (cap-hit rate + false-negative rate), not guesses.
+        maxChangedLines: z.number().int().positive().default(1000),
+        // Secondary guard so a chunk isn't an absurd number of tiny-diff files.
+        maxFiles: z.number().int().positive().default(20),
+        // Max concurrent reviewer calls across all agents/chunks.
+        concurrency: z.number().int().positive().default(6),
+    })
+        .default({ maxChangedLines: 1000, maxFiles: 20, concurrency: 6 }),
+    noise: z
+        .object({
+        additionalIgnores: z.array(z.string()).default([]),
+        additionalMarkers: z.array(z.string()).default([]),
+    })
+        .default({ additionalIgnores: [], additionalMarkers: [] }),
+    breakGlass: z
+        .object({ marker: z.string().default('/skip-review') })
+        .default({ marker: '/skip-review' }),
+    commentTag: z.string().default('expo-ai-code-reviewer'),
+    auth: z
+        .object({
+        // "api-key": the token env is sent as the provider's API key (x-api-key).
+        // "oauth": the token env is a Claude Pro/Max style OAuth token, injected
+        // into an isolated OpenCode auth.json so it's sent as a Bearer token.
+        mode: z.enum(['api-key', 'oauth']).default('api-key'),
+        provider: z.string().default('anthropic'),
+        /** Env var holding the key/token. */
+        tokenEnv: z.string().optional(),
+    })
+        .default({ mode: 'api-key', provider: 'anthropic' }),
+});

package/build/core/auth.js

@@ -0,0 +1,102 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+/** Env var each provider's SDK reads for an API key (x-api-key style). */
+const PROVIDER_KEY_ENV = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    google: 'GOOGLE_GENERATIVE_AI_API_KEY',
+    openrouter: 'OPENROUTER_API_KEY',
+};
+/**
+ * Env vars that must NEVER be forwarded to a model provider. `auth.tokenEnv` names
+ * the env var whose value becomes the provider credential — but that config is
+ * loaded from the repo, and in the CI auto-review it can be PR-controlled. A PR
+ * that pointed `tokenEnv` at one of these would exfiltrate that secret to the
+ * external model provider. The provider credential must only ever be a token
+ * minted for that provider, so we hard-refuse these well-known unrelated secrets.
+ * Defense-in-depth alongside loading config only from the trusted base ref.
+ */
+const FORBIDDEN_TOKEN_ENVS = new Set([
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'ACTIONS_RUNTIME_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'AWS_ACCESS_KEY_ID',
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    'GOOGLE_APPLICATION_CREDENTIALS',
+    'GCP_SERVICE_ACCOUNT_KEY',
+    'NPM_TOKEN',
+    'NODE_AUTH_TOKEN',
+    'SSH_PRIVATE_KEY',
+]);
+const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+/**
+ * Prepare model credentials for the OpenCode server based on the repo's auth mode.
+ * Must run before the server starts (it mutates env). Returns a cleanup handle.
+ *
+ * - `api-key`: copy the configured token env into the provider's API-key env var
+ *   (so the workflow can pass a namespaced secret and OpenCode still finds it).
+ * - `oauth`: write an isolated OpenCode `auth.json` with the token as a Bearer
+ *   OAuth credential and point OpenCode at it via XDG_DATA_HOME, so it uses its
+ *   native Claude Pro/Max path (correct bearer + oauth headers) rather than
+ *   x-api-key. Isolated so it never touches the developer's real auth.json.
+ */
+export async function prepareAuth(config) {
+    const noop = { cleanup: async () => { } };
+    const { mode, provider, tokenEnv } = config.auth;
+    // REVIEWER_MODEL is an explicit "use this model with my own creds" override — a
+    // common local case (e.g. the repo config targets Claude OAuth in CI, but a dev
+    // runs against their own OpenAI login). Don't inject the configured provider's
+    // auth; let OpenCode use whatever it's logged into for the override model.
+    if (process.env.REVIEWER_MODEL) {
+        return noop;
+    }
+    // Refuse to forward a well-known unrelated secret as the provider credential,
+    // even if the (repo/PR-controlled) config names one — that would leak it.
+    if (tokenEnv && FORBIDDEN_TOKEN_ENVS.has(tokenEnv)) {
+        throw new Error(`auth.tokenEnv is set to "${tokenEnv}", a well-known non-provider secret. Refusing ` +
+            `to forward it to the model provider (that would leak the secret). Point auth.tokenEnv ` +
+            `at a token minted for the model provider instead.`);
+    }
+    if (mode === 'api-key') {
+        if (tokenEnv) {
+            const value = process.env[tokenEnv];
+            const target = PROVIDER_KEY_ENV[provider] ?? 'ANTHROPIC_API_KEY';
+            // The explicitly-configured tokenEnv is authoritative — set it even if the
+            // provider env is already present, so config wins over ambient env.
+            if (value) {
+                process.env[target] = value;
+            }
+        }
+        return noop;
+    }
+    // oauth
+    if (!tokenEnv) {
+        throw new Error('auth.mode "oauth" requires auth.tokenEnv to name the env var holding the OAuth token.');
+    }
+    const token = process.env[tokenEnv];
+    if (!token) {
+        throw new Error(`OAuth token env "${tokenEnv}" is not set.`);
+    }
+    const dir = await mkdtemp(path.join(tmpdir(), 'ecr-auth-'));
+    await mkdir(path.join(dir, 'opencode'), { recursive: true });
+    const authJson = {
+        [provider]: {
+            type: 'oauth',
+            access: token,
+            refresh: '',
+            // Far-future expiry so OpenCode uses the token as-is and does not try to
+            // refresh it (setup-token tokens are long-lived and carry no refresh).
+            expires: Date.now() + YEAR_MS,
+        },
+    };
+    await writeFile(path.join(dir, 'opencode', 'auth.json'), JSON.stringify(authJson), 'utf8');
+    process.env.XDG_DATA_HOME = dir;
+    return {
+        cleanup: async () => {
+            await rm(dir, { recursive: true, force: true });
+        },
+    };
+}

package/build/core/coordinator.js

@@ -0,0 +1,24 @@
+import { promptAndParse } from './opencode.js';
+import { buildCoordinatorSystem, buildCoordinatorTask } from './prompts.js';
+import { parseCoordinatorOutput } from './schema.js';
+/**
+ * Single LLM call that dedupes, re-judges severity, and decides. Structured so it
+ * could later own a spawn tool, but for now stays a plain consolidation pass.
+ */
+// The coordinator only re-judges text (no repo tools), so it's usually quick; the
+// cap is a backstop. It runs AFTER all passes, so this adds to the worst-case
+// serial chain — keep it within the CI job timeout (see review.ts / workflows).
+const COORDINATOR_TIMEOUT_MS = 10 * 60 * 1000;
+export async function coordinate(handle, config, metadata, agentFindings, coverageNotes = []) {
+    const system = buildCoordinatorSystem(config);
+    const text = buildCoordinatorTask(metadata, agentFindings, coverageNotes);
+    const { value, cost, tokens, truncated } = await promptAndParse(handle, {
+        agent: 'coordinator',
+        system,
+        text,
+        title: 'review-coordinator',
+        maxWaitMs: COORDINATOR_TIMEOUT_MS,
+        finalizeOnTimeout: true,
+    }, parseCoordinatorOutput);
+    return { output: value, cost, tokens, truncated };
+}