@expo/code-review-cli 0.3.0 → 0.4.0

package/build/config/load.js

@@ -1,33 +1,59 @@
-import { readdir, readFile } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-import { ReviewConfigSchema } from './schema.js';
-import { toolMap } from '../core/tools.js';
-export const CONFIG_DIRNAME = '.expo-code-review';
+import { readdir, readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { ReviewConfigSchema, ScopeReviewConfigSchema } from "./schema.js";
+import { toolMap } from "../core/tools.js";
+export const CONFIG_DIRNAME = ".expo-code-review";
 /** Default OpenCode tool toggles for a reviewer: read the repo, never mutate it. */
-const DEFAULT_AGENT_TOOLS = toolMap(['read', 'grep', 'glob', 'list']);
+const DEFAULT_AGENT_TOOLS = toolMap(["read", "grep", "glob", "list"]);
 export function configDirFor(repoRoot) {
     return path.join(repoRoot, CONFIG_DIRNAME);
 }
-export function hasConfig(repoRoot) {
-    const dir = configDirFor(repoRoot);
-    return existsSync(path.join(dir, 'config.jsonc')) || existsSync(path.join(dir, 'config.json'));
+/**
+ * Resolve the config directory: an explicit override (absolute or repo-relative)
+ * → the ECR_CONFIG_DIR env var → the repo's default `.expo-code-review/`. This is
+ * the escape hatch (graft 1); with neither override present the result is exactly
+ * `configDirFor(repoRoot)`, so the default behavior is byte-identical.
+ */
+export function resolveConfigDir(repoRoot, override) {
+    const chosen = override ?? process.env.ECR_CONFIG_DIR;
+    if (chosen) {
+        return path.isAbsolute(chosen) ? chosen : path.join(repoRoot, chosen);
+    }
+    return path.join(repoRoot, CONFIG_DIRNAME);
+}
+export function hasConfig(repoRoot, options = {}) {
+    // Resolve the same way loadReviewConfig does (incl. the ECR_CONFIG_DIR escape
+    // hatch) so doctor's "no config" diagnostic never disagrees with the loader.
+    const dir = resolveConfigDir(repoRoot, options.configDir);
+    return existsSync(path.join(dir, "config.jsonc")) || existsSync(path.join(dir, "config.json"));
 }
 /**
  * Discover and fully resolve a repo's review config from `.expo-code-review/`:
  * parse config.jsonc, read every prompt file, and resolve models (with an
  * optional REVIEWER_MODEL env override applied to all agents + the coordinator).
  */
-export async function loadReviewConfig(repoRoot) {
-    const dir = configDirFor(repoRoot);
-    const configPath = ['config.jsonc', 'config.json']
-        .map(name => path.join(dir, name))
-        .find(candidate => existsSync(candidate));
+export async function loadReviewConfig(repoRoot, options = {}) {
+    const dir = resolveConfigDir(repoRoot, options.configDir);
+    return (await loadConfigDir(dir, ReviewConfigSchema)).config;
+}
+/**
+ * The shared per-directory loader: parse config.jsonc, read every prompt file,
+ * resolve models. Root and scope loading share this one code path — the schema
+ * argument controls whether the centrally-locked keys (auth/breakGlass) are
+ * accepted (root) or rejected at the Zod level (scope). `loadReviewConfig` with
+ * `ReviewConfigSchema` produces identical output for identical input.
+ */
+async function loadConfigDir(dir, schema) {
+    const configPath = ["config.jsonc", "config.json"]
+        .map((name) => path.join(dir, name))
+        .find((candidate) => existsSync(candidate));
     if (!configPath) {
-        throw new Error(`No ${CONFIG_DIRNAME}/config.jsonc found in ${repoRoot}. Run \`ecr init\` to scaffold one.`);
+        throw new Error(`No ${CONFIG_DIRNAME}/config.jsonc found in ${path.dirname(dir)}. Run \`ecr init\` to scaffold one.`);
     }
-    const raw = await readFile(configPath, 'utf8');
-    const parsed = ReviewConfigSchema.parse(JSON.parse(stripTrailingCommas(stripJsonComments(raw))));
+    const raw = await readFile(configPath, "utf8");
+    const rawObject = JSON.parse(stripTrailingCommas(stripJsonComments(raw)));
+    const parsed = schema.parse(rawObject);
     const override = process.env.REVIEWER_MODEL;
     const defaultModel = override ?? parsed.model;
     const resolveModel = (frontmatterModel) => override ?? frontmatterModel ?? defaultModel;
@@ -36,39 +62,39 @@ export async function loadReviewConfig(repoRoot) {
         return Number.isFinite(n) ? n : fallback;
     };
     // shared.md is optional; the coordinator is required.
-    const sharedPath = path.join(dir, 'shared.md');
+    const sharedPath = path.join(dir, "shared.md");
     const sharedPromptText = existsSync(sharedPath)
-        ? parseFrontmatter(await readFile(sharedPath, 'utf8')).body
-        : '';
-    const coordinatorPath = path.join(dir, 'coordinator.md');
+        ? parseFrontmatter(await readFile(sharedPath, "utf8")).body
+        : "";
+    const coordinatorPath = path.join(dir, "coordinator.md");
     if (!existsSync(coordinatorPath)) {
         throw new Error(`Missing ${CONFIG_DIRNAME}/coordinator.md`);
     }
-    const coordinatorMd = parseFrontmatter(await readFile(coordinatorPath, 'utf8'));
+    const coordinatorMd = parseFrontmatter(await readFile(coordinatorPath, "utf8"));
     // Every markdown file in agents/ is a reviewer agent (id = filename).
-    const agentsDir = path.join(dir, 'agents');
+    const agentsDir = path.join(dir, "agents");
     if (!existsSync(agentsDir)) {
         throw new Error(`Missing ${CONFIG_DIRNAME}/agents/ directory. Run \`ecr init\`.`);
     }
-    const agentFiles = (await readdir(agentsDir)).filter(name => name.endsWith('.md')).sort();
+    const agentFiles = (await readdir(agentsDir)).filter((name) => name.endsWith(".md")).sort();
     if (agentFiles.length === 0) {
         throw new Error(`No agent markdown files in ${CONFIG_DIRNAME}/agents/.`);
     }
     const agents = [];
     for (const file of agentFiles) {
-        const md = parseFrontmatter(await readFile(path.join(agentsDir, file), 'utf8'));
-        const id = file.replace(/\.md$/, '');
+        const md = parseFrontmatter(await readFile(path.join(agentsDir, file), "utf8"));
+        const id = file.replace(/\.md$/, "");
         agents.push({
             id,
-            description: md.data.description ?? '',
-            alwaysRun: /^(true|yes|1)$/i.test(md.data.alwaysRun ?? ''),
+            description: md.data.description ?? "",
+            alwaysRun: /^(true|yes|1)$/i.test(md.data.alwaysRun ?? ""),
             model: resolveModel(md.data.model),
             temperature: resolveTemp(md.data.temperature, 0.1),
             tools: DEFAULT_AGENT_TOOLS,
             promptText: md.body,
         });
     }
-    return {
+    const config = {
         configDir: dir,
         sharedPromptText,
         agents,
@@ -80,15 +106,91 @@ export async function loadReviewConfig(repoRoot) {
         policy: parsed.policy,
         chunk: parsed.chunk,
         noise: parsed.noise,
-        breakGlassMarker: parsed.breakGlass.marker,
-        commentTag: parsed.commentTag,
+        // parsed.breakGlass/auth are always present for the root schema (defaults) and
+        // absent for the scope schema; loadScopeConfig overrides both afterwards.
+        breakGlassMarker: parsed.breakGlass?.marker ?? "/skip-review",
+        // Scope configs can't declare commentTag (scope schema rejects it);
+        // loadScopeConfig overwrites this placeholder with the manifest default.
+        commentTag: parsed.commentTag ?? "expo-ai-code-reviewer",
         auth: {
-            mode: parsed.auth.mode,
-            provider: parsed.auth.provider,
-            tokenEnv: parsed.auth.tokenEnv,
+            mode: parsed.auth?.mode ?? "api-key",
+            provider: parsed.auth?.provider ?? "anthropic",
+            tokenEnv: parsed.auth?.tokenEnv,
         },
         review: parsed.review,
     };
+    return { config, raw: rawObject };
+}
+/**
+ * auth is honored ONLY here: the manifest's `defaults.auth` wins when present,
+ * otherwise the root config.jsonc auth. A scope config can never contribute auth
+ * (the scope schema rejects it), so the secret-forwarding surface stays a single,
+ * root-owned value no matter how many scopes exist.
+ */
+export function loadAuthFromRoot(rootConfig, manifest) {
+    const override = manifest?.defaults.auth;
+    if (override) {
+        return { mode: override.mode, provider: override.provider, tokenEnv: override.tokenEnv };
+    }
+    return rootConfig.auth;
+}
+/**
+ * Load one scope's fully-resolved config. The default scope (config '.') reuses
+ * the root config unchanged except auth; a nested scope reads its own
+ * `.expo-code-review/` via the scope schema (auth/breakGlass rejected by Zod).
+ * auth and breakGlass always come from the root; `defaults.enforceAgents` are
+ * injected with alwaysRun and win any same-id agent in the scope roster (risk 11).
+ */
+export async function loadScopeConfig(root, scope, manifest, rootConfig) {
+    let base;
+    let commentTag;
+    if (scope.config === ".") {
+        base = rootConfig;
+        // The default scope keeps the ROOT comment marker so the existing single
+        // comment (and its dismissal state) upserts in place, not duplicated (risk 8).
+        commentTag = rootConfig.commentTag;
+    }
+    else {
+        // Defense in depth behind the schema's traversal refinement: never read a
+        // scope config from outside the repo checkout (scope.config is PR-controllable).
+        const resolvedRoot = path.resolve(root);
+        const resolvedScope = path.resolve(root, scope.config);
+        if (resolvedScope !== resolvedRoot && !resolvedScope.startsWith(resolvedRoot + path.sep)) {
+            throw new Error(`scope "${scope.name}": config "${scope.config}" resolves outside the repo checkout`);
+        }
+        const dir = path.join(root, scope.config, CONFIG_DIRNAME);
+        const { config } = await loadConfigDir(dir, ScopeReviewConfigSchema);
+        base = config;
+        // Non-default scopes never carry their own marker (the scope schema rejects
+        // commentTag): ci derives `<rootTag>:<scope>` for per-scope comments, so the
+        // loaded value here is only the manifest default, for display/doctor.
+        commentTag = manifest.defaults.commentTag;
+    }
+    // Inject the enforced agents from the ROOT roster with alwaysRun, replacing any
+    // same-id agent the scope defines (the enforced one wins — risk 11).
+    const agents = base.agents.map((agent) => ({ ...agent }));
+    for (const id of manifest.defaults.enforceAgents) {
+        const rootAgent = rootConfig.agents.find((agent) => agent.id === id);
+        if (!rootAgent) {
+            throw new Error(`defaults.enforceAgents lists "${id}", but the root roster has no agent with that id.`);
+        }
+        const enforced = { ...rootAgent, alwaysRun: true };
+        const index = agents.findIndex((agent) => agent.id === id);
+        if (index >= 0) {
+            agents[index] = enforced;
+        }
+        else {
+            agents.push(enforced);
+        }
+    }
+    return {
+        ...base,
+        agents,
+        auth: loadAuthFromRoot(rootConfig, manifest),
+        breakGlassMarker: rootConfig.breakGlassMarker,
+        commentTag,
+        scopeName: scope.name,
+    };
 }
 /**
  * Parse optional YAML-ish frontmatter (simple `key: value` scalars) from the top
@@ -96,20 +198,20 @@ export async function loadReviewConfig(repoRoot) {
  * stripped. Supports per-agent overrides like `model:` and `temperature:`.
  */
 export function parseFrontmatter(md) {
-    if (!md.startsWith('---')) {
+    if (!md.startsWith("---")) {
         return { data: {}, body: md };
     }
-    const end = md.indexOf('\n---', 3);
+    const end = md.indexOf("\n---", 3);
     if (end === -1) {
         return { data: {}, body: md };
     }
     const header = md.slice(3, end).trim();
-    const body = md.slice(end + 4).replace(/^\r?\n/, '');
+    const body = md.slice(end + 4).replace(/^\r?\n/, "");
     const data = {};
-    for (const line of header.split('\n')) {
+    for (const line of header.split("\n")) {
         const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
         if (match) {
-            data[match[1]] = match[2].trim().replace(/^["']|["']$/g, '');
+            data[match[1]] = match[2].trim().replace(/^["']|["']$/g, "");
         }
     }
     return { data, body };
@@ -119,7 +221,7 @@ export function parseFrontmatter(md) {
  * string literals. The config is trusted (in-repo), so a light scanner suffices.
  */
 export function stripJsonComments(input) {
-    let out = '';
+    let out = "";
     let inString = false;
     let inLine = false;
     let inBlock = false;
@@ -127,14 +229,14 @@ export function stripJsonComments(input) {
         const char = input[i];
         const next = input[i + 1];
         if (inLine) {
-            if (char === '\n') {
+            if (char === "\n") {
                 inLine = false;
                 out += char;
             }
             continue;
         }
         if (inBlock) {
-            if (char === '*' && next === '/') {
+            if (char === "*" && next === "/") {
                 inBlock = false;
                 i++;
             }
@@ -142,8 +244,8 @@ export function stripJsonComments(input) {
         }
         if (inString) {
             out += char;
-            if (char === '\\') {
-                out += input[i + 1] ?? '';
+            if (char === "\\") {
+                out += input[i + 1] ?? "";
                 i++;
             }
             else if (char === '"') {
@@ -155,11 +257,11 @@ export function stripJsonComments(input) {
             inString = true;
             out += char;
         }
-        else if (char === '/' && next === '/') {
+        else if (char === "/" && next === "/") {
             inLine = true;
             i++;
         }
-        else if (char === '/' && next === '*') {
+        else if (char === "/" && next === "*") {
             inBlock = true;
             i++;
         }
@@ -171,14 +273,14 @@ export function stripJsonComments(input) {
 }
 /** Remove trailing commas before `}`/`]` (JSONC), ignoring string contents. */
 export function stripTrailingCommas(input) {
-    let out = '';
+    let out = "";
     let inString = false;
     for (let i = 0; i < input.length; i++) {
         const char = input[i];
         if (inString) {
             out += char;
-            if (char === '\\') {
-                out += input[i + 1] ?? '';
+            if (char === "\\") {
+                out += input[i + 1] ?? "";
                 i++;
             }
             else if (char === '"') {
@@ -191,12 +293,12 @@ export function stripTrailingCommas(input) {
             out += char;
             continue;
         }
-        if (char === ',') {
+        if (char === ",") {
             let j = i + 1;
             while (j < input.length && /\s/.test(input[j])) {
                 j++;
             }
-            if (input[j] === '}' || input[j] === ']') {
+            if (input[j] === "}" || input[j] === "]") {
                 continue; // drop the trailing comma
             }
         }

package/build/config/routing.js

@@ -0,0 +1,122 @@
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { RoutingManifestSchema } from "./schema.js";
+import { resolveConfigDir, stripJsonComments, stripTrailingCommas } from "./load.js";
+import { matchesIgnore } from "../core/noise.js";
+export const ROUTING_FILENAME = "routing.jsonc";
+/**
+ * Parse the routing manifest. It lives in the SAME resolved root config dir as
+ * config.jsonc (`resolveConfigDir` — the `--config-dir`/`ECR_CONFIG_DIR` escape
+ * hatch): the override designates an alternate ROOT config dir, so config.jsonc
+ * and routing.jsonc always travel together and never split across the override
+ * and the default tree. With no override the dir is `<root>/.expo-code-review`,
+ * byte-identical to the pre-escape-hatch path. Absent file => null (backcompat).
+ * Scope `config` paths stay repo-root-relative (see `loadScopeConfig`): an
+ * override relocates only the ROOT artifacts, never the scopes' own subtrees.
+ */
+export async function loadRoutingManifest(root, options = {}) {
+    const manifestPath = path.join(resolveConfigDir(root, options.configDir), ROUTING_FILENAME);
+    if (!existsSync(manifestPath)) {
+        return null;
+    }
+    const raw = await readFile(manifestPath, "utf8");
+    // Let schema/JSON errors throw — a malformed manifest must be a loud error,
+    // never a silent fallback to single-scope behavior.
+    return RoutingManifestSchema.parse(JSON.parse(stripTrailingCommas(stripJsonComments(raw))));
+}
+// The repo's minimal glob translates `**` to `.*`, so a leading double-star + slash
+// requires at least one slash in the path — which would make the documented catch-all
+// silently miss root-level files (README.md, package.json). To give the double-star +
+// slash its conventional "zero or more directories" meaning, we also test the variant
+// with each such prefix removed, so the catch-all matches both `a.ts` and `src/b.ts`.
+function patternVariants(pattern) {
+    const collapsed = pattern.replace(/\*\*\//g, "");
+    return collapsed !== pattern && collapsed.length > 0 ? [pattern, collapsed] : [pattern];
+}
+/** Does any of the scope's globs match this file? */
+function scopeMatches(paths, file) {
+    return paths.some((pattern) => patternVariants(pattern).some((variant) => matchesIgnore(file, variant)));
+}
+/**
+ * Assign each changed file to exactly one scope: test the file against every
+ * scope's paths in ARRAY ORDER; the LAST matching scope wins. Glob matching via
+ * matchesIgnore (supports ** across / and * within a segment — the manifest
+ * documents this dialect). Deterministic, no filesystem access.
+ */
+export function resolveScopes(manifest, changedFiles) {
+    const buckets = new Map();
+    const unmatched = [];
+    const overlaps = [];
+    for (const file of changedFiles) {
+        const matched = [];
+        for (const scope of manifest.scopes) {
+            if (scopeMatches(scope.paths, file)) {
+                matched.push(scope.name);
+            }
+        }
+        if (matched.length === 0) {
+            unmatched.push(file);
+            continue;
+        }
+        const winner = matched[matched.length - 1];
+        (buckets.get(winner) ?? buckets.set(winner, []).get(winner)).push(file);
+        if (matched.length > 1) {
+            overlaps.push({ file, matched, winner });
+        }
+    }
+    const active = [];
+    for (const scope of manifest.scopes) {
+        const files = buckets.get(scope.name);
+        if (files && files.length > 0) {
+            active.push({ name: scope.name, configDir: scope.config, files });
+        }
+    }
+    return { active, unmatched, overlaps };
+}
+/** Scoped comment tag: `${defaults.commentTag}:${scope.name}` (distinct full marker). */
+export function scopedCommentTag(rootTag, scopeName) {
+    return `${rootTag}:${scopeName}`;
+}
+/**
+ * Divide the total passes budget across N active scopes, which run SEQUENTIALLY
+ * in one `ecr ci` process. Even split = `floor(total / active)`, clamped up to
+ * `min` so a scope always gets a workable window. When that clamp wins (the even
+ * split fell below `min`), the floor is kept — a scope below `min` isn't worth
+ * starting — and `overshoot` flags that the run will exceed the total budget so
+ * the caller can warn. Pure so the math is unit-testable.
+ */
+export function scopePassesBudgetMs(totalMs, minMs, activeCount) {
+    const count = Math.max(1, activeCount);
+    const evenSplit = Math.floor(totalMs / count);
+    const perScopeMs = Math.max(minMs, evenSplit);
+    return { perScopeMs, overshoot: count * perScopeMs > totalMs };
+}
+/**
+ * Owner table for doctor/CI logs (graft 4): one row per file —
+ * `file  →  winning scope (also matched: a, b)`. Returns printable lines,
+ * capped at `limit` rows with a "+N more" tail.
+ */
+export function formatOwnerTable(resolution, limit = 40) {
+    const rows = [];
+    const overlapByFile = new Map(resolution.overlaps.map((o) => [o.file, o]));
+    for (const scope of resolution.active) {
+        for (const file of scope.files) {
+            const overlap = overlapByFile.get(file);
+            const also = overlap ? overlap.matched.filter((name) => name !== scope.name) : [];
+            rows.push({ file, scope: scope.name, also });
+        }
+    }
+    for (const file of resolution.unmatched) {
+        rows.push({ file, scope: "(none)", also: [] });
+    }
+    const lines = [];
+    for (const row of rows.slice(0, limit)) {
+        const suffix = row.also.length > 0 ? `  (also matched: ${row.also.join(", ")})` : "";
+        lines.push(`  ${row.file}  →  ${row.scope}${suffix}`);
+    }
+    if (rows.length > limit) {
+        lines.push(`  …and ${rows.length - limit} more`);
+    }
+    return lines;
+}

package/build/config/schema.js

@@ -1,8 +1,9 @@
-import { z } from 'zod';
+import path from "node:path";
+import { z } from "zod";
 export const ReviewConfigSchema = z.object({
     /** Default model for every agent + the coordinator. Override per-agent via
      * frontmatter in the agent's markdown, or globally via REVIEWER_MODEL. */
-    model: z.string().default('anthropic/claude-sonnet-5'),
+    model: z.string().default("anthropic/claude-sonnet-5"),
     policy: z
         .object({
         includeSuggestions: z.boolean().default(false),
@@ -48,20 +49,20 @@ export const ReviewConfigSchema = z.object({
     })
         .default({ additionalIgnores: [], additionalMarkers: [] }),
     breakGlass: z
-        .object({ marker: z.string().default('/skip-review') })
-        .default({ marker: '/skip-review' }),
-    commentTag: z.string().default('expo-ai-code-reviewer'),
+        .object({ marker: z.string().default("/skip-review") })
+        .default({ marker: "/skip-review" }),
+    commentTag: z.string().default("expo-ai-code-reviewer"),
     auth: z
         .object({
         // "api-key": the token env is sent as the provider's API key (x-api-key).
         // "oauth": the token env is a Claude Pro/Max style OAuth token, injected
         // into an isolated OpenCode auth.json so it's sent as a Bearer token.
-        mode: z.enum(['api-key', 'oauth']).default('api-key'),
-        provider: z.string().default('anthropic'),
+        mode: z.enum(["api-key", "oauth"]).default("api-key"),
+        provider: z.string().default("anthropic"),
         /** Env var holding the key/token. */
         tokenEnv: z.string().optional(),
     })
-        .default({ mode: 'api-key', provider: 'anthropic' }),
+        .default({ mode: "api-key", provider: "anthropic" }),
     review: z
         .object({
         // Which PRs `ecr ci` acts on — the source of truth for trigger policy (a
@@ -69,12 +70,115 @@ export const ReviewConfigSchema = z.object({
         //   "all"   — review every PR, unless it carries the `skipLabel`.
         //   "label" — review only PRs carrying `label` (e.g. `ai-review`) or a
         //             `label:<agent>` variant. `skipLabel` still wins.
-        trigger: z.enum(['all', 'label']).default('all'),
+        trigger: z.enum(["all", "label"]).default("all"),
         // Opt-in label (and prefix for `label:<agent>`) used when trigger is "label".
-        label: z.string().default('ai-review'),
+        label: z.string().default("ai-review"),
         // Opt a single PR out of review. A label (not a config flag) because labels
         // are write-gated to maintainers — a PR author can't add one to dodge review.
-        skipLabel: z.string().default('ai-review:skip'),
+        skipLabel: z.string().default("ai-review:skip"),
     })
-        .default({ trigger: 'all', label: 'ai-review', skipLabel: 'ai-review:skip' }),
+        .default({ trigger: "all", label: "ai-review", skipLabel: "ai-review:skip" }),
+});
+/** One routing scope: ordered globs → a directory containing .expo-code-review/. */
+export const RoutingScopeSchema = z.object({
+    /** Kebab-case id; used in comments, fingerprint namespacing, --scopes. */
+    name: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "scope name must be kebab-case"),
+    /** Ordered globs (same dialect as noise.additionalIgnores: ** and *). */
+    paths: z.array(z.string().min(1)).min(1),
+    /** Repo-relative dir whose .expo-code-review/ holds the scope's config ('.' = root).
+     * routing.jsonc is read from the PR-head checkout, so this field is
+     * PR-controllable input: absolute paths and `..` traversal are rejected so a
+     * scope config can never resolve outside the repo. */
+    config: z
+        .string()
+        .min(1)
+        .refine((value) => !path.isAbsolute(value) && !path.normalize(value).split(/[/\\]/).includes(".."), { message: 'scope config must be a repo-relative path without ".." segments' }),
+});
+export const RoutingManifestSchema = z
+    .object({
+    /** How N scopes render on one PR. */
+    comment: z.enum(["single", "per-scope"]).default("single"),
+    /** Wall-clock budget for the per-scope review passes. Active scopes run
+     * SEQUENTIALLY in one `ecr ci` process, so the total is divided across them
+     * (not spent per scope). Absent = today's totals (zod defaults). */
+    budget: z
+        .object({
+        /** Total passes budget (minutes) split across active scopes. Sized to fit
+         * the scaffolded workflow's `timeout-minutes` (60) with margin for the
+         * coordinator, verification, and git/gh overhead. */
+        totalPassesMinutes: z.number().int().positive().default(32),
+        /** Per-scope floor (minutes): below this a scope review isn't worth
+         * starting, so the even split clamps up to it — even when that makes the
+         * scopes overshoot the total (ecr ci warns; doctor flags the worst case). */
+        minScopeMinutes: z.number().int().positive().default(5),
+    })
+        .default({ totalPassesMinutes: 32, minScopeMinutes: 5 }),
+    defaults: z
+        .object({
+        /** The ONLY manifest-level place auth is honored (locks the root value).
+         * Unwrap the inner `.default()` first: in zod v4 a `.default().optional()`
+         * chain still fires the default when the key is absent, which would make
+         * `defaults.auth` a phantom `{mode:'api-key',provider:'anthropic'}` for every
+         * manifest that omits auth and silently override the root config's real auth. */
+        auth: ReviewConfigSchema.shape.auth.unwrap().optional(),
+        /** Agent ids injected into every scope with alwaysRun, from the ROOT roster. */
+        enforceAgents: z.array(z.string()).default([]),
+        /** Root comment marker; per-scope tags derive from it. */
+        commentTag: z.string().default("expo-ai-code-reviewer"),
+    })
+        .default({ enforceAgents: [], commentTag: "expo-ai-code-reviewer" }),
+    /** Ordered; LAST matching scope wins per changed file (CODEOWNERS discipline). */
+    scopes: z.array(RoutingScopeSchema).min(1),
+})
+    .superRefine((manifest, ctx) => {
+    // unique scope names; unique config dirs (after path.normalize).
+    const seenNames = new Set();
+    for (const scope of manifest.scopes) {
+        if (seenNames.has(scope.name)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `duplicate scope name: ${scope.name}`,
+                path: ["scopes"],
+            });
+        }
+        seenNames.add(scope.name);
+    }
+    const seenDirs = new Map();
+    for (const scope of manifest.scopes) {
+        const norm = path.normalize(scope.config).replace(/[/\\]+$/, "");
+        if (seenDirs.has(norm)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `duplicate scope config dir: ${scope.config} (already used by scope "${seenDirs.get(norm)}")`,
+                path: ["scopes"],
+            });
+        }
+        seenDirs.set(norm, scope.name);
+    }
+});
+/**
+ * Scope config = root config MINUS the centrally locked keys. Allowlist of
+ * scope-overridable keys (Turborepo-style, graft 6): model, policy, chunk,
+ * noise (+ the prompt files living beside it: shared.md, coordinator.md,
+ * agents/). NEVER auth or breakGlass — declaring either fails parsing at the
+ * Zod level so IDE/doctor catch it before CI. commentTag is also locked: a
+ * scope's comment marker is always DERIVED (`<rootTag>:<scope>`; the default
+ * scope keeps the root tag) so `ecr ci`'s post/clear/reconcile paths and a
+ * standalone `ecr review --scope --post` always target the same marker — an
+ * honored per-scope tag would let the two halves strand each other's comments.
+ */
+export const ScopeReviewConfigSchema = ReviewConfigSchema.omit({
+    auth: true,
+    breakGlass: true,
+    commentTag: true,
+}).extend({
+    auth: z
+        .never({ error: "auth is locked to the root config; remove it from this scope config" })
+        .optional(),
+    breakGlass: z.never({ error: "breakGlass is locked to the root config" }).optional(),
+    commentTag: z
+        .never({
+        error: "commentTag is locked: per-scope comment markers are derived as <rootTag>:<scope>; remove it from this scope config",
+    })
+        .optional(),
 });