@expo/code-review-cli 0.3.0 → 0.5.0

package/build/reporters/terminal.js

@@ -1,6 +1,6 @@
-import { decisionExitCode, decisionLabel, groupBySeverity, sortFindings, } from '../core/render.js';
-import { SEVERITIES } from '../core/schema.js';
-const ESC = '';
+import { decisionExitCode, decisionLabel, groupBySeverity, sortFindings } from "../core/render.js";
+import { SEVERITIES } from "../core/schema.js";
+const ESC = "";
 const RESET = `${ESC}[0m`;
 const BOLD = `${ESC}[1m`;
 const DIM = `${ESC}[2m`;
@@ -10,9 +10,9 @@ const COLORS = {
     suggestion: `${ESC}[36m`,
 };
 const SEVERITY_LABEL = {
-    critical: 'CRITICAL',
-    warning: 'WARNING',
-    suggestion: 'SUGGESTION',
+    critical: "CRITICAL",
+    warning: "WARNING",
+    suggestion: "SUGGESTION",
 };
 /**
  * Prints a human-readable summary grouped by severity; honors --json; never
@@ -38,19 +38,19 @@ export class TerminalReporter {
         process.exitCode = this.options.noFail ? 0 : decisionExitCode(review.decision);
     }
     renderPretty(review) {
-        const out = [''];
+        const out = [""];
         out.push(this.paint(BOLD, `AI code review — ${decisionLabel(review.decision)}`));
-        out.push(this.tally(review.findings), '');
-        out.push(review.summary, '');
+        out.push(this.tally(review.findings), "");
+        out.push(review.summary, "");
         if (review.incomplete.length > 0) {
-            out.push(this.paint(BOLD, '⏱️  Coverage note: some passes did not finish (partial coverage):'));
+            out.push(this.paint(BOLD, "⏱️  Coverage note: some passes did not finish (partial coverage):"));
             for (const note of review.incomplete) {
                 out.push(this.paint(DIM, `  - ${note}`));
             }
-            out.push('');
+            out.push("");
         }
         if (review.findings.length === 0) {
-            out.push(this.paint(DIM, 'No findings.'), '');
+            out.push(this.paint(DIM, "No findings."), "");
         }
         else {
             const groups = groupBySeverity(sortFindings(review.findings));
@@ -59,21 +59,21 @@ export class TerminalReporter {
                 if (findings.length === 0) {
                     continue;
                 }
-                out.push(this.paint(`${BOLD}${COLORS[severity]}`, `${SEVERITY_LABEL[severity]} (${findings.length})`), '');
+                out.push(this.paint(`${BOLD}${COLORS[severity]}`, `${SEVERITY_LABEL[severity]} (${findings.length})`), "");
                 for (const finding of findings) {
                     out.push(this.renderFinding(finding));
                 }
             }
         }
-        return `${out.join('\n')}\n`;
+        return `${out.join("\n")}\n`;
     }
     /** One-line count headline, e.g. "2 critical · 5 warning". */
     tally(findings) {
-        const parts = SEVERITIES.map(severity => {
-            const n = findings.filter(finding => finding.severity === severity).length;
+        const parts = SEVERITIES.map((severity) => {
+            const n = findings.filter((finding) => finding.severity === severity).length;
             return n > 0 ? this.paint(COLORS[severity], `${n} ${severity}`) : null;
         }).filter((part) => part !== null);
-        return parts.length > 0 ? parts.join(this.paint(DIM, ' · ')) : this.paint(DIM, 'no findings');
+        return parts.length > 0 ? parts.join(this.paint(DIM, " · ")) : this.paint(DIM, "no findings");
     }
     renderFinding(finding) {
         const loc = finding.line != null ? `${finding.file}:${finding.line}` : finding.file;
@@ -83,9 +83,9 @@ export class TerminalReporter {
             `  ${finding.rationale}`,
         ];
         if (finding.suggestion) {
-            lines.push(`  ${this.paint(DIM, 'Suggestion:')} ${finding.suggestion}`);
+            lines.push(`  ${this.paint(DIM, "Suggestion:")} ${finding.suggestion}`);
         }
-        return `${lines.join('\n')}\n`;
+        return `${lines.join("\n")}\n`;
     }
     paint(codes, text) {
         return this.color ? `${codes}${text}${RESET}` : text;

package/build/sources/github-pr.js

@@ -1,8 +1,8 @@
-import { mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { run } from '../core/exec.js';
-import { parseUnifiedDiff } from '../core/diff.js';
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { run } from "../core/exec.js";
+import { parseUnifiedDiff } from "../core/diff.js";
 /**
  * Pulls PR diff + metadata through the `gh` CLI, which is preinstalled and
  * authenticated on GitHub Actions runners via GH_TOKEN.
@@ -13,27 +13,27 @@ export class GitHubPRSource {
         this.options = options;
     }
     repoArgs() {
-        return this.options.repo ? ['--repo', this.options.repo] : [];
+        return this.options.repo ? ["--repo", this.options.repo] : [];
     }
     async getMetadata() {
-        const { stdout } = await run('gh', [
-            'pr',
-            'view',
+        const { stdout } = await run("gh", [
+            "pr",
+            "view",
             String(this.options.prNumber),
             ...this.repoArgs(),
-            '--json',
-            'title,body,baseRefName,headRefName',
+            "--json",
+            "title,body,baseRefName,headRefName",
         ], { cwd: this.options.cwd });
         const parsed = JSON.parse(stdout);
         return {
-            title: parsed.title ?? '',
-            body: parsed.body ?? '',
-            baseRef: parsed.baseRefName ?? '',
-            headRef: parsed.headRefName ?? '',
+            title: parsed.title ?? "",
+            body: parsed.body ?? "",
+            baseRef: parsed.baseRefName ?? "",
+            headRef: parsed.headRefName ?? "",
         };
     }
     async getChangedFiles() {
-        const { stdout } = await run('gh', ['pr', 'diff', String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
+        const { stdout } = await run("gh", ["pr", "diff", String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
         return parseUnifiedDiff(stdout);
     }
     /**
@@ -54,16 +54,16 @@ export class GitHubPRSource {
         const ref = `refs/pull/${this.options.prNumber}/head`;
         let parent;
         try {
-            await run('git', ['fetch', '--no-tags', '--depth=1', url, ref], { cwd });
-            parent = await mkdtemp(path.join(tmpdir(), 'ecr-prhead-'));
-            const dir = path.join(parent, 'head'); // must not pre-exist for `worktree add`
-            await run('git', ['worktree', 'add', '--detach', dir, 'FETCH_HEAD'], { cwd });
+            await run("git", ["fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), "ecr-prhead-"));
+            const dir = path.join(parent, "head"); // must not pre-exist for `worktree add`
+            await run("git", ["worktree", "add", "--detach", dir, "FETCH_HEAD"], { cwd });
             const removeParent = parent;
             return {
                 dir,
                 cleanup: async () => {
                     try {
-                        await run('git', ['worktree', 'remove', '--force', dir], { cwd });
+                        await run("git", ["worktree", "remove", "--force", dir], { cwd });
                     }
                     catch {
                         // best effort — fall through to removing the temp dir

package/build/sources/local-git.js

@@ -1,5 +1,5 @@
-import { git, run } from '../core/exec.js';
-import { parseUnifiedDiff } from '../core/diff.js';
+import { git, run } from "../core/exec.js";
+import { parseUnifiedDiff } from "../core/diff.js";
 /**
  * Reads local git state. No network calls. Default compares the working tree
  * against the merge-base with the default branch; flags override base/head or
@@ -16,8 +16,8 @@ export class LocalGitSource {
     }
     async defaultBranch() {
         try {
-            const ref = (await git(['symbolic-ref', 'refs/remotes/origin/HEAD'], this.cwd)).trim();
-            const short = ref.replace(/^refs\/remotes\//, '');
+            const ref = (await git(["symbolic-ref", "refs/remotes/origin/HEAD"], this.cwd)).trim();
+            const short = ref.replace(/^refs\/remotes\//, "");
             if (short) {
                 return short;
             }
@@ -25,16 +25,16 @@ export class LocalGitSource {
         catch {
             // fall through to guesses
         }
-        for (const guess of ['origin/main', 'origin/master', 'main', 'master']) {
+        for (const guess of ["origin/main", "origin/master", "main", "master"]) {
             try {
-                await git(['rev-parse', '--verify', '--quiet', guess], this.cwd);
+                await git(["rev-parse", "--verify", "--quiet", guess], this.cwd);
                 return guess;
             }
             catch {
                 // try next
             }
         }
-        return 'main';
+        return "main";
     }
     async resolveBase() {
         if (this.resolvedBase) {
@@ -46,7 +46,7 @@ export class LocalGitSource {
         }
         const branch = await this.defaultBranch();
         try {
-            this.resolvedBase = (await git(['merge-base', branch, 'HEAD'], this.cwd)).trim();
+            this.resolvedBase = (await git(["merge-base", branch, "HEAD"], this.cwd)).trim();
         }
         catch {
             this.resolvedBase = branch;
@@ -55,30 +55,30 @@ export class LocalGitSource {
     }
     async getMetadata() {
         if (this.options.staged) {
-            return { title: '', body: '', baseRef: 'HEAD', headRef: 'STAGED' };
+            return { title: "", body: "", baseRef: "HEAD", headRef: "STAGED" };
         }
         const base = await this.resolveBase();
         return {
-            title: '',
-            body: '',
+            title: "",
+            body: "",
             baseRef: base,
-            headRef: this.options.head ?? 'WORKING_TREE',
+            headRef: this.options.head ?? "WORKING_TREE",
         };
     }
     async getChangedFiles() {
         let raw;
         if (this.options.staged) {
-            raw = await git(['diff', '--staged'], this.cwd);
+            raw = await git(["diff", "--staged"], this.cwd);
         }
         else {
             const base = await this.resolveBase();
             if (this.options.head) {
-                raw = await git(['diff', `${base}...${this.options.head}`], this.cwd);
+                raw = await git(["diff", `${base}...${this.options.head}`], this.cwd);
             }
             else {
-                const tracked = await git(['diff', base], this.cwd);
+                const tracked = await git(["diff", base], this.cwd);
                 const untracked = await this.untrackedDiffs();
-                raw = [tracked, untracked].filter(chunk => chunk.trim()).join('\n');
+                raw = [tracked, untracked].filter((chunk) => chunk.trim()).join("\n");
             }
         }
         return parseUnifiedDiff(raw);
@@ -89,12 +89,12 @@ export class LocalGitSource {
      */
     async untrackedDiffs() {
         // -z: null-terminated output so filenames containing newlines parse correctly.
-        const listing = await git(['ls-files', '-z', '--others', '--exclude-standard'], this.cwd);
-        const files = listing.split('\0').filter(Boolean);
+        const listing = await git(["ls-files", "-z", "--others", "--exclude-standard"], this.cwd);
+        const files = listing.split("\0").filter(Boolean);
         const chunks = [];
         for (const file of files) {
             // `--` so a filename beginning with `-` can't be read as a git option.
-            const { stdout } = await run('git', ['diff', '--no-index', '--', '/dev/null', file], {
+            const { stdout } = await run("git", ["diff", "--no-index", "--", "/dev/null", file], {
                 cwd: this.cwd,
                 check: false,
             });
@@ -102,6 +102,6 @@ export class LocalGitSource {
                 chunks.push(stdout);
             }
         }
-        return chunks.join('\n');
+        return chunks.join("\n");
     }
 }

package/build/sources/source.js

@@ -1 +1,35 @@
-export {};
+/**
+ * Wrap a source so getMetadata/getChangedFiles/prepareReadRootAsync each run once
+ * and are shared across N sequential runReview calls (one `gh pr diff`, one
+ * PR-head worktree for the whole fan-out — rate-limit hygiene, risk 6). The wrapped
+ * prepareReadRootAsync hands each run a handle whose cleanup() is a no-op; the real
+ * cleanup is deferred to dispose(), which must be called once after the last scope.
+ */
+export function memoizeSource(source) {
+    let metadataPromise;
+    let changedPromise;
+    let readRootPromise;
+    let realHandle = null;
+    return {
+        getMetadata: () => (metadataPromise ??= source.getMetadata()),
+        getChangedFiles: () => (changedPromise ??= source.getChangedFiles()),
+        prepareReadRootAsync: async () => {
+            readRootPromise ??= source.prepareReadRootAsync
+                ? source.prepareReadRootAsync()
+                : Promise.resolve(null);
+            realHandle = await readRootPromise;
+            if (!realHandle) {
+                return null;
+            }
+            // No-op cleanup per run; the real teardown happens once in dispose().
+            return { dir: realHandle.dir, cleanup: async () => { } };
+        },
+        dispose: async () => {
+            if (realHandle) {
+                const handle = realHandle;
+                realHandle = null;
+                await handle.cleanup();
+            }
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {
@@ -26,18 +26,23 @@
     "build": "tsc -p tsconfig.build.json",
     "clean": "rimraf build",
     "typecheck": "tsc --noEmit",
+    "lint": "oxlint src",
+    "fmt": "oxfmt src",
+    "fmt:check": "oxfmt --check src",
     "dev": "bun run src/cli.ts",
     "test:unit": "bun test",
     "release": "bash scripts/release.sh",
     "prepublishOnly": "rimraf build && tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@opencode-ai/sdk": "^1.18.2",
-    "opencode-ai": "^1.18.2",
+    "@opencode-ai/sdk": "1.18.4",
+    "opencode-ai": "1.18.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "20.14.8",
+    "oxfmt": "^0.60.0",
+    "oxlint": "^1.75.0",
     "rimraf": "3.0.2",
     "typescript": "5.5.4"
   }

package/templates/agents/security.md

@@ -1,6 +1,11 @@
 ---
 description: Security and secrets. Injection, credential or secret leakage, unsafe shell/child-process use, missing validation at trust boundaries.
 alwaysRun: true
+# Security is the highest-stakes agent and benefits most from stronger threat-model
+# reasoning, so it runs on the pro tier even though the other specialists use the
+# default model. Scoped to this one agent to limit the extra latency/rate-limit cost;
+# subdivide-on-timeout + the per-fetch deadline keep a slow pro pass from hanging.
+model: openai/gpt-5.5-pro
 ---
 
 # Security & secrets

package/templates/command.yml

@@ -0,0 +1,167 @@
+name: AI code review (command)
+
+# On-demand, ONE-SHOT reviewer triggered by a PR comment (maintainers only):
+#   /review                        run once now; the router picks the agents
+#   /review all                    run once with every agent
+#   /review correctness security   run once with just those agents
+# This never changes configuration. CONTINUOUS review is configured in
+# expo-code-review.yml (the `pull_request` workflow) via the `review.trigger`
+# policy in .expo-code-review/config.jsonc and the `ai-review:skip` label.
+
+on:
+  issue_comment:
+    types: [created]
+
+# Comment-only: read the repo, write PR comments (issue comments API).
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+env:
+  # Published reviewer run via npx (override with repo variable ECR_VERSION; pin to
+  # a specific version to freeze it). Used for the guard AND the review so the engine
+  # that clears a config is the same engine that then reads it.
+  ECR_VERSION: ${{ vars.ECR_VERSION || 'latest' }}
+
+concurrency:
+  group: ai-code-review-cmd-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  command:
+    # Only PR comments starting with /review, from a maintainer.
+    if: >-
+      github.event.issue.pull_request != null &&
+      startsWith(github.event.comment.body, '/review') &&
+      contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    # Bound the run so a slow/stalled review fails fast rather than hanging. Keep it
+    # above the passes budget (budget.totalPassesMinutes, 55m) + coordinator (10m) +
+    # verification + setup, like the auto-review workflow's cap.
+    timeout-minutes: 90
+    # A reviewer failure must never fail the PR's checks.
+    continue-on-error: true
+    steps:
+      - name: Parse command
+        id: cmd
+        env:
+          # Via env (never inline ${{ }}) so an untrusted comment can't inject shell.
+          COMMENT: ${{ github.event.comment.body }}
+        run: |
+          line=$(printf '%s' "$COMMENT" | head -n1 | tr -d '\r')
+          verb=$(printf '%s' "$line" | awk '{print $1}')
+          rest=$(printf '%s' "$line" | cut -s -d' ' -f2-)
+          # Only /review (one-shot). Continuous review is policy/label-driven, not a
+          # comment; /review no longer changes any configuration.
+          if [ "$verb" != "/review" ]; then
+            echo "run=false" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          # Bare "/review" -> router picks; "all" -> every agent; names -> subset.
+          # Sanitize agent ids to [a-zA-Z0-9,_-] to keep the value shell-safe.
+          agents=""
+          route=false
+          if [ -z "$rest" ]; then
+            route=true
+          elif [ "$rest" != "all" ]; then
+            agents=$(printf '%s' "$rest" | tr ' ' ',' | tr -cd 'a-zA-Z0-9,_-')
+          fi
+          {
+            echo "run=true"
+            echo "agents=$agents"
+            echo "route=$route"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Acknowledge
+        if: steps.cmd.outputs.run == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh api -X POST "repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions" -f content=eyes
+
+      # SECURITY: `issue_comment` is NOT fork-restricted by GitHub — it always
+      # runs in the base-repo context with full secrets and a write-scoped token,
+      # regardless of whether the commented-on PR is from a fork. We check out ONLY
+      # the trusted base ref (the default branch) for the `.expo-code-review/`
+      # config, and never `gh pr checkout` the PR head. The reviewer engine itself
+      # is the PUBLISHED @expo/code-review-cli (fetched by npx), not built from any
+      # checkout, so attacker-controlled PR code never runs here. The diff + PR
+      # metadata come from the API (`gh pr diff`/`gh pr view`).
+      - name: Checkout (base ref only — never the PR head)
+        if: steps.cmd.outputs.run == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Set up Node
+        if: steps.cmd.outputs.run == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          # The reviewer runs via npx and never installs with a package manager, so
+          # disable setup-node's auto package-manager cache (its post step would try
+          # to save an empty cache and error).
+          package-manager-cache: false
+
+      # SECURITY: the base-ref checkout above includes every .expo-code-review/
+      # config.jsonc + routing.jsonc, whose auth.tokenEnv names the env var the CLI
+      # forwards as the model credential. The canonical guard ships with the CLI:
+      # `ecr verify-config` sweeps every config (root + routing + all scopes, referenced
+      # or not) with the engine's real JSONC parser and refuses unless tokenEnv appears
+      # exactly once, in a ROOT-owned file, equal to ECR_EXPECTED_TOKEN_ENV — so a
+      # base-ref config change can't repoint it at another runner secret, sneak in a
+      # JSON-escaped key, or stage an unreferenced scope config with its own auth.
+      # This is layer 2; layer 1 is the runtime ECR_EXPECTED_TOKEN_ENV lock in `ecr ci`.
+      # Runs after Set up Node so the guard runs the SAME $ECR_VERSION `ecr ci` will.
+      - name: Guard config tokenEnv (root + routing + all scopes)
+        if: steps.cmd.outputs.run == 'true'
+        env:
+          # (Comma-separated set for a multi-credential auth.providers config.)
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
+        run: npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr verify-config
+
+      - name: Run AI review
+        if: steps.cmd.outputs.run == 'true'
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Layer-1 auth lock: the CLI refuses to run when the tokenEnv it would honor
+          # differs from this. Keep it in sync with the guard's EXPECTED.
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
+          # OpenAI API key — the env var named by auth.tokenEnv in config.jsonc.
+          # Store it as a repo secret; a project-scoped key restricted to model
+          # inference (with a spend limit) is all the reviewer needs.
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # Optional: override the model for every agent (uses your OpenCode login).
+          REVIEWER_MODEL: ${{ vars.REVIEWER_MODEL }}
+          AGENTS: ${{ steps.cmd.outputs.agents }}
+          ROUTE: ${{ steps.cmd.outputs.route }}
+        # NOTE: running via `issue_comment` makes this a manual /review, which the CLI
+        # detects (GITHUB_EVENT_NAME=issue_comment) and treats as a trigger-gate bypass
+        # — it reviews even when the config trigger policy or an `ai-review:skip` label
+        # would skip the auto workflow. The bypass affects ONLY the trigger gate; the
+        # config guard above, break-glass, and the auth lock still apply.
+        run: |
+          # Array (not a string) so the flags expand as separate argv entries
+          # without unquoted word-splitting. AGENTS is a single sanitized,
+          # space-free comma list, so it stays one element.
+          ARGS=()
+          if [ -n "$AGENTS" ]; then
+            ARGS=(--agents "$AGENTS")
+          elif [ "$ROUTE" = "true" ]; then
+            ARGS=(--route)
+          fi
+          npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr ci "${ARGS[@]}"
+
+      # Same ephemeral per-run log as the pull_request workflow — a /review command
+      # runs the full `ecr ci`, whose .expo-code-review/.runs/ log is gone when the
+      # runner tears down. always() captures it even on error, gated on run=='true'
+      # (a non-/review comment writes no log); issue.number IS the PR number here
+      # (issue_comment context has no pull_request.number).
+      - name: Upload review run log
+        if: always() && steps.cmd.outputs.run == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: review-run-log-pr${{ github.event.issue.number }}
+          path: .expo-code-review/.runs/reviews.jsonl
+          if-no-files-found: ignore
+          retention-days: 14

package/templates/config.jsonc

@@ -1,14 +1,14 @@
 {
   // Default model for every agent. Override per-agent via frontmatter in the
   // agent's markdown, or at runtime with the REVIEWER_MODEL env var
-  // (e.g. REVIEWER_MODEL=openai/gpt-5.4-mini-fast).
-  "model": "anthropic/claude-sonnet-5",
+  // (e.g. REVIEWER_MODEL=openai/gpt-5.4-mini).
+  "model": "openai/gpt-5.5",
 
   // Agents: every markdown file in agents/ is one reviewer (id = filename).
   // Add or remove files to change the roster — no list needed here.
   // shared.md (prepended to every agent + coordinator) and coordinator.md are
   // reserved filenames. Per-agent overrides go in each file's YAML frontmatter,
-  // e.g. `---\nmodel: anthropic/claude-opus-4-1\n---`.
+  // e.g. `---\nmodel: openai/gpt-5.5-pro\n---`.
 
   "policy": {
     // Phase 1: keep signal high by surfacing only critical/warning.
@@ -41,16 +41,29 @@
   // HTML marker used to find + update the single PR comment. Keep it stable.
   "commentTag": "expo-ai-code-reviewer",
 
-  // How model credentials are provided. Default: a Claude Pro/Max subscription.
-  //   "oauth":   tokenEnv holds a Claude Pro/Max OAuth token (from
-  //              `claude setup-token`); it's injected as a bearer credential.
-  //   "api-key": tokenEnv holds a provider API key (sent as x-api-key). If you
-  //              omit `auth`, OpenCode's own login / ANTHROPIC_API_KEY is used.
-  // For OpenAI/GPT or another provider, omit `auth` and set REVIEWER_MODEL after an
-  // `opencode auth login` for that provider.
+  // How model credentials are provided. Default: an OpenAI API key.
+  //   "api-key": tokenEnv names the env var holding a provider API key. In CI,
+  //              store the key as a repo secret and pass it under that env var
+  //              (the scaffolded workflow does). If you omit `auth` entirely,
+  //              OpenCode's own login / ambient provider env vars are used.
+  // For Anthropic/Claude, set provider "anthropic", tokenEnv "ANTHROPIC_API_KEY",
+  // and an anthropic/... model above. For another provider, omit `auth` and set
+  // REVIEWER_MODEL after an `opencode auth login` for that provider.
+  //
+  // MIXED setup (a ChatGPT/Codex subscription for the default models, plus a
+  // metered API key for pro-tier models the subscription doesn't offer): use the
+  // per-provider map instead, reference `openai-api/...` models in the frontmatter
+  // of the agents that need the pro tier, and set ECR_EXPECTED_TOKEN_ENV in the
+  // workflow to the comma-separated set of both env names.
+  //   "auth": { "providers": {
+  //     "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_REFRESH_TOKEN" },
+  //     "openai-api": { "mode": "api-key", "tokenEnv": "OPENAI_API_KEY", "upstream": "openai" }
+  //   } }
+  // (openai oauth: tokenEnv holds the REFRESH token from an `opencode auth login`
+  // ChatGPT sign-in — copy `.openai.refresh` from OpenCode's auth.json.)
   "auth": {
-    "mode": "oauth",
-    "provider": "anthropic",
-    "tokenEnv": "ANTHROPIC_OAUTH_API_KEY"
+    "mode": "api-key",
+    "provider": "openai",
+    "tokenEnv": "OPENAI_API_KEY"
   }
 }

package/templates/coordinator.md

@@ -1,7 +1,9 @@
 ---
-# The coordinator only consolidates text (no repo tools), so a fast, cheap model
-# fits and keeps this serial step from adding latency. Override as you like.
-model: anthropic/claude-haiku-4-5-20251001
+# The coordinator makes the final call — de-duping, re-judging severity, and
+# deciding — so it runs on the pro tier: consolidation quality matters more here
+# than the small serial-tail latency it adds (no repo tools, one bounded pass).
+# Override with a cheaper model if you'd rather trade decision quality for latency.
+model: openai/gpt-5.5-pro
 ---
 
 # Coordinator — consolidation & decision