@expo/code-review-cli 0.3.0 → 0.5.0

package/build/commands/review.js

@@ -1,11 +1,13 @@
-import { loadReviewConfig } from '../config/load.js';
-import { repoRoot, resolveRepo } from '../core/exec.js';
-import { errorMessage } from '../core/util.js';
-import { runReview } from '../core/review.js';
-import { LocalGitSource } from '../sources/local-git.js';
-import { GitHubPRSource } from '../sources/github-pr.js';
-import { TerminalReporter } from '../reporters/terminal.js';
-import { GitHubReporter } from '../reporters/github.js';
+import { loadReviewConfig, loadScopeConfig } from "../config/load.js";
+import { loadRoutingManifest, resolveScopes, scopedCommentTag } from "../config/routing.js";
+import { repoRoot, resolveRepo } from "../core/exec.js";
+import { errorMessage } from "../core/util.js";
+import { runReview } from "../core/review.js";
+import { LocalGitSource } from "../sources/local-git.js";
+import { GitHubPRSource } from "../sources/github-pr.js";
+import { memoizeSource } from "../sources/source.js";
+import { TerminalReporter } from "../reporters/terminal.js";
+import { GitHubReporter } from "../reporters/github.js";
 const USAGE = `ecr review — AI code review, printed to your terminal
 
 Usage:
@@ -28,6 +30,10 @@ Options:
                        to publish.
   --agents <a,b>       run only these agents (comma-separated ids); default: all
   --route              let the router pick relevant agents from the diff
+  --scope <name>       review only this routing scope (needs a routing.jsonc);
+                       runs its config over just that scope's changed files
+  --config-dir <dir>   load config from <dir> instead of .expo-code-review/
+                       (also ECR_CONFIG_DIR); can't combine with --scope
   --json               emit machine-readable JSON on stdout
   --no-fail            always exit 0, even on request-changes
   -h, --help           show this help
@@ -39,7 +45,7 @@ on a PR, \`gh pr checkout <n>\` first, then run a plain \`ecr review\`.
 Exit codes: 0 approve / approve-with-comments, 1 request-changes, 2 error.
 `;
 function requireValue(flag, value) {
-    if (value === undefined || value.startsWith('--')) {
+    if (value === undefined || value.startsWith("--")) {
         throw new Error(`${flag} requires a value`);
     }
     return value;
@@ -56,16 +62,16 @@ function parseArgs(argv) {
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         switch (arg) {
-            case '--base':
+            case "--base":
                 args.base = requireValue(arg, argv[++i]);
                 break;
-            case '--head':
+            case "--head":
                 args.head = requireValue(arg, argv[++i]);
                 break;
-            case '--staged':
+            case "--staged":
                 args.staged = true;
                 break;
-            case '--pr': {
+            case "--pr": {
                 const value = requireValue(arg, argv[++i]);
                 const number = Number(value);
                 if (!Number.isInteger(number) || number <= 0) {
@@ -74,29 +80,35 @@ function parseArgs(argv) {
                 args.pr = number;
                 break;
             }
-            case '--repo':
+            case "--repo":
                 args.repo = requireValue(arg, argv[++i]);
                 break;
-            case '--post':
+            case "--post":
                 args.post = true;
                 break;
-            case '--agents':
+            case "--agents":
                 args.agents = requireValue(arg, argv[++i])
-                    .split(',')
-                    .map(id => id.trim())
+                    .split(",")
+                    .map((id) => id.trim())
                     .filter(Boolean);
                 break;
-            case '--route':
+            case "--route":
                 args.route = true;
                 break;
-            case '--json':
+            case "--scope":
+                args.scope = requireValue(arg, argv[++i]);
+                break;
+            case "--config-dir":
+                args.configDir = requireValue(arg, argv[++i]);
+                break;
+            case "--json":
                 args.json = true;
                 break;
-            case '--no-fail':
+            case "--no-fail":
                 args.noFail = true;
                 break;
-            case '-h':
-            case '--help':
+            case "-h":
+            case "--help":
                 args.help = true;
                 break;
             default:
@@ -134,17 +146,90 @@ export async function reviewCommand(argv) {
         process.chdir(root);
     }
     try {
-        const config = await loadReviewConfig(process.cwd());
         const cwd = process.cwd();
-        const source = args.pr != null
+        const makeSource = () => args.pr != null
             ? new GitHubPRSource({ prNumber: args.pr, repo: args.repo, cwd })
             : new LocalGitSource({ base: args.base, head: args.head, staged: args.staged, cwd });
+        // --scope: load the named scope's config and review only that scope's files.
+        if (args.scope) {
+            // --scope and --config-dir are mutually exclusive (validateArgs), so
+            // args.configDir is undefined here; pass it through for consistency and so
+            // the manifest always resolves from the same dir as the root config.
+            const manifest = await loadRoutingManifest(cwd, { configDir: args.configDir });
+            if (!manifest) {
+                throw new Error("no .expo-code-review/routing.jsonc — --scope requires a routing manifest");
+            }
+            const scopeDef = manifest.scopes.find((scope) => scope.name === args.scope);
+            if (!scopeDef) {
+                throw new Error(`unknown scope "${args.scope}". Known scopes: ${manifest.scopes.map((s) => s.name).join(", ")}`);
+            }
+            const rootConfig = await loadReviewConfig(cwd);
+            const config = await loadScopeConfig(cwd, scopeDef, manifest, rootConfig);
+            const source = memoizeSource(makeSource());
+            try {
+                const changed = await source.getChangedFiles();
+                const resolution = resolveScopes(manifest, changed.map((file) => file.path));
+                const files = resolution.active.find((scope) => scope.name === args.scope)?.files ?? [];
+                if (files.length === 0) {
+                    process.stdout.write(`No changed files in scope ${args.scope}.\n`);
+                    return;
+                }
+                const review = await runReview(source, {
+                    config,
+                    mode: "local",
+                    agents: args.agents,
+                    route: args.route,
+                    includePaths: files,
+                    onProgress: (message) => process.stderr.write(`${message}\n`),
+                });
+                await new TerminalReporter({ json: args.json, noFail: args.noFail }).report(review);
+                if (args.post && args.pr != null) {
+                    const repo = args.repo ?? (await resolveRepo(cwd));
+                    // A scope always posts under the DERIVED marker `<rootTag>:<scope>` —
+                    // from the ROOT config's tag exactly like `ecr ci` does (runRoutedCi
+                    // prefers rootConfig.commentTag over manifest defaults when they
+                    // diverge) — so a standalone scope post and CI's per-scope post/clear/
+                    // reconcile paths always target the same marker, and the bare aggregate
+                    // marker is never used here. (Per-scope commentTag overrides are
+                    // rejected by the scope schema for exactly this reason.)
+                    const tag = scopedCommentTag(rootConfig.commentTag, args.scope);
+                    const reporter = new GitHubReporter({
+                        prNumber: args.pr,
+                        repo,
+                        commentTag: tag,
+                        breakGlassMarker: config.breakGlassMarker,
+                        cwd,
+                    });
+                    // Respect the author's break-glass opt-out, same as the non-scope path.
+                    let breakGlass = false;
+                    try {
+                        breakGlass = await reporter.checkBreakGlass();
+                    }
+                    catch {
+                        breakGlass = false;
+                    }
+                    if (breakGlass) {
+                        process.stderr.write(`\nNot posting: ${config.breakGlassMarker} is set on ${repo}#${args.pr} (break-glass).\n`);
+                    }
+                    else {
+                        await reporter.report(review);
+                        process.stderr.write(`\nPosted scope "${args.scope}" review to ${repo}#${args.pr}.\n`);
+                    }
+                }
+            }
+            finally {
+                await source.dispose();
+            }
+            return;
+        }
+        const config = await loadReviewConfig(cwd, { configDir: args.configDir });
+        const source = makeSource();
         const review = await runReview(source, {
             config,
-            mode: 'local',
+            mode: "local",
             agents: args.agents,
             route: args.route,
-            onProgress: message => process.stderr.write(`${message}\n`),
+            onProgress: (message) => process.stderr.write(`${message}\n`),
         });
         // Always print the result here first.
         await new TerminalReporter({ json: args.json, noFail: args.noFail }).report(review);
@@ -183,15 +268,18 @@ export async function reviewCommand(argv) {
 /** Reject flag combinations that don't make sense together. */
 function validateArgs(args) {
     if (args.pr != null && (args.base || args.head || args.staged)) {
-        throw new Error('--pr reviews a PR by its diff and cannot be combined with --base/--head/--staged.');
+        throw new Error("--pr reviews a PR by its diff and cannot be combined with --base/--head/--staged.");
     }
     if (args.pr == null && (args.repo || args.post)) {
-        throw new Error('--repo/--post only apply together with --pr.');
+        throw new Error("--repo/--post only apply together with --pr.");
     }
     // --staged diffs the index against HEAD, so --base/--head have no effect. Reject
     // the combination rather than silently ignoring the range the user asked for.
     if (args.staged && (args.base || args.head)) {
-        throw new Error('--staged reviews the staged changes (index vs HEAD) and cannot be combined with --base/--head.');
+        throw new Error("--staged reviews the staged changes (index vs HEAD) and cannot be combined with --base/--head.");
+    }
+    if (args.scope && args.configDir) {
+        throw new Error("--scope and --config-dir are mutually exclusive.");
     }
 }
 /** Resolve owner/repo from the current checkout via gh (for --post). */

package/build/commands/verify-config.js

@@ -0,0 +1,252 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { CONFIG_DIRNAME, stripJsonComments, stripTrailingCommas } from "../config/load.js";
+import { ROUTING_FILENAME } from "../config/routing.js";
+import { repoRoot } from "../core/exec.js";
+import { errorMessage } from "../core/util.js";
+const USAGE = `ecr verify-config — refuse to run when a checked-out config could redirect the model credential
+
+Usage:
+  ecr verify-config [--expected <ENV_NAME>] [--json]
+
+The canonical pre-review guard (ships with the CLI). It sweeps EVERY
+.expo-code-review/config.jsonc|config.json and routing.jsonc in the repo via a
+plain recursive walk (skipping node_modules/.git, so a staged-but-unreferenced
+config can't hide from git's index), parses each with the real comment-aware JSONC
+parser (never regex-scraping), and refuses to run (exit 1) when:
+  • a tokenEnv (auth.tokenEnv, or any auth.providers.<id>.tokenEnv; routing.jsonc:
+    same under defaults.auth) appears in a non-root file, in more than one root
+    file, twice under the same name, or — with --expected / ECR_EXPECTED_TOKEN_ENV
+    set (comma-separated) — the declared set differs from the expected set;
+  • a non-root config declares auth, breakGlass, or commentTag (root-locked keys);
+  • any file fails to parse (fail-closed), reporting the parse error.
+Exit 0 = safe to run the review.
+
+Options:
+  --expected <ENVS>       Require the declared tokenEnv set to equal this
+                          comma-separated set (else ECR_EXPECTED_TOKEN_ENV).
+  --json                  Emit {ok, findings:[{file, problem}]} on stdout.
+`;
+const CONFIG_FILENAMES = new Set(["config.jsonc", "config.json", ROUTING_FILENAME]);
+/**
+ * Discover every config the CLI could ever read via a plain recursive walk (not
+ * `git ls-files`): a PR can't hide an unreferenced/untracked config dir from an
+ * on-disk sweep the way it could from git's index. Skips node_modules and .git.
+ */
+async function discoverConfigFiles(root) {
+    const found = [];
+    async function walk(dir) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable dir — nothing to sweep here
+        }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (entry.name === "node_modules" || entry.name === ".git") {
+                    continue;
+                }
+                await walk(path.join(dir, entry.name));
+            }
+            else if (entry.isFile() &&
+                path.basename(dir) === CONFIG_DIRNAME &&
+                CONFIG_FILENAMES.has(entry.name)) {
+                found.push(path.join(dir, entry.name));
+            }
+        }
+    }
+    await walk(root);
+    return found.sort();
+}
+function asObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Every tokenEnv an auth block names — legacy single, or one per providers entry. */
+function collectTokenEnvs(auth) {
+    if (!auth) {
+        return [];
+    }
+    const found = [];
+    if (typeof auth.tokenEnv === "string") {
+        found.push(auth.tokenEnv);
+    }
+    const providers = asObject(auth.providers);
+    for (const entry of Object.values(providers ?? {})) {
+        const tokenEnv = asObject(entry)?.tokenEnv;
+        if (typeof tokenEnv === "string") {
+            found.push(tokenEnv);
+        }
+    }
+    return found;
+}
+/** Read the security-relevant declarations from a parsed config/routing object. */
+function extractFacts(file, parsed) {
+    if (path.basename(file) === ROUTING_FILENAME) {
+        // routing.jsonc locks auth under defaults.auth (defaults.auth.tokenEnv).
+        const defaults = asObject(parsed.defaults);
+        return {
+            tokenEnvs: collectTokenEnvs(asObject(defaults?.auth)),
+            declaresAuth: Boolean(defaults) && "auth" in defaults,
+            declaresBreakGlass: false, // routing.jsonc has no breakGlass concept
+            declaresCommentTag: Boolean(defaults) && "commentTag" in defaults,
+        };
+    }
+    return {
+        tokenEnvs: collectTokenEnvs(asObject(parsed.auth)),
+        declaresAuth: "auth" in parsed,
+        declaresBreakGlass: "breakGlass" in parsed,
+        declaresCommentTag: "commentTag" in parsed,
+    };
+}
+/**
+ * Verify every discoverable config is safe to run a review against. Fail-closed:
+ * any parse error, any tokenEnv anomaly, or any root-locked key in a non-root
+ * config is a finding. Never trusts the routing manifest — an unreferenced staged
+ * config dir is swept the same as a referenced one.
+ */
+export async function verifyConfig(root, options = {}) {
+    const findings = [];
+    const rootConfigDir = path.join(root, CONFIG_DIRNAME);
+    const rel = (file) => path.relative(root, file) || path.basename(file);
+    const files = await discoverConfigFiles(root);
+    const tokenEnvOccurrences = [];
+    for (const file of files) {
+        const isRoot = path.dirname(file) === rootConfigDir;
+        let parsed;
+        try {
+            const raw = await readFile(file, "utf8");
+            parsed = JSON.parse(stripTrailingCommas(stripJsonComments(raw)));
+        }
+        catch (error) {
+            findings.push({ file: rel(file), problem: `failed to parse: ${errorMessage(error)}` });
+            continue;
+        }
+        const object = asObject(parsed);
+        if (!object) {
+            findings.push({ file: rel(file), problem: "config is not a JSON object" });
+            continue;
+        }
+        const facts = extractFacts(file, object);
+        for (const value of facts.tokenEnvs) {
+            tokenEnvOccurrences.push({ file: rel(file), value, isRoot });
+        }
+        if (!isRoot) {
+            const locked = [];
+            if (facts.declaresAuth) {
+                locked.push("auth");
+            }
+            if (facts.declaresBreakGlass) {
+                locked.push("breakGlass");
+            }
+            if (facts.declaresCommentTag) {
+                locked.push("commentTag");
+            }
+            if (locked.length > 0) {
+                findings.push({
+                    file: rel(file),
+                    problem: `non-root config declares ${locked.join(", ")} — root-locked; only the root .expo-code-review config may set ${locked.length > 1 ? "them" : "it"}`,
+                });
+            }
+        }
+    }
+    // tokenEnvs may only be declared in root-owned files…
+    for (const occurrence of tokenEnvOccurrences.filter((o) => !o.isRoot)) {
+        findings.push({
+            file: occurrence.file,
+            problem: `tokenEnv "${occurrence.value}" is declared outside the root config; only a root-owned config.jsonc/config.json or routing.jsonc may name the forwarded credential`,
+        });
+    }
+    // …and all in ONE root file (multiple entries in one auth block are fine —
+    // that's the multi-provider map — but split across files there is no single
+    // honored source and a stale/staged second file could smuggle a credential).
+    const rootOccurrences = tokenEnvOccurrences.filter((o) => o.isRoot);
+    const rootFiles = [...new Set(rootOccurrences.map((o) => o.file))];
+    if (rootFiles.length > 1) {
+        findings.push({
+            file: rootFiles.join(", "),
+            problem: `tokenEnv is declared in ${rootFiles.length} root files; all credential env names must live in ONE root-owned config`,
+        });
+    }
+    // Duplicate names within a file are a config bug worth failing on too: two auth
+    // entries forwarding the same env var means one of them is misconfigured.
+    const seen = new Set();
+    for (const occurrence of rootOccurrences) {
+        if (seen.has(occurrence.value)) {
+            findings.push({
+                file: occurrence.file,
+                problem: `tokenEnv "${occurrence.value}" is declared more than once; each credential env name must appear exactly once`,
+            });
+        }
+        seen.add(occurrence.value);
+    }
+    // With an expectation set, the declared names must equal the expected SET
+    // exactly (comma-separated; order-insensitive). A missing name is as much a
+    // finding as an extra one — a PR must not add, drop, or repoint credentials.
+    const expected = options.expected;
+    if (expected) {
+        const expectedSet = expected
+            .split(",")
+            .map((name) => name.trim())
+            .filter(Boolean)
+            .sort();
+        const declared = [...seen].sort();
+        if (declared.length === 0) {
+            findings.push({
+                file: path.join(CONFIG_DIRNAME, "config.jsonc"),
+                problem: `no tokenEnv found, but expected "${expectedSet.join(", ")}" — the root-owned config must name exactly those credential env(s)`,
+            });
+        }
+        else if (JSON.stringify(declared) !== JSON.stringify(expectedSet)) {
+            findings.push({
+                file: rootFiles.join(", ") || path.join(CONFIG_DIRNAME, "config.jsonc"),
+                problem: `declared tokenEnv set [${declared.join(", ")}] != expected [${expectedSet.join(", ")}] — a PR must not add, drop, or repoint which secrets are forwarded to model providers`,
+            });
+        }
+    }
+    return { ok: findings.length === 0, findings };
+}
+/** CLI wrapper: parse flags, run the sweep, print, and set the exit code. */
+export async function verifyConfigCommand(argv = []) {
+    if (argv.includes("-h") || argv.includes("--help")) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const json = argv.includes("--json");
+    let expected = process.env.ECR_EXPECTED_TOKEN_ENV || undefined;
+    const expectedIdx = argv.indexOf("--expected");
+    if (expectedIdx >= 0) {
+        const value = argv[expectedIdx + 1];
+        if (!value || value.startsWith("-")) {
+            process.stderr.write("--expected requires a value (the env var name)\n");
+            process.exitCode = 2;
+            return;
+        }
+        expected = value;
+    }
+    const root = (await repoRoot()) ?? process.cwd();
+    const result = await verifyConfig(root, { expected });
+    // The sweep is deliberately repo-wide (a security check, not a config loader), so
+    // it is unaffected by ECR_CONFIG_DIR. But when the override is set, the root the
+    // loaders actually honor may not be ./.expo-code-review — note that so the two
+    // don't look inconsistent in a job log. JSON output stays machine-clean.
+    if (!json && process.env.ECR_CONFIG_DIR) {
+        process.stderr.write(`  ℹ ECR_CONFIG_DIR is set (${process.env.ECR_CONFIG_DIR}); the honored root config may differ from ./${CONFIG_DIRNAME}. This sweep still scans the ENTIRE repo (unchanged).\n`);
+    }
+    if (json) {
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+    }
+    else if (result.ok) {
+        process.stdout.write(`verify-config: OK — ${expected ? `tokenEnv locked to "${expected}"` : "no tokenEnv anomalies"}; no non-root config declares root-locked keys.\n`);
+    }
+    else {
+        for (const finding of result.findings) {
+            process.stderr.write(`::error::${finding.problem} (${finding.file})\n`);
+        }
+        process.stderr.write(`verify-config: refusing to run — ${result.findings.length} problem(s) above.\n`);
+    }
+    process.exitCode = result.ok ? 0 : 1;
+}