@expo/code-review-cli 0.3.0 → 0.5.0

package/build/config/load.js

@@ -1,34 +1,67 @@
-import { readdir, readFile } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-import { ReviewConfigSchema } from './schema.js';
-import { toolMap } from '../core/tools.js';
-export const CONFIG_DIRNAME = '.expo-code-review';
+import { readdir, readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { ReviewConfigSchema, ScopeReviewConfigSchema } from "./schema.js";
+import { toolMap } from "../core/tools.js";
+export const CONFIG_DIRNAME = ".expo-code-review";
 /** Default OpenCode tool toggles for a reviewer: read the repo, never mutate it. */
-const DEFAULT_AGENT_TOOLS = toolMap(['read', 'grep', 'glob', 'list']);
+const DEFAULT_AGENT_TOOLS = toolMap(["read", "grep", "glob", "list"]);
 export function configDirFor(repoRoot) {
     return path.join(repoRoot, CONFIG_DIRNAME);
 }
-export function hasConfig(repoRoot) {
-    const dir = configDirFor(repoRoot);
-    return existsSync(path.join(dir, 'config.jsonc')) || existsSync(path.join(dir, 'config.json'));
+/**
+ * Resolve the config directory: an explicit override (absolute or repo-relative)
+ * → the ECR_CONFIG_DIR env var → the repo's default `.expo-code-review/`. This is
+ * the escape hatch (graft 1); with neither override present the result is exactly
+ * `configDirFor(repoRoot)`, so the default behavior is byte-identical.
+ */
+export function resolveConfigDir(repoRoot, override) {
+    const chosen = override ?? process.env.ECR_CONFIG_DIR;
+    if (chosen) {
+        return path.isAbsolute(chosen) ? chosen : path.join(repoRoot, chosen);
+    }
+    return path.join(repoRoot, CONFIG_DIRNAME);
+}
+export function hasConfig(repoRoot, options = {}) {
+    // Resolve the same way loadReviewConfig does (incl. the ECR_CONFIG_DIR escape
+    // hatch) so doctor's "no config" diagnostic never disagrees with the loader.
+    const dir = resolveConfigDir(repoRoot, options.configDir);
+    return existsSync(path.join(dir, "config.jsonc")) || existsSync(path.join(dir, "config.json"));
 }
 /**
  * Discover and fully resolve a repo's review config from `.expo-code-review/`:
  * parse config.jsonc, read every prompt file, and resolve models (with an
  * optional REVIEWER_MODEL env override applied to all agents + the coordinator).
  */
-export async function loadReviewConfig(repoRoot) {
-    const dir = configDirFor(repoRoot);
-    const configPath = ['config.jsonc', 'config.json']
-        .map(name => path.join(dir, name))
-        .find(candidate => existsSync(candidate));
+export async function loadReviewConfig(repoRoot, options = {}) {
+    const dir = resolveConfigDir(repoRoot, options.configDir);
+    return (await loadConfigDir(dir, ReviewConfigSchema)).config;
+}
+/**
+ * The shared per-directory loader: parse config.jsonc, read every prompt file,
+ * resolve models. Root and scope loading share this one code path — the schema
+ * argument controls whether the centrally-locked keys (auth/breakGlass) are
+ * accepted (root) or rejected at the Zod level (scope). `loadReviewConfig` with
+ * `ReviewConfigSchema` produces identical output for identical input.
+ */
+async function loadConfigDir(dir, schema) {
+    const configPath = ["config.jsonc", "config.json"]
+        .map((name) => path.join(dir, name))
+        .find((candidate) => existsSync(candidate));
     if (!configPath) {
-        throw new Error(`No ${CONFIG_DIRNAME}/config.jsonc found in ${repoRoot}. Run \`ecr init\` to scaffold one.`);
+        throw new Error(`No ${CONFIG_DIRNAME}/config.jsonc found in ${path.dirname(dir)}. Run \`ecr init\` to scaffold one.`);
     }
-    const raw = await readFile(configPath, 'utf8');
-    const parsed = ReviewConfigSchema.parse(JSON.parse(stripTrailingCommas(stripJsonComments(raw))));
-    const override = process.env.REVIEWER_MODEL;
+    const raw = await readFile(configPath, "utf8");
+    const rawObject = JSON.parse(stripTrailingCommas(stripJsonComments(raw)));
+    const parsed = schema.parse(rawObject);
+    // An EMPTY REVIEWER_MODEL means "not set", not "use the empty model". GitHub Actions
+    // passes `${{ vars.REVIEWER_MODEL }}` as an empty string whenever that repo variable
+    // doesn't exist — which both scaffolded workflows do — so `??` (which only falls
+    // through on null/undefined) silently replaced every configured model with "". Every
+    // agent and the coordinator then ran on whatever OpenCode picked by default, so a
+    // config saying `anthropic/claude-sonnet-5` reviewed with something else entirely and
+    // nothing anywhere said so. Trim too: a stray newline is the same class of accident.
+    const override = process.env.REVIEWER_MODEL?.trim() || undefined;
     const defaultModel = override ?? parsed.model;
     const resolveModel = (frontmatterModel) => override ?? frontmatterModel ?? defaultModel;
     const resolveTemp = (value, fallback) => {
@@ -36,39 +69,39 @@ export async function loadReviewConfig(repoRoot) {
         return Number.isFinite(n) ? n : fallback;
     };
     // shared.md is optional; the coordinator is required.
-    const sharedPath = path.join(dir, 'shared.md');
+    const sharedPath = path.join(dir, "shared.md");
     const sharedPromptText = existsSync(sharedPath)
-        ? parseFrontmatter(await readFile(sharedPath, 'utf8')).body
-        : '';
-    const coordinatorPath = path.join(dir, 'coordinator.md');
+        ? parseFrontmatter(await readFile(sharedPath, "utf8")).body
+        : "";
+    const coordinatorPath = path.join(dir, "coordinator.md");
     if (!existsSync(coordinatorPath)) {
         throw new Error(`Missing ${CONFIG_DIRNAME}/coordinator.md`);
     }
-    const coordinatorMd = parseFrontmatter(await readFile(coordinatorPath, 'utf8'));
+    const coordinatorMd = parseFrontmatter(await readFile(coordinatorPath, "utf8"));
     // Every markdown file in agents/ is a reviewer agent (id = filename).
-    const agentsDir = path.join(dir, 'agents');
+    const agentsDir = path.join(dir, "agents");
     if (!existsSync(agentsDir)) {
         throw new Error(`Missing ${CONFIG_DIRNAME}/agents/ directory. Run \`ecr init\`.`);
     }
-    const agentFiles = (await readdir(agentsDir)).filter(name => name.endsWith('.md')).sort();
+    const agentFiles = (await readdir(agentsDir)).filter((name) => name.endsWith(".md")).sort();
     if (agentFiles.length === 0) {
         throw new Error(`No agent markdown files in ${CONFIG_DIRNAME}/agents/.`);
     }
     const agents = [];
     for (const file of agentFiles) {
-        const md = parseFrontmatter(await readFile(path.join(agentsDir, file), 'utf8'));
-        const id = file.replace(/\.md$/, '');
+        const md = parseFrontmatter(await readFile(path.join(agentsDir, file), "utf8"));
+        const id = file.replace(/\.md$/, "");
         agents.push({
             id,
-            description: md.data.description ?? '',
-            alwaysRun: /^(true|yes|1)$/i.test(md.data.alwaysRun ?? ''),
+            description: md.data.description ?? "",
+            alwaysRun: /^(true|yes|1)$/i.test(md.data.alwaysRun ?? ""),
             model: resolveModel(md.data.model),
             temperature: resolveTemp(md.data.temperature, 0.1),
             tools: DEFAULT_AGENT_TOOLS,
             promptText: md.body,
         });
     }
-    return {
+    const config = {
         configDir: dir,
         sharedPromptText,
         agents,
@@ -80,15 +113,127 @@ export async function loadReviewConfig(repoRoot) {
         policy: parsed.policy,
         chunk: parsed.chunk,
         noise: parsed.noise,
-        breakGlassMarker: parsed.breakGlass.marker,
-        commentTag: parsed.commentTag,
-        auth: {
-            mode: parsed.auth.mode,
-            provider: parsed.auth.provider,
-            tokenEnv: parsed.auth.tokenEnv,
-        },
+        // parsed.breakGlass/auth are always present for the root schema (defaults) and
+        // absent for the scope schema; loadScopeConfig overrides both afterwards.
+        breakGlassMarker: parsed.breakGlass?.marker ?? "/skip-review",
+        // Scope configs can't declare commentTag (scope schema rejects it);
+        // loadScopeConfig overwrites this placeholder with the manifest default.
+        commentTag: parsed.commentTag ?? "expo-ai-code-reviewer",
+        auth: normalizeAuth(parsed.auth),
         review: parsed.review,
     };
+    return { config, raw: rawObject };
+}
+/**
+ * Normalize either accepted `auth` shape (legacy single object, or the
+ * per-provider `{ providers }` map) into the canonical entry list. Absent auth
+ * means the schema default (api-key/openai, no tokenEnv).
+ */
+export function normalizeAuth(auth) {
+    if (!auth) {
+        return [{ provider: "openai", mode: "api-key" }];
+    }
+    if ("providers" in auth) {
+        return Object.entries(auth.providers).map(([provider, entry]) => ({
+            provider,
+            mode: entry.mode,
+            tokenEnv: entry.tokenEnv,
+            upstream: entry.upstream,
+        }));
+    }
+    return [{ provider: auth.provider, mode: auth.mode, tokenEnv: auth.tokenEnv }];
+}
+/**
+ * Runtime auth lock: null when the entries' tokenEnv names equal the expected
+ * comma-separated set exactly (order-insensitive), else a human-readable
+ * mismatch. Set semantics because a multi-provider auth block names several
+ * credential envs — a PR must not be able to add, drop, or repoint any of them.
+ */
+export function tokenEnvMismatch(auth, expected) {
+    const declared = [
+        ...new Set(auth.map((entry) => entry.tokenEnv).filter((v) => Boolean(v))),
+    ].sort();
+    const expectedSet = [
+        ...new Set(expected
+            .split(",")
+            .map((name) => name.trim())
+            .filter(Boolean)),
+    ].sort();
+    if (JSON.stringify(declared) === JSON.stringify(expectedSet)) {
+        return null;
+    }
+    return `configured tokenEnv set [${declared.join(", ") || "(none)"}] != ECR_EXPECTED_TOKEN_ENV [${expectedSet.join(", ")}]`;
+}
+/**
+ * auth is honored ONLY here: the manifest's `defaults.auth` wins when present,
+ * otherwise the root config.jsonc auth. A scope config can never contribute auth
+ * (the scope schema rejects it), so the secret-forwarding surface stays a single,
+ * root-owned value no matter how many scopes exist.
+ */
+export function loadAuthFromRoot(rootConfig, manifest) {
+    const override = manifest?.defaults.auth;
+    if (override) {
+        return normalizeAuth(override);
+    }
+    return rootConfig.auth;
+}
+/**
+ * Load one scope's fully-resolved config. The default scope (config '.') reuses
+ * the root config unchanged except auth; a nested scope reads its own
+ * `.expo-code-review/` via the scope schema (auth/breakGlass rejected by Zod).
+ * auth and breakGlass always come from the root; `defaults.enforceAgents` are
+ * injected with alwaysRun and win any same-id agent in the scope roster (risk 11).
+ */
+export async function loadScopeConfig(root, scope, manifest, rootConfig) {
+    let base;
+    let commentTag;
+    if (scope.config === ".") {
+        base = rootConfig;
+        // The default scope keeps the ROOT comment marker so the existing single
+        // comment (and its dismissal state) upserts in place, not duplicated (risk 8).
+        commentTag = rootConfig.commentTag;
+    }
+    else {
+        // Defense in depth behind the schema's traversal refinement: never read a
+        // scope config from outside the repo checkout (scope.config is PR-controllable).
+        const resolvedRoot = path.resolve(root);
+        const resolvedScope = path.resolve(root, scope.config);
+        if (resolvedScope !== resolvedRoot && !resolvedScope.startsWith(resolvedRoot + path.sep)) {
+            throw new Error(`scope "${scope.name}": config "${scope.config}" resolves outside the repo checkout`);
+        }
+        const dir = path.join(root, scope.config, CONFIG_DIRNAME);
+        const { config } = await loadConfigDir(dir, ScopeReviewConfigSchema);
+        base = config;
+        // Non-default scopes never carry their own marker (the scope schema rejects
+        // commentTag): ci derives `<rootTag>:<scope>` for per-scope comments, so the
+        // loaded value here is only the manifest default, for display/doctor.
+        commentTag = manifest.defaults.commentTag;
+    }
+    // Inject the enforced agents from the ROOT roster with alwaysRun, replacing any
+    // same-id agent the scope defines (the enforced one wins — risk 11).
+    const agents = base.agents.map((agent) => ({ ...agent }));
+    for (const id of manifest.defaults.enforceAgents) {
+        const rootAgent = rootConfig.agents.find((agent) => agent.id === id);
+        if (!rootAgent) {
+            throw new Error(`defaults.enforceAgents lists "${id}", but the root roster has no agent with that id.`);
+        }
+        const enforced = { ...rootAgent, alwaysRun: true };
+        const index = agents.findIndex((agent) => agent.id === id);
+        if (index >= 0) {
+            agents[index] = enforced;
+        }
+        else {
+            agents.push(enforced);
+        }
+    }
+    return {
+        ...base,
+        agents,
+        auth: loadAuthFromRoot(rootConfig, manifest),
+        breakGlassMarker: rootConfig.breakGlassMarker,
+        commentTag,
+        scopeName: scope.name,
+    };
 }
 /**
  * Parse optional YAML-ish frontmatter (simple `key: value` scalars) from the top
@@ -96,20 +241,20 @@ export async function loadReviewConfig(repoRoot) {
  * stripped. Supports per-agent overrides like `model:` and `temperature:`.
  */
 export function parseFrontmatter(md) {
-    if (!md.startsWith('---')) {
+    if (!md.startsWith("---")) {
         return { data: {}, body: md };
     }
-    const end = md.indexOf('\n---', 3);
+    const end = md.indexOf("\n---", 3);
     if (end === -1) {
         return { data: {}, body: md };
     }
     const header = md.slice(3, end).trim();
-    const body = md.slice(end + 4).replace(/^\r?\n/, '');
+    const body = md.slice(end + 4).replace(/^\r?\n/, "");
     const data = {};
-    for (const line of header.split('\n')) {
+    for (const line of header.split("\n")) {
         const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
         if (match) {
-            data[match[1]] = match[2].trim().replace(/^["']|["']$/g, '');
+            data[match[1]] = match[2].trim().replace(/^["']|["']$/g, "");
         }
     }
     return { data, body };
@@ -119,7 +264,7 @@ export function parseFrontmatter(md) {
  * string literals. The config is trusted (in-repo), so a light scanner suffices.
  */
 export function stripJsonComments(input) {
-    let out = '';
+    let out = "";
     let inString = false;
     let inLine = false;
     let inBlock = false;
@@ -127,14 +272,14 @@ export function stripJsonComments(input) {
         const char = input[i];
         const next = input[i + 1];
         if (inLine) {
-            if (char === '\n') {
+            if (char === "\n") {
                 inLine = false;
                 out += char;
             }
             continue;
         }
         if (inBlock) {
-            if (char === '*' && next === '/') {
+            if (char === "*" && next === "/") {
                 inBlock = false;
                 i++;
             }
@@ -142,8 +287,8 @@ export function stripJsonComments(input) {
         }
         if (inString) {
             out += char;
-            if (char === '\\') {
-                out += input[i + 1] ?? '';
+            if (char === "\\") {
+                out += input[i + 1] ?? "";
                 i++;
             }
             else if (char === '"') {
@@ -155,11 +300,11 @@ export function stripJsonComments(input) {
             inString = true;
             out += char;
         }
-        else if (char === '/' && next === '/') {
+        else if (char === "/" && next === "/") {
             inLine = true;
             i++;
         }
-        else if (char === '/' && next === '*') {
+        else if (char === "/" && next === "*") {
             inBlock = true;
             i++;
         }
@@ -171,14 +316,14 @@ export function stripJsonComments(input) {
 }
 /** Remove trailing commas before `}`/`]` (JSONC), ignoring string contents. */
 export function stripTrailingCommas(input) {
-    let out = '';
+    let out = "";
     let inString = false;
     for (let i = 0; i < input.length; i++) {
         const char = input[i];
         if (inString) {
             out += char;
-            if (char === '\\') {
-                out += input[i + 1] ?? '';
+            if (char === "\\") {
+                out += input[i + 1] ?? "";
                 i++;
             }
             else if (char === '"') {
@@ -191,12 +336,12 @@ export function stripTrailingCommas(input) {
             out += char;
             continue;
         }
-        if (char === ',') {
+        if (char === ",") {
             let j = i + 1;
             while (j < input.length && /\s/.test(input[j])) {
                 j++;
             }
-            if (input[j] === '}' || input[j] === ']') {
+            if (input[j] === "}" || input[j] === "]") {
                 continue; // drop the trailing comma
             }
         }

package/build/config/routing.js

@@ -0,0 +1,122 @@
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { RoutingManifestSchema } from "./schema.js";
+import { resolveConfigDir, stripJsonComments, stripTrailingCommas } from "./load.js";
+import { matchesIgnore } from "../core/noise.js";
+export const ROUTING_FILENAME = "routing.jsonc";
+/**
+ * Parse the routing manifest. It lives in the SAME resolved root config dir as
+ * config.jsonc (`resolveConfigDir` — the `--config-dir`/`ECR_CONFIG_DIR` escape
+ * hatch): the override designates an alternate ROOT config dir, so config.jsonc
+ * and routing.jsonc always travel together and never split across the override
+ * and the default tree. With no override the dir is `<root>/.expo-code-review`,
+ * byte-identical to the pre-escape-hatch path. Absent file => null (backcompat).
+ * Scope `config` paths stay repo-root-relative (see `loadScopeConfig`): an
+ * override relocates only the ROOT artifacts, never the scopes' own subtrees.
+ */
+export async function loadRoutingManifest(root, options = {}) {
+    const manifestPath = path.join(resolveConfigDir(root, options.configDir), ROUTING_FILENAME);
+    if (!existsSync(manifestPath)) {
+        return null;
+    }
+    const raw = await readFile(manifestPath, "utf8");
+    // Let schema/JSON errors throw — a malformed manifest must be a loud error,
+    // never a silent fallback to single-scope behavior.
+    return RoutingManifestSchema.parse(JSON.parse(stripTrailingCommas(stripJsonComments(raw))));
+}
+// The repo's minimal glob translates `**` to `.*`, so a leading double-star + slash
+// requires at least one slash in the path — which would make the documented catch-all
+// silently miss root-level files (README.md, package.json). To give the double-star +
+// slash its conventional "zero or more directories" meaning, we also test the variant
+// with each such prefix removed, so the catch-all matches both `a.ts` and `src/b.ts`.
+function patternVariants(pattern) {
+    const collapsed = pattern.replace(/\*\*\//g, "");
+    return collapsed !== pattern && collapsed.length > 0 ? [pattern, collapsed] : [pattern];
+}
+/** Does any of the scope's globs match this file? */
+function scopeMatches(paths, file) {
+    return paths.some((pattern) => patternVariants(pattern).some((variant) => matchesIgnore(file, variant)));
+}
+/**
+ * Assign each changed file to exactly one scope: test the file against every
+ * scope's paths in ARRAY ORDER; the LAST matching scope wins. Glob matching via
+ * matchesIgnore (supports ** across / and * within a segment — the manifest
+ * documents this dialect). Deterministic, no filesystem access.
+ */
+export function resolveScopes(manifest, changedFiles) {
+    const buckets = new Map();
+    const unmatched = [];
+    const overlaps = [];
+    for (const file of changedFiles) {
+        const matched = [];
+        for (const scope of manifest.scopes) {
+            if (scopeMatches(scope.paths, file)) {
+                matched.push(scope.name);
+            }
+        }
+        if (matched.length === 0) {
+            unmatched.push(file);
+            continue;
+        }
+        const winner = matched[matched.length - 1];
+        (buckets.get(winner) ?? buckets.set(winner, []).get(winner)).push(file);
+        if (matched.length > 1) {
+            overlaps.push({ file, matched, winner });
+        }
+    }
+    const active = [];
+    for (const scope of manifest.scopes) {
+        const files = buckets.get(scope.name);
+        if (files && files.length > 0) {
+            active.push({ name: scope.name, configDir: scope.config, files });
+        }
+    }
+    return { active, unmatched, overlaps };
+}
+/** Scoped comment tag: `${defaults.commentTag}:${scope.name}` (distinct full marker). */
+export function scopedCommentTag(rootTag, scopeName) {
+    return `${rootTag}:${scopeName}`;
+}
+/**
+ * Divide the total passes budget across N active scopes, which run SEQUENTIALLY
+ * in one `ecr ci` process. Even split = `floor(total / active)`, clamped up to
+ * `min` so a scope always gets a workable window. When that clamp wins (the even
+ * split fell below `min`), the floor is kept — a scope below `min` isn't worth
+ * starting — and `overshoot` flags that the run will exceed the total budget so
+ * the caller can warn. Pure so the math is unit-testable.
+ */
+export function scopePassesBudgetMs(totalMs, minMs, activeCount) {
+    const count = Math.max(1, activeCount);
+    const evenSplit = Math.floor(totalMs / count);
+    const perScopeMs = Math.max(minMs, evenSplit);
+    return { perScopeMs, overshoot: count * perScopeMs > totalMs };
+}
+/**
+ * Owner table for doctor/CI logs (graft 4): one row per file —
+ * `file  →  winning scope (also matched: a, b)`. Returns printable lines,
+ * capped at `limit` rows with a "+N more" tail.
+ */
+export function formatOwnerTable(resolution, limit = 40) {
+    const rows = [];
+    const overlapByFile = new Map(resolution.overlaps.map((o) => [o.file, o]));
+    for (const scope of resolution.active) {
+        for (const file of scope.files) {
+            const overlap = overlapByFile.get(file);
+            const also = overlap ? overlap.matched.filter((name) => name !== scope.name) : [];
+            rows.push({ file, scope: scope.name, also });
+        }
+    }
+    for (const file of resolution.unmatched) {
+        rows.push({ file, scope: "(none)", also: [] });
+    }
+    const lines = [];
+    for (const row of rows.slice(0, limit)) {
+        const suffix = row.also.length > 0 ? `  (also matched: ${row.also.join(", ")})` : "";
+        lines.push(`  ${row.file}  →  ${row.scope}${suffix}`);
+    }
+    if (rows.length > limit) {
+        lines.push(`  …and ${rows.length - limit} more`);
+    }
+    return lines;
+}