@expo/code-review-cli 0.3.0 → 0.5.0

package/build/config/schema.js

@@ -1,8 +1,9 @@
-import { z } from 'zod';
+import path from "node:path";
+import { z } from "zod";
 export const ReviewConfigSchema = z.object({
     /** Default model for every agent + the coordinator. Override per-agent via
      * frontmatter in the agent's markdown, or globally via REVIEWER_MODEL. */
-    model: z.string().default('anthropic/claude-sonnet-5'),
+    model: z.string().default("openai/gpt-5.5"),
     policy: z
         .object({
         includeSuggestions: z.boolean().default(false),
@@ -48,20 +49,48 @@ export const ReviewConfigSchema = z.object({
     })
         .default({ additionalIgnores: [], additionalMarkers: [] }),
     breakGlass: z
-        .object({ marker: z.string().default('/skip-review') })
-        .default({ marker: '/skip-review' }),
-    commentTag: z.string().default('expo-ai-code-reviewer'),
+        .object({ marker: z.string().default("/skip-review") })
+        .default({ marker: "/skip-review" }),
+    commentTag: z.string().default("expo-ai-code-reviewer"),
+    // Two accepted shapes (see AuthConfigEntry for the canonical internal form):
+    //  - legacy single credential: { mode, provider, tokenEnv }
+    //  - per-provider map:         { providers: { <id>: { mode, tokenEnv, upstream? } } }
+    // The map form allows a MIXED setup — e.g. the "openai" provider on a ChatGPT/Codex
+    // subscription (mode "oauth", tokenEnv = the refresh token) plus an "openai-api"
+    // alias (upstream "openai") holding a metered API key for pro-tier models the
+    // subscription doesn't offer.
+    //
+    // Union order matters: the map form must be tried FIRST — the legacy object's keys
+    // all have defaults, so a non-strict legacy parse would accept (and gut) a
+    // { providers } object by stripping the unknown key.
     auth: z
-        .object({
-        // "api-key": the token env is sent as the provider's API key (x-api-key).
-        // "oauth": the token env is a Claude Pro/Max style OAuth token, injected
-        // into an isolated OpenCode auth.json so it's sent as a Bearer token.
-        mode: z.enum(['api-key', 'oauth']).default('api-key'),
-        provider: z.string().default('anthropic'),
-        /** Env var holding the key/token. */
-        tokenEnv: z.string().optional(),
-    })
-        .default({ mode: 'api-key', provider: 'anthropic' }),
+        .union([
+        z.object({
+            providers: z.record(z.string(), z.object({
+                // "api-key": tokenEnv holds the provider's API key.
+                // "oauth": tokenEnv holds an OAuth token, injected into an isolated
+                // OpenCode auth.json. For "openai" this is the REFRESH token from a
+                // ChatGPT/Codex sign-in (OpenCode's codex plugin mints access tokens
+                // from it). NOTE: anthropic oauth cannot work — OpenCode has no
+                // anthropic OAuth plugin and Anthropic prohibits subscription tokens
+                // in third-party tools.
+                mode: z.enum(["api-key", "oauth"]).default("api-key"),
+                tokenEnv: z.string().optional(),
+                // Set ⇒ this provider id is an ALIAS synthesized into the OpenCode
+                // config, backed by the named upstream's SDK ("openai", "anthropic",
+                // anything else = openai-compatible). Lets one upstream be reached
+                // with two credentials at once (subscription + API key).
+                upstream: z.string().optional(),
+            })),
+        }),
+        z.object({
+            mode: z.enum(["api-key", "oauth"]).default("api-key"),
+            provider: z.string().default("openai"),
+            /** Env var holding the key/token. */
+            tokenEnv: z.string().optional(),
+        }),
+    ])
+        .default({ mode: "api-key", provider: "openai" }),
     review: z
         .object({
         // Which PRs `ecr ci` acts on — the source of truth for trigger policy (a
@@ -69,12 +98,117 @@ export const ReviewConfigSchema = z.object({
         //   "all"   — review every PR, unless it carries the `skipLabel`.
         //   "label" — review only PRs carrying `label` (e.g. `ai-review`) or a
         //             `label:<agent>` variant. `skipLabel` still wins.
-        trigger: z.enum(['all', 'label']).default('all'),
+        trigger: z.enum(["all", "label"]).default("all"),
         // Opt-in label (and prefix for `label:<agent>`) used when trigger is "label".
-        label: z.string().default('ai-review'),
+        label: z.string().default("ai-review"),
         // Opt a single PR out of review. A label (not a config flag) because labels
         // are write-gated to maintainers — a PR author can't add one to dodge review.
-        skipLabel: z.string().default('ai-review:skip'),
+        skipLabel: z.string().default("ai-review:skip"),
+    })
+        .default({ trigger: "all", label: "ai-review", skipLabel: "ai-review:skip" }),
+});
+/** One routing scope: ordered globs → a directory containing .expo-code-review/. */
+export const RoutingScopeSchema = z.object({
+    /** Kebab-case id; used in comments, fingerprint namespacing, --scopes. */
+    name: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "scope name must be kebab-case"),
+    /** Ordered globs (same dialect as noise.additionalIgnores: ** and *). */
+    paths: z.array(z.string().min(1)).min(1),
+    /** Repo-relative dir whose .expo-code-review/ holds the scope's config ('.' = root).
+     * routing.jsonc is read from the PR-head checkout, so this field is
+     * PR-controllable input: absolute paths and `..` traversal are rejected so a
+     * scope config can never resolve outside the repo. */
+    config: z
+        .string()
+        .min(1)
+        .refine((value) => !path.isAbsolute(value) && !path.normalize(value).split(/[/\\]/).includes(".."), { message: 'scope config must be a repo-relative path without ".." segments' }),
+});
+export const RoutingManifestSchema = z
+    .object({
+    /** How N scopes render on one PR. */
+    comment: z.enum(["single", "per-scope"]).default("single"),
+    /** Wall-clock budget for the per-scope review passes. Active scopes run
+     * SEQUENTIALLY in one `ecr ci` process, so the total is divided across them
+     * (not spent per scope). Absent = today's totals (zod defaults). */
+    budget: z
+        .object({
+        /** Total passes budget (minutes) split across active scopes. Sized to fit
+         * the scaffolded workflow's `timeout-minutes` (90) with margin for the
+         * coordinator (10m), verification, and git/gh overhead. The cross-file pass
+         * expands to fill whatever of this window is left (see review.ts), so this
+         * is the knob that decides how long it may trace. */
+        totalPassesMinutes: z.number().int().positive().default(55),
+        /** Per-scope floor (minutes): below this a scope review isn't worth
+         * starting, so the even split clamps up to it — even when that makes the
+         * scopes overshoot the total (ecr ci warns; doctor flags the worst case). */
+        minScopeMinutes: z.number().int().positive().default(5),
+    })
+        .default({ totalPassesMinutes: 55, minScopeMinutes: 5 }),
+    defaults: z
+        .object({
+        /** The ONLY manifest-level place auth is honored (locks the root value).
+         * Unwrap the inner `.default()` first: in zod v4 a `.default().optional()`
+         * chain still fires the default when the key is absent, which would make
+         * `defaults.auth` a phantom `{mode:'api-key',provider:'openai'}` for every
+         * manifest that omits auth and silently override the root config's real auth. */
+        auth: ReviewConfigSchema.shape.auth.unwrap().optional(),
+        /** Agent ids injected into every scope with alwaysRun, from the ROOT roster. */
+        enforceAgents: z.array(z.string()).default([]),
+        /** Root comment marker; per-scope tags derive from it. */
+        commentTag: z.string().default("expo-ai-code-reviewer"),
+    })
+        .default({ enforceAgents: [], commentTag: "expo-ai-code-reviewer" }),
+    /** Ordered; LAST matching scope wins per changed file (CODEOWNERS discipline). */
+    scopes: z.array(RoutingScopeSchema).min(1),
+})
+    .superRefine((manifest, ctx) => {
+    // unique scope names; unique config dirs (after path.normalize).
+    const seenNames = new Set();
+    for (const scope of manifest.scopes) {
+        if (seenNames.has(scope.name)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `duplicate scope name: ${scope.name}`,
+                path: ["scopes"],
+            });
+        }
+        seenNames.add(scope.name);
+    }
+    const seenDirs = new Map();
+    for (const scope of manifest.scopes) {
+        const norm = path.normalize(scope.config).replace(/[/\\]+$/, "");
+        if (seenDirs.has(norm)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `duplicate scope config dir: ${scope.config} (already used by scope "${seenDirs.get(norm)}")`,
+                path: ["scopes"],
+            });
+        }
+        seenDirs.set(norm, scope.name);
+    }
+});
+/**
+ * Scope config = root config MINUS the centrally locked keys. Allowlist of
+ * scope-overridable keys (Turborepo-style, graft 6): model, policy, chunk,
+ * noise (+ the prompt files living beside it: shared.md, coordinator.md,
+ * agents/). NEVER auth or breakGlass — declaring either fails parsing at the
+ * Zod level so IDE/doctor catch it before CI. commentTag is also locked: a
+ * scope's comment marker is always DERIVED (`<rootTag>:<scope>`; the default
+ * scope keeps the root tag) so `ecr ci`'s post/clear/reconcile paths and a
+ * standalone `ecr review --scope --post` always target the same marker — an
+ * honored per-scope tag would let the two halves strand each other's comments.
+ */
+export const ScopeReviewConfigSchema = ReviewConfigSchema.omit({
+    auth: true,
+    breakGlass: true,
+    commentTag: true,
+}).extend({
+    auth: z
+        .never({ error: "auth is locked to the root config; remove it from this scope config" })
+        .optional(),
+    breakGlass: z.never({ error: "breakGlass is locked to the root config" }).optional(),
+    commentTag: z
+        .never({
+        error: "commentTag is locked: per-scope comment markers are derived as <rootTag>:<scope>; remove it from this scope config",
     })
-        .default({ trigger: 'all', label: 'ai-review', skipLabel: 'ai-review:skip' }),
+        .optional(),
 });

package/build/core/auth.js

@@ -1,12 +1,12 @@
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
 /** Env var each provider's SDK reads for an API key (x-api-key style). */
 const PROVIDER_KEY_ENV = {
-    anthropic: 'ANTHROPIC_API_KEY',
-    openai: 'OPENAI_API_KEY',
-    google: 'GOOGLE_GENERATIVE_AI_API_KEY',
-    openrouter: 'OPENROUTER_API_KEY',
+    anthropic: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    google: "GOOGLE_GENERATIVE_AI_API_KEY",
+    openrouter: "OPENROUTER_API_KEY",
 };
 /**
  * Env vars that must NEVER be forwarded to a model provider. `auth.tokenEnv` names
@@ -18,39 +18,108 @@ const PROVIDER_KEY_ENV = {
  * Defense-in-depth alongside loading config only from the trusted base ref.
  */
 const FORBIDDEN_TOKEN_ENVS = new Set([
-    'GITHUB_TOKEN',
-    'GH_TOKEN',
-    'ACTIONS_RUNTIME_TOKEN',
-    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
-    'AWS_ACCESS_KEY_ID',
-    'AWS_SECRET_ACCESS_KEY',
-    'AWS_SESSION_TOKEN',
-    'GOOGLE_APPLICATION_CREDENTIALS',
-    'GCP_SERVICE_ACCOUNT_KEY',
-    'NPM_TOKEN',
-    'NODE_AUTH_TOKEN',
-    'SSH_PRIVATE_KEY',
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "ACTIONS_RUNTIME_TOKEN",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "GCP_SERVICE_ACCOUNT_KEY",
+    "NPM_TOKEN",
+    "NODE_AUTH_TOKEN",
+    "SSH_PRIVATE_KEY",
 ]);
 const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
 /**
- * Decide whether the configured model provider has a usable credential, WITHOUT
- * mutating the environment. Shared by `prepareAuth` (fail fast before spinning up
- * the server and every pass) and `doctor` (report), so the two never drift.
+ * Documented Anthropic OAuth token shape: `sk-ant-oat01-` + 95 chars = 108 total
+ * (what `claude setup-token` prints). Treated as a STRONG HINT, not a spec: it comes
+ * from observed tokens and third-party sources, not an Anthropic format guarantee, so
+ * an unrecognized shape only warns. The one exception is below — a value that becomes
+ * exactly this shape by restoring a dropped `sk-` is provably a mangled paste.
+ */
+const ANTHROPIC_OAUTH_PREFIX = "sk-ant-oat";
+/** Anthropic API keys — valid credentials, but for auth.mode "api-key", not "oauth". */
+const ANTHROPIC_API_KEY_PREFIX = "sk-ant-api";
+/** Shorter than any credential of any provider ⇒ truncated, whatever the format. */
+const MIN_TOKEN_LENGTH = 40;
+/**
+ * Catch an OAuth token that CANNOT work before it costs a whole run.
+ *
+ * Motivation: OpenCode refuses a malformed credential by dropping the provider from
+ * its provider list entirely, so every configured model then reports "model not
+ * found" and nothing anywhere mentions credentials. That misdirection cost a full
+ * debugging session for a value that had simply lost its leading `sk-`.
  *
- * We only report `ok: false` when we're confident there is no credential — a
- * missing OAuth token, a forbidden tokenEnv, or an api-key run with neither the
- * configured tokenEnv nor the provider's own key env set. When nothing is
- * configured and no known key env is present, we assume OpenCode's own login may
- * cover it and don't hard-fail. `REVIEWER_MODEL` bypasses provider auth entirely.
+ * The bar for `ok: false` is "this cannot be a valid credential", not "this looks
+ * odd", because a false rejection blocks a working setup — a worse failure than the
+ * one being prevented. Provable: whitespace, absurdly short, an API key in oauth
+ * mode, and an OAuth token missing its `sk-`. Everything else is at most a warning,
+ * and formats of providers we don't know are never judged at all.
  */
-export function checkProviderAuth(config, env = process.env) {
-    const { mode, provider, tokenEnv } = config.auth;
-    if (env.REVIEWER_MODEL) {
+export function checkOauthTokenShape(provider, token, tokenEnv) {
+    const ok = { ok: true, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+    const fix = `Re-generate it with \`claude setup-token\` and set ${tokenEnv} to the full value.`;
+    if (token !== token.trim()) {
         return {
-            ok: true,
-            detail: `REVIEWER_MODEL override (${env.REVIEWER_MODEL}); using OpenCode's own login for that model`,
+            ok: false,
+            detail: `${tokenEnv} has leading/trailing whitespace (a newline from a copy-paste or a ` +
+                `\`cat\`-ed file is the usual cause); the provider will refuse it. ${fix}`,
         };
     }
+    if (token.length < MIN_TOKEN_LENGTH) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} holds only ${token.length} characters, too short to be a real ${provider} token — it looks truncated. ${fix}`,
+        };
+    }
+    // Only anthropic's formats are known well enough to say anything about.
+    if (provider !== "anthropic") {
+        return ok;
+    }
+    if (token.startsWith(ANTHROPIC_API_KEY_PREFIX)) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} holds an Anthropic API key ("${ANTHROPIC_API_KEY_PREFIX}…"), but auth.mode is ` +
+                `"oauth", which expects the OAuth token from \`claude setup-token\` ` +
+                `("${ANTHROPIC_OAUTH_PREFIX}…"). Either set auth.mode to "api-key" in ` +
+                `.expo-code-review/config.jsonc, or put an OAuth token in ${tokenEnv}.`,
+        };
+    }
+    // Provable mangled paste: prepending the dropped "sk-" yields exactly the documented
+    // OAuth shape. Only this reconstruction earns a hard failure — the value is not a
+    // credential of any known kind as it stands, but is one character-for-character with
+    // its prefix restored.
+    if (!token.startsWith("sk-") && `sk-${token}`.startsWith(ANTHROPIC_OAUTH_PREFIX)) {
+        return {
+            ok: false,
+            detail: `${tokenEnv} starts with "${token.slice(0, 10)}…", which is an Anthropic OAuth token ` +
+                `missing its leading "sk-" — the prefix was dropped when the value was copied ` +
+                `(adding it back gives "${ANTHROPIC_OAUTH_PREFIX}…", the shape \`claude setup-token\` ` +
+                `prints). OpenCode refuses a malformed credential by dropping the provider entirely, ` +
+                `which then surfaces as "model not found" for every model. ${fix}`,
+        };
+    }
+    if (!token.startsWith(ANTHROPIC_OAUTH_PREFIX)) {
+        // Unrecognized, but we can't prove it's wrong: Anthropic can mint shapes we don't
+        // know, so advise and continue rather than refusing to run.
+        return {
+            ...ok,
+            warning: `${tokenEnv} does not start with "${ANTHROPIC_OAUTH_PREFIX}…" (the shape ` +
+                `\`claude setup-token\` prints for auth.mode "oauth"). It may still be valid — but if ` +
+                `the run fails with "model not found" for every model, the credential was refused, ` +
+                `and this is the first thing to check.`,
+        };
+    }
+    return ok;
+}
+/**
+ * Decide whether ONE configured credential is usable, WITHOUT mutating the
+ * environment. See checkProviderAuth for the all-entries wrapper.
+ */
+export function checkAuthEntry(entry, env = process.env) {
+    const { mode, provider, tokenEnv, upstream } = entry;
     if (tokenEnv && FORBIDDEN_TOKEN_ENVS.has(tokenEnv)) {
         return {
             ok: false,
@@ -59,17 +128,62 @@ export function checkProviderAuth(config, env = process.env) {
                 `token minted for the provider instead.`,
         };
     }
-    if (mode === 'oauth') {
+    // A well-known provider key env may only feed THAT provider. The tokenEnv guard
+    // locks which env names are forwarded, but not where they go — without this, a
+    // PR-supplied auth entry could keep the locked name (e.g. OPENAI_API_KEY) and
+    // point its provider/upstream somewhere else, sending one provider's key to a
+    // different provider.
+    if (tokenEnv) {
+        const keyOwner = Object.entries(PROVIDER_KEY_ENV).find(([, env]) => env === tokenEnv)?.[0];
+        if (keyOwner && keyOwner !== provider && keyOwner !== upstream) {
+            return {
+                ok: false,
+                detail: `auth for ${provider} names tokenEnv "${tokenEnv}", which is ${keyOwner}'s ` +
+                    `well-known key env — refusing to send one provider's credential to another. ` +
+                    `Use a credential minted for ${provider}${upstream ? ` (upstream ${upstream})` : ""}, ` +
+                    `or fix the provider/upstream mapping.`,
+            };
+        }
+    }
+    if (mode === "oauth") {
+        if (!tokenEnv) {
+            return {
+                ok: false,
+                detail: `auth mode "oauth" for ${provider} requires tokenEnv to name the env var holding the OAuth token.`,
+            };
+        }
+        if (!env[tokenEnv]) {
+            return {
+                ok: false,
+                detail: `auth is oauth for ${provider} but token env "${tokenEnv}" is not set.`,
+            };
+        }
+        const shape = checkOauthTokenShape(provider, env[tokenEnv], tokenEnv);
+        if (!shape.ok) {
+            return shape;
+        }
+        return { ...shape, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+    }
+    // api-key with an upstream alias: the synthesized provider reads the key
+    // straight from {env:tokenEnv}, so both must exist — there is no ambient
+    // fallback for a provider id we invented.
+    if (upstream) {
         if (!tokenEnv) {
             return {
                 ok: false,
-                detail: 'auth.mode "oauth" requires auth.tokenEnv to name the env var holding the OAuth token.',
+                detail: `auth for ${provider} (upstream ${upstream}) requires tokenEnv — the synthesized provider reads the key from that env var.`,
             };
         }
         if (!env[tokenEnv]) {
-            return { ok: false, detail: `auth is oauth for ${provider} but token env "${tokenEnv}" is not set.` };
+            return {
+                ok: false,
+                detail: `auth for ${provider} (upstream ${upstream}) names token env "${tokenEnv}" but it is not set.`,
+            };
         }
-        return { ok: true, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+        return {
+            ok: true,
+            detail: `api-key for ${provider} (upstream ${upstream}); token env ${tokenEnv} is set`,
+        };
     }
     // api-key: usable if the configured tokenEnv is set, or the provider's own key
     // env is already present in the environment.
@@ -86,7 +200,7 @@ export function checkProviderAuth(config, env = process.env) {
             detail: `api-key for ${provider}; no tokenEnv configured and no known key env — relying on OpenCode's own login`,
         };
     }
-    const names = [tokenEnv, providerKeyEnv].filter(Boolean).join(' or ');
+    const names = [tokenEnv, providerKeyEnv].filter(Boolean).join(" or ");
     return {
         ok: false,
         detail: `configured api-key for ${provider} but no credential is set — set ${names}, or set ` +
@@ -94,27 +208,79 @@ export function checkProviderAuth(config, env = process.env) {
     };
 }
 /**
- * Prepare model credentials for the OpenCode server based on the repo's auth mode.
- * Must run before the server starts (it mutates env). Returns a cleanup handle.
+ * Decide whether EVERY configured provider credential is usable, WITHOUT
+ * mutating the environment. Shared by `prepareAuth` (fail fast before spinning up
+ * the server and every pass) and `doctor` (report), so the two never drift.
  *
- * - `api-key`: copy the configured token env into the provider's API-key env var
- *   (so the workflow can pass a namespaced secret and OpenCode still finds it).
- * - `oauth`: write an isolated OpenCode `auth.json` with the token as a Bearer
- *   OAuth credential and point OpenCode at it via XDG_DATA_HOME, so it uses its
- *   native Claude Pro/Max path (correct bearer + oauth headers) rather than
- *   x-api-key. Isolated so it never touches the developer's real auth.json.
+ * All entries must pass — a mixed setup with one broken credential would fail
+ * exactly the passes routed to it, which is the silent-degradation this check
+ * exists to prevent. `REVIEWER_MODEL` bypasses provider auth entirely.
+ */
+export function checkProviderAuth(config, env = process.env) {
+    if (env.REVIEWER_MODEL) {
+        return {
+            ok: true,
+            detail: `REVIEWER_MODEL override (${env.REVIEWER_MODEL}); using OpenCode's own login for that model`,
+        };
+    }
+    const details = [];
+    const warnings = [];
+    for (const entry of config.auth) {
+        const readiness = checkAuthEntry(entry, env);
+        if (!readiness.ok) {
+            return readiness;
+        }
+        details.push(readiness.detail);
+        if (readiness.warning) {
+            warnings.push(readiness.warning);
+        }
+    }
+    return {
+        ok: true,
+        detail: details.join("; "),
+        ...(warnings.length > 0 ? { warning: warnings.join("; ") } : {}),
+    };
+}
+/**
+ * The auth.json entry for one oauth credential. Provider-shaped:
+ * - openai: the durable secret is the REFRESH token (a ChatGPT/Codex sign-in's
+ *   access tokens live ~1h, shorter than a worst-case run), so store it with
+ *   `expires: 0` and let OpenCode's codex plugin mint access tokens on demand.
+ * - everything else: the token IS the access credential (e.g. long-lived
+ *   setup-token style bearers), far-future expiry so OpenCode never tries to
+ *   refresh a credential that has no refresh half.
+ */
+export function oauthAuthJsonEntry(provider, token) {
+    if (provider === "openai") {
+        return { type: "oauth", access: "", refresh: token, expires: 0 };
+    }
+    return { type: "oauth", access: token, refresh: "", expires: Date.now() + YEAR_MS };
+}
+/**
+ * Prepare model credentials for the OpenCode server from the repo's auth entries
+ * (any mix of modes/providers). Must run before the server starts (it mutates
+ * env). Returns a cleanup handle.
+ *
+ * - `api-key` (standard provider): copy the configured token env into the
+ *   provider's API-key env var (so the workflow can pass a namespaced secret and
+ *   OpenCode still finds it).
+ * - `api-key` (upstream alias): nothing to do here — buildOpencodeConfig
+ *   synthesizes a provider block whose options read `{env:tokenEnv}` directly.
+ * - `oauth`: write ALL oauth credentials into one isolated OpenCode `auth.json`
+ *   and point OpenCode at it via XDG_DATA_HOME (see oauthAuthJsonEntry for the
+ *   per-provider shapes). Isolated so it never touches the developer's real
+ *   auth.json.
  */
 export async function prepareAuth(config) {
     const noop = { cleanup: async () => { } };
-    const { mode, provider, tokenEnv } = config.auth;
     // REVIEWER_MODEL is an explicit "use this model with my own creds" override — a
-    // common local case (e.g. the repo config targets Claude OAuth in CI, but a dev
-    // runs against their own OpenAI login). Don't inject the configured provider's
+    // common local case (e.g. the repo config targets a CI credential, but a dev
+    // runs against their own OpenCode login). Don't inject the configured providers'
     // auth; let OpenCode use whatever it's logged into for the override model.
     if (process.env.REVIEWER_MODEL) {
         return noop;
     }
-    // Fail fast, before starting the server and every pass, if the configured
+    // Fail fast, before starting the server and every pass, if ANY configured
     // provider has no usable credential — otherwise it surfaces as N failed passes
     // mid-run. This is the same readiness check `doctor` reports, and it also covers
     // the forbidden-secret guard (refusing to forward a well-known unrelated secret).
@@ -122,37 +288,33 @@ export async function prepareAuth(config) {
     if (!readiness.ok) {
         throw new Error(readiness.detail);
     }
-    if (mode === 'api-key') {
-        if (tokenEnv) {
-            const value = process.env[tokenEnv];
-            const target = PROVIDER_KEY_ENV[provider] ?? 'ANTHROPIC_API_KEY';
-            // The explicitly-configured tokenEnv is authoritative — set it even if the
-            // provider env is already present, so config wins over ambient env.
-            if (value) {
+    const authJson = {};
+    for (const entry of config.auth) {
+        const { mode, provider, tokenEnv, upstream } = entry;
+        const value = tokenEnv ? process.env[tokenEnv] : undefined;
+        if (mode === "api-key") {
+            // Upstream aliases read {env:tokenEnv} from the synthesized provider block.
+            if (!upstream && tokenEnv && value) {
+                const target = PROVIDER_KEY_ENV[provider] ?? "ANTHROPIC_API_KEY";
+                // The explicitly-configured tokenEnv is authoritative — set it even if the
+                // provider env is already present, so config wins over ambient env.
                 process.env[target] = value;
             }
+            continue;
         }
+        // oauth — checkProviderAuth guarantees tokenEnv is set and present; read
+        // defensively so TypeScript narrows and this stays correct if called directly.
+        if (!value) {
+            throw new Error(`auth mode "oauth" for ${provider} requires tokenEnv to name a set OAuth token env.`);
+        }
+        authJson[provider] = oauthAuthJsonEntry(provider, value);
+    }
+    if (Object.keys(authJson).length === 0) {
         return noop;
     }
-    // oauth — checkProviderAuth guarantees tokenEnv is set and present; read
-    // defensively so TypeScript narrows and this stays correct if called directly.
-    const token = tokenEnv ? process.env[tokenEnv] : undefined;
-    if (!token) {
-        throw new Error('auth.mode "oauth" requires auth.tokenEnv to name a set OAuth token env.');
-    }
-    const dir = await mkdtemp(path.join(tmpdir(), 'ecr-auth-'));
-    await mkdir(path.join(dir, 'opencode'), { recursive: true });
-    const authJson = {
-        [provider]: {
-            type: 'oauth',
-            access: token,
-            refresh: '',
-            // Far-future expiry so OpenCode uses the token as-is and does not try to
-            // refresh it (setup-token tokens are long-lived and carry no refresh).
-            expires: Date.now() + YEAR_MS,
-        },
-    };
-    await writeFile(path.join(dir, 'opencode', 'auth.json'), JSON.stringify(authJson), 'utf8');
+    const dir = await mkdtemp(path.join(tmpdir(), "ecr-auth-"));
+    await mkdir(path.join(dir, "opencode"), { recursive: true });
+    await writeFile(path.join(dir, "opencode", "auth.json"), JSON.stringify(authJson), "utf8");
     process.env.XDG_DATA_HOME = dir;
     return {
         cleanup: async () => {

package/build/core/coordinator.js

@@ -1,6 +1,6 @@
-import { promptAndParse } from './opencode.js';
-import { buildCoordinatorSystem, buildCoordinatorTask } from './prompts.js';
-import { parseCoordinatorOutput } from './schema.js';
+import { promptAndParse } from "./opencode.js";
+import { buildCoordinatorSystem, buildCoordinatorTask } from "./prompts.js";
+import { parseCoordinatorOutput } from "./schema.js";
 /**
  * Single LLM call that dedupes, re-judges severity, and decides. Structured so it
  * could later own a spawn tool, but for now stays a plain consolidation pass.
@@ -12,13 +12,13 @@ const COORDINATOR_TIMEOUT_MS = 10 * 60 * 1000;
 export async function coordinate(handle, config, metadata, agentFindings, coverageNotes = []) {
     const system = buildCoordinatorSystem(config);
     const text = buildCoordinatorTask(metadata, agentFindings, coverageNotes);
-    const { value, cost, tokens, truncated } = await promptAndParse(handle, {
-        agent: 'coordinator',
+    const { value, cost, tokens, truncated, model } = await promptAndParse(handle, {
+        agent: "coordinator",
         system,
         text,
-        title: 'review-coordinator',
+        title: "review-coordinator",
         maxWaitMs: COORDINATOR_TIMEOUT_MS,
         finalizeOnTimeout: true,
     }, parseCoordinatorOutput);
-    return { output: value, cost, tokens, truncated };
+    return { output: value, cost, tokens, truncated, model };
 }