@expo/code-review-cli 0.4.0 → 0.5.0

package/build/core/prompts.js

@@ -146,13 +146,72 @@ export function buildReviewerTask(files, allFiles, filtered = []) {
  * large diff. It sees the whole change set and reports ONLY issues that span
  * multiple changed files, which per-chunk reviews can't see.
  */
-export function buildCrossCuttingTask(allFiles, agents, filtered = []) {
+/**
+ * Total changed lines the cross-file task will inline before it stops and lists the
+ * rest as patch paths to read on demand. Sized to stay well inside the model's
+ * context on a normal PR while still covering the overwhelming majority of them; a
+ * genuinely huge diff degrades to the old read-on-demand behavior for its tail
+ * rather than overflowing.
+ */
+export const CROSS_CUTTING_INLINE_MAX_LINES = 6000;
+/**
+ * Split the changed files into the ones whose diffs are inlined into the cross-file
+ * task and the ones left for on-demand reads. Always inlines at least the first file
+ * so a single enormous file can't produce an all-deferred prompt. Exported for tests.
+ */
+export function splitCrossCuttingInline(allFiles, maxLines = CROSS_CUTTING_INLINE_MAX_LINES) {
+    const inlined = [];
+    const deferred = [];
+    let lines = 0;
+    for (const file of allFiles) {
+        if (inlined.length > 0 && lines + file.changedLines > maxLines) {
+            deferred.push(file);
+            continue;
+        }
+        inlined.push(file);
+        lines += file.changedLines;
+    }
+    return { inlined, deferred };
+}
+export function buildCrossCuttingTask(allFiles, agents, filtered = [], 
+/** Set for the no-tools fallback pass, which cannot open anything it isn't shown. */
+opts = {}) {
     const lenses = agents
         .map((agent) => `- ${agent.id}: ${agent.description || agent.id}`)
         .join("\n");
-    const fileList = allFiles
-        .map((file) => `- \`${sanitizeUntrusted(file.path)}\` (${file.status ?? "M"}) — patch: \`${file.patchPath}\``)
-        .join("\n");
+    // Inline the diffs instead of only naming their patch files. Reading them back was
+    // one tool round-trip per changed file BEFORE any tracing could start (13 reads and
+    // several minutes on a 14-file PR), spent on content we already have in memory.
+    const { inlined, deferred } = splitCrossCuttingInline(allFiles);
+    const inlinedDiffs = inlined.map(inlineDiff).join("\n\n");
+    // On a diff too large to inline whole, the tail is named either way — a file this
+    // pass can't see must never look unchanged. What differs is the instruction: a
+    // no-tools pass told to "read their patch files" would be told to do the one thing
+    // it can't, so it gets the same "you cannot see these, don't fault them" framing
+    // the noise-filtered files get.
+    const deferredSection = deferred.length === 0
+        ? []
+        : opts.noTools
+            ? [
+                "",
+                "This PR changed these files too, but their diffs are NOT shown to you (the",
+                "diff is large) and you cannot open them on this pass:",
+                deferred
+                    .map((file) => `- \`${sanitizeUntrusted(file.path)}\` (${file.status ?? "M"})`)
+                    .join("\n"),
+                "",
+                "They WERE changed by this PR. Do NOT report that any of them was not updated,",
+                "and do not claim an interaction you cannot see in the diffs above.",
+            ]
+            : [
+                "",
+                "This PR changed these files too, but their diffs are NOT inlined above (the",
+                "diff is large). Read their patch files on demand if a cross-file interaction",
+                "points at them:",
+                deferred
+                    .map((file) => `- \`${sanitizeUntrusted(file.path)}\` (${file.status ?? "M"}) — patch: \`${file.patchPath}\``)
+                    .join("\n"),
+            ];
     return [
         "This PR changed the files below, and each was already reviewed on its own by",
         "specialist reviewers covering these concerns:",
@@ -166,7 +225,7 @@ export function buildCrossCuttingTask(allFiles, agents, filtered = []) {
         "single-file issues.",
         "",
         "Stay focused and efficient — you are on a time budget:",
-        "- Work from the patches of the CHANGED files listed below; that is your scope.",
+        "- Work from the diffs of the CHANGED files below; that is your scope.",
         "- Read additional source ONLY when directly needed to confirm a specific",
         "  cross-file interaction (e.g. open the caller a changed signature affects).",
         "- Do NOT audit unrelated parts of the repository or read files with no",
@@ -174,8 +233,10 @@ export function buildCrossCuttingTask(allFiles, agents, filtered = []) {
         "- As soon as you have traced the cross-file interactions, return your answer;",
         "  do not keep exploring for completeness.",
         "",
-        "Changed files:",
-        fileList,
+        "Changed files (diffs inlined — you do not need to read these back):",
+        "",
+        inlinedDiffs,
+        ...deferredSection,
         ...filteredSection(filtered),
         "",
         "Return the single JSON object described in your instructions and nothing else.",

package/build/core/review.js

@@ -3,7 +3,7 @@ import { prepareAuth } from "./auth.js";
 import { coordinate } from "./coordinator.js";
 import { writeRunLog } from "./log.js";
 import { filterNoise, writePatchWorkspace } from "./noise.js";
-import { addTokenUsage, AgentTimeoutError, buildOpencodeConfig, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
+import { addTokenUsage, AgentTimeoutError, assertModelsResolvable, buildOpencodeConfig, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
 import { routeAgents } from "./router.js";
 import { buildCrossCuttingSystem, buildCrossCuttingTask, buildReviewerSystem, buildReviewerTask, NO_TOOLS_INSTRUCTION, } from "./prompts.js";
 import { fingerprintFinding, parseReviewerOutput } from "./schema.js";
@@ -114,7 +114,19 @@ export async function runReview(source, options) {
         await auth.cleanup();
         await restoreCwd();
         throw new Error(`Failed to start the OpenCode server. Ensure the \`opencode\` CLI is installed and ` +
-            `model credentials are configured.\n${errorMessage(error)}`);
+            `model credentials are configured (\`ecr doctor\` checks both).\n${errorMessage(error)}`);
+    }
+    // Preflight: a model id the server can't resolve would otherwise fail EVERY pass
+    // identically — N indistinguishable coverage gaps, after spending the run's budget
+    // discovering the same fixable thing N times. Throw once, up front, naming the fix.
+    try {
+        await assertModelsResolvable(handle, [...config.agents.map((agent) => agent.model), config.coordinator.model], config.auth);
+    }
+    catch (error) {
+        handle.close();
+        await auth.cleanup();
+        await restoreCwd();
+        throw error;
     }
     const agentCosts = {};
     const tokenTotals = {};
@@ -129,6 +141,23 @@ export async function runReview(source, options) {
         addTokenUsage(tokenTotals, tokens);
         addTokenUsage((agentTokens[bucket] ??= {}), tokens);
     };
+    // The provider/model that ACTUALLY answered each pass, and any pass whose model was
+    // silently substituted for the configured one. OpenCode does that substitution
+    // quietly whenever an agent's model id is empty or unusable, so a run can review with
+    // a different model than config.jsonc names and look completely normal — which is
+    // exactly what happened for weeks behind an empty REVIEWER_MODEL. Recorded in the run
+    // log, reported in the log line, and surfaced as a coverage note when it happens.
+    const agentModels = {};
+    const substituted = new Set();
+    const trackModel = (bucket, configured, actual) => {
+        if (!actual) {
+            return;
+        }
+        agentModels[bucket] = actual;
+        if (configured && actual !== configured) {
+            substituted.add(`${bucket}: configured ${configured}, ran ${actual}`);
+        }
+    };
     try {
         const workspace = await writePatchWorkspace(kept, metadata, runDir);
         // Resolve which agents run: an explicit list wins; otherwise route (LLM picks
@@ -158,7 +187,6 @@ export async function runReview(source, options) {
         // These caps must fit inside PASSES_BUDGET_MS (below), which in turn fits inside
         // the CI job's timeout-minutes.
         const CHUNK_TIMEOUT_MS = 15 * 60 * 1000;
-        const CROSS_CUTTING_TIMEOUT_MS = 25 * 60 * 1000;
         // A subdivided sub-chunk is smaller, so it gets a shorter cap (halved per level,
         // floored) — enough to converge without letting the recursion balloon.
         const SUBDIVIDE_MIN_TIMEOUT_MS = 6 * 60 * 1000;
@@ -168,14 +196,50 @@ export async function runReview(source, options) {
         // Tool-call ceilings — generous for a legitimate pass, low enough to catch
         // runaway roaming (the root cause of the non-convergent timeouts).
         const CHUNK_MAX_TOOL_CALLS = 50;
-        const CROSS_CUTTING_MAX_TOOL_CALLS = 120;
         // Global ceiling for ALL passes incl. subdivision/fallback waves, sized to
         // leave room for the coordinator (10m) + verification + overhead inside the CI
         // job timeout. Past this, a timed-out pass is reported as a gap rather than
         // broken down further, so total wall-clock stays bounded.
-        const PASSES_BUDGET_MS = 32 * 60 * 1000;
+        const PASSES_BUDGET_MS = 55 * 60 * 1000;
         const passesBudgetMs = options.passesBudgetMs ?? PASSES_BUDGET_MS;
         const passesDeadline = started + passesBudgetMs;
+        // The cross-file pass is the one pass whose scope cannot be traded for
+        // convergence: halving its file set deletes exactly the coverage it exists to
+        // provide (see the timeout branch below). So instead of a fixed cap it gets the
+        // WHOLE remaining passes window. Chunk passes run concurrently alongside it under
+        // their own caps, so a long cross-file pass doesn't starve them — it only extends
+        // the run toward the passes deadline, which the job timeout is sized for.
+        //
+        // Computed here, not as a constant, because the window is what's actually left:
+        // filtering, routing and server startup already spent some of it, and `ecr ci`
+        // divides the budget across active scopes.
+        //
+        // The reserve is what keeps its own salvage paths affordable: if it expanded into
+        // the entire window, then on a timeout there would be nothing left to run the
+        // whole-diff no-tools fallback with, and "elastic budget" would have quietly
+        // reintroduced the coverage gap it exists to prevent. Sized for the finalize
+        // soft-landing plus one FALLBACK_TIMEOUT_MS pass.
+        const CROSS_CUTTING_RESERVE_MS = FALLBACK_TIMEOUT_MS + 4 * 60 * 1000;
+        // Floor: never LESS generous than one chunk pass. On a run whose window is already
+        // small (many active scopes dividing the budget) this can exceed what's left, but
+        // that exposure is exactly what chunk passes already carry — their 15m cap can also
+        // outlast a small per-scope slice — and the job timeout keeps a wide margin over
+        // the budget for it. Dropping the pass instead would silently cost the coverage no
+        // other pass provides.
+        const crossCuttingWaitMs = Math.max(CHUNK_TIMEOUT_MS, passesDeadline - Date.now() - CROSS_CUTTING_RESERVE_MS);
+        // Tool calls are for TRACING (opening the caller a changed signature affects) —
+        // the changed files' diffs are inlined, so they are not spent fetching the diff.
+        // Scale with the diff's file count instead of fixing the ceiling: under a large
+        // elastic time budget a fixed cap becomes the binding constraint, and the extra
+        // time can't be used.
+        const CROSS_CUTTING_TOOL_CALLS_PER_FILE = 10;
+        const CROSS_CUTTING_MIN_TOOL_CALLS = 120;
+        const CROSS_CUTTING_MAX_TOOL_CALLS = 400;
+        const crossCuttingMaxToolCalls = Math.min(CROSS_CUTTING_MAX_TOOL_CALLS, Math.max(CROSS_CUTTING_MIN_TOOL_CALLS, CROSS_CUTTING_TOOL_CALLS_PER_FILE * workspace.files.length));
+        // Coverage notes for passes that hit their time limit, stalled, failed, or were
+        // never started, surfaced in the final review so a cut-short run is never
+        // presented as complete.
+        const incomplete = [];
         const tasks = [];
         for (const agent of selectedAgents) {
             const system = buildReviewerSystem(config, agent);
@@ -206,8 +270,8 @@ export async function runReview(source, options) {
                 title: "review-xcut",
                 files: workspace.files,
                 coverageLabel: "the cross-file review (issues spanning multiple changed files)",
-                maxWaitMs: CROSS_CUTTING_TIMEOUT_MS,
-                maxToolCalls: CROSS_CUTTING_MAX_TOOL_CALLS,
+                maxWaitMs: crossCuttingWaitMs,
+                maxToolCalls: crossCuttingMaxToolCalls,
                 depth: 0,
                 fallback: false,
             });
@@ -215,11 +279,19 @@ export async function runReview(source, options) {
         // Longest-processing-time-first: schedule the long cross-cutting/large chunks
         // ahead of short ones so they don't dominate the tail of the makespan.
         tasks.sort((a, b) => b.maxWaitMs - a.maxWaitMs);
+        // What each task was CONFIGURED to run on — mirrors buildOpencodeConfig, which
+        // gives the cross-file pass the first agent's model. Compared against what actually
+        // answered so a silent substitution can't pass unnoticed.
+        const taskModel = (task) => task.kind === "cross-cutting"
+            ? (selectedAgents[0]?.model ?? config.coordinator.model)
+            : (selectedAgents.find((agent) => agent.id === task.bucket)?.model ?? "");
         // Build the task prompt on demand (so a subdivided task rebuilds over its
         // smaller file set); a fallback task forbids tools and reviews the inlined diff.
         const buildTaskText = (task) => {
             const base = task.kind === "cross-cutting"
-                ? buildCrossCuttingTask(task.files, selectedAgents, filtered)
+                ? buildCrossCuttingTask(task.files, selectedAgents, filtered, {
+                    noTools: task.fallback,
+                })
                 : buildReviewerTask(task.files, workspace.files, filtered);
             return task.fallback ? `${base}\n\n${NO_TOOLS_INSTRUCTION}` : base;
         };
@@ -234,9 +306,6 @@ export async function runReview(source, options) {
             coverageLabel: `the ${humanBucket(parent.bucket)} review of ${filesLabel(files)}`,
             ...overrides,
         });
-        // Coverage notes for passes that hit their time limit or failed, surfaced in
-        // the final review so a cut-short run is never presented as complete.
-        const incomplete = [];
         let completedPasses = 0;
         let failedPasses = 0;
         // promptAndParse already retries internally (same-session corrective, then a
@@ -247,7 +316,7 @@ export async function runReview(source, options) {
         await runGrowableQueue(tasks, config.chunk.concurrency, async (task, enqueue) => {
             const minutes = Math.round(task.maxWaitMs / 60000);
             try {
-                const { value, cost, truncated, tokens } = await promptAndParse(handle, {
+                const { value, cost, truncated, tokens, model } = await promptAndParse(handle, {
                     agent: task.bucket,
                     system: task.system,
                     text: buildTaskText(task),
@@ -259,6 +328,7 @@ export async function runReview(source, options) {
                 }, parseReviewerOutput);
                 agentCosts[task.bucket] = (agentCosts[task.bucket] ?? 0) + cost;
                 trackTokens(task.bucket, tokens);
+                trackModel(task.bucket, taskModel(task), model);
                 (agentFindings[task.bucket] ??= []).push(...value.findings);
                 completedPasses++;
                 if (truncated) {
@@ -284,13 +354,15 @@ export async function runReview(source, options) {
                 agentCosts[task.bucket] = (agentCosts[task.bucket] ?? 0) + error.cost;
                 trackTokens(task.bucket, error.tokens);
                 const remaining = passesDeadline - Date.now();
-                // Cross-file analysis needs ≥2 files to be meaningful; a single-file
-                // reviewer chunk can't be split further.
-                const minFiles = task.kind === "cross-cutting" ? 2 : 1;
+                // Subdividing trades scope for convergence, which is the right trade for a
+                // reviewer chunk (each file still gets reviewed) and the WRONG one for the
+                // cross-file pass: an interaction between a file in the left half and one in
+                // the right half is invisible to both halves, so "splitting" it silently
+                // deletes the coverage the pass exists to provide while reporting success.
+                // It goes straight to the whole-diff no-tools fallback below instead.
+                const canSubdivide = task.kind === "reviewer" && task.files.length > 1;
                 const childCap = Math.max(SUBDIVIDE_MIN_TIMEOUT_MS, Math.floor(task.maxWaitMs / 2));
-                if (task.files.length > minFiles &&
-                    task.depth < MAX_SUBDIVIDE_DEPTH &&
-                    remaining > childCap) {
+                if (canSubdivide && task.depth < MAX_SUBDIVIDE_DEPTH && remaining > childCap) {
                     const mid = Math.ceil(task.files.length / 2);
                     const left = task.files.slice(0, mid);
                     const right = task.files.slice(mid);
@@ -300,9 +372,12 @@ export async function runReview(source, options) {
                     enqueue(childTask(task, right, `↳${right.length}f`, over));
                     return;
                 }
-                // Can't subdivide further: try a fast no-tools pass over the inlined diff
-                // (reviewer only — cross-file analysis fundamentally needs to read files).
-                if (task.kind === "reviewer" && !task.fallback && remaining > FALLBACK_TIMEOUT_MS) {
+                // Can't (or shouldn't) subdivide: fall back to a fast no-tools pass over the
+                // inlined diffs. This works for the cross-file pass too — every changed file's
+                // diff is inlined in its task, so it can still reason across the whole diff
+                // without tools; it just can't open a caller outside the diff. A lighter
+                // cross-file review beats the coverage gap it used to report.
+                if (!task.fallback && remaining > FALLBACK_TIMEOUT_MS) {
                     progress(`  ${task.label}: exceeded ${minutes}m — retrying ${filesLabel(task.files)} with a fast no-tools pass`);
                     enqueue(childTask(task, task.files, "(no-tools fallback)", {
                         fallback: true,
@@ -315,10 +390,24 @@ export async function runReview(source, options) {
                 // never silent. Distinguish WHY so the note doesn't overstate what happened:
                 // we could still have split/fallen back, but the global budget ran out first,
                 // vs. the task was already at its smallest reviewable unit and still failed.
+                // A stalled pass is called out separately: it did not run out of time doing
+                // work, its model requests went silent, which is an infrastructure symptom
+                // and not something a bigger budget or a smaller scope would have fixed.
                 failedPasses++;
-                const couldStillReduce = (task.files.length > minFiles && task.depth < MAX_SUBDIVIDE_DEPTH) ||
-                    (task.kind === "reviewer" && !task.fallback);
-                if (couldStillReduce) {
+                const couldStillReduce = (canSubdivide && task.depth < MAX_SUBDIVIDE_DEPTH) || !task.fallback;
+                if (error.reason === "stall") {
+                    progress(`  ${task.label}: its model requests went silent (stalled) and did not recover — ` +
+                        `most likely provider rate limiting; reporting a coverage gap`);
+                    // Name the likely cause. OpenCode retries a 429 internally without surfacing
+                    // it, so provider throttling reaches us as pure silence — indistinguishable
+                    // from a wedged connection, and the single most common reason a pass produces
+                    // nothing at all. Saying "went silent" alone sends people hunting for a bug
+                    // in the reviewer instead of checking their usage window.
+                    incomplete.push(`${capitalize(task.coverageLabel)} could not run: its model requests went silent and produced no output, even after being retried. ` +
+                        `The usual cause is the model provider rate-limiting the account (a subscription credential over its usage window), which reaches this tool as silence rather than an error; ` +
+                        `those changes were not fully reviewed.`);
+                }
+                else if (couldStillReduce) {
                     progress(`  ${task.label}: exceeded ${minutes}m and the run's time budget is spent — reporting a coverage gap`);
                     incomplete.push(`${capitalize(task.coverageLabel)} timed out and the overall review budget was exhausted before it could be broken down further; those changes were not fully reviewed.`);
                 }
@@ -328,6 +417,18 @@ export async function runReview(source, options) {
                 }
             }
         });
+        // A substituted model means the review did not run on the model this repo
+        // configured — the findings may be from a weaker (or free-tier) model entirely.
+        // Never silent: it goes to the log, the coverage notes, and the run log.
+        if (substituted.size > 0) {
+            for (const line of substituted) {
+                progress(`  ⚠ model substituted — ${line}`);
+            }
+            incomplete.push(`Some passes did not run on the configured model (${[...substituted].join("; ")}). ` +
+                `OpenCode silently falls back to a default model when the configured id is empty or ` +
+                `unusable, so these findings may come from a different (possibly much weaker) model ` +
+                `than intended — check the agents' \`model\`, \`coordinator.model\`, REVIEWER_MODEL, and the provider credential.`);
+        }
         // Note: routine noise filtering (lockfiles, generated, binary) is expected and
         // NOT a coverage gap — it stays in the run log (filteredFiles), not the
         // user-facing coverage note, which is reserved for passes that didn't finish.
@@ -348,9 +449,10 @@ export async function runReview(source, options) {
             progress("Coordinating findings…");
             let consolidated;
             try {
-                const { output: rawOutput, cost, tokens: coordinatorTokens, truncated: coordinatorTruncated, } = await coordinate(handle, config, metadata, agentFindings, coverageNotes);
+                const { output: rawOutput, cost, tokens: coordinatorTokens, truncated: coordinatorTruncated, model: coordinatorModel, } = await coordinate(handle, config, metadata, agentFindings, coverageNotes);
                 agentCosts["coordinator"] = cost;
                 trackTokens("coordinator", coordinatorTokens);
+                trackModel("coordinator", config.coordinator.model, coordinatorModel);
                 consolidated = applyReviewPolicy(rawOutput, config.policy);
                 if (coordinatorTruncated) {
                     // The coordinator ran out of time and returned partial findings — flag it
@@ -382,6 +484,8 @@ export async function runReview(source, options) {
             const verification = await verifyFindings(handle, output.findings, process.cwd(), progress);
             agentCosts["verifier"] = verification.cost;
             trackTokens("verifier", verification.tokens);
+            // Mirrors buildOpencodeConfig, which gives the verifier the first agent's model.
+            trackModel("verifier", config.agents[0]?.model ?? config.coordinator.model, verification.model);
             verifierDropped = verification.dropped;
             if (verification.dropped.length > 0) {
                 progress(`Verification dropped ${verification.dropped.length} unverified finding(s).`);
@@ -411,14 +515,23 @@ export async function runReview(source, options) {
         if (removedAfterChecks > 0) {
             output = { ...output, summary: reconcileSummary(output.summary, output.findings.length) };
         }
+        // Every pass says which model actually answered it — in the job log, the step
+        // summary table, and the run log — so a wrong or substituted model is always
+        // visible, not just when the substitution warning fires.
+        if (Object.keys(agentModels).length > 0) {
+            progress(`Models used — ${Object.entries(agentModels)
+                .map(([bucket, model]) => `${bucket}: ${model}`)
+                .join("; ")}`);
+        }
         progress(formatUsageSummary(tokenTotals, sum(agentCosts)));
-        await appendStepSummary(renderUsageMarkdown(agentTokens, agentCosts, tokenTotals, sum(agentCosts)));
+        await appendStepSummary(renderUsageMarkdown(agentTokens, agentCosts, tokenTotals, sum(agentCosts), agentModels));
         await safeLog(logPath, {
             ...baseRecord,
             agentCosts,
             totalCost: sum(agentCosts),
             tokens: tokenTotals,
             agentTokens,
+            agentModels,
             agentFindings,
             coverageNotes,
             verifierDropped,
@@ -650,15 +763,15 @@ export function formatUsageSummary(tokens, totalCost) {
  * row per pass plus a total, and the prompt-cache hit rate (the share of prompt
  * tokens served from cache instead of being reprocessed at full price).
  */
-export function renderUsageMarkdown(agentTokens, agentCosts, totals, totalCost) {
-    const row = (label, tokens, cost) => `| ${label} | ${tokens.input ?? 0} | ${tokens.output ?? 0} | ${tokens.cache?.read ?? 0} | ${tokens.cache?.write ?? 0} | $${cost.toFixed(4)} |`;
+export function renderUsageMarkdown(agentTokens, agentCosts, totals, totalCost, agentModels = {}) {
+    const row = (label, model, tokens, cost) => `| ${label} | ${model} | ${tokens.input ?? 0} | ${tokens.output ?? 0} | ${tokens.cache?.read ?? 0} | ${tokens.cache?.write ?? 0} | $${cost.toFixed(4)} |`;
     const lines = [
         "### 🤖 AI review — token usage",
         "",
-        "| pass | input | output | cache read | cache write | cost |",
-        "| --- | ---: | ---: | ---: | ---: | ---: |",
-        ...Object.keys(agentCosts).map((bucket) => row(bucket, agentTokens[bucket] ?? {}, agentCosts[bucket] ?? 0)),
-        row("**total**", totals, totalCost),
+        "| pass | model | input | output | cache read | cache write | cost |",
+        "| --- | --- | ---: | ---: | ---: | ---: | ---: |",
+        ...Object.keys(agentCosts).map((bucket) => row(bucket, agentModels[bucket] ?? "—", agentTokens[bucket] ?? {}, agentCosts[bucket] ?? 0)),
+        row("**total**", "", totals, totalCost),
     ];
     const read = totals.cache?.read ?? 0;
     const uncached = totals.input ?? 0;

package/build/core/verify.js

@@ -81,6 +81,7 @@ async function evidencePresence(finding, cwd) {
 export async function verifyFindings(handle, findings, cwd, onProgress) {
     const dropped = [];
     let cost = 0;
+    let model;
     const tokens = {};
     // Phase 1 — deterministic quote-grounding for every finding.
     const checked = await Promise.all(findings.map(async (finding) => ({ finding, presence: await evidencePresence(finding, cwd) })));
@@ -98,7 +99,7 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
     // Phase 2 — LLM verify (parallel). Refuted → drop; verified or errored → keep.
     await Promise.all(toVerify.map(async ({ finding, presence }, index) => {
         try {
-            const { value, cost: verifyCost, tokens: verifyTokens, } = await promptAndParse(handle, {
+            const { value, cost: verifyCost, tokens: verifyTokens, model: verifyModel, } = await promptAndParse(handle, {
                 agent: VERIFIER_AGENT,
                 system: buildVerifierSystem(),
                 text: buildVerifierTask(finding, { evidenceUngrounded: presence === "absent" }),
@@ -108,6 +109,7 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
             }, parseVerdict);
             cost += verifyCost;
             addTokenUsage(tokens, verifyTokens);
+            model = verifyModel ?? model;
             if (value.verified) {
                 verdicts.set(finding, "keep");
             }
@@ -125,5 +127,5 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
     }));
     // Preserve original order.
     const kept = findings.filter((finding) => verdicts.get(finding) === "keep");
-    return { kept, dropped, cost, tokens };
+    return { kept, dropped, cost, tokens, model };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {
@@ -35,8 +35,8 @@
     "prepublishOnly": "rimraf build && tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@opencode-ai/sdk": "^1.18.2",
-    "opencode-ai": "^1.18.2",
+    "@opencode-ai/sdk": "1.18.4",
+    "opencode-ai": "1.18.4",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/templates/agents/security.md

@@ -2,10 +2,10 @@
 description: Security and secrets. Injection, credential or secret leakage, unsafe shell/child-process use, missing validation at trust boundaries.
 alwaysRun: true
 # Security is the highest-stakes agent and benefits most from stronger threat-model
-# reasoning, so it runs on Opus even though the other specialists use the default
-# model. Scoped to this one agent to limit the extra latency/rate-limit cost;
-# subdivide-on-timeout + the per-fetch deadline keep a slow Opus pass from hanging.
-model: anthropic/claude-opus-4-8
+# reasoning, so it runs on the pro tier even though the other specialists use the
+# default model. Scoped to this one agent to limit the extra latency/rate-limit cost;
+# subdivide-on-timeout + the per-fetch deadline keep a slow pro pass from hanging.
+model: openai/gpt-5.5-pro
 ---
 
 # Security & secrets

package/templates/command.yml

@@ -36,8 +36,10 @@ jobs:
       startsWith(github.event.comment.body, '/review') &&
       contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
     runs-on: ubuntu-latest
-    # Bound the run so a slow/stalled review fails fast rather than hanging.
-    timeout-minutes: 50
+    # Bound the run so a slow/stalled review fails fast rather than hanging. Keep it
+    # above the passes budget (budget.totalPassesMinutes, 55m) + coordinator (10m) +
+    # verification + setup, like the auto-review workflow's cap.
+    timeout-minutes: 90
     # A reviewer failure must never fail the PR's checks.
     continue-on-error: true
     steps:
@@ -113,7 +115,8 @@ jobs:
       - name: Guard config tokenEnv (root + routing + all scopes)
         if: steps.cmd.outputs.run == 'true'
         env:
-          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
+          # (Comma-separated set for a multi-credential auth.providers config.)
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
         run: npx --yes -p "@expo/code-review-cli@$ECR_VERSION" ecr verify-config
 
       - name: Run AI review
@@ -123,11 +126,11 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Layer-1 auth lock: the CLI refuses to run when the tokenEnv it would honor
           # differs from this. Keep it in sync with the guard's EXPECTED.
-          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'ANTHROPIC_OAUTH_API_KEY' }}
-          # Claude Pro/Max OAuth token (from `claude setup-token`) — the env var named
-          # by auth.tokenEnv in config.jsonc. Store it as a repo secret. (For an API
-          # key instead, set auth.mode "api-key" and pass that key here.)
-          ANTHROPIC_OAUTH_API_KEY: ${{ secrets.ANTHROPIC_OAUTH_API_KEY }}
+          ECR_EXPECTED_TOKEN_ENV: ${{ vars.ECR_EXPECTED_TOKEN_ENV || 'OPENAI_API_KEY' }}
+          # OpenAI API key — the env var named by auth.tokenEnv in config.jsonc.
+          # Store it as a repo secret; a project-scoped key restricted to model
+          # inference (with a spend limit) is all the reviewer needs.
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           # Optional: override the model for every agent (uses your OpenCode login).
           REVIEWER_MODEL: ${{ vars.REVIEWER_MODEL }}
           AGENTS: ${{ steps.cmd.outputs.agents }}

package/templates/config.jsonc

@@ -1,14 +1,14 @@
 {
   // Default model for every agent. Override per-agent via frontmatter in the
   // agent's markdown, or at runtime with the REVIEWER_MODEL env var
-  // (e.g. REVIEWER_MODEL=openai/gpt-5.4-mini-fast).
-  "model": "anthropic/claude-sonnet-5",
+  // (e.g. REVIEWER_MODEL=openai/gpt-5.4-mini).
+  "model": "openai/gpt-5.5",
 
   // Agents: every markdown file in agents/ is one reviewer (id = filename).
   // Add or remove files to change the roster — no list needed here.
   // shared.md (prepended to every agent + coordinator) and coordinator.md are
   // reserved filenames. Per-agent overrides go in each file's YAML frontmatter,
-  // e.g. `---\nmodel: anthropic/claude-opus-4-1\n---`.
+  // e.g. `---\nmodel: openai/gpt-5.5-pro\n---`.
 
   "policy": {
     // Phase 1: keep signal high by surfacing only critical/warning.
@@ -41,16 +41,29 @@
   // HTML marker used to find + update the single PR comment. Keep it stable.
   "commentTag": "expo-ai-code-reviewer",
 
-  // How model credentials are provided. Default: a Claude Pro/Max subscription.
-  //   "oauth":   tokenEnv holds a Claude Pro/Max OAuth token (from
-  //              `claude setup-token`); it's injected as a bearer credential.
-  //   "api-key": tokenEnv holds a provider API key (sent as x-api-key). If you
-  //              omit `auth`, OpenCode's own login / ANTHROPIC_API_KEY is used.
-  // For OpenAI/GPT or another provider, omit `auth` and set REVIEWER_MODEL after an
-  // `opencode auth login` for that provider.
+  // How model credentials are provided. Default: an OpenAI API key.
+  //   "api-key": tokenEnv names the env var holding a provider API key. In CI,
+  //              store the key as a repo secret and pass it under that env var
+  //              (the scaffolded workflow does). If you omit `auth` entirely,
+  //              OpenCode's own login / ambient provider env vars are used.
+  // For Anthropic/Claude, set provider "anthropic", tokenEnv "ANTHROPIC_API_KEY",
+  // and an anthropic/... model above. For another provider, omit `auth` and set
+  // REVIEWER_MODEL after an `opencode auth login` for that provider.
+  //
+  // MIXED setup (a ChatGPT/Codex subscription for the default models, plus a
+  // metered API key for pro-tier models the subscription doesn't offer): use the
+  // per-provider map instead, reference `openai-api/...` models in the frontmatter
+  // of the agents that need the pro tier, and set ECR_EXPECTED_TOKEN_ENV in the
+  // workflow to the comma-separated set of both env names.
+  //   "auth": { "providers": {
+  //     "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_REFRESH_TOKEN" },
+  //     "openai-api": { "mode": "api-key", "tokenEnv": "OPENAI_API_KEY", "upstream": "openai" }
+  //   } }
+  // (openai oauth: tokenEnv holds the REFRESH token from an `opencode auth login`
+  // ChatGPT sign-in — copy `.openai.refresh` from OpenCode's auth.json.)
   "auth": {
-    "mode": "oauth",
-    "provider": "anthropic",
-    "tokenEnv": "ANTHROPIC_OAUTH_API_KEY"
+    "mode": "api-key",
+    "provider": "openai",
+    "tokenEnv": "OPENAI_API_KEY"
   }
 }

package/templates/coordinator.md

@@ -1,9 +1,9 @@
 ---
 # The coordinator makes the final call — de-duping, re-judging severity, and
-# deciding — so it runs on Opus: consolidation quality matters more here than the
-# small serial-tail latency it adds (no repo tools, so it's a single bounded pass).
+# deciding — so it runs on the pro tier: consolidation quality matters more here
+# than the small serial-tail latency it adds (no repo tools, one bounded pass).
 # Override with a cheaper model if you'd rather trade decision quality for latency.
-model: anthropic/claude-opus-4-8
+model: openai/gpt-5.5-pro
 ---
 
 # Coordinator — consolidation & decision

package/templates/routing.jsonc

@@ -18,7 +18,7 @@
   // Passes budget, split across active scopes (they run sequentially in one `ecr ci`):
   // keep totalPassesMinutes inside the workflow's timeout-minutes; minScopeMinutes is
   // the floor below which a scope review isn't worth starting. Defaults shown.
-  // "budget": { "totalPassesMinutes": 32, "minScopeMinutes": 5 },
+  // "budget": { "totalPassesMinutes": 55, "minScopeMinutes": 5 },
 
   // Ordered; the LAST matching scope wins per changed file. Keep a '**/*' catch-all first.
   "scopes": [