@expo/code-review-cli 0.4.0 → 0.5.1

package/build/commands/setup-auth.js

@@ -0,0 +1,200 @@
+import { spawnSync } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline/promises";
+import { hasConfig, loadReviewConfig } from "../config/load.js";
+import { opencodeBinSource } from "../core/opencode.js";
+import { errorMessage } from "../core/util.js";
+const USAGE = `ecr setup-auth — set up model credentials for local runs
+
+Reads this repo's .expo-code-review/config.jsonc auth entries and walks through
+getting each credential:
+  • a ChatGPT/Codex subscription (oauth/openai): runs the bundled
+    \`opencode auth login\` (interactive; opens your browser), then prints the
+    \`export <tokenEnv>=…\` line to add to your shell config. An existing
+    OpenCode ChatGPT sign-in is reused instead of re-authenticating.
+  • an API key (api-key entries): prints where to create the key, the exact
+    permissions it needs, and the export line to fill in.
+
+Without a repo config, it offers the recommended ChatGPT/Codex subscription flow
+with the default env name.
+
+Options:
+  --yes   Skip confirmation prompts (still interactive during the login itself).
+`;
+export function planFromAuth(auth) {
+    const plan = { manualKeys: [], unsupported: [] };
+    for (const entry of auth) {
+        if (entry.mode === "oauth" && entry.provider === "openai" && entry.tokenEnv) {
+            plan.chatgptLogin = { tokenEnv: entry.tokenEnv };
+        }
+        else if (entry.mode === "api-key" && entry.tokenEnv) {
+            plan.manualKeys.push({
+                provider: entry.provider,
+                tokenEnv: entry.tokenEnv,
+                upstream: entry.upstream,
+            });
+        }
+        else if (entry.mode === "oauth") {
+            plan.unsupported.push(entry);
+        }
+        // api-key without tokenEnv relies on OpenCode's own login — nothing to set up.
+    }
+    return plan;
+}
+/** Where OpenCode's own (non-isolated) auth.json lives. */
+export function opencodeAuthJsonPath(env = process.env) {
+    const dataHome = env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share");
+    return path.join(dataHome, "opencode", "auth.json");
+}
+/** The stored ChatGPT sign-in's refresh token, if OpenCode has one. */
+async function readStoredRefreshToken() {
+    try {
+        const raw = await readFile(opencodeAuthJsonPath(), "utf8");
+        const parsed = JSON.parse(raw);
+        const openai = parsed.openai;
+        return openai?.type === "oauth" && openai.refresh ? openai.refresh : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function confirm(question, skip) {
+    if (skip) {
+        return true;
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(`${question} [Y/n] `)).trim().toLowerCase();
+        return answer === "" || answer === "y" || answer === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}
+/** The line to paste into a shell config. Single-quoted: tokens never contain '. */
+export function exportLine(tokenEnv, value) {
+    return `export ${tokenEnv}='${value}'`;
+}
+export async function setupAuthCommand(argv = []) {
+    if (argv.includes("-h") || argv.includes("--help")) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const yes = argv.includes("--yes");
+    const out = (line = "") => process.stdout.write(`${line}\n`);
+    const err = (line = "") => process.stderr.write(`${line}\n`);
+    try {
+        // Plan from the repo config when there is one; otherwise offer the
+        // recommended subscription flow with the default env name.
+        let plan;
+        if (hasConfig(process.cwd())) {
+            const config = await loadReviewConfig(process.cwd());
+            plan = planFromAuth(config.auth);
+        }
+        else {
+            err("No .expo-code-review config here — setting up the default ChatGPT/Codex flow.");
+            plan = planFromAuth([
+                { provider: "openai", mode: "oauth", tokenEnv: "CODEX_OAUTH_REFRESH_TOKEN" },
+            ]);
+        }
+        if (!plan.chatgptLogin && plan.manualKeys.length === 0 && plan.unsupported.length === 0) {
+            out("This repo's auth config needs no local credential setup (OpenCode's own login covers it).");
+            return;
+        }
+        const exports = [];
+        if (plan.chatgptLogin) {
+            const { tokenEnv } = plan.chatgptLogin;
+            if (process.env[tokenEnv]) {
+                err(`✓ ${tokenEnv} is already set in this shell — skipping the ChatGPT sign-in.`);
+            }
+            else {
+                let refresh = await readStoredRefreshToken();
+                if (refresh) {
+                    err("Found an existing ChatGPT sign-in in OpenCode.");
+                    if (!(await confirm(`Reuse it for ${tokenEnv}?`, yes))) {
+                        refresh = null;
+                    }
+                }
+                if (!refresh) {
+                    err("This will run the bundled `opencode auth login` (interactive).");
+                    err("When it prompts:");
+                    err("  1. select the provider:  OpenAI");
+                    err("  2. select the method:    Sign in with ChatGPT  (Codex subscription)");
+                    err("  3. your browser opens — sign in and authorize.");
+                    if (!(await confirm("Run it now?", yes))) {
+                        err("Skipped the ChatGPT sign-in.");
+                    }
+                    else {
+                        const binDir = opencodeBinSource().dir;
+                        const opencode = binDir ? path.join(binDir, "opencode") : "opencode";
+                        const result = spawnSync(opencode, ["auth", "login"], { stdio: "inherit" });
+                        if (result.status !== 0) {
+                            throw new Error(`\`opencode auth login\` exited with ${result.status ?? "a signal"}; nothing was changed.`);
+                        }
+                        refresh = await readStoredRefreshToken();
+                        if (!refresh) {
+                            throw new Error("The login finished but no ChatGPT sign-in was stored — did you select " +
+                                'OpenAI → "Sign in with ChatGPT"? Re-run `ecr setup-auth` to try again.');
+                        }
+                    }
+                }
+                if (refresh) {
+                    // The REFRESH token is the durable secret: access tokens are short-lived,
+                    // and OpenCode mints them from this on demand.
+                    exports.push(exportLine(tokenEnv, refresh));
+                }
+            }
+        }
+        for (const key of plan.manualKeys) {
+            if (process.env[key.tokenEnv]) {
+                err(`✓ ${key.tokenEnv} is already set in this shell — skipping.`);
+                continue;
+            }
+            const upstream = key.upstream ?? key.provider;
+            err("");
+            err(`${key.tokenEnv} (${key.provider}) is an API key — create it by hand:`);
+            if (upstream === "openai") {
+                err("  https://platform.openai.com/api-keys — in a dedicated project (set a");
+                err("  monthly budget), as a RESTRICTED key with exactly two permissions, both");
+                err("  under Model capabilities: Responses → Request, Chat completions → Request.");
+                err("  Everything else (including List models) stays None.");
+            }
+            else if (upstream === "anthropic") {
+                err("  https://console.anthropic.com/settings/keys — a workspace-scoped key");
+                err("  with a spend limit is all the reviewer needs.");
+            }
+            else {
+                err(`  mint a key for the "${upstream}" provider.`);
+            }
+            exports.push(exportLine(key.tokenEnv, "<paste the key here>"));
+        }
+        for (const entry of plan.unsupported) {
+            err("");
+            err(`auth for "${entry.provider}" is mode "oauth", which has no automated setup flow here` +
+                (entry.provider === "anthropic"
+                    ? " — and cannot work: Anthropic prohibits subscription tokens in third-party tools. Use an API key instead."
+                    : `. Set ${entry.tokenEnv ?? "its token env"} manually.`));
+        }
+        if (exports.length > 0) {
+            const rc = process.env.SHELL?.includes("zsh") ? "~/.zshrc" : "your shell config";
+            err("");
+            err(`Add ${exports.length === 1 ? "this line" : "these lines"} to ${rc}:`);
+            out("");
+            for (const line of exports) {
+                out(`    ${line}`);
+            }
+            out("");
+            err(`Then restart your shell (or \`source ${rc}\`) and run \`ecr doctor\` to verify.`);
+        }
+        else {
+            err("");
+            err("Nothing to add — run `ecr doctor` to verify your setup.");
+        }
+    }
+    catch (error) {
+        err(`setup-auth failed: ${errorMessage(error)}`);
+        process.exitCode = 1;
+    }
+}

package/build/commands/verify-config.js

@@ -14,15 +14,17 @@ The canonical pre-review guard (ships with the CLI). It sweeps EVERY
 plain recursive walk (skipping node_modules/.git, so a staged-but-unreferenced
 config can't hide from git's index), parses each with the real comment-aware JSONC
 parser (never regex-scraping), and refuses to run (exit 1) when:
-  • auth.tokenEnv (config) / defaults.auth.tokenEnv (routing.jsonc) appears more
-    than once, or in a non-root file, or — with --expected / ECR_EXPECTED_TOKEN_ENV
-    set — differs from the expected name or is absent (count must be exactly one);
+  • a tokenEnv (auth.tokenEnv, or any auth.providers.<id>.tokenEnv; routing.jsonc:
+    same under defaults.auth) appears in a non-root file, in more than one root
+    file, twice under the same name, or — with --expected / ECR_EXPECTED_TOKEN_ENV
+    set (comma-separated) — the declared set differs from the expected set;
   • a non-root config declares auth, breakGlass, or commentTag (root-locked keys);
   • any file fails to parse (fail-closed), reporting the parse error.
 Exit 0 = safe to run the review.
 
 Options:
-  --expected <ENV_NAME>   Require tokenEnv to equal this (else ECR_EXPECTED_TOKEN_ENV).
+  --expected <ENVS>       Require the declared tokenEnv set to equal this
+                          comma-separated set (else ECR_EXPECTED_TOKEN_ENV).
   --json                  Emit {ok, findings:[{file, problem}]} on stdout.
 `;
 const CONFIG_FILENAMES = new Set(["config.jsonc", "config.json", ROUTING_FILENAME]);
@@ -63,22 +65,38 @@ function asObject(value) {
         ? value
         : undefined;
 }
+/** Every tokenEnv an auth block names — legacy single, or one per providers entry. */
+function collectTokenEnvs(auth) {
+    if (!auth) {
+        return [];
+    }
+    const found = [];
+    if (typeof auth.tokenEnv === "string") {
+        found.push(auth.tokenEnv);
+    }
+    const providers = asObject(auth.providers);
+    for (const entry of Object.values(providers ?? {})) {
+        const tokenEnv = asObject(entry)?.tokenEnv;
+        if (typeof tokenEnv === "string") {
+            found.push(tokenEnv);
+        }
+    }
+    return found;
+}
 /** Read the security-relevant declarations from a parsed config/routing object. */
 function extractFacts(file, parsed) {
     if (path.basename(file) === ROUTING_FILENAME) {
         // routing.jsonc locks auth under defaults.auth (defaults.auth.tokenEnv).
         const defaults = asObject(parsed.defaults);
-        const auth = asObject(defaults?.auth);
         return {
-            tokenEnv: typeof auth?.tokenEnv === "string" ? auth.tokenEnv : undefined,
+            tokenEnvs: collectTokenEnvs(asObject(defaults?.auth)),
             declaresAuth: Boolean(defaults) && "auth" in defaults,
             declaresBreakGlass: false, // routing.jsonc has no breakGlass concept
             declaresCommentTag: Boolean(defaults) && "commentTag" in defaults,
         };
     }
-    const auth = asObject(parsed.auth);
     return {
-        tokenEnv: typeof auth?.tokenEnv === "string" ? auth.tokenEnv : undefined,
+        tokenEnvs: collectTokenEnvs(asObject(parsed.auth)),
         declaresAuth: "auth" in parsed,
         declaresBreakGlass: "breakGlass" in parsed,
         declaresCommentTag: "commentTag" in parsed,
@@ -113,8 +131,8 @@ export async function verifyConfig(root, options = {}) {
             continue;
         }
         const facts = extractFacts(file, object);
-        if (facts.tokenEnv !== undefined) {
-            tokenEnvOccurrences.push({ file: rel(file), value: facts.tokenEnv, isRoot });
+        for (const value of facts.tokenEnvs) {
+            tokenEnvOccurrences.push({ file: rel(file), value, isRoot });
         }
         if (!isRoot) {
             const locked = [];
@@ -135,38 +153,58 @@ export async function verifyConfig(root, options = {}) {
             }
         }
     }
-    // tokenEnv must appear at most once, only in a root-owned file.
+    // tokenEnvs may only be declared in root-owned files…
     for (const occurrence of tokenEnvOccurrences.filter((o) => !o.isRoot)) {
         findings.push({
             file: occurrence.file,
             problem: `tokenEnv "${occurrence.value}" is declared outside the root config; only a root-owned config.jsonc/config.json or routing.jsonc may name the forwarded credential`,
         });
     }
-    if (tokenEnvOccurrences.length > 1) {
+    // …and all in ONE root file (multiple entries in one auth block are fine —
+    // that's the multi-provider map — but split across files there is no single
+    // honored source and a stale/staged second file could smuggle a credential).
+    const rootOccurrences = tokenEnvOccurrences.filter((o) => o.isRoot);
+    const rootFiles = [...new Set(rootOccurrences.map((o) => o.file))];
+    if (rootFiles.length > 1) {
         findings.push({
-            file: tokenEnvOccurrences.map((o) => o.file).join(", "),
-            problem: `tokenEnv is declared in ${tokenEnvOccurrences.length} files; it must appear exactly once, in a root-owned config`,
+            file: rootFiles.join(", "),
+            problem: `tokenEnv is declared in ${rootFiles.length} root files; all credential env names must live in ONE root-owned config`,
         });
     }
-    // With an expectation set, exactly one root occurrence equal to it is required.
+    // Duplicate names within a file are a config bug worth failing on too: two auth
+    // entries forwarding the same env var means one of them is misconfigured.
+    const seen = new Set();
+    for (const occurrence of rootOccurrences) {
+        if (seen.has(occurrence.value)) {
+            findings.push({
+                file: occurrence.file,
+                problem: `tokenEnv "${occurrence.value}" is declared more than once; each credential env name must appear exactly once`,
+            });
+        }
+        seen.add(occurrence.value);
+    }
+    // With an expectation set, the declared names must equal the expected SET
+    // exactly (comma-separated; order-insensitive). A missing name is as much a
+    // finding as an extra one — a PR must not add, drop, or repoint credentials.
     const expected = options.expected;
     if (expected) {
-        const rootOccurrences = tokenEnvOccurrences.filter((o) => o.isRoot);
-        if (rootOccurrences.length === 0) {
+        const expectedSet = expected
+            .split(",")
+            .map((name) => name.trim())
+            .filter(Boolean)
+            .sort();
+        const declared = [...seen].sort();
+        if (declared.length === 0) {
             findings.push({
                 file: path.join(CONFIG_DIRNAME, "config.jsonc"),
-                problem: `no tokenEnv found, but an expected value "${expected}" is set — exactly one root-owned tokenEnv is required`,
+                problem: `no tokenEnv found, but expected "${expectedSet.join(", ")}" — the root-owned config must name exactly those credential env(s)`,
             });
         }
-        else {
-            for (const occurrence of rootOccurrences) {
-                if (occurrence.value !== expected) {
-                    findings.push({
-                        file: occurrence.file,
-                        problem: `tokenEnv "${occurrence.value}" != expected "${expected}" — a PR must not repoint which secret is forwarded to the model provider`,
-                    });
-                }
-            }
+        else if (JSON.stringify(declared) !== JSON.stringify(expectedSet)) {
+            findings.push({
+                file: rootFiles.join(", ") || path.join(CONFIG_DIRNAME, "config.jsonc"),
+                problem: `declared tokenEnv set [${declared.join(", ")}] != expected [${expectedSet.join(", ")}] — a PR must not add, drop, or repoint which secrets are forwarded to model providers`,
+            });
         }
     }
     return { ok: findings.length === 0, findings };

package/build/config/load.js

@@ -54,7 +54,14 @@ async function loadConfigDir(dir, schema) {
     const raw = await readFile(configPath, "utf8");
     const rawObject = JSON.parse(stripTrailingCommas(stripJsonComments(raw)));
     const parsed = schema.parse(rawObject);
-    const override = process.env.REVIEWER_MODEL;
+    // An EMPTY REVIEWER_MODEL means "not set", not "use the empty model". GitHub Actions
+    // passes `${{ vars.REVIEWER_MODEL }}` as an empty string whenever that repo variable
+    // doesn't exist — which both scaffolded workflows do — so `??` (which only falls
+    // through on null/undefined) silently replaced every configured model with "". Every
+    // agent and the coordinator then ran on whatever OpenCode picked by default, so a
+    // config saying `anthropic/claude-sonnet-5` reviewed with something else entirely and
+    // nothing anywhere said so. Trim too: a stray newline is the same class of accident.
+    const override = process.env.REVIEWER_MODEL?.trim() || undefined;
     const defaultModel = override ?? parsed.model;
     const resolveModel = (frontmatterModel) => override ?? frontmatterModel ?? defaultModel;
     const resolveTemp = (value, fallback) => {
@@ -112,15 +119,51 @@ async function loadConfigDir(dir, schema) {
         // Scope configs can't declare commentTag (scope schema rejects it);
         // loadScopeConfig overwrites this placeholder with the manifest default.
         commentTag: parsed.commentTag ?? "expo-ai-code-reviewer",
-        auth: {
-            mode: parsed.auth?.mode ?? "api-key",
-            provider: parsed.auth?.provider ?? "anthropic",
-            tokenEnv: parsed.auth?.tokenEnv,
-        },
+        auth: normalizeAuth(parsed.auth),
         review: parsed.review,
     };
     return { config, raw: rawObject };
 }
+/**
+ * Normalize either accepted `auth` shape (legacy single object, or the
+ * per-provider `{ providers }` map) into the canonical entry list. Absent auth
+ * means the schema default (api-key/openai, no tokenEnv).
+ */
+export function normalizeAuth(auth) {
+    if (!auth) {
+        return [{ provider: "openai", mode: "api-key" }];
+    }
+    if ("providers" in auth) {
+        return Object.entries(auth.providers).map(([provider, entry]) => ({
+            provider,
+            mode: entry.mode,
+            tokenEnv: entry.tokenEnv,
+            upstream: entry.upstream,
+        }));
+    }
+    return [{ provider: auth.provider, mode: auth.mode, tokenEnv: auth.tokenEnv }];
+}
+/**
+ * Runtime auth lock: null when the entries' tokenEnv names equal the expected
+ * comma-separated set exactly (order-insensitive), else a human-readable
+ * mismatch. Set semantics because a multi-provider auth block names several
+ * credential envs — a PR must not be able to add, drop, or repoint any of them.
+ */
+export function tokenEnvMismatch(auth, expected) {
+    const declared = [
+        ...new Set(auth.map((entry) => entry.tokenEnv).filter((v) => Boolean(v))),
+    ].sort();
+    const expectedSet = [
+        ...new Set(expected
+            .split(",")
+            .map((name) => name.trim())
+            .filter(Boolean)),
+    ].sort();
+    if (JSON.stringify(declared) === JSON.stringify(expectedSet)) {
+        return null;
+    }
+    return `configured tokenEnv set [${declared.join(", ") || "(none)"}] != ECR_EXPECTED_TOKEN_ENV [${expectedSet.join(", ")}]`;
+}
 /**
  * auth is honored ONLY here: the manifest's `defaults.auth` wins when present,
  * otherwise the root config.jsonc auth. A scope config can never contribute auth
@@ -130,7 +173,7 @@ async function loadConfigDir(dir, schema) {
 export function loadAuthFromRoot(rootConfig, manifest) {
     const override = manifest?.defaults.auth;
     if (override) {
-        return { mode: override.mode, provider: override.provider, tokenEnv: override.tokenEnv };
+        return normalizeAuth(override);
     }
     return rootConfig.auth;
 }

package/build/config/schema.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 export const ReviewConfigSchema = z.object({
     /** Default model for every agent + the coordinator. Override per-agent via
      * frontmatter in the agent's markdown, or globally via REVIEWER_MODEL. */
-    model: z.string().default("anthropic/claude-sonnet-5"),
+    model: z.string().default("openai/gpt-5.5"),
     policy: z
         .object({
         includeSuggestions: z.boolean().default(false),
@@ -52,17 +52,45 @@ export const ReviewConfigSchema = z.object({
         .object({ marker: z.string().default("/skip-review") })
         .default({ marker: "/skip-review" }),
     commentTag: z.string().default("expo-ai-code-reviewer"),
+    // Two accepted shapes (see AuthConfigEntry for the canonical internal form):
+    //  - legacy single credential: { mode, provider, tokenEnv }
+    //  - per-provider map:         { providers: { <id>: { mode, tokenEnv, upstream? } } }
+    // The map form allows a MIXED setup — e.g. the "openai" provider on a ChatGPT/Codex
+    // subscription (mode "oauth", tokenEnv = the refresh token) plus an "openai-api"
+    // alias (upstream "openai") holding a metered API key for pro-tier models the
+    // subscription doesn't offer.
+    //
+    // Union order matters: the map form must be tried FIRST — the legacy object's keys
+    // all have defaults, so a non-strict legacy parse would accept (and gut) a
+    // { providers } object by stripping the unknown key.
     auth: z
-        .object({
-        // "api-key": the token env is sent as the provider's API key (x-api-key).
-        // "oauth": the token env is a Claude Pro/Max style OAuth token, injected
-        // into an isolated OpenCode auth.json so it's sent as a Bearer token.
-        mode: z.enum(["api-key", "oauth"]).default("api-key"),
-        provider: z.string().default("anthropic"),
-        /** Env var holding the key/token. */
-        tokenEnv: z.string().optional(),
-    })
-        .default({ mode: "api-key", provider: "anthropic" }),
+        .union([
+        z.object({
+            providers: z.record(z.string(), z.object({
+                // "api-key": tokenEnv holds the provider's API key.
+                // "oauth": tokenEnv holds an OAuth token, injected into an isolated
+                // OpenCode auth.json. For "openai" this is the REFRESH token from a
+                // ChatGPT/Codex sign-in (OpenCode's codex plugin mints access tokens
+                // from it). NOTE: anthropic oauth cannot work — OpenCode has no
+                // anthropic OAuth plugin and Anthropic prohibits subscription tokens
+                // in third-party tools.
+                mode: z.enum(["api-key", "oauth"]).default("api-key"),
+                tokenEnv: z.string().optional(),
+                // Set ⇒ this provider id is an ALIAS synthesized into the OpenCode
+                // config, backed by the named upstream's SDK ("openai", "anthropic",
+                // anything else = openai-compatible). Lets one upstream be reached
+                // with two credentials at once (subscription + API key).
+                upstream: z.string().optional(),
+            })),
+        }),
+        z.object({
+            mode: z.enum(["api-key", "oauth"]).default("api-key"),
+            provider: z.string().default("openai"),
+            /** Env var holding the key/token. */
+            tokenEnv: z.string().optional(),
+        }),
+    ])
+        .default({ mode: "api-key", provider: "openai" }),
     review: z
         .object({
         // Which PRs `ecr ci` acts on — the source of truth for trigger policy (a
@@ -104,21 +132,23 @@ export const RoutingManifestSchema = z
     budget: z
         .object({
         /** Total passes budget (minutes) split across active scopes. Sized to fit
-         * the scaffolded workflow's `timeout-minutes` (60) with margin for the
-         * coordinator, verification, and git/gh overhead. */
-        totalPassesMinutes: z.number().int().positive().default(32),
+         * the scaffolded workflow's `timeout-minutes` (90) with margin for the
+         * coordinator (10m), verification, and git/gh overhead. The cross-file pass
+         * expands to fill whatever of this window is left (see review.ts), so this
+         * is the knob that decides how long it may trace. */
+        totalPassesMinutes: z.number().int().positive().default(55),
         /** Per-scope floor (minutes): below this a scope review isn't worth
          * starting, so the even split clamps up to it — even when that makes the
          * scopes overshoot the total (ecr ci warns; doctor flags the worst case). */
         minScopeMinutes: z.number().int().positive().default(5),
     })
-        .default({ totalPassesMinutes: 32, minScopeMinutes: 5 }),
+        .default({ totalPassesMinutes: 55, minScopeMinutes: 5 }),
     defaults: z
         .object({
         /** The ONLY manifest-level place auth is honored (locks the root value).
          * Unwrap the inner `.default()` first: in zod v4 a `.default().optional()`
          * chain still fires the default when the key is absent, which would make
-         * `defaults.auth` a phantom `{mode:'api-key',provider:'anthropic'}` for every
+         * `defaults.auth` a phantom `{mode:'api-key',provider:'openai'}` for every
          * manifest that omits auth and silently override the root config's real auth. */
         auth: ReviewConfigSchema.shape.auth.unwrap().optional(),
         /** Agent ids injected into every scope with alwaysRun, from the ROOT roster. */