@expo/code-review-cli 0.5.1 → 0.6.0

package/README.md

@@ -55,7 +55,7 @@ subscription** sign-in (it runs OpenCode's browser login and extracts the token
 for you). `doctor` offers to run it whenever a credential is missing.
 
 In CI, store the same values as repo secrets (`OPENAI_API_KEY`; plus
-`CODEX_OAUTH_REFRESH_TOKEN` for the mixed setup) — the scaffolded workflow
+`CODEX_OAUTH_ACCESS_TOKEN` for the mixed setup) — the scaffolded workflow
 forwards them.
 
 **Have a ChatGPT Plus/Pro (Codex) subscription? Use both.** The recommended
@@ -218,16 +218,31 @@ your-monorepo/
   (e.g. `security`) are injected into every scope with `alwaysRun`, taken from the
   root roster — a scope defining a same-id agent gets the root one, so a team can't
   shadow the enforced reviewer with a weaker version on its own subtree.
-- **Config comes from the checked-out ref (documented tradeoff).** The scaffolded
-  auto workflow checks out the PR **merge ref**, so a PR *can* edit rosters, prompts,
-  and routing globs for its own advisory review — that only steers what the
-  comment-only reviewer says about that PR. What a PR can **never** do is touch
-  credentials: `auth` is locked by the scope-schema rejection, the CLI's runtime
-  `ECR_EXPECTED_TOKEN_ENV` check, and the guard step above, all three of which run
-  against whatever ref is checked out. A `/review`-command workflow that checks out
-  only the trusted base ref (see eas-cli's) closes the prompt-tampering vector too;
-  resolving config from the base ref on the auto path as well is on the
-  [roadmap](./ROADMAP.md).
+- **Configuration comes from the PR's trusted base commit.** In `ecr ci`, review
+  policy and reviewer configuration — `config.jsonc`, `routing.jsonc`, prompts,
+  models, and the auth mapping — load from the PR's immutable **base** commit,
+  materialized via the GitHub API. The PR head is untrusted data: it is
+  materialized separately (pinned to its immutable OID) purely as source content
+  to read and verify against. A PR editing rosters, prompts, or routing is
+  reviewed under the **previous** config; its changes activate after merge. If
+  the base commit can't be materialized, the run fails closed (one terminal
+  comment) — it never falls back to the checkout. A scope config that is new in
+  a PR is reviewed with the root config until it merges.
+- **The model runtime never sees PR-owned ambient config.** The head worktree the
+  agents read from is scrubbed of runtime configuration before the OpenCode
+  server starts: `opencode.json{,c}`, `.opencode/` (plugins), `AGENTS.md`,
+  `CLAUDE.md`, `.claude/`, `.mcp.json`, `.cursor*`, and `.env*` at every depth.
+  A PR can't install a plugin, MCP server, instruction file, or `.env` into the
+  process that holds the model credential and the comment token. (Changes to
+  those files are still reviewed — their diffs are inlined in the prompt — but a
+  finding citing one can't be re-read during verification; that's the tradeoff.)
+- **The scaffolded workflows check out only the base commit** with
+  `persist-credentials: false`; the CLI's own git fetches authenticate through
+  `gh` from `GH_TOKEN`, so the token never lands in `.git/config` or argv. The
+  CLI enforces the trust model itself, so a custom workflow that checks out the
+  PR head still gets base-commit configuration. The temporary escape hatch
+  `ecr ci --unsafe-config-from-head` restores the old behavior with a loud
+  security warning and will be removed on a minor boundary.
 
 Ownership is enforced with CODEOWNERS: `/.expo-code-review/routing.jsonc @your-infra`
 (the single authoritative router) and `/server/www/.expo-code-review/ @your-www-team`
@@ -344,7 +359,7 @@ coordinator, and per-repo `noise.additionalIgnores`.
 {
   "model": "openai/gpt-5.5",                  // default model for the specialists
   "policy": { "includeSuggestions": false },  // suppress suggestion-severity findings
-  "chunk": { "maxChangedLines": 1000, "maxFiles": 20, "concurrency": 6 },
+  "chunk": { "maxChangedLines": 1000, "maxFiles": 20 },  // concurrency defaults: 6 (API key) / 3 (subscription)
   "noise": { "additionalIgnores": ["packages/*/build/**"] },
   "review": { "trigger": "all",               // which PRs `ecr ci` reviews: "all"
               "label": "ai-review",            // (default, except ai-review:skip) or
@@ -406,6 +421,15 @@ change which model reviewed your code. Use an explicit override instead.
   session, inside the same budget — instead of spending the whole cap on a dead
   request. Progress lines say how long a reply has been silent, so this is legible in
   the CI log.
+- **Rate limits are detected and waited out, not fought.** The reviewer watches the
+  OpenCode server's own log for provider 429s (hard evidence, per run). A stall
+  *with* recent 429 evidence is throttling, not a wedge — the pass waits in 90s
+  beats (without consuming its one retry) instead of re-sending its whole context
+  into a limited account; explicit 429 errors retry on a slow 15s/45s/90s schedule.
+  Subscription (oauth) runs also default to `concurrency` 3 instead of 6, since one
+  account may be serving several PRs' reviews at once. Rate-limit events are
+  reported in the job log and the run log (`rateLimitEvents`), so throttling is a
+  visible fact about a run, never a mystery slowdown.
 - **Soft landing on timeout** — at either cap, the run is interrupted and the agent
   is asked to return the findings it already has, rather than discarding its work.
   Tools are disabled for that request, so the salvage step can't resume investigating
@@ -490,7 +514,7 @@ set in `config.auth` (credentials come from OpenCode):
 
   ```jsonc
   "auth": { "providers": {
-    "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_REFRESH_TOKEN" },
+    "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_ACCESS_TOKEN" },
     "openai-api": { "mode": "api-key", "tokenEnv": "OPENAI_API_KEY", "upstream": "openai" }
   } }
   ```
@@ -499,11 +523,14 @@ set in `config.auth` (credentials come from OpenCode):
   (`upstream` names the SDK it's backed by): agents reference `openai-api/gpt-5.5-pro`
   in frontmatter while everything else stays on `openai/gpt-5.5`. Notes:
 
-  - **The oauth `tokenEnv` holds the refresh token** from an `opencode auth login`
-    ChatGPT sign-in (copy `.openai.refresh` out of OpenCode's `auth.json`) —
-    access tokens are short-lived, so the refresh token is the durable secret and
-    OpenCode mints access tokens on demand. Refresh-token reuse across runs is
-    verified, so a static CI secret works.
+  - **The oauth `tokenEnv` holds the ACCESS token** from an `opencode auth login`
+    ChatGPT sign-in (`ecr setup-auth` extracts it) — a plain bearer, valid for
+    days, with no rotation involvement. Do **not** use the refresh token as a
+    shared secret: refresh tokens are single-use (rotation), so a static copy is
+    spent by its first use and the sign-in dies with it. Access tokens expire
+    (~10 days observed), so CI secrets need periodic re-minting — see the
+    token-rotator item in the [roadmap](./ROADMAP.md); `doctor` and the run
+    preflight warn before expiry.
   - **The API key needs exactly two permissions** — a *Restricted* key with
     *Model capabilities*: **Responses → Request** and **Chat completions →
     Request**; everything else (including *List models*) stays None. Create it
@@ -511,7 +538,7 @@ set in `config.auth` (credentials come from OpenCode):
     instructions too.)
   - **In CI**, set the `ECR_EXPECTED_TOKEN_ENV` repo variable to the
     comma-separated set of both env names
-    (`CODEX_OAUTH_REFRESH_TOKEN,OPENAI_API_KEY`) and pass both secrets in the
+    (`CODEX_OAUTH_ACCESS_TOKEN,OPENAI_API_KEY`) and pass both secrets in the
     workflow.
   - **Auditability**: every pass logs which provider/model answered it (job log,
     step summary, run log), so the subscription/API split is visible per run.

package/build/commands/ci.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
-import { loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
+import path from "node:path";
+import { CONFIG_DIRNAME, hasScopeConfig, loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
 import { loadRoutingManifest, resolveScopes, scopedCommentTag, scopePassesBudgetMs, formatOwnerTable, } from "../config/routing.js";
 import { repoRoot, run } from "../core/exec.js";
 import { errorMessage } from "../core/util.js";
@@ -32,6 +33,15 @@ For GitHub Actions: reads the PR number + repo from the event/env, gets the diff
 via \`gh pr diff\`, runs the reviewer, and upserts a single PR comment. Comment-only
 and non-blocking (a reviewer failure never fails the PR's checks).
 
+Trust model: review policy and reviewer configuration (config.jsonc, routing,
+prompts, models, auth mapping) load from the PR's immutable BASE commit,
+materialized via the GitHub API — never from the PR head — so a PR cannot change
+the reviewer that evaluates it; config changes activate after merge. The PR head
+is materialized separately (pinned to its immutable OID, scrubbed of ambient
+runtime config) purely as source content to read and verify against. If the
+trusted base cannot be materialized, the run fails closed with one terminal
+comment; it never falls back to the checkout.
+
 Monorepos: when .expo-code-review/routing.jsonc exists, ci fans out INTERNALLY —
 it assigns each changed file to exactly one scope (last-match-wins) and reviews
 each active scope over only its files, then renders one aggregated comment (or one
@@ -42,8 +52,17 @@ Options:
   --route              Let the router pick relevant agents from the diff
   --scopes <a,b>       Limit the fan-out to these named scopes (routing only)
   --config-dir <dir>   Load the ROOT config.jsonc + routing.jsonc from <dir>
-                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). Scope
-                       subtrees stay repo-root-relative.
+                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). A
+                       RELATIVE dir resolves beneath the trusted base commit; an
+                       ABSOLUTE dir is an explicit operator trust decision. Scope
+                       subtrees always resolve beneath the trusted base commit.
+  --unsafe-config-from-head
+                       COMPATIBILITY ESCAPE HATCH: load configuration from the
+                       current checkout instead of the PR's trusted base commit.
+                       This lets a same-repo PR change the reviewer (policy,
+                       prompts, model, auth mapping) that evaluates itself.
+                       Never scaffolded; prints a security warning; will be
+                       removed on a scheduled minor boundary.
   --comment <mode>     Override manifest comment mode: single | per-scope
   --force              Manual override: review even if the trigger policy (label
                        trigger / ai-review:skip) would skip. Break-glass and the
@@ -78,6 +97,7 @@ export async function ciCommand(argv = []) {
     // A maintainer's explicit `/review` (comment command or --force) is a manual
     // escape hatch that bypasses the trigger-policy gate only (see passesTriggerGate).
     const bypassTriggerGate = shouldBypassTriggerGate(argv);
+    const unsafeConfigFromHead = argv.includes("--unsafe-config-from-head");
     const root = await repoRoot();
     if (root && root !== process.cwd()) {
         process.chdir(root);
@@ -89,35 +109,120 @@ export async function ciCommand(argv = []) {
         process.stderr.write("CI reviewer: could not determine repository or PR number from the environment. Skipping.\n");
         return;
     }
-    // A malformed manifest is a loud, non-blocking error (never a silent fallback).
-    let manifest;
-    try {
-        manifest = await loadRoutingManifest(cwd, { configDir });
+    // ONE source for the whole run: metadata (incl. immutable OIDs), the diff, and
+    // the PR-head read root are each fetched once and shared across scopes.
+    const ghSource = new GitHubPRSource({ prNumber, repo, cwd });
+    const source = memoizeSource(ghSource);
+    // Trusted configuration root: review policy and reviewer config load from the
+    // PR's immutable BASE commit, so the PR head is data, never policy. Fail CLOSED:
+    // when the base can't be materialized, post the one terminal comment and stop —
+    // silently reading the checkout would let a head checkout smuggle config in.
+    let trustedRoot = null;
+    let configRoot = cwd;
+    if (unsafeConfigFromHead) {
+        process.stderr.write("CI reviewer: ⚠ SECURITY — --unsafe-config-from-head is set: reviewer configuration " +
+            "(policy, prompts, models, auth mapping) is being loaded from the current checkout, so " +
+            "a same-repository PR can change the reviewer that evaluates it. This escape hatch will " +
+            "be removed in a future minor release.\n");
     }
-    catch (error) {
-        process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
-        return;
+    else {
+        try {
+            trustedRoot = await ghSource.prepareTrustedConfigRootAsync();
+            configRoot = trustedRoot.dir;
+        }
+        catch (error) {
+            const reason = errorMessage(error);
+            process.stderr.write(`CI reviewer: could not materialize the PR's base commit for trusted configuration ` +
+                `(failing closed, not reviewing): ${reason}\n`);
+            await postTerminalFailureNote(repo, prNumber, cwd, `it could not load trusted configuration from the PR's base commit (${reason}). ` +
+                `This usually means the runner has no git checkout or no usable GH_TOKEN; re-run once fixed`);
+            return;
+        }
     }
-    if (manifest == null) {
-        await runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir);
-        return;
+    try {
+        // A malformed manifest is a loud, non-blocking error (never a silent fallback).
+        let manifest;
+        try {
+            manifest = await loadRoutingManifest(configRoot, { configDir });
+        }
+        catch (error) {
+            process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
+            return;
+        }
+        if (manifest == null) {
+            await runLegacyCi(source, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                bypassTriggerGate,
+                configDir,
+            });
+            return;
+        }
+        try {
+            await runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                scopesFilter,
+                commentOverride,
+                bypassTriggerGate,
+                configDir,
+            });
+        }
+        catch (error) {
+            // Fan-out failures stay non-blocking (single-writer property is the point).
+            process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+        }
     }
+    finally {
+        await source.dispose();
+        await trustedRoot?.cleanup();
+    }
+}
+/**
+ * The one terminal "this PR was NOT reviewed" comment for failures that happen
+ * before any configuration is loaded (trusted-root materialization). Uses the
+ * DEFAULT comment tag/break-glass marker because the config that could customize
+ * them is exactly what failed to load; a repo with a custom tag gets a fresh
+ * comment rather than an upsert, which is the acceptable degraded case.
+ */
+async function postTerminalFailureNote(repo, prNumber, cwd, reason) {
     try {
-        await runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir);
+        const reporter = new GitHubReporter({
+            prNumber,
+            repo,
+            commentTag: "expo-ai-code-reviewer",
+            breakGlassMarker: "/skip-review",
+            cwd,
+        });
+        await reporter.report({
+            decision: "approve_with_comments",
+            findings: [],
+            summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed: ${reason}.`,
+            incomplete: [],
+            couldNotComplete: true,
+        });
     }
-    catch (error) {
-        // Fan-out failures stay non-blocking (single-writer property is the point).
-        process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+    catch (postError) {
+        process.stderr.write(`CI reviewer: also failed to post the failure notice: ${errorMessage(postError)}\n`);
     }
 }
+/**
+ * Run-log + patch-workspace anchor: ALWAYS the workspace checkout, never the
+ * (temporary, removed-on-exit) trusted config root — the workflow uploads
+ * `.expo-code-review/.runs/reviews.jsonl` from the workspace as an artifact.
+ */
+function workspaceRunsDir(cwd) {
+    return path.join(cwd, CONFIG_DIRNAME, ".runs");
+}
 /**
  * The pre-routing single-config path. Kept byte-for-byte equivalent so that with no
  * routing.jsonc the CLI behaves exactly as before (backcompat invariant).
  */
-async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir) {
+async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, bypassTriggerGate, configDir } = options;
     let config;
     try {
-        config = await loadReviewConfig(cwd, { configDir });
+        config = await loadReviewConfig(configRoot, { configDir });
     }
     catch (error) {
         process.stderr.write(`CI reviewer: ${errorMessage(error)}\n`);
@@ -158,11 +263,12 @@ async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     try {
-        const review = await runReview(new GitHubPRSource({ prNumber, repo, cwd }), {
+        const review = await runReview(source, {
             config,
             mode: "ci",
             agents,
             route,
+            runsDir: workspaceRunsDir(cwd),
             onProgress: (message) => process.stderr.write(`${message}\n`),
         });
         await reporter.report(review);
@@ -198,10 +304,12 @@ function failureReview(scopeName, reason) {
     };
 }
 /** The routing fan-out: one process, N scopes reviewed sequentially, one render. */
-async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir) {
+async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir } = options;
     // The root config + manifest follow the override; scope configs stay
-    // repo-root-relative (loadScopeConfig reads <root>/<scope.config>/.expo-code-review).
-    const rootConfig = await loadReviewConfig(cwd, { configDir });
+    // relative to the TRUSTED root (loadScopeConfig reads
+    // <configRoot>/<scope.config>/.expo-code-review).
+    const rootConfig = await loadReviewConfig(configRoot, { configDir });
     // The root/aggregate marker is the ACTUAL root-owned comment tag so the
     // pre-routing comment and its dismissal state upsert in place, not stranded
     // under a new marker (risk 8/9). manifest.defaults.commentTag is the
@@ -240,7 +348,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
     if (!passesTriggerGate(await fetchPrLabels(repo, prNumber, cwd), rootConfig.review, bypassTriggerGate)) {
         return;
     }
-    const source = memoizeSource(new GitHubPRSource({ prNumber, repo, cwd }));
     const changed = await source.getChangedFiles();
     const resolution = resolveScopes(manifest, changed.map((file) => file.path));
     process.stderr.write("CI reviewer: scope ownership —\n");
@@ -276,7 +383,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         if (await bgReporter.checkBreakGlass()) {
             process.stderr.write(`CI reviewer: ${rootConfig.breakGlassMarker} detected; skipping.\n`);
             await bgReporter.postSkipNote();
-            await source.dispose();
             return;
         }
     }
@@ -284,17 +390,17 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     // Build ONE link context for all scopes (rate-limit hygiene): diff lines from the
-    // already-fetched changed files, base SHA via a single `gh pr view`.
+    // already-fetched changed files, base OID from the memoized PR metadata (the same
+    // immutable OID the trusted config root was materialized from).
     const link = {
         repo,
         prNumber,
         diffLines: buildDiffLineIndex(changed.map((file) => ({ path: file.path, patch: file.patch }))),
     };
     try {
-        const { stdout } = await run("gh", ["pr", "view", String(prNumber), "--repo", repo, "--json", "baseRefOid"], { cwd });
-        const oid = JSON.parse(stdout).baseRefOid;
-        if (oid) {
-            link.baseSha = oid;
+        const { baseOid } = await source.getMetadata();
+        if (baseOid) {
+            link.baseSha = baseOid;
         }
     }
     catch {
@@ -317,7 +423,18 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         const isDefault = scope.configDir === ".";
         let review;
         try {
-            const config = await loadScopeConfig(cwd, scopeDef, manifest, rootConfig);
+            // A scope whose config dir doesn't exist at the TRUSTED base commit is a
+            // scope this PR introduces: review it with the root config rather than
+            // failing the run on exactly that PR. The scope's own config (PR-owned,
+            // untrusted for this run) activates once it merges.
+            let effectiveScopeDef = scopeDef;
+            if (!hasScopeConfig(configRoot, scopeDef)) {
+                process.stderr.write(`CI reviewer: [${scope.name}] no config at "${scopeDef.config}" in the PR's base ` +
+                    `commit (new in this PR?); reviewing with the root config — the scope's config ` +
+                    `takes effect after merge.\n`);
+                effectiveScopeDef = { ...scopeDef, config: "." };
+            }
+            const config = await loadScopeConfig(configRoot, effectiveScopeDef, manifest, rootConfig);
             review = await runReview(source, {
                 config,
                 mode: "ci",
@@ -325,6 +442,7 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
                 route,
                 includePaths: scope.files,
                 passesBudgetMs: budget,
+                runsDir: workspaceRunsDir(cwd),
                 onProgress: (message) => process.stderr.write(`[${scope.name}] ${message}\n`),
             });
         }
@@ -335,7 +453,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         }
         results.push({ scope: scope.name, isDefault, review });
     }
-    await source.dispose();
     const reporterFor = (tag, withLink = false) => new GitHubReporter({
         prNumber,
         repo,

package/build/commands/review.js

@@ -38,9 +38,11 @@ Options:
   --no-fail            always exit 0, even on request-changes
   -h, --help           show this help
 
-Note: agents read the local working tree for surrounding context, so --pr uses the
-PR's diff (authoritative) but your checked-out files for context. For full fidelity
-on a PR, \`gh pr checkout <n>\` first, then run a plain \`ecr review\`.
+Note: with --repo (or in CI), --pr materializes the PR-head tree (pinned to its
+immutable commit, scrubbed of ambient runtime config) so reads match the PR; if
+that isn't possible, it falls back to your checked-out files with a warning.
+Config always loads from YOUR checkout in local runs — you are the trust
+principal here. In \`ecr ci\`, config loads from the PR's trusted base commit.
 
 Exit codes: 0 approve / approve-with-comments, 1 request-changes, 2 error.
 `;

package/build/commands/setup-auth.js

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline/promises";
 import { hasConfig, loadReviewConfig } from "../config/load.js";
+import { jwtExpiryMs } from "../core/auth.js";
 import { opencodeBinSource } from "../core/opencode.js";
 import { errorMessage } from "../core/util.js";
 const USAGE = `ecr setup-auth — set up model credentials for local runs
@@ -48,13 +49,25 @@ export function opencodeAuthJsonPath(env = process.env) {
     const dataHome = env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share");
     return path.join(dataHome, "opencode", "auth.json");
 }
-/** The stored ChatGPT sign-in's refresh token, if OpenCode has one. */
-async function readStoredRefreshToken() {
+/**
+ * The stored ChatGPT sign-in's ACCESS token, if OpenCode has a live one. The
+ * refresh token deliberately never leaves OpenCode's store: refresh tokens are
+ * SINGLE-USE (rotation) and OpenCode is their sole legitimate consumer — a copy
+ * in a shell config or CI secret dies on the next rotation and can take the
+ * whole sign-in with it. The access token is a plain bearer that stays valid for
+ * days and never touches rotation.
+ */
+async function readStoredAccessToken() {
     try {
         const raw = await readFile(opencodeAuthJsonPath(), "utf8");
         const parsed = JSON.parse(raw);
         const openai = parsed.openai;
-        return openai?.type === "oauth" && openai.refresh ? openai.refresh : null;
+        if (openai?.type !== "oauth" || !openai.access) {
+            return null;
+        }
+        const expiresMs = jwtExpiryMs(openai.access) ?? 0;
+        // An expired stored token means the sign-in needs redoing anyway.
+        return expiresMs > Date.now() ? { token: openai.access, expiresMs } : null;
     }
     catch {
         return null;
@@ -96,7 +109,7 @@ export async function setupAuthCommand(argv = []) {
         else {
             err("No .expo-code-review config here — setting up the default ChatGPT/Codex flow.");
             plan = planFromAuth([
-                { provider: "openai", mode: "oauth", tokenEnv: "CODEX_OAUTH_REFRESH_TOKEN" },
+                { provider: "openai", mode: "oauth", tokenEnv: "CODEX_OAUTH_ACCESS_TOKEN" },
             ]);
         }
         if (!plan.chatgptLogin && plan.manualKeys.length === 0 && plan.unsupported.length === 0) {
@@ -110,14 +123,15 @@ export async function setupAuthCommand(argv = []) {
                 err(`✓ ${tokenEnv} is already set in this shell — skipping the ChatGPT sign-in.`);
             }
             else {
-                let refresh = await readStoredRefreshToken();
-                if (refresh) {
-                    err("Found an existing ChatGPT sign-in in OpenCode.");
-                    if (!(await confirm(`Reuse it for ${tokenEnv}?`, yes))) {
-                        refresh = null;
+                let stored = await readStoredAccessToken();
+                if (stored) {
+                    err(`Found a live ChatGPT sign-in in OpenCode (access token valid ` +
+                        `${Math.max(1, Math.round((stored.expiresMs - Date.now()) / 86_400_000))} more day(s)).`);
+                    if (!(await confirm(`Use it for ${tokenEnv}?`, yes))) {
+                        stored = null;
                     }
                 }
-                if (!refresh) {
+                if (!stored) {
                     err("This will run the bundled `opencode auth login` (interactive).");
                     err("When it prompts:");
                     err("  1. select the provider:  OpenAI");
@@ -133,17 +147,20 @@ export async function setupAuthCommand(argv = []) {
                         if (result.status !== 0) {
                             throw new Error(`\`opencode auth login\` exited with ${result.status ?? "a signal"}; nothing was changed.`);
                         }
-                        refresh = await readStoredRefreshToken();
-                        if (!refresh) {
-                            throw new Error("The login finished but no ChatGPT sign-in was stored — did you select " +
+                        stored = await readStoredAccessToken();
+                        if (!stored) {
+                            throw new Error("The login finished but no live ChatGPT sign-in was stored — did you select " +
                                 'OpenAI → "Sign in with ChatGPT"? Re-run `ecr setup-auth` to try again.');
                         }
                     }
                 }
-                if (refresh) {
-                    // The REFRESH token is the durable secret: access tokens are short-lived,
-                    // and OpenCode mints them from this on demand.
-                    exports.push(exportLine(tokenEnv, refresh));
+                if (stored) {
+                    // The ACCESS token: a plain bearer, valid for days, no rotation involved.
+                    // (The refresh token stays in OpenCode's store — it is single-use, and
+                    // copying it anywhere kills it on the next rotation.)
+                    exports.push(exportLine(tokenEnv, stored.token));
+                    err(`Note: this access token expires in ~${Math.max(1, Math.round((stored.expiresMs - Date.now()) / 86_400_000))} day(s); ` +
+                        `re-run \`ecr setup-auth\` then to refresh it (your OpenCode sign-in stays valid).`);
                 }
             }
         }

package/build/config/load.js

@@ -177,6 +177,21 @@ export function loadAuthFromRoot(rootConfig, manifest) {
     }
     return rootConfig.auth;
 }
+/**
+ * Whether a scope's own config dir exists under `root` — the same path
+ * `loadScopeConfig` reads (deliberately NOT via resolveConfigDir: ECR_CONFIG_DIR
+ * must never redirect scope subtrees). `ecr ci` uses this against the TRUSTED
+ * BASE root to give scopes that are new in a PR a defined miss behavior (review
+ * with the root config; the scope config activates after merge) instead of
+ * failing the run on exactly the PR that introduces the scope.
+ */
+export function hasScopeConfig(root, scope) {
+    if (scope.config === ".") {
+        return true;
+    }
+    const dir = path.join(root, scope.config, CONFIG_DIRNAME);
+    return existsSync(path.join(dir, "config.jsonc")) || existsSync(path.join(dir, "config.json"));
+}
 /**
  * Load one scope's fully-resolved config. The default scope (config '.') reuses
  * the root config unchanged except auth; a nested scope reads its own

package/build/config/schema.js

@@ -38,10 +38,15 @@ export const ReviewConfigSchema = z.object({
         maxChangedLines: z.number().int().positive().default(1000),
         // Secondary guard so a chunk isn't an absurd number of tiny-diff files.
         maxFiles: z.number().int().positive().default(20),
-        // Max concurrent reviewer calls across all agents/chunks.
-        concurrency: z.number().int().positive().default(6),
+        // Max concurrent reviewer calls across all agents/chunks. Unset ⇒ resolved
+        // from the auth mode: 6 for API-key runs, 3 when a subscription (oauth)
+        // credential is configured — one ChatGPT account handles six parallel
+        // streams poorly (requests get parked = the stall signature), and several
+        // PRs may be reviewing on the same credential at once. An explicit value
+        // here always wins. See effectiveConcurrency in core/review.ts.
+        concurrency: z.number().int().positive().optional(),
     })
-        .default({ maxChangedLines: 1000, maxFiles: 20, concurrency: 6 }),
+        .default({ maxChangedLines: 1000, maxFiles: 20 }),
     noise: z
         .object({
         additionalIgnores: z.array(z.string()).default([]),