@expo/code-review-cli 0.5.1 → 0.6.0

package/build/core/auth.js

@@ -74,6 +74,31 @@ export function checkOauthTokenShape(provider, token, tokenEnv) {
             detail: `${tokenEnv} holds only ${token.length} characters, too short to be a real ${provider} token — it looks truncated. ${fix}`,
         };
     }
+    // A ChatGPT access token carries its own expiry — check it up front, so a
+    // lapsed credential is one clear message instead of N failed passes, and a
+    // nearly-lapsed one warns before it bites mid-run.
+    if (provider === "openai" && isJwtAccessToken(token)) {
+        const expires = jwtExpiryMs(token);
+        if (expires !== null) {
+            const remainingMs = expires - Date.now();
+            if (remainingMs <= 0) {
+                return {
+                    ok: false,
+                    detail: `${tokenEnv} holds a ChatGPT access token that EXPIRED ${Math.ceil(-remainingMs / 86_400_000)} day(s) ago. ` +
+                        `Mint a fresh one (\`ecr setup-auth\`, or your token-rotator job) and update ${tokenEnv}.`,
+                };
+            }
+            if (remainingMs < 3 * 86_400_000) {
+                return {
+                    ...ok,
+                    detail: `oauth for ${provider}; token env ${tokenEnv} is set`,
+                    warning: `${tokenEnv}'s ChatGPT access token expires in ${Math.max(1, Math.round(remainingMs / 3_600_000))}h — ` +
+                        `re-mint it soon (\`ecr setup-auth\`, or your token-rotator job).`,
+                };
+            }
+        }
+        return { ...ok, detail: `oauth for ${provider}; token env ${tokenEnv} is set` };
+    }
     // Only anthropic's formats are known well enough to say anything about.
     if (provider !== "anthropic") {
         return ok;
@@ -241,20 +266,45 @@ export function checkProviderAuth(config, env = process.env) {
         ...(warnings.length > 0 ? { warning: warnings.join("; ") } : {}),
     };
 }
+/** A ChatGPT access token is a JWT (three base64url segments); refresh tokens are opaque. */
+export function isJwtAccessToken(token) {
+    return token.startsWith("eyJ") && token.split(".").length === 3;
+}
+/** A JWT's `exp` claim as epoch ms, decoded (not verified) — null when unreadable. */
+export function jwtExpiryMs(token) {
+    const payload = token.split(".")[1];
+    if (!payload) {
+        return null;
+    }
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof claims.exp === "number" ? claims.exp * 1000 : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * The auth.json entry for one oauth credential. Provider-shaped:
- * - openai: the durable secret is the REFRESH token (a ChatGPT/Codex sign-in's
- *   access tokens live ~1h, shorter than a worst-case run), so store it with
- *   `expires: 0` and let OpenCode's codex plugin mint access tokens on demand.
+ * The auth.json entry for one oauth credential. Shaped by what the token IS:
+ * - a JWT (an ACCESS token, e.g. from `ecr setup-auth` or a rotator job): use it
+ *   as-is and never refresh — refresh tokens are SINGLE-USE (rotation), so a
+ *   static/shared secret must not participate in rotation at all. Expiry comes
+ *   from the JWT's own `exp` claim so OpenCode trusts it exactly as long as it
+ *   is valid.
+ * - an opaque openai token (a REFRESH token): store it with `expires: 0` and let
+ *   OpenCode's codex plugin mint the access token. Only safe when this run is
+ *   the token's SOLE consumer — a value shared across runs/repos dies on first
+ *   rotation (learned the hard way).
  * - everything else: the token IS the access credential (e.g. long-lived
  *   setup-token style bearers), far-future expiry so OpenCode never tries to
  *   refresh a credential that has no refresh half.
  */
 export function oauthAuthJsonEntry(provider, token) {
-    if (provider === "openai") {
+    if (provider === "openai" && !isJwtAccessToken(token)) {
         return { type: "oauth", access: "", refresh: token, expires: 0 };
     }
-    return { type: "oauth", access: token, refresh: "", expires: Date.now() + YEAR_MS };
+    const expires = isJwtAccessToken(token) ? jwtExpiryMs(token) : null;
+    return { type: "oauth", access: token, refresh: "", expires: expires ?? Date.now() + YEAR_MS };
 }
 /**
  * Prepare model credentials for the OpenCode server from the repo's auth entries

package/build/core/opencode.js

@@ -1,6 +1,7 @@
 import { createRequire } from "node:module";
 import path from "node:path";
 import { createOpencode } from "@opencode-ai/sdk";
+import { RateLimitWatch } from "./throttle.js";
 import { toolMap } from "./tools.js";
 import { errorMessage, sleep } from "./util.js";
 /** Sum token usage across attempts (for per-task/run totals). */
@@ -175,7 +176,9 @@ export async function startOpencode(config) {
         port: 0,
         config: config,
     });
-    return { client, url: server.url, close: () => server.close() };
+    // Watch THIS server's log for provider throttle evidence (prepareAuth has already
+    // pointed XDG_DATA_HOME at the run's isolated dir when auth is injected).
+    return { client, url: server.url, close: () => server.close(), rateLimit: new RateLimitWatch() };
 }
 /** `provider/model` as the server reported it, or undefined if it reported neither. */
 export function formatModel(providerID, modelID) {
@@ -357,17 +360,26 @@ const FINALIZE_STALL_MS = 60 * 1000;
 // Breathing room before the retry: if the silence came from provider-side throttling
 // or backoff, reconnecting instantly is the worst move.
 const STALL_RETRY_BACKOFF_MS = 20 * 1000;
+// When the account is provably rate-limited, wait in longer beats: re-sending the
+// pass's whole context into a throttled account only deepens the limit. Several
+// waits fit inside a pass budget, and each is long enough for a limit window to move.
+const RATE_LIMIT_WAIT_MS = 90 * 1000;
 // Only retry when enough of the pass's budget remains for the fresh attempt to
 // plausibly finish; otherwise go straight to the soft landing.
 const STALL_RETRY_MIN_REMAINING_MS = STALL_MS + 60 * 1000;
 /**
- * What to do about a stalled attempt: start over from a clean session, or stop and
- * try to salvage findings. Exactly ONE retry, and only with enough budget left for it
- * to land — a second wedged attempt would just spend the rest of the pass's window,
+ * What to do about a stalled attempt: WAIT (the account is provably rate-limited —
+ * see core/throttle.ts — so patience beats re-sending the context; waits don't
+ * consume the one retry), start over from a clean session, or stop and salvage
+ * findings. Exactly ONE wedged retry, and only with enough budget left for it to
+ * land — a second wedged attempt would just spend the rest of the pass's window,
  * which is the failure this whole mechanism exists to end. Exported for tests.
  */
-export function stallAction(attempt, remainingMs) {
-    return attempt === 0 && remainingMs > STALL_RETRY_MIN_REMAINING_MS ? "retry" : "soft-land";
+export function stallAction(wedgedRetries, remainingMs, rateLimited = false) {
+    if (rateLimited && remainingMs > STALL_RETRY_MIN_REMAINING_MS) {
+        return "wait";
+    }
+    return wedgedRetries === 0 && remainingMs > STALL_RETRY_MIN_REMAINING_MS ? "retry" : "soft-land";
 }
 const FINALIZE_PROMPT = "You have reached your time budget. STOP investigating now — do NOT read, grep, " +
     "glob, list, or open any more files, and do not call any tools. Based ONLY on " +
@@ -551,6 +563,7 @@ export async function promptAgent(handle, args) {
             throw finalizeError;
         }
     };
+    let wedgedRetries = 0;
     for (let attempt = 0;; attempt++) {
         const session = unwrap(await handle.client.session.create({
             body: { title: attempt === 0 ? args.title : `${args.title}-retry${attempt}` },
@@ -578,11 +591,27 @@ export async function promptAgent(handle, args) {
             // wedged request to answer. Exactly one retry, and only when enough budget
             // remains for it to land; after that the finalize is still worth a try as the
             // only remaining salvage (in eas-cli#4084 the session did respond once aborted).
+            //
+            // EXCEPT when the server log shows the account is rate-limited: then the
+            // silence is throttling, not a wedge, and the patient move is to wait —
+            // re-sending the pass's whole context would deepen the limit. Waits repeat
+            // (never consuming the one wedged retry) until the evidence goes stale or
+            // the pass runs out of room, both bounded by the pass deadline.
             if (error instanceof NoProgress) {
                 await abortQuietly(handle, session.id);
                 absorb(error);
+                await handle.rateLimit.check();
                 const remaining = deadline - Date.now();
-                if (stallAction(attempt, remaining) === "retry") {
+                const action = stallAction(wedgedRetries, remaining, handle.rateLimit.recentlyLimited());
+                if (action === "wait") {
+                    args.onActivity?.(`provider is rate-limiting this account (429 in the server log; ` +
+                        `${handle.rateLimit.events} so far) — waiting ${Math.round(RATE_LIMIT_WAIT_MS / 1000)}s ` +
+                        `instead of retrying (${Math.round(remaining / 60000)}m of budget left)`);
+                    await sleep(RATE_LIMIT_WAIT_MS);
+                    continue;
+                }
+                if (action === "retry") {
+                    wedgedRetries++;
                     args.onActivity?.(`stalled — no output for ${Math.round(error.idleMs / 1000)}s; ` +
                         `retrying once from a clean session (${Math.round(remaining / 60000)}m of budget left)`);
                     await sleep(STALL_RETRY_BACKOFF_MS);
@@ -606,6 +635,18 @@ const CORRECTIVE = "\n\nIMPORTANT: your previous reply could not be parsed. Repl
 const CORRECTIVE_WAIT_MS = 2 * 60 * 1000;
 /** Backoff (ms) before the 2nd and 3rd attempt of a transient-failing model call. */
 const TRANSIENT_BACKOFF_MS = [2_000, 8_000];
+/**
+ * Rate limits need patience, not persistence: a limited account stays limited for
+ * tens of seconds to minutes, so the 2s/8s schedule just burns the retries. Shared
+ * subscription credentials (several PRs reviewing at once) make this the common
+ * transient, hence the dedicated, slower schedule.
+ */
+const RATE_LIMIT_BACKOFF_MS = [15_000, 45_000, 90_000];
+const RATE_LIMIT_ERROR = /\b429\b|rate.?limit|too many requests/i;
+/** A transient error that is specifically a provider rate limit. */
+export function isRateLimitError(error) {
+    return !(error instanceof AgentTimeoutError) && RATE_LIMIT_ERROR.test(errorMessage(error));
+}
 /**
  * A transient, retryable API failure — a one-off rate-limit (429), server error
  * (5xx), or network blip — as opposed to a timeout (which means "abandon", see
@@ -649,11 +690,13 @@ async function withTransientRetry(label, onActivity, fn) {
             return await fn();
         }
         catch (error) {
-            const waitMs = TRANSIENT_BACKOFF_MS[attempt];
+            // Rate limits get the slower, longer schedule — see RATE_LIMIT_BACKOFF_MS.
+            const schedule = isRateLimitError(error) ? RATE_LIMIT_BACKOFF_MS : TRANSIENT_BACKOFF_MS;
+            const waitMs = schedule[attempt];
             if (waitMs === undefined || !isTransientApiError(error)) {
                 throw error;
             }
-            onActivity?.(`${label}: transient API error (${errorMessage(error)}); retry ${attempt + 1}/${TRANSIENT_BACKOFF_MS.length} in ${Math.round(waitMs / 1000)}s`);
+            onActivity?.(`${label}: transient API error (${errorMessage(error)}); retry ${attempt + 1}/${schedule.length} in ${Math.round(waitMs / 1000)}s`);
             await sleep(waitMs);
         }
     }

package/build/core/render.js

@@ -108,7 +108,7 @@ export function renderMarkdown(review, tag, dismissed = [], link) {
     const kept = withFp.filter(({ fp }) => !dismissedByFp.has(fp));
     const dropped = withFp.filter(({ fp }) => dismissedByFp.has(fp));
     const lines = [commentMarker(tag), "## 🤖 AI code review", ""];
-    lines.push(`**Decision:** ${decisionLabel(review.decision)}`, "", review.summary, "");
+    lines.push(`**Decision:** ${review.couldNotComplete ? "No review — every pass failed" : decisionLabel(review.decision)}`, "", review.summary, "");
     if (review.incomplete.length > 0) {
         lines.push("> ⏱️ **Coverage note:** coverage is partial — some review passes did not", "> finish (timed out or failed), so issues may exist in areas not fully reviewed:", ...review.incomplete.map((note) => `> - ${note}`), "");
     }
@@ -230,7 +230,7 @@ export function renderAggregateMarkdown(results, tag, dismissed, link, opts) {
             "| --- | --- | --- |",
         ];
         for (const { result, kept } of perScope) {
-            lines.push(`| ${result.scope} | ${decisionLabel(result.review.decision)} | ${kept.length} |`);
+            lines.push(`| ${result.scope} | ${result.review.couldNotComplete ? "No review — every pass failed" : decisionLabel(result.review.decision)} | ${kept.length} |`);
         }
         lines.push("");
         const anyIncomplete = results.some((result) => result.review.incomplete.length > 0);

package/build/core/review.js

@@ -32,12 +32,26 @@ function makeRunId() {
  * → coordinate → apply policy. Returns a CoordinatorOutput; the CLI commands are
  * thin wrappers that supply a Source and render the result.
  */
+/**
+ * Max concurrent reviewer calls: an explicit config value wins; otherwise 3 when a
+ * subscription (oauth) credential is configured, else 6. One ChatGPT account
+ * handles six parallel streams poorly — requests get parked server-side (the
+ * stall signature seen on eas-cli#4084), and several PRs may be reviewing on the
+ * same credential at once — so subscription runs trade a little wall-clock for a
+ * lot of reliability. Exported for tests.
+ */
+export function effectiveConcurrency(config) {
+    if (config.chunk.concurrency) {
+        return config.chunk.concurrency;
+    }
+    return config.auth.some((entry) => entry.mode === "oauth") ? 3 : 6;
+}
 export async function runReview(source, options) {
     const { config } = options;
     const started = Date.now();
     const runId = makeRunId();
     const progress = options.onProgress ?? (() => { });
-    const runsRoot = path.join(config.configDir, ".runs");
+    const runsRoot = options.runsDir ?? path.join(config.configDir, ".runs");
     const runDir = path.join(runsRoot, runId);
     const logPath = path.join(runsRoot, "reviews.jsonl");
     // Fail fast on an invalid explicit selection before doing any work. Routing
@@ -83,18 +97,27 @@ export async function runReview(source, options) {
         });
         return output;
     }
-    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
-    // and doing it first means nothing that can throw sits between the chdir and the
-    // guarded blocks — so a prepareAuth failure can't leak the worktree or leave cwd
-    // pointing at it.
-    const auth = await prepareAuth(config);
-    // Read the PR-head tree (not the current checkout) when the source can materialize
-    // it, so the agents' surrounding-source reads and the verifier's re-reads see the
-    // versions that match the diff. Config is already fully loaded in memory, so the
-    // chdir doesn't affect it; run-log/patch paths are absolute; gh/git calls already
-    // ran above. Fails soft to the current directory.
+    // Materialize the PR-head tree (not the current checkout) when the source can, so
+    // the agents' surrounding-source reads and the verifier's re-reads see the versions
+    // that match the diff. Config is already fully loaded in memory, so the chdir below
+    // doesn't affect it; run-log/patch paths are absolute; gh/git calls already ran
+    // above. Failure policy is MODE-DEPENDENT (see resolveReadRoot): CI fails closed —
+    // with a base-SHA checkout the fallback tree is pre-PR content, and silently
+    // reviewing/verifying that drops real findings — while a local run falls back to
+    // the user's own checkout with a warning.
     const originalCwd = process.cwd();
-    const readRoot = (await source.prepareReadRootAsync?.()) ?? null;
+    const readRoot = await resolveReadRoot(source, options.mode, progress);
+    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
+    // and doing it after readRoot but before chdir means a prepareAuth failure can't
+    // leave cwd pointing at the worktree — it only has the worktree itself to release.
+    let auth;
+    try {
+        auth = await prepareAuth(config);
+    }
+    catch (error) {
+        await readRoot?.cleanup();
+        throw error;
+    }
     const restoreCwd = async () => {
         if (readRoot) {
             process.chdir(originalCwd);
@@ -177,9 +200,10 @@ export async function runReview(source, options) {
         const chunks = chunkByLines(workspace.files, config.chunk.maxChangedLines, config.chunk.maxFiles);
         // Only chunk (and add a cross-cutting pass) when the diff exceeds one chunk.
         const chunked = chunks.length > 1;
+        const concurrency = effectiveConcurrency(config);
         progress(`Running ${selectedAgents.length} reviewer(s) [${selectedAgents.map((a) => a.id).join(", ")}] over ${chunks.length} chunk(s)` +
             `${chunked ? " + cross-cutting pass" : ""} ` +
-            `(${kept.length} files, concurrency ${config.chunk.concurrency})…`);
+            `(${kept.length} files, concurrency ${concurrency})…`);
         for (const agent of selectedAgents) {
             agentFindings[agent.id] = [];
             agentCosts[agent.id] = 0;
@@ -313,7 +337,7 @@ export async function runReview(source, options) {
         // TIMEOUT, instead of dropping the work we break it into units that converge:
         // subdivide the chunk, then a fast no-tools pass, and only report a coverage gap
         // when even that can't finish inside the budget — so dropped work is never silent.
-        await runGrowableQueue(tasks, config.chunk.concurrency, async (task, enqueue) => {
+        await runGrowableQueue(tasks, concurrency, async (task, enqueue) => {
             const minutes = Math.round(task.maxWaitMs / 60000);
             try {
                 const { value, cost, truncated, tokens, model } = await promptAndParse(handle, {
@@ -443,6 +467,9 @@ export async function runReview(source, options) {
                 summary: "⚠️ The AI review could not complete: every review pass failed or timed out, " +
                     'so these changes were effectively NOT reviewed. Treat this as "no review", not "looks good".',
                 incomplete: coverageNotes,
+                // Presentation override: without it the comment header reads "Decision:
+                // Approve with comments" over a review that reviewed nothing (euxy#8).
+                couldNotComplete: true,
             };
         }
         else {
@@ -515,6 +542,14 @@ export async function runReview(source, options) {
         if (removedAfterChecks > 0) {
             output = { ...output, summary: reconcileSummary(output.summary, output.findings.length) };
         }
+        // Surface provider throttling as a fact about the run: passes already waited or
+        // backed off, but the operator should still SEE that it happened (a run that
+        // was rate-limited is slower and may carry partial passes — that's the cause).
+        await handle.rateLimit.check();
+        if (handle.rateLimit.events > 0) {
+            progress(`  ⚠ provider rate-limited this run ${handle.rateLimit.events} time(s) ` +
+                `(429s in the OpenCode server log) — passes waited it out rather than failing`);
+        }
         // Every pass says which model actually answered it — in the job log, the step
         // summary table, and the run log — so a wrong or substituted model is always
         // visible, not just when the substitution warning fires.
@@ -535,6 +570,7 @@ export async function runReview(source, options) {
             agentFindings,
             coverageNotes,
             verifierDropped,
+            ...(handle.rateLimit.events > 0 ? { rateLimitEvents: handle.rateLimit.events } : {}),
             durationMs: Date.now() - started,
             decision: output.decision,
             findingCount: output.findings.length,
@@ -641,6 +677,39 @@ export function reconcileSummary(summary, remaining) {
         "this summary was written, so it may mention issues no longer listed below._\n\n" +
         summary);
 }
+/**
+ * Resolve the tree the review reads from, applying the mode's trust policy:
+ *
+ * - `null` from the source means "nothing to materialize" — reviewing the current
+ *   checkout is intended (local diffs, or `--pr` without a repo). Never an error.
+ * - A materialization FAILURE (throw) is fatal in CI: the checkout there is the
+ *   trusted BASE tree, and falling back to it would silently review and verify
+ *   pre-PR file contents (dropping real findings with no trace in the output).
+ *   The throw propagates to `ecr ci`'s catch, which posts the one terminal
+ *   "not reviewed" comment.
+ * - The same failure in local mode degrades softly to the user's own checkout —
+ *   the user is the trust principal there and sees the warning directly.
+ *
+ * Exported for tests.
+ */
+export async function resolveReadRoot(source, mode, progress) {
+    if (!source.prepareReadRootAsync) {
+        return null;
+    }
+    try {
+        return await source.prepareReadRootAsync();
+    }
+    catch (error) {
+        if (mode === "ci") {
+            throw new Error(`Could not materialize the PR-head tree to review (and the CI checkout is the ` +
+                `trusted base, so reviewing it instead would silently review the wrong ` +
+                `contents): ${errorMessage(error)}`);
+        }
+        progress(`Could not materialize the PR-head tree (${errorMessage(error)}); ` +
+            `reading the current checkout instead — file contents may not match the PR.`);
+        return null;
+    }
+}
 /** Capitalize the first letter (coverage notes read as sentences). */
 function capitalize(text) {
     return text.length > 0 ? text[0].toUpperCase() + text.slice(1) : text;

package/build/core/schema.js

@@ -46,6 +46,14 @@ export const CoordinatorOutputSchema = z.object({
      * cut-short review is never presented as complete.
      */
     incomplete: z.array(z.string()).default([]),
+    /**
+     * True when EVERY pass failed — nothing was actually reviewed. Set by the
+     * engine, never the model. Reporters must not render an approving decision
+     * label for such a run (the decision enum has no "no review" member, and
+     * widening it would ripple through dismiss state and exit codes — this flag
+     * overrides the presentation instead).
+     */
+    couldNotComplete: z.boolean().optional(),
 });
 /** Minimum normalized evidence length to key a fingerprint on the code (below
  * this we fall back to the title). */

package/build/core/scrub.js

@@ -0,0 +1,62 @@
+import { readdir, rm } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Ambient runtime configuration the OpenCode server (and the Claude-compatible
+ * loaders inside it) discovers from its project directory. The review core chdirs
+ * into a materialized PR-HEAD worktree before starting the server, so every one
+ * of these is attacker-writable in a PR: a plugin or MCP definition is arbitrary
+ * code execution in a process holding the model credential and a comment-capable
+ * GH_TOKEN; a `.env` can repoint a provider base URL; instruction files inject
+ * system-level prompts. OPENCODE_CONFIG_CONTENT (how ECR passes its own config)
+ * MERGES with project config rather than replacing it, so deleting these from the
+ * throwaway worktree is the only isolation that doesn't depend on OpenCode
+ * semantics.
+ *
+ * Exact-name entries match files or directories at any depth; `.env` is matched
+ * as a prefix (`.env`, `.env.local`, …). The PR's CHANGES to these files are
+ * still reviewed — their diffs are inlined in the task prompt — but the reviewer
+ * can no longer open their full head contents, and a finding citing one will
+ * fail verification (a documented tradeoff of the scrub approach).
+ */
+export const AMBIENT_RUNTIME_CONFIG_NAMES = new Set([
+    "opencode.json",
+    "opencode.jsonc",
+    ".opencode",
+    "AGENTS.md",
+    "CLAUDE.md",
+    ".claude",
+    ".mcp.json",
+    ".cursor",
+    ".cursorrules",
+]);
+/** Names never descended into (and never scrubbed as a unit — `.git` is the worktree link). */
+const SKIP_DIRS = new Set([".git", "node_modules"]);
+/** Whether a directory entry is ambient runtime config that must not reach the model runtime. */
+export function isAmbientRuntimeConfig(name) {
+    return AMBIENT_RUNTIME_CONFIG_NAMES.has(name) || name === ".env" || name.startsWith(".env.");
+}
+/**
+ * Remove ambient runtime config from a THROWAWAY materialized tree, at every
+ * depth. Must only ever run on a tree ECR created and will delete (a worktree or
+ * extracted archive) — never on the user's checkout. Returns the repo-relative
+ * paths removed so callers can log them.
+ */
+export async function scrubAmbientRuntimeConfig(root) {
+    const removed = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (isAmbientRuntimeConfig(entry.name)) {
+                await rm(full, { recursive: true, force: true });
+                removed.push(path.relative(root, full));
+                continue;
+            }
+            if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+                await walk(full);
+            }
+        }
+    };
+    await walk(root);
+    return removed.sort();
+}

package/build/core/throttle.js

@@ -0,0 +1,94 @@
+import { open } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Rate-limit evidence, read from the OpenCode server's own log.
+ *
+ * Why this exists: provider throttling reaches us in two shapes. An EXPLICIT
+ * failure (HTTP 429 / "rate limit" stream error) surfaces in OpenCode's log as a
+ * structured ERROR line — that is proof. A SILENT one (the request is accepted
+ * and parked server-side) produces no error anywhere and is indistinguishable
+ * from a wedged request from the outside. So: the log watcher turns the explicit
+ * case into a hard signal, and the stall path treats "stall + recent explicit
+ * evidence" as throttling — the one situation where the right move is to WAIT
+ * (re-sending the whole context into a limited account only makes it worse).
+ *
+ * During oauth runs prepareAuth points XDG_DATA_HOME at an isolated temp dir, so
+ * the log we read belongs to exactly this run's server — no cross-talk with a
+ * developer's own OpenCode sessions.
+ */
+/** The OpenCode server's log file under the active data dir. */
+export function opencodeLogFile(env = process.env) {
+    const dataHome = env.XDG_DATA_HOME || path.join(os.homedir(), ".local", "share");
+    return path.join(dataHome, "opencode", "log", "opencode.log");
+}
+/**
+ * Provider throttle signatures in OpenCode log lines. Matched only against ERROR
+ * lines (a chatty INFO line mentioning "retry" must not count as evidence).
+ */
+const RATE_LIMIT_PATTERN = /\b429\b|rate.?limit|too many requests|quota exceeded/i;
+const ERROR_LINE = /\blevel=ERROR\b/;
+/** Count rate-limit ERROR lines in a chunk of log text. Pure, for tests. */
+export function countRateLimitLines(chunk) {
+    let count = 0;
+    for (const line of chunk.split("\n")) {
+        if (ERROR_LINE.test(line) && RATE_LIMIT_PATTERN.test(line)) {
+            count++;
+        }
+    }
+    return count;
+}
+/** How recent explicit evidence must be for a stall to be read as throttling. */
+const EVIDENCE_WINDOW_MS = 5 * 60 * 1000;
+/**
+ * Incremental watcher over the OpenCode server log. `check()` reads only what was
+ * appended since the last call (cheap enough for poll loops); `recentlyLimited()`
+ * is the signal the stall path consults. Fails soft everywhere: a missing or
+ * unreadable log yields "no evidence", never an error.
+ */
+export class RateLimitWatch {
+    file;
+    /** Total rate-limit ERROR lines seen this run. */
+    events = 0;
+    /** Wall-clock time evidence was last SEEN (observation time, not log time). */
+    lastSeenAt = 0;
+    offset = 0;
+    constructor(file = opencodeLogFile()) {
+        this.file = file;
+    }
+    /** Scan newly-appended log lines for rate-limit evidence. */
+    async check() {
+        try {
+            const handle = await open(this.file, "r");
+            try {
+                const { size } = await handle.stat();
+                if (size < this.offset) {
+                    this.offset = 0; // rotated/truncated — rescan from the top
+                }
+                if (size === this.offset) {
+                    return this.events;
+                }
+                const length = size - this.offset;
+                const buffer = Buffer.alloc(length);
+                await handle.read(buffer, 0, length, this.offset);
+                this.offset = size;
+                const found = countRateLimitLines(buffer.toString("utf8"));
+                if (found > 0) {
+                    this.events += found;
+                    this.lastSeenAt = Date.now();
+                }
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch {
+            // No log yet (server just started) or unreadable — no evidence, no error.
+        }
+        return this.events;
+    }
+    /** True when explicit throttle evidence appeared within the recency window. */
+    recentlyLimited(now = Date.now()) {
+        return this.lastSeenAt > 0 && now - this.lastSeenAt < EVIDENCE_WINDOW_MS;
+    }
+}