@expo/code-review-cli 0.5.1 → 0.6.0

package/build/sources/github-pr.js

@@ -3,6 +3,19 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
+import { scrubAmbientRuntimeConfig } from "../core/scrub.js";
+/** A full 40-hex-char commit OID — the only ref form passed to security-sensitive git calls. */
+export function isCommitOid(value) {
+    return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
+}
+/**
+ * Append gh as a git credential helper for a single command. The token comes from
+ * GH_TOKEN via the credential-helper protocol — never argv, never `.git/config` —
+ * so a base-SHA checkout with `persist-credentials: false` (no extraheader) can
+ * still fetch a private repo. Appending (not replacing) keeps a local user's own
+ * helpers first, so developer machines behave exactly as before.
+ */
+const GH_CREDENTIAL_HELPER_ARGS = ["-c", "credential.helper=!gh auth git-credential"];
 /**
  * Pulls PR diff + metadata through the `gh` CLI, which is preinstalled and
  * authenticated on GitHub Actions runners via GH_TOKEN.
@@ -12,17 +25,29 @@ export class GitHubPRSource {
     constructor(options) {
         this.options = options;
     }
+    metadataPromise;
     repoArgs() {
         return this.options.repo ? ["--repo", this.options.repo] : [];
     }
-    async getMetadata() {
+    /**
+     * Memoized internally (not just by memoizeSource) because the materialization
+     * paths below need the immutable OIDs and must not depend on the caller having
+     * called getMetadata() first.
+     */
+    getMetadata() {
+        return (this.metadataPromise ??= this.fetchMetadata());
+    }
+    async fetchMetadata() {
         const { stdout } = await run("gh", [
             "pr",
             "view",
             String(this.options.prNumber),
             ...this.repoArgs(),
             "--json",
-            "title,body,baseRefName,headRefName",
+            // baseRefOid/headRefOid are the immutable commit OIDs backing this PR at
+            // this moment; every materialization below pins to them so a rename,
+            // force-push, or deleted head between API calls can't swap a tree.
+            "title,body,baseRefName,headRefName,baseRefOid,headRefOid",
         ], { cwd: this.options.cwd });
         const parsed = JSON.parse(stdout);
         return {
@@ -30,6 +55,8 @@ export class GitHubPRSource {
             body: parsed.body ?? "",
             baseRef: parsed.baseRefName ?? "",
             headRef: parsed.headRefName ?? "",
+            baseOid: isCommitOid(parsed.baseRefOid) ? parsed.baseRefOid.toLowerCase() : undefined,
+            headOid: isCommitOid(parsed.headRefOid) ? parsed.headRefOid.toLowerCase() : undefined,
         };
     }
     async getChangedFiles() {
@@ -37,27 +64,28 @@ export class GitHubPRSource {
         return parseUnifiedDiff(stdout);
     }
     /**
-     * Check the PR HEAD out into a throwaway git worktree so the agents and verifier
-     * read the PR's versions of files (not whatever branch happens to be checked out).
-     * Fetches the head from the repo's own URL — `refs/pull/<n>/head`, which the base
-     * repo hosts even for fork PRs — so it's always the correct PR, independent of the
-     * local `origin`. Fails SOFT: any problem (not a git repo, fetch/worktree error)
-     * returns null, and the review falls back to reading the current checkout.
+     * Fetch `ref` from the repo's own HTTPS URL and materialize `oid` as a detached
+     * throwaway worktree under a fresh temp dir. Never falls back to a branch name:
+     * `oid` is validated as a full commit hash before reaching git.
      */
-    async prepareReadRootAsync() {
-        const cwd = this.options.cwd;
+    async materializeWorktreeAsync(ref, oid) {
         if (!this.options.repo) {
-            // Without an explicit owner/repo we can't build the fetch URL safely.
-            return null;
+            throw new Error("cannot materialize a PR tree without an explicit owner/repo");
+        }
+        if (!isCommitOid(oid)) {
+            throw new Error(`refusing to materialize a non-OID ref: "${oid}"`);
         }
+        const cwd = this.options.cwd;
         const url = `https://github.com/${this.options.repo}.git`;
-        const ref = `refs/pull/${this.options.prNumber}/head`;
         let parent;
         try {
-            await run("git", ["fetch", "--no-tags", "--depth=1", url, ref], { cwd });
-            parent = await mkdtemp(path.join(tmpdir(), "ecr-prhead-"));
-            const dir = path.join(parent, "head"); // must not pre-exist for `worktree add`
-            await run("git", ["worktree", "add", "--detach", dir, "FETCH_HEAD"], { cwd });
+            await run("git", [...GH_CREDENTIAL_HELPER_ARGS, "fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), "ecr-tree-"));
+            const dir = path.join(parent, "tree"); // must not pre-exist for `worktree add`
+            // Check out the OID (not FETCH_HEAD): if the ref moved between the API call
+            // and this fetch, the OID is absent and this fails instead of silently
+            // materializing a different tree than the one the diff was fetched for.
+            await run("git", ["worktree", "add", "--detach", dir, oid], { cwd });
             const removeParent = parent;
             return {
                 dir,
@@ -72,11 +100,64 @@ export class GitHubPRSource {
                 },
             };
         }
-        catch {
+        catch (error) {
             if (parent) {
                 await rm(parent, { recursive: true, force: true }).catch(() => { });
             }
+            throw error;
+        }
+    }
+    /**
+     * Check the PR HEAD out into a throwaway worktree so the agents and verifier
+     * read the PR's versions of files (not whatever branch happens to be checked
+     * out), pinned to the immutable head OID. The fetch uses `refs/pull/<n>/head`,
+     * which the base repo hosts even for fork PRs.
+     *
+     * The worktree is SCRUBBED of ambient runtime config (opencode.json, .opencode
+     * plugins, AGENTS.md/CLAUDE.md, .mcp.json, .env*, …) before it's returned: the
+     * OpenCode server is started with this directory as its project root, and
+     * anything it discovers there is attacker-controlled PR content executing or
+     * injecting inside a process that holds the model credential and GH_TOKEN.
+     *
+     * Returns null only when no owner/repo is configured (a local `--pr` run
+     * without --repo, where the current checkout is an acceptable read root).
+     * Materialization FAILURES throw — the caller decides per mode whether that is
+     * fatal (CI: fail closed) or a soft fallback (local: the user's own checkout).
+     */
+    async prepareReadRootAsync() {
+        if (!this.options.repo) {
+            // Without an explicit owner/repo we can't build the fetch URL safely.
             return null;
         }
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.headOid)) {
+            throw new Error("GitHub did not report an immutable head OID for this PR");
+        }
+        const root = await this.materializeWorktreeAsync(`refs/pull/${this.options.prNumber}/head`, metadata.headOid);
+        try {
+            await scrubAmbientRuntimeConfig(root.dir);
+        }
+        catch (error) {
+            // A half-scrubbed tree must never become the runtime's project root.
+            await root.cleanup().catch(() => { });
+            throw error;
+        }
+        return root;
+    }
+    /**
+     * Materialize the PR's BASE commit as the trusted configuration root: review
+     * policy, prompts, routing, and auth mapping load from here, so a PR cannot
+     * change the reviewer that evaluates it (config changes activate on merge).
+     * Failures throw — `ecr ci` must fail closed, never fall back to the checkout.
+     */
+    async prepareTrustedConfigRootAsync() {
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.baseOid)) {
+            throw new Error("GitHub did not report an immutable base OID for this PR");
+        }
+        // The base OID is fetchable by SHA (it's the tip of the base branch as of the
+        // API call; GitHub serves reachable SHAs — the same mechanism actions/checkout
+        // uses for `ref:` pins).
+        return this.materializeWorktreeAsync(metadata.baseOid, metadata.baseOid);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {

package/templates/command.yml

@@ -85,12 +85,18 @@ jobs:
       # config, and never `gh pr checkout` the PR head. The reviewer engine itself
       # is the PUBLISHED @expo/code-review-cli (fetched by npx), not built from any
       # checkout, so attacker-controlled PR code never runs here. The diff + PR
-      # metadata come from the API (`gh pr diff`/`gh pr view`).
+      # metadata come from the API (`gh pr diff`/`gh pr view`); `ecr ci` loads
+      # configuration from the PR's immutable base commit and reads source from a
+      # head worktree scrubbed of ambient runtime config (opencode.json, plugins,
+      # AGENTS.md, .env, …) — the same trust model as the pull_request workflow.
       - name: Checkout (base ref only — never the PR head)
         if: steps.cmd.outputs.run == 'true'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # The CLI's own git fetches authenticate through `gh` from GH_TOKEN, so
+          # the token never lands in .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/config.jsonc

@@ -23,6 +23,9 @@
   // Large diffs are split into focused chunks by changed-line count, plus a
   // cross-cutting pass for multi-file issues. Diffs under maxChangedLines are one
   // full-context pass. Defaults shown; raise/lower per your model + PR sizes.
+  // Concurrency defaults by auth mode: 6 with an API key, 3 on a subscription
+  // (oauth) credential — one account handles many parallel streams poorly, and
+  // several PRs may review on the same credential at once. Set it to override.
   // "chunk": { "maxChangedLines": 1000, "maxFiles": 20, "concurrency": 4 },
 
   // Which PRs `ecr ci` reviews. This is the source of truth for trigger policy;
@@ -56,11 +59,12 @@
   // of the agents that need the pro tier, and set ECR_EXPECTED_TOKEN_ENV in the
   // workflow to the comma-separated set of both env names.
   //   "auth": { "providers": {
-  //     "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_REFRESH_TOKEN" },
+  //     "openai":     { "mode": "oauth",   "tokenEnv": "CODEX_OAUTH_ACCESS_TOKEN" },
   //     "openai-api": { "mode": "api-key", "tokenEnv": "OPENAI_API_KEY", "upstream": "openai" }
   //   } }
-  // (openai oauth: tokenEnv holds the REFRESH token from an `opencode auth login`
-  // ChatGPT sign-in — copy `.openai.refresh` from OpenCode's auth.json.)
+  // (openai oauth: tokenEnv holds the ACCESS token from an `opencode auth login`
+  // ChatGPT sign-in — `ecr setup-auth` extracts it. NEVER share the refresh
+  // token: it is single-use and dies on first rotation.)
   "auth": {
     "mode": "api-key",
     "provider": "openai",

package/templates/dismiss.yml

@@ -83,6 +83,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # Dismiss never fetches; gh authenticates from GH_TOKEN. Keep the token
+          # out of .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/workflow.yml

@@ -39,10 +39,21 @@ jobs:
     # A reviewer failure must never fail the PR's checks.
     continue-on-error: true
     steps:
+      # SECURITY: check out the PR's immutable BASE commit, never the PR head or
+      # merge ref. Everything security-sensitive on this runner (`ecr verify-config`'s
+      # sweep, and any ambient files) therefore comes from a commit that already
+      # merged. `ecr ci` additionally enforces this itself: it materializes the base
+      # commit via the GitHub API for configuration and the head commit (scrubbed of
+      # runtime config) for source reads, so this checkout is defense in depth, not
+      # the only line. persist-credentials off — the CLI's own git fetches
+      # authenticate through `gh` from GH_TOKEN, so the token never lands in
+      # .git/config.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.base.sha }}
           # Shallow is enough — the reviewer gets the diff from the API (`gh`).
           fetch-depth: 1
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -52,16 +63,17 @@ jobs:
           # to save an empty cache and error).
           package-manager-cache: false
 
-      # SECURITY: this workflow checks out the PR's code, including every
+      # SECURITY: the TRUSTED BASE checkout above includes every
       # .expo-code-review/config.jsonc + routing.jsonc, whose auth.tokenEnv names the
       # env var the CLI forwards as the model credential. The canonical guard ships
       # with the CLI: `ecr verify-config` sweeps every config (root + routing + all
       # scopes, referenced or not) with the engine's real JSONC parser and refuses
       # unless tokenEnv appears exactly once, in a ROOT-owned file, equal to the
-      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a PR can't repoint it at
-      # another runner secret, sneak in a JSON-escaped key, or stage an unreferenced
-      # scope config with its own auth. This is layer 2; layer 1 is the runtime
-      # ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift fails safe.
+      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a config change can't
+      # repoint it at another runner secret, sneak in a JSON-escaped key, or stage an
+      # unreferenced scope config with its own auth. This is layer 2; layer 1 is the
+      # runtime ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift
+      # fails safe.
       #
       # This step MUST run BEFORE `ecr ci` (before any PR code is built or loaded).
       # Only setup-node (runtime install) precedes it; running the PUBLISHED package