@expo/code-review-cli 0.5.2 → 0.6.0

package/README.md

@@ -218,16 +218,31 @@ your-monorepo/
   (e.g. `security`) are injected into every scope with `alwaysRun`, taken from the
   root roster — a scope defining a same-id agent gets the root one, so a team can't
   shadow the enforced reviewer with a weaker version on its own subtree.
-- **Config comes from the checked-out ref (documented tradeoff).** The scaffolded
-  auto workflow checks out the PR **merge ref**, so a PR *can* edit rosters, prompts,
-  and routing globs for its own advisory review — that only steers what the
-  comment-only reviewer says about that PR. What a PR can **never** do is touch
-  credentials: `auth` is locked by the scope-schema rejection, the CLI's runtime
-  `ECR_EXPECTED_TOKEN_ENV` check, and the guard step above, all three of which run
-  against whatever ref is checked out. A `/review`-command workflow that checks out
-  only the trusted base ref (see eas-cli's) closes the prompt-tampering vector too;
-  resolving config from the base ref on the auto path as well is on the
-  [roadmap](./ROADMAP.md).
+- **Configuration comes from the PR's trusted base commit.** In `ecr ci`, review
+  policy and reviewer configuration — `config.jsonc`, `routing.jsonc`, prompts,
+  models, and the auth mapping — load from the PR's immutable **base** commit,
+  materialized via the GitHub API. The PR head is untrusted data: it is
+  materialized separately (pinned to its immutable OID) purely as source content
+  to read and verify against. A PR editing rosters, prompts, or routing is
+  reviewed under the **previous** config; its changes activate after merge. If
+  the base commit can't be materialized, the run fails closed (one terminal
+  comment) — it never falls back to the checkout. A scope config that is new in
+  a PR is reviewed with the root config until it merges.
+- **The model runtime never sees PR-owned ambient config.** The head worktree the
+  agents read from is scrubbed of runtime configuration before the OpenCode
+  server starts: `opencode.json{,c}`, `.opencode/` (plugins), `AGENTS.md`,
+  `CLAUDE.md`, `.claude/`, `.mcp.json`, `.cursor*`, and `.env*` at every depth.
+  A PR can't install a plugin, MCP server, instruction file, or `.env` into the
+  process that holds the model credential and the comment token. (Changes to
+  those files are still reviewed — their diffs are inlined in the prompt — but a
+  finding citing one can't be re-read during verification; that's the tradeoff.)
+- **The scaffolded workflows check out only the base commit** with
+  `persist-credentials: false`; the CLI's own git fetches authenticate through
+  `gh` from `GH_TOKEN`, so the token never lands in `.git/config` or argv. The
+  CLI enforces the trust model itself, so a custom workflow that checks out the
+  PR head still gets base-commit configuration. The temporary escape hatch
+  `ecr ci --unsafe-config-from-head` restores the old behavior with a loud
+  security warning and will be removed on a minor boundary.
 
 Ownership is enforced with CODEOWNERS: `/.expo-code-review/routing.jsonc @your-infra`
 (the single authoritative router) and `/server/www/.expo-code-review/ @your-www-team`

package/build/commands/ci.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
-import { loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
+import path from "node:path";
+import { CONFIG_DIRNAME, hasScopeConfig, loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
 import { loadRoutingManifest, resolveScopes, scopedCommentTag, scopePassesBudgetMs, formatOwnerTable, } from "../config/routing.js";
 import { repoRoot, run } from "../core/exec.js";
 import { errorMessage } from "../core/util.js";
@@ -32,6 +33,15 @@ For GitHub Actions: reads the PR number + repo from the event/env, gets the diff
 via \`gh pr diff\`, runs the reviewer, and upserts a single PR comment. Comment-only
 and non-blocking (a reviewer failure never fails the PR's checks).
 
+Trust model: review policy and reviewer configuration (config.jsonc, routing,
+prompts, models, auth mapping) load from the PR's immutable BASE commit,
+materialized via the GitHub API — never from the PR head — so a PR cannot change
+the reviewer that evaluates it; config changes activate after merge. The PR head
+is materialized separately (pinned to its immutable OID, scrubbed of ambient
+runtime config) purely as source content to read and verify against. If the
+trusted base cannot be materialized, the run fails closed with one terminal
+comment; it never falls back to the checkout.
+
 Monorepos: when .expo-code-review/routing.jsonc exists, ci fans out INTERNALLY —
 it assigns each changed file to exactly one scope (last-match-wins) and reviews
 each active scope over only its files, then renders one aggregated comment (or one
@@ -42,8 +52,17 @@ Options:
   --route              Let the router pick relevant agents from the diff
   --scopes <a,b>       Limit the fan-out to these named scopes (routing only)
   --config-dir <dir>   Load the ROOT config.jsonc + routing.jsonc from <dir>
-                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). Scope
-                       subtrees stay repo-root-relative.
+                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). A
+                       RELATIVE dir resolves beneath the trusted base commit; an
+                       ABSOLUTE dir is an explicit operator trust decision. Scope
+                       subtrees always resolve beneath the trusted base commit.
+  --unsafe-config-from-head
+                       COMPATIBILITY ESCAPE HATCH: load configuration from the
+                       current checkout instead of the PR's trusted base commit.
+                       This lets a same-repo PR change the reviewer (policy,
+                       prompts, model, auth mapping) that evaluates itself.
+                       Never scaffolded; prints a security warning; will be
+                       removed on a scheduled minor boundary.
   --comment <mode>     Override manifest comment mode: single | per-scope
   --force              Manual override: review even if the trigger policy (label
                        trigger / ai-review:skip) would skip. Break-glass and the
@@ -78,6 +97,7 @@ export async function ciCommand(argv = []) {
     // A maintainer's explicit `/review` (comment command or --force) is a manual
     // escape hatch that bypasses the trigger-policy gate only (see passesTriggerGate).
     const bypassTriggerGate = shouldBypassTriggerGate(argv);
+    const unsafeConfigFromHead = argv.includes("--unsafe-config-from-head");
     const root = await repoRoot();
     if (root && root !== process.cwd()) {
         process.chdir(root);
@@ -89,35 +109,120 @@ export async function ciCommand(argv = []) {
         process.stderr.write("CI reviewer: could not determine repository or PR number from the environment. Skipping.\n");
         return;
     }
-    // A malformed manifest is a loud, non-blocking error (never a silent fallback).
-    let manifest;
-    try {
-        manifest = await loadRoutingManifest(cwd, { configDir });
+    // ONE source for the whole run: metadata (incl. immutable OIDs), the diff, and
+    // the PR-head read root are each fetched once and shared across scopes.
+    const ghSource = new GitHubPRSource({ prNumber, repo, cwd });
+    const source = memoizeSource(ghSource);
+    // Trusted configuration root: review policy and reviewer config load from the
+    // PR's immutable BASE commit, so the PR head is data, never policy. Fail CLOSED:
+    // when the base can't be materialized, post the one terminal comment and stop —
+    // silently reading the checkout would let a head checkout smuggle config in.
+    let trustedRoot = null;
+    let configRoot = cwd;
+    if (unsafeConfigFromHead) {
+        process.stderr.write("CI reviewer: ⚠ SECURITY — --unsafe-config-from-head is set: reviewer configuration " +
+            "(policy, prompts, models, auth mapping) is being loaded from the current checkout, so " +
+            "a same-repository PR can change the reviewer that evaluates it. This escape hatch will " +
+            "be removed in a future minor release.\n");
     }
-    catch (error) {
-        process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
-        return;
+    else {
+        try {
+            trustedRoot = await ghSource.prepareTrustedConfigRootAsync();
+            configRoot = trustedRoot.dir;
+        }
+        catch (error) {
+            const reason = errorMessage(error);
+            process.stderr.write(`CI reviewer: could not materialize the PR's base commit for trusted configuration ` +
+                `(failing closed, not reviewing): ${reason}\n`);
+            await postTerminalFailureNote(repo, prNumber, cwd, `it could not load trusted configuration from the PR's base commit (${reason}). ` +
+                `This usually means the runner has no git checkout or no usable GH_TOKEN; re-run once fixed`);
+            return;
+        }
     }
-    if (manifest == null) {
-        await runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir);
-        return;
+    try {
+        // A malformed manifest is a loud, non-blocking error (never a silent fallback).
+        let manifest;
+        try {
+            manifest = await loadRoutingManifest(configRoot, { configDir });
+        }
+        catch (error) {
+            process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
+            return;
+        }
+        if (manifest == null) {
+            await runLegacyCi(source, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                bypassTriggerGate,
+                configDir,
+            });
+            return;
+        }
+        try {
+            await runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                scopesFilter,
+                commentOverride,
+                bypassTriggerGate,
+                configDir,
+            });
+        }
+        catch (error) {
+            // Fan-out failures stay non-blocking (single-writer property is the point).
+            process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+        }
     }
+    finally {
+        await source.dispose();
+        await trustedRoot?.cleanup();
+    }
+}
+/**
+ * The one terminal "this PR was NOT reviewed" comment for failures that happen
+ * before any configuration is loaded (trusted-root materialization). Uses the
+ * DEFAULT comment tag/break-glass marker because the config that could customize
+ * them is exactly what failed to load; a repo with a custom tag gets a fresh
+ * comment rather than an upsert, which is the acceptable degraded case.
+ */
+async function postTerminalFailureNote(repo, prNumber, cwd, reason) {
     try {
-        await runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir);
+        const reporter = new GitHubReporter({
+            prNumber,
+            repo,
+            commentTag: "expo-ai-code-reviewer",
+            breakGlassMarker: "/skip-review",
+            cwd,
+        });
+        await reporter.report({
+            decision: "approve_with_comments",
+            findings: [],
+            summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed: ${reason}.`,
+            incomplete: [],
+            couldNotComplete: true,
+        });
     }
-    catch (error) {
-        // Fan-out failures stay non-blocking (single-writer property is the point).
-        process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+    catch (postError) {
+        process.stderr.write(`CI reviewer: also failed to post the failure notice: ${errorMessage(postError)}\n`);
     }
 }
+/**
+ * Run-log + patch-workspace anchor: ALWAYS the workspace checkout, never the
+ * (temporary, removed-on-exit) trusted config root — the workflow uploads
+ * `.expo-code-review/.runs/reviews.jsonl` from the workspace as an artifact.
+ */
+function workspaceRunsDir(cwd) {
+    return path.join(cwd, CONFIG_DIRNAME, ".runs");
+}
 /**
  * The pre-routing single-config path. Kept byte-for-byte equivalent so that with no
  * routing.jsonc the CLI behaves exactly as before (backcompat invariant).
  */
-async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir) {
+async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, bypassTriggerGate, configDir } = options;
     let config;
     try {
-        config = await loadReviewConfig(cwd, { configDir });
+        config = await loadReviewConfig(configRoot, { configDir });
     }
     catch (error) {
         process.stderr.write(`CI reviewer: ${errorMessage(error)}\n`);
@@ -158,11 +263,12 @@ async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     try {
-        const review = await runReview(new GitHubPRSource({ prNumber, repo, cwd }), {
+        const review = await runReview(source, {
             config,
             mode: "ci",
             agents,
             route,
+            runsDir: workspaceRunsDir(cwd),
             onProgress: (message) => process.stderr.write(`${message}\n`),
         });
         await reporter.report(review);
@@ -198,10 +304,12 @@ function failureReview(scopeName, reason) {
     };
 }
 /** The routing fan-out: one process, N scopes reviewed sequentially, one render. */
-async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir) {
+async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir } = options;
     // The root config + manifest follow the override; scope configs stay
-    // repo-root-relative (loadScopeConfig reads <root>/<scope.config>/.expo-code-review).
-    const rootConfig = await loadReviewConfig(cwd, { configDir });
+    // relative to the TRUSTED root (loadScopeConfig reads
+    // <configRoot>/<scope.config>/.expo-code-review).
+    const rootConfig = await loadReviewConfig(configRoot, { configDir });
     // The root/aggregate marker is the ACTUAL root-owned comment tag so the
     // pre-routing comment and its dismissal state upsert in place, not stranded
     // under a new marker (risk 8/9). manifest.defaults.commentTag is the
@@ -240,7 +348,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
     if (!passesTriggerGate(await fetchPrLabels(repo, prNumber, cwd), rootConfig.review, bypassTriggerGate)) {
         return;
     }
-    const source = memoizeSource(new GitHubPRSource({ prNumber, repo, cwd }));
     const changed = await source.getChangedFiles();
     const resolution = resolveScopes(manifest, changed.map((file) => file.path));
     process.stderr.write("CI reviewer: scope ownership —\n");
@@ -276,7 +383,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         if (await bgReporter.checkBreakGlass()) {
             process.stderr.write(`CI reviewer: ${rootConfig.breakGlassMarker} detected; skipping.\n`);
             await bgReporter.postSkipNote();
-            await source.dispose();
             return;
         }
     }
@@ -284,17 +390,17 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     // Build ONE link context for all scopes (rate-limit hygiene): diff lines from the
-    // already-fetched changed files, base SHA via a single `gh pr view`.
+    // already-fetched changed files, base OID from the memoized PR metadata (the same
+    // immutable OID the trusted config root was materialized from).
     const link = {
         repo,
         prNumber,
         diffLines: buildDiffLineIndex(changed.map((file) => ({ path: file.path, patch: file.patch }))),
     };
     try {
-        const { stdout } = await run("gh", ["pr", "view", String(prNumber), "--repo", repo, "--json", "baseRefOid"], { cwd });
-        const oid = JSON.parse(stdout).baseRefOid;
-        if (oid) {
-            link.baseSha = oid;
+        const { baseOid } = await source.getMetadata();
+        if (baseOid) {
+            link.baseSha = baseOid;
         }
     }
     catch {
@@ -317,7 +423,18 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         const isDefault = scope.configDir === ".";
         let review;
         try {
-            const config = await loadScopeConfig(cwd, scopeDef, manifest, rootConfig);
+            // A scope whose config dir doesn't exist at the TRUSTED base commit is a
+            // scope this PR introduces: review it with the root config rather than
+            // failing the run on exactly that PR. The scope's own config (PR-owned,
+            // untrusted for this run) activates once it merges.
+            let effectiveScopeDef = scopeDef;
+            if (!hasScopeConfig(configRoot, scopeDef)) {
+                process.stderr.write(`CI reviewer: [${scope.name}] no config at "${scopeDef.config}" in the PR's base ` +
+                    `commit (new in this PR?); reviewing with the root config — the scope's config ` +
+                    `takes effect after merge.\n`);
+                effectiveScopeDef = { ...scopeDef, config: "." };
+            }
+            const config = await loadScopeConfig(configRoot, effectiveScopeDef, manifest, rootConfig);
             review = await runReview(source, {
                 config,
                 mode: "ci",
@@ -325,6 +442,7 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
                 route,
                 includePaths: scope.files,
                 passesBudgetMs: budget,
+                runsDir: workspaceRunsDir(cwd),
                 onProgress: (message) => process.stderr.write(`[${scope.name}] ${message}\n`),
             });
         }
@@ -335,7 +453,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         }
         results.push({ scope: scope.name, isDefault, review });
     }
-    await source.dispose();
     const reporterFor = (tag, withLink = false) => new GitHubReporter({
         prNumber,
         repo,

package/build/commands/review.js

@@ -38,9 +38,11 @@ Options:
   --no-fail            always exit 0, even on request-changes
   -h, --help           show this help
 
-Note: agents read the local working tree for surrounding context, so --pr uses the
-PR's diff (authoritative) but your checked-out files for context. For full fidelity
-on a PR, \`gh pr checkout <n>\` first, then run a plain \`ecr review\`.
+Note: with --repo (or in CI), --pr materializes the PR-head tree (pinned to its
+immutable commit, scrubbed of ambient runtime config) so reads match the PR; if
+that isn't possible, it falls back to your checked-out files with a warning.
+Config always loads from YOUR checkout in local runs — you are the trust
+principal here. In \`ecr ci\`, config loads from the PR's trusted base commit.
 
 Exit codes: 0 approve / approve-with-comments, 1 request-changes, 2 error.
 `;

package/build/config/load.js

@@ -177,6 +177,21 @@ export function loadAuthFromRoot(rootConfig, manifest) {
     }
     return rootConfig.auth;
 }
+/**
+ * Whether a scope's own config dir exists under `root` — the same path
+ * `loadScopeConfig` reads (deliberately NOT via resolveConfigDir: ECR_CONFIG_DIR
+ * must never redirect scope subtrees). `ecr ci` uses this against the TRUSTED
+ * BASE root to give scopes that are new in a PR a defined miss behavior (review
+ * with the root config; the scope config activates after merge) instead of
+ * failing the run on exactly the PR that introduces the scope.
+ */
+export function hasScopeConfig(root, scope) {
+    if (scope.config === ".") {
+        return true;
+    }
+    const dir = path.join(root, scope.config, CONFIG_DIRNAME);
+    return existsSync(path.join(dir, "config.jsonc")) || existsSync(path.join(dir, "config.json"));
+}
 /**
  * Load one scope's fully-resolved config. The default scope (config '.') reuses
  * the root config unchanged except auth; a nested scope reads its own

package/build/core/review.js

@@ -51,7 +51,7 @@ export async function runReview(source, options) {
     const started = Date.now();
     const runId = makeRunId();
     const progress = options.onProgress ?? (() => { });
-    const runsRoot = path.join(config.configDir, ".runs");
+    const runsRoot = options.runsDir ?? path.join(config.configDir, ".runs");
     const runDir = path.join(runsRoot, runId);
     const logPath = path.join(runsRoot, "reviews.jsonl");
     // Fail fast on an invalid explicit selection before doing any work. Routing
@@ -97,18 +97,27 @@ export async function runReview(source, options) {
         });
         return output;
     }
-    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
-    // and doing it first means nothing that can throw sits between the chdir and the
-    // guarded blocks — so a prepareAuth failure can't leak the worktree or leave cwd
-    // pointing at it.
-    const auth = await prepareAuth(config);
-    // Read the PR-head tree (not the current checkout) when the source can materialize
-    // it, so the agents' surrounding-source reads and the verifier's re-reads see the
-    // versions that match the diff. Config is already fully loaded in memory, so the
-    // chdir doesn't affect it; run-log/patch paths are absolute; gh/git calls already
-    // ran above. Fails soft to the current directory.
+    // Materialize the PR-head tree (not the current checkout) when the source can, so
+    // the agents' surrounding-source reads and the verifier's re-reads see the versions
+    // that match the diff. Config is already fully loaded in memory, so the chdir below
+    // doesn't affect it; run-log/patch paths are absolute; gh/git calls already ran
+    // above. Failure policy is MODE-DEPENDENT (see resolveReadRoot): CI fails closed —
+    // with a base-SHA checkout the fallback tree is pre-PR content, and silently
+    // reviewing/verifying that drops real findings — while a local run falls back to
+    // the user's own checkout with a warning.
     const originalCwd = process.cwd();
-    const readRoot = (await source.prepareReadRootAsync?.()) ?? null;
+    const readRoot = await resolveReadRoot(source, options.mode, progress);
+    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
+    // and doing it after readRoot but before chdir means a prepareAuth failure can't
+    // leave cwd pointing at the worktree — it only has the worktree itself to release.
+    let auth;
+    try {
+        auth = await prepareAuth(config);
+    }
+    catch (error) {
+        await readRoot?.cleanup();
+        throw error;
+    }
     const restoreCwd = async () => {
         if (readRoot) {
             process.chdir(originalCwd);
@@ -668,6 +677,39 @@ export function reconcileSummary(summary, remaining) {
         "this summary was written, so it may mention issues no longer listed below._\n\n" +
         summary);
 }
+/**
+ * Resolve the tree the review reads from, applying the mode's trust policy:
+ *
+ * - `null` from the source means "nothing to materialize" — reviewing the current
+ *   checkout is intended (local diffs, or `--pr` without a repo). Never an error.
+ * - A materialization FAILURE (throw) is fatal in CI: the checkout there is the
+ *   trusted BASE tree, and falling back to it would silently review and verify
+ *   pre-PR file contents (dropping real findings with no trace in the output).
+ *   The throw propagates to `ecr ci`'s catch, which posts the one terminal
+ *   "not reviewed" comment.
+ * - The same failure in local mode degrades softly to the user's own checkout —
+ *   the user is the trust principal there and sees the warning directly.
+ *
+ * Exported for tests.
+ */
+export async function resolveReadRoot(source, mode, progress) {
+    if (!source.prepareReadRootAsync) {
+        return null;
+    }
+    try {
+        return await source.prepareReadRootAsync();
+    }
+    catch (error) {
+        if (mode === "ci") {
+            throw new Error(`Could not materialize the PR-head tree to review (and the CI checkout is the ` +
+                `trusted base, so reviewing it instead would silently review the wrong ` +
+                `contents): ${errorMessage(error)}`);
+        }
+        progress(`Could not materialize the PR-head tree (${errorMessage(error)}); ` +
+            `reading the current checkout instead — file contents may not match the PR.`);
+        return null;
+    }
+}
 /** Capitalize the first letter (coverage notes read as sentences). */
 function capitalize(text) {
     return text.length > 0 ? text[0].toUpperCase() + text.slice(1) : text;

package/build/core/scrub.js

@@ -0,0 +1,62 @@
+import { readdir, rm } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Ambient runtime configuration the OpenCode server (and the Claude-compatible
+ * loaders inside it) discovers from its project directory. The review core chdirs
+ * into a materialized PR-HEAD worktree before starting the server, so every one
+ * of these is attacker-writable in a PR: a plugin or MCP definition is arbitrary
+ * code execution in a process holding the model credential and a comment-capable
+ * GH_TOKEN; a `.env` can repoint a provider base URL; instruction files inject
+ * system-level prompts. OPENCODE_CONFIG_CONTENT (how ECR passes its own config)
+ * MERGES with project config rather than replacing it, so deleting these from the
+ * throwaway worktree is the only isolation that doesn't depend on OpenCode
+ * semantics.
+ *
+ * Exact-name entries match files or directories at any depth; `.env` is matched
+ * as a prefix (`.env`, `.env.local`, …). The PR's CHANGES to these files are
+ * still reviewed — their diffs are inlined in the task prompt — but the reviewer
+ * can no longer open their full head contents, and a finding citing one will
+ * fail verification (a documented tradeoff of the scrub approach).
+ */
+export const AMBIENT_RUNTIME_CONFIG_NAMES = new Set([
+    "opencode.json",
+    "opencode.jsonc",
+    ".opencode",
+    "AGENTS.md",
+    "CLAUDE.md",
+    ".claude",
+    ".mcp.json",
+    ".cursor",
+    ".cursorrules",
+]);
+/** Names never descended into (and never scrubbed as a unit — `.git` is the worktree link). */
+const SKIP_DIRS = new Set([".git", "node_modules"]);
+/** Whether a directory entry is ambient runtime config that must not reach the model runtime. */
+export function isAmbientRuntimeConfig(name) {
+    return AMBIENT_RUNTIME_CONFIG_NAMES.has(name) || name === ".env" || name.startsWith(".env.");
+}
+/**
+ * Remove ambient runtime config from a THROWAWAY materialized tree, at every
+ * depth. Must only ever run on a tree ECR created and will delete (a worktree or
+ * extracted archive) — never on the user's checkout. Returns the repo-relative
+ * paths removed so callers can log them.
+ */
+export async function scrubAmbientRuntimeConfig(root) {
+    const removed = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (isAmbientRuntimeConfig(entry.name)) {
+                await rm(full, { recursive: true, force: true });
+                removed.push(path.relative(root, full));
+                continue;
+            }
+            if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+                await walk(full);
+            }
+        }
+    };
+    await walk(root);
+    return removed.sort();
+}

package/build/sources/github-pr.js

@@ -3,6 +3,19 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
+import { scrubAmbientRuntimeConfig } from "../core/scrub.js";
+/** A full 40-hex-char commit OID — the only ref form passed to security-sensitive git calls. */
+export function isCommitOid(value) {
+    return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value);
+}
+/**
+ * Append gh as a git credential helper for a single command. The token comes from
+ * GH_TOKEN via the credential-helper protocol — never argv, never `.git/config` —
+ * so a base-SHA checkout with `persist-credentials: false` (no extraheader) can
+ * still fetch a private repo. Appending (not replacing) keeps a local user's own
+ * helpers first, so developer machines behave exactly as before.
+ */
+const GH_CREDENTIAL_HELPER_ARGS = ["-c", "credential.helper=!gh auth git-credential"];
 /**
  * Pulls PR diff + metadata through the `gh` CLI, which is preinstalled and
  * authenticated on GitHub Actions runners via GH_TOKEN.
@@ -12,17 +25,29 @@ export class GitHubPRSource {
     constructor(options) {
         this.options = options;
     }
+    metadataPromise;
     repoArgs() {
         return this.options.repo ? ["--repo", this.options.repo] : [];
     }
-    async getMetadata() {
+    /**
+     * Memoized internally (not just by memoizeSource) because the materialization
+     * paths below need the immutable OIDs and must not depend on the caller having
+     * called getMetadata() first.
+     */
+    getMetadata() {
+        return (this.metadataPromise ??= this.fetchMetadata());
+    }
+    async fetchMetadata() {
         const { stdout } = await run("gh", [
             "pr",
             "view",
             String(this.options.prNumber),
             ...this.repoArgs(),
             "--json",
-            "title,body,baseRefName,headRefName",
+            // baseRefOid/headRefOid are the immutable commit OIDs backing this PR at
+            // this moment; every materialization below pins to them so a rename,
+            // force-push, or deleted head between API calls can't swap a tree.
+            "title,body,baseRefName,headRefName,baseRefOid,headRefOid",
         ], { cwd: this.options.cwd });
         const parsed = JSON.parse(stdout);
         return {
@@ -30,6 +55,8 @@ export class GitHubPRSource {
             body: parsed.body ?? "",
             baseRef: parsed.baseRefName ?? "",
             headRef: parsed.headRefName ?? "",
+            baseOid: isCommitOid(parsed.baseRefOid) ? parsed.baseRefOid.toLowerCase() : undefined,
+            headOid: isCommitOid(parsed.headRefOid) ? parsed.headRefOid.toLowerCase() : undefined,
         };
     }
     async getChangedFiles() {
@@ -37,27 +64,28 @@ export class GitHubPRSource {
         return parseUnifiedDiff(stdout);
     }
     /**
-     * Check the PR HEAD out into a throwaway git worktree so the agents and verifier
-     * read the PR's versions of files (not whatever branch happens to be checked out).
-     * Fetches the head from the repo's own URL — `refs/pull/<n>/head`, which the base
-     * repo hosts even for fork PRs — so it's always the correct PR, independent of the
-     * local `origin`. Fails SOFT: any problem (not a git repo, fetch/worktree error)
-     * returns null, and the review falls back to reading the current checkout.
+     * Fetch `ref` from the repo's own HTTPS URL and materialize `oid` as a detached
+     * throwaway worktree under a fresh temp dir. Never falls back to a branch name:
+     * `oid` is validated as a full commit hash before reaching git.
      */
-    async prepareReadRootAsync() {
-        const cwd = this.options.cwd;
+    async materializeWorktreeAsync(ref, oid) {
         if (!this.options.repo) {
-            // Without an explicit owner/repo we can't build the fetch URL safely.
-            return null;
+            throw new Error("cannot materialize a PR tree without an explicit owner/repo");
+        }
+        if (!isCommitOid(oid)) {
+            throw new Error(`refusing to materialize a non-OID ref: "${oid}"`);
         }
+        const cwd = this.options.cwd;
         const url = `https://github.com/${this.options.repo}.git`;
-        const ref = `refs/pull/${this.options.prNumber}/head`;
         let parent;
         try {
-            await run("git", ["fetch", "--no-tags", "--depth=1", url, ref], { cwd });
-            parent = await mkdtemp(path.join(tmpdir(), "ecr-prhead-"));
-            const dir = path.join(parent, "head"); // must not pre-exist for `worktree add`
-            await run("git", ["worktree", "add", "--detach", dir, "FETCH_HEAD"], { cwd });
+            await run("git", [...GH_CREDENTIAL_HELPER_ARGS, "fetch", "--no-tags", "--depth=1", url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), "ecr-tree-"));
+            const dir = path.join(parent, "tree"); // must not pre-exist for `worktree add`
+            // Check out the OID (not FETCH_HEAD): if the ref moved between the API call
+            // and this fetch, the OID is absent and this fails instead of silently
+            // materializing a different tree than the one the diff was fetched for.
+            await run("git", ["worktree", "add", "--detach", dir, oid], { cwd });
             const removeParent = parent;
             return {
                 dir,
@@ -72,11 +100,64 @@ export class GitHubPRSource {
                 },
             };
         }
-        catch {
+        catch (error) {
             if (parent) {
                 await rm(parent, { recursive: true, force: true }).catch(() => { });
             }
+            throw error;
+        }
+    }
+    /**
+     * Check the PR HEAD out into a throwaway worktree so the agents and verifier
+     * read the PR's versions of files (not whatever branch happens to be checked
+     * out), pinned to the immutable head OID. The fetch uses `refs/pull/<n>/head`,
+     * which the base repo hosts even for fork PRs.
+     *
+     * The worktree is SCRUBBED of ambient runtime config (opencode.json, .opencode
+     * plugins, AGENTS.md/CLAUDE.md, .mcp.json, .env*, …) before it's returned: the
+     * OpenCode server is started with this directory as its project root, and
+     * anything it discovers there is attacker-controlled PR content executing or
+     * injecting inside a process that holds the model credential and GH_TOKEN.
+     *
+     * Returns null only when no owner/repo is configured (a local `--pr` run
+     * without --repo, where the current checkout is an acceptable read root).
+     * Materialization FAILURES throw — the caller decides per mode whether that is
+     * fatal (CI: fail closed) or a soft fallback (local: the user's own checkout).
+     */
+    async prepareReadRootAsync() {
+        if (!this.options.repo) {
+            // Without an explicit owner/repo we can't build the fetch URL safely.
             return null;
         }
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.headOid)) {
+            throw new Error("GitHub did not report an immutable head OID for this PR");
+        }
+        const root = await this.materializeWorktreeAsync(`refs/pull/${this.options.prNumber}/head`, metadata.headOid);
+        try {
+            await scrubAmbientRuntimeConfig(root.dir);
+        }
+        catch (error) {
+            // A half-scrubbed tree must never become the runtime's project root.
+            await root.cleanup().catch(() => { });
+            throw error;
+        }
+        return root;
+    }
+    /**
+     * Materialize the PR's BASE commit as the trusted configuration root: review
+     * policy, prompts, routing, and auth mapping load from here, so a PR cannot
+     * change the reviewer that evaluates it (config changes activate on merge).
+     * Failures throw — `ecr ci` must fail closed, never fall back to the checkout.
+     */
+    async prepareTrustedConfigRootAsync() {
+        const metadata = await this.getMetadata();
+        if (!isCommitOid(metadata.baseOid)) {
+            throw new Error("GitHub did not report an immutable base OID for this PR");
+        }
+        // The base OID is fetchable by SHA (it's the tip of the base branch as of the
+        // API call; GitHub serves reachable SHAs — the same mechanism actions/checkout
+        // uses for `ref:` pins).
+        return this.materializeWorktreeAsync(metadata.baseOid, metadata.baseOid);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {

package/templates/command.yml

@@ -85,12 +85,18 @@ jobs:
       # config, and never `gh pr checkout` the PR head. The reviewer engine itself
       # is the PUBLISHED @expo/code-review-cli (fetched by npx), not built from any
       # checkout, so attacker-controlled PR code never runs here. The diff + PR
-      # metadata come from the API (`gh pr diff`/`gh pr view`).
+      # metadata come from the API (`gh pr diff`/`gh pr view`); `ecr ci` loads
+      # configuration from the PR's immutable base commit and reads source from a
+      # head worktree scrubbed of ambient runtime config (opencode.json, plugins,
+      # AGENTS.md, .env, …) — the same trust model as the pull_request workflow.
       - name: Checkout (base ref only — never the PR head)
         if: steps.cmd.outputs.run == 'true'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # The CLI's own git fetches authenticate through `gh` from GH_TOKEN, so
+          # the token never lands in .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/dismiss.yml

@@ -83,6 +83,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          # Dismiss never fetches; gh authenticates from GH_TOKEN. Keep the token
+          # out of .git/config.
+          persist-credentials: false
 
       - name: Set up Node
         if: steps.cmd.outputs.run == 'true'

package/templates/workflow.yml

@@ -39,10 +39,21 @@ jobs:
     # A reviewer failure must never fail the PR's checks.
     continue-on-error: true
     steps:
+      # SECURITY: check out the PR's immutable BASE commit, never the PR head or
+      # merge ref. Everything security-sensitive on this runner (`ecr verify-config`'s
+      # sweep, and any ambient files) therefore comes from a commit that already
+      # merged. `ecr ci` additionally enforces this itself: it materializes the base
+      # commit via the GitHub API for configuration and the head commit (scrubbed of
+      # runtime config) for source reads, so this checkout is defense in depth, not
+      # the only line. persist-credentials off — the CLI's own git fetches
+      # authenticate through `gh` from GH_TOKEN, so the token never lands in
+      # .git/config.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.event.pull_request.base.sha }}
           # Shallow is enough — the reviewer gets the diff from the API (`gh`).
           fetch-depth: 1
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -52,16 +63,17 @@ jobs:
           # to save an empty cache and error).
           package-manager-cache: false
 
-      # SECURITY: this workflow checks out the PR's code, including every
+      # SECURITY: the TRUSTED BASE checkout above includes every
       # .expo-code-review/config.jsonc + routing.jsonc, whose auth.tokenEnv names the
       # env var the CLI forwards as the model credential. The canonical guard ships
       # with the CLI: `ecr verify-config` sweeps every config (root + routing + all
       # scopes, referenced or not) with the engine's real JSONC parser and refuses
       # unless tokenEnv appears exactly once, in a ROOT-owned file, equal to the
-      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a PR can't repoint it at
-      # another runner secret, sneak in a JSON-escaped key, or stage an unreferenced
-      # scope config with its own auth. This is layer 2; layer 1 is the runtime
-      # ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift fails safe.
+      # expected value (repo var ECR_EXPECTED_TOKEN_ENV) — so a config change can't
+      # repoint it at another runner secret, sneak in a JSON-escaped key, or stage an
+      # unreferenced scope config with its own auth. This is layer 2; layer 1 is the
+      # runtime ECR_EXPECTED_TOKEN_ENV lock in `ecr ci` itself, so guard/loader drift
+      # fails safe.
       #
       # This step MUST run BEFORE `ecr ci` (before any PR code is built or loaded).
       # Only setup-node (runtime install) precedes it; running the PUBLISHED package