@expo/code-review-cli 0.5.2 → 0.7.0

package/README.md

@@ -110,7 +110,7 @@ is a ready example to adapt.
 | `ecr init [--no-workflow] [--force]` | Scaffold `.expo-code-review/` (config, agents, prompts) + a CI workflow. |
 | `ecr init --monorepo` | …and add a `routing.jsonc` routing manifest (one default scope). |
 | `ecr init --scope <dir>` | Scaffold a per-team scope under `<dir>` and register it in the manifest. |
-| `ecr setup-auth [--yes]` | Walk through getting model credentials for local runs (ChatGPT sign-in and/or API keys), printing the `export` lines for your shell config. |
+| `ecr setup-auth [--yes]` | Walk through getting model credentials for local runs (ChatGPT/Claude sign-in and/or API keys), printing the `export` lines for your shell config. |
 | `ecr review [options]` | Review local changes and print an advisory review (default command). |
 | `ecr review --scope <name>` | Review only one routing scope over just that scope's changed files. |
 | `ecr ci` | Review the current GitHub PR and post/update a comment. For GitHub Actions. |
@@ -218,16 +218,31 @@ your-monorepo/
   (e.g. `security`) are injected into every scope with `alwaysRun`, taken from the
   root roster — a scope defining a same-id agent gets the root one, so a team can't
   shadow the enforced reviewer with a weaker version on its own subtree.
-- **Config comes from the checked-out ref (documented tradeoff).** The scaffolded
-  auto workflow checks out the PR **merge ref**, so a PR *can* edit rosters, prompts,
-  and routing globs for its own advisory review — that only steers what the
-  comment-only reviewer says about that PR. What a PR can **never** do is touch
-  credentials: `auth` is locked by the scope-schema rejection, the CLI's runtime
-  `ECR_EXPECTED_TOKEN_ENV` check, and the guard step above, all three of which run
-  against whatever ref is checked out. A `/review`-command workflow that checks out
-  only the trusted base ref (see eas-cli's) closes the prompt-tampering vector too;
-  resolving config from the base ref on the auto path as well is on the
-  [roadmap](./ROADMAP.md).
+- **Configuration comes from the PR's trusted base commit.** In `ecr ci`, review
+  policy and reviewer configuration — `config.jsonc`, `routing.jsonc`, prompts,
+  models, and the auth mapping — load from the PR's immutable **base** commit,
+  materialized via the GitHub API. The PR head is untrusted data: it is
+  materialized separately (pinned to its immutable OID) purely as source content
+  to read and verify against. A PR editing rosters, prompts, or routing is
+  reviewed under the **previous** config; its changes activate after merge. If
+  the base commit can't be materialized, the run fails closed (one terminal
+  comment) — it never falls back to the checkout. A scope config that is new in
+  a PR is reviewed with the root config until it merges.
+- **The model runtime never sees PR-owned ambient config.** The head worktree the
+  agents read from is scrubbed of runtime configuration before the OpenCode
+  server starts: `opencode.json{,c}`, `.opencode/` (plugins), `AGENTS.md`,
+  `CLAUDE.md`, `.claude/`, `.mcp.json`, `.cursor*`, and `.env*` at every depth.
+  A PR can't install a plugin, MCP server, instruction file, or `.env` into the
+  process that holds the model credential and the comment token. (Changes to
+  those files are still reviewed — their diffs are inlined in the prompt — but a
+  finding citing one can't be re-read during verification; that's the tradeoff.)
+- **The scaffolded workflows check out only the base commit** with
+  `persist-credentials: false`; the CLI's own git fetches authenticate through
+  `gh` from `GH_TOKEN`, so the token never lands in `.git/config` or argv. The
+  CLI enforces the trust model itself, so a custom workflow that checks out the
+  PR head still gets base-commit configuration. The temporary escape hatch
+  `ecr ci --unsafe-config-from-head` restores the old behavior with a loud
+  security warning and will be removed on a minor boundary.
 
 Ownership is enforced with CODEOWNERS: `/.expo-code-review/routing.jsonc @your-infra`
 (the single authoritative router) and `/server/www/.expo-code-review/ @your-www-team`
@@ -530,18 +545,36 @@ set in `config.auth` (credentials come from OpenCode):
     One caveat: OpenCode can't price alias models (they're config-declared), so
     pro passes report `$0` in the run log's cost column — token counts are
     correct, and the OpenAI project dashboard is the source of truth for spend.
-- **Anthropic / Claude (API key)** — set `auth.provider` to `"anthropic"`, point
-  `tokenEnv` at the env var holding a Console API key (e.g. `ANTHROPIC_API_KEY`),
-  and use `anthropic/...` model ids; the key is sent as `x-api-key`. Note that
-  Claude Pro/Max **subscription** tokens cannot be used here: Anthropic prohibits
-  them in third-party tools, and OpenCode has no Anthropic OAuth support — only an
-  API key works.
+- **Anthropic / Claude** — use `anthropic/...` model ids and every anthropic pass
+  runs through the **Claude Code CLI** (`claude -p --output-format json`), inferred
+  from the model. The credential is (in order) a `tokenEnv` you name, an ambient
+  `CLAUDE_CODE_OAUTH_TOKEN`, or your local `claude` login — an `auth` entry is
+  entirely optional. Run `claude setup-token` for a Max/Team subscription token
+  (forwarded as `CLAUDE_CODE_OAUTH_TOKEN`) or point `tokenEnv` at an Anthropic
+  Console API key (`sk-ant-api…`, forwarded as `ANTHROPIC_API_KEY`); the CLI reads
+  either. `ecr setup-auth` walks you through it. Each pass is trust-isolated and
+  read-only: it runs with `--safe-mode` (no `CLAUDE.md`/hooks/MCP/plugins),
+  `--strict-mcp-config`, `--permission-mode dontAsk`, and only the
+  `Read`/`Grep`/`Glob` tools — never `Bash`/`Edit`/`Write`/`WebFetch`/`WebSearch`.
+  The child env is an allowlist that omits ambient `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`
+  (only the configured credential is re-injected).
+  ```jsonc
+  // Optional — no anthropic entry at all falls back to your `claude` login.
+  "auth": { "providers": {
+    "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" }
+  } }
+  ```
 - **Another provider** — the current path is the `REVIEWER_MODEL`
   env override: `opencode auth login` once (pick the provider), then run with
   e.g. `REVIEWER_MODEL=google/gemini-3-pro`. It overrides every agent's model
-  and uses your OpenCode login, so no `auth` block is needed. *(Per-agent
-  provider mixing beyond the alias mechanism above is on the
-  [roadmap](./ROADMAP.md).)*
+  and uses your OpenCode login, so no `auth` block is needed.
+
+Engines are inferred **per agent** from that agent's resolved model alone: an
+`anthropic/…` agent runs through the Claude Code CLI while other agents run through
+OpenCode — in the SAME run. So an anthropic model may coexist with an `openai` (or
+any other) OpenCode provider, and each agent's `model` selects its engine.
+`REVIEWER_MODEL` still overrides every agent's model (and therefore every agent's
+engine), converging the whole run onto one engine.
 
 There is no shared fallback key; if a run fails for lack of credentials, authenticate
 a provider in OpenCode. `ecr doctor` diagnoses setup.
@@ -555,8 +588,11 @@ rediscovering one fixable thing, then reports N coverage gaps. So before any pas
   model, with nothing pointing at the credential. A truncated value, surrounding
   whitespace, or a token that can't work for the configured `auth.mode` is rejected
   by name.
-- **Configured model ids are checked against the running server**, so a typo or an id
-  the provider doesn't have is reported once, up front, with the close matches.
+- **Configured model ids for OpenCode-routed providers are checked against the running
+  server**, so a typo or an id the provider doesn't have is reported once, up front,
+  with the close matches. `anthropic/…` (Claude Code) model ids aren't checked up
+  front — Claude validates them per-request, so a typo there surfaces as a per-pass
+  error instead.
 - **`ecr doctor` reports the `opencode` version actually in use** and warns when a
   different one is first on your `PATH` — runs use the version this package pins.
 

package/build/commands/ci.js

@@ -1,8 +1,9 @@
 import { readFile } from "node:fs/promises";
-import { loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
+import path from "node:path";
+import { CONFIG_DIRNAME, hasScopeConfig, loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
 import { loadRoutingManifest, resolveScopes, scopedCommentTag, scopePassesBudgetMs, formatOwnerTable, } from "../config/routing.js";
-import { repoRoot, run } from "../core/exec.js";
-import { errorMessage } from "../core/util.js";
+import { repoRoot, resolveTrustedTool, run } from "../core/exec.js";
+import { errorMessage, publicFailureReason } from "../core/util.js";
 import { buildDiffLineIndex } from "../core/render.js";
 import { runReview } from "../core/review.js";
 import { GitHubPRSource } from "../sources/github-pr.js";
@@ -32,6 +33,15 @@ For GitHub Actions: reads the PR number + repo from the event/env, gets the diff
 via \`gh pr diff\`, runs the reviewer, and upserts a single PR comment. Comment-only
 and non-blocking (a reviewer failure never fails the PR's checks).
 
+Trust model: review policy and reviewer configuration (config.jsonc, routing,
+prompts, models, auth mapping) load from the PR's immutable BASE commit,
+materialized via the GitHub API — never from the PR head — so a PR cannot change
+the reviewer that evaluates it; config changes activate after merge. The PR head
+is materialized separately (pinned to its immutable OID, scrubbed of ambient
+runtime config) purely as source content to read and verify against. If the
+trusted base cannot be materialized, the run fails closed with one terminal
+comment; it never falls back to the checkout.
+
 Monorepos: when .expo-code-review/routing.jsonc exists, ci fans out INTERNALLY —
 it assigns each changed file to exactly one scope (last-match-wins) and reviews
 each active scope over only its files, then renders one aggregated comment (or one
@@ -42,8 +52,17 @@ Options:
   --route              Let the router pick relevant agents from the diff
   --scopes <a,b>       Limit the fan-out to these named scopes (routing only)
   --config-dir <dir>   Load the ROOT config.jsonc + routing.jsonc from <dir>
-                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). Scope
-                       subtrees stay repo-root-relative.
+                       instead of .expo-code-review/ (also ECR_CONFIG_DIR). A
+                       RELATIVE dir resolves beneath the trusted base commit; an
+                       ABSOLUTE dir is an explicit operator trust decision. Scope
+                       subtrees always resolve beneath the trusted base commit.
+  --unsafe-config-from-head
+                       COMPATIBILITY ESCAPE HATCH: load configuration from the
+                       current checkout instead of the PR's trusted base commit.
+                       This lets a same-repo PR change the reviewer (policy,
+                       prompts, model, auth mapping) that evaluates itself.
+                       Never scaffolded; prints a security warning; will be
+                       removed on a scheduled minor boundary.
   --comment <mode>     Override manifest comment mode: single | per-scope
   --force              Manual override: review even if the trigger policy (label
                        trigger / ai-review:skip) would skip. Break-glass and the
@@ -78,6 +97,7 @@ export async function ciCommand(argv = []) {
     // A maintainer's explicit `/review` (comment command or --force) is a manual
     // escape hatch that bypasses the trigger-policy gate only (see passesTriggerGate).
     const bypassTriggerGate = shouldBypassTriggerGate(argv);
+    const unsafeConfigFromHead = argv.includes("--unsafe-config-from-head");
     const root = await repoRoot();
     if (root && root !== process.cwd()) {
         process.chdir(root);
@@ -89,35 +109,120 @@ export async function ciCommand(argv = []) {
         process.stderr.write("CI reviewer: could not determine repository or PR number from the environment. Skipping.\n");
         return;
     }
-    // A malformed manifest is a loud, non-blocking error (never a silent fallback).
-    let manifest;
-    try {
-        manifest = await loadRoutingManifest(cwd, { configDir });
+    // ONE source for the whole run: metadata (incl. immutable OIDs), the diff, and
+    // the PR-head read root are each fetched once and shared across scopes.
+    const ghSource = new GitHubPRSource({ prNumber, repo, cwd });
+    const source = memoizeSource(ghSource);
+    // Trusted configuration root: review policy and reviewer config load from the
+    // PR's immutable BASE commit, so the PR head is data, never policy. Fail CLOSED:
+    // when the base can't be materialized, post the one terminal comment and stop —
+    // silently reading the checkout would let a head checkout smuggle config in.
+    let trustedRoot = null;
+    let configRoot = cwd;
+    if (unsafeConfigFromHead) {
+        process.stderr.write("CI reviewer: ⚠ SECURITY — --unsafe-config-from-head is set: reviewer configuration " +
+            "(policy, prompts, models, auth mapping) is being loaded from the current checkout, so " +
+            "a same-repository PR can change the reviewer that evaluates it. This escape hatch will " +
+            "be removed in a future minor release.\n");
     }
-    catch (error) {
-        process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
-        return;
+    else {
+        try {
+            trustedRoot = await ghSource.prepareTrustedConfigRootAsync();
+            configRoot = trustedRoot.dir;
+        }
+        catch (error) {
+            const reason = errorMessage(error);
+            process.stderr.write(`CI reviewer: could not materialize the PR's base commit for trusted configuration ` +
+                `(failing closed, not reviewing): ${reason}\n`);
+            await postTerminalFailureNote(repo, prNumber, cwd, `it could not load trusted configuration from the PR's base commit (${publicFailureReason(error)}). ` +
+                `This usually means the runner has no git checkout or no usable GH_TOKEN; re-run once fixed`);
+            return;
+        }
     }
-    if (manifest == null) {
-        await runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir);
-        return;
+    try {
+        // A malformed manifest is a loud, non-blocking error (never a silent fallback).
+        let manifest;
+        try {
+            manifest = await loadRoutingManifest(configRoot, { configDir });
+        }
+        catch (error) {
+            process.stderr.write(`CI reviewer: invalid routing.jsonc: ${errorMessage(error)}\n`);
+            return;
+        }
+        if (manifest == null) {
+            await runLegacyCi(source, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                bypassTriggerGate,
+                configDir,
+            });
+            return;
+        }
+        try {
+            await runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, {
+                agents,
+                route,
+                scopesFilter,
+                commentOverride,
+                bypassTriggerGate,
+                configDir,
+            });
+        }
+        catch (error) {
+            // Fan-out failures stay non-blocking (single-writer property is the point).
+            process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+        }
+    }
+    finally {
+        await source.dispose();
+        await trustedRoot?.cleanup();
     }
+}
+/**
+ * The one terminal "this PR was NOT reviewed" comment for failures that happen
+ * before any configuration is loaded (trusted-root materialization). Uses the
+ * DEFAULT comment tag/break-glass marker because the config that could customize
+ * them is exactly what failed to load; a repo with a custom tag gets a fresh
+ * comment rather than an upsert, which is the acceptable degraded case.
+ */
+async function postTerminalFailureNote(repo, prNumber, cwd, reason) {
     try {
-        await runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir);
+        const reporter = new GitHubReporter({
+            prNumber,
+            repo,
+            commentTag: "expo-ai-code-reviewer",
+            breakGlassMarker: "/skip-review",
+            cwd,
+        });
+        await reporter.report({
+            decision: "approve_with_comments",
+            findings: [],
+            summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed: ${reason}.`,
+            incomplete: [],
+            couldNotComplete: true,
+        });
     }
-    catch (error) {
-        // Fan-out failures stay non-blocking (single-writer property is the point).
-        process.stderr.write(`CI reviewer: routed run failed (non-blocking): ${errorMessage(error)}\n`);
+    catch (postError) {
+        process.stderr.write(`CI reviewer: also failed to post the failure notice: ${errorMessage(postError)}\n`);
     }
 }
+/**
+ * Run-log + patch-workspace anchor: ALWAYS the workspace checkout, never the
+ * (temporary, removed-on-exit) trusted config root — the workflow uploads
+ * `.expo-code-review/.runs/reviews.jsonl` from the workspace as an artifact.
+ */
+function workspaceRunsDir(cwd) {
+    return path.join(cwd, CONFIG_DIRNAME, ".runs");
+}
 /**
  * The pre-routing single-config path. Kept byte-for-byte equivalent so that with no
  * routing.jsonc the CLI behaves exactly as before (backcompat invariant).
  */
-async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate, configDir) {
+async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, bypassTriggerGate, configDir } = options;
     let config;
     try {
-        config = await loadReviewConfig(cwd, { configDir });
+        config = await loadReviewConfig(configRoot, { configDir });
     }
     catch (error) {
         process.stderr.write(`CI reviewer: ${errorMessage(error)}\n`);
@@ -158,11 +263,12 @@ async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     try {
-        const review = await runReview(new GitHubPRSource({ prNumber, repo, cwd }), {
+        const review = await runReview(source, {
             config,
             mode: "ci",
             agents,
             route,
+            runsDir: workspaceRunsDir(cwd),
             onProgress: (message) => process.stderr.write(`${message}\n`),
         });
         await reporter.report(review);
@@ -179,7 +285,7 @@ async function runLegacyCi(repo, prNumber, cwd, agents, route, bypassTriggerGate
             await reporter.report({
                 decision: "approve_with_comments",
                 findings: [],
-                summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed:\n\n> ${reason}`,
+                summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed:\n\n> ${publicFailureReason(error)}`,
                 incomplete: [],
             });
         }
@@ -198,10 +304,12 @@ function failureReview(scopeName, reason) {
     };
 }
 /** The routing fan-out: one process, N scopes reviewed sequentially, one render. */
-async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir) {
+async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, options) {
+    const { agents, route, scopesFilter, commentOverride, bypassTriggerGate, configDir } = options;
     // The root config + manifest follow the override; scope configs stay
-    // repo-root-relative (loadScopeConfig reads <root>/<scope.config>/.expo-code-review).
-    const rootConfig = await loadReviewConfig(cwd, { configDir });
+    // relative to the TRUSTED root (loadScopeConfig reads
+    // <configRoot>/<scope.config>/.expo-code-review).
+    const rootConfig = await loadReviewConfig(configRoot, { configDir });
     // The root/aggregate marker is the ACTUAL root-owned comment tag so the
     // pre-routing comment and its dismissal state upsert in place, not stranded
     // under a new marker (risk 8/9). manifest.defaults.commentTag is the
@@ -240,7 +348,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
     if (!passesTriggerGate(await fetchPrLabels(repo, prNumber, cwd), rootConfig.review, bypassTriggerGate)) {
         return;
     }
-    const source = memoizeSource(new GitHubPRSource({ prNumber, repo, cwd }));
     const changed = await source.getChangedFiles();
     const resolution = resolveScopes(manifest, changed.map((file) => file.path));
     process.stderr.write("CI reviewer: scope ownership —\n");
@@ -276,7 +383,6 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         if (await bgReporter.checkBreakGlass()) {
             process.stderr.write(`CI reviewer: ${rootConfig.breakGlassMarker} detected; skipping.\n`);
             await bgReporter.postSkipNote();
-            await source.dispose();
             return;
         }
     }
@@ -284,17 +390,17 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
     // Build ONE link context for all scopes (rate-limit hygiene): diff lines from the
-    // already-fetched changed files, base SHA via a single `gh pr view`.
+    // already-fetched changed files, base OID from the memoized PR metadata (the same
+    // immutable OID the trusted config root was materialized from).
     const link = {
         repo,
         prNumber,
         diffLines: buildDiffLineIndex(changed.map((file) => ({ path: file.path, patch: file.patch }))),
     };
     try {
-        const { stdout } = await run("gh", ["pr", "view", String(prNumber), "--repo", repo, "--json", "baseRefOid"], { cwd });
-        const oid = JSON.parse(stdout).baseRefOid;
-        if (oid) {
-            link.baseSha = oid;
+        const { baseOid } = await source.getMetadata();
+        if (baseOid) {
+            link.baseSha = baseOid;
         }
     }
     catch {
@@ -317,7 +423,18 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
         const isDefault = scope.configDir === ".";
         let review;
         try {
-            const config = await loadScopeConfig(cwd, scopeDef, manifest, rootConfig);
+            // A scope whose config dir doesn't exist at the TRUSTED base commit is a
+            // scope this PR introduces: review it with the root config rather than
+            // failing the run on exactly that PR. The scope's own config (PR-owned,
+            // untrusted for this run) activates once it merges.
+            let effectiveScopeDef = scopeDef;
+            if (!hasScopeConfig(configRoot, scopeDef)) {
+                process.stderr.write(`CI reviewer: [${scope.name}] no config at "${scopeDef.config}" in the PR's base ` +
+                    `commit (new in this PR?); reviewing with the root config — the scope's config ` +
+                    `takes effect after merge.\n`);
+                effectiveScopeDef = { ...scopeDef, config: "." };
+            }
+            const config = await loadScopeConfig(configRoot, effectiveScopeDef, manifest, rootConfig);
             review = await runReview(source, {
                 config,
                 mode: "ci",
@@ -325,17 +442,16 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
                 route,
                 includePaths: scope.files,
                 passesBudgetMs: budget,
+                runsDir: workspaceRunsDir(cwd),
                 onProgress: (message) => process.stderr.write(`[${scope.name}] ${message}\n`),
             });
         }
         catch (error) {
-            const reason = errorMessage(error);
-            process.stderr.write(`CI reviewer: [${scope.name}] failed (non-blocking): ${reason}\n`);
-            review = failureReview(scope.name, reason);
+            process.stderr.write(`CI reviewer: [${scope.name}] failed (non-blocking): ${errorMessage(error)}\n`);
+            review = failureReview(scope.name, publicFailureReason(error));
         }
         results.push({ scope: scope.name, isDefault, review });
     }
-    await source.dispose();
     const reporterFor = (tag, withLink = false) => new GitHubReporter({
         prNumber,
         repo,
@@ -408,7 +524,8 @@ async function runRoutedCi(manifest, repo, prNumber, cwd, agents, route, scopesF
  */
 async function fetchPrLabels(repo, prNumber, cwd) {
     try {
-        const { stdout } = await run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, [
             "pr",
             "view",
             String(prNumber),