@expo/code-review-cli 0.5.2 → 0.7.0

package/build/core/review.js

@@ -3,7 +3,8 @@ import { prepareAuth } from "./auth.js";
 import { coordinate } from "./coordinator.js";
 import { writeRunLog } from "./log.js";
 import { filterNoise, writePatchWorkspace } from "./noise.js";
-import { addTokenUsage, AgentTimeoutError, assertModelsResolvable, buildOpencodeConfig, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
+import { addTokenUsage, AgentTimeoutError, assertModelsResolvable, buildOpencodeConfig, CLAUDE_CODE_ENGINE, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
+import { buildEngineMap, claudeTemperatureNote, claudeTokenCredential, startClaudeCode, } from "./claude-code.js";
 import { routeAgents } from "./router.js";
 import { buildCrossCuttingSystem, buildCrossCuttingTask, buildReviewerSystem, buildReviewerTask, NO_TOOLS_INSTRUCTION, } from "./prompts.js";
 import { fingerprintFinding, parseReviewerOutput } from "./schema.js";
@@ -33,25 +34,42 @@ function makeRunId() {
  * thin wrappers that supply a Source and render the result.
  */
 /**
- * Max concurrent reviewer calls: an explicit config value wins; otherwise 3 when a
- * subscription (oauth) credential is configured, else 6. One ChatGPT account
- * handles six parallel streams poorly — requests get parked server-side (the
- * stall signature seen on eas-cli#4084), and several PRs may be reviewing on the
- * same credential at once — so subscription runs trade a little wall-clock for a
- * lot of reliability. Exported for tests.
+ * Max concurrent reviewer calls: an explicit config value wins; otherwise 3 when the
+ * run leans on a subscription credential, else 6. One subscription account handles
+ * six parallel streams poorly — requests get parked server-side (the stall signature
+ * seen on eas-cli#4084), and several PRs may be reviewing on the same credential at
+ * once — so subscription runs trade a little wall-clock for a lot of reliability.
+ *
+ * A subscription run is any of: an oauth (ChatGPT/Codex) entry; OR the Claude Code
+ * engine being in use (an `anthropic/…` model) on an OAUTH credential — a subscription
+ * token OR the local `claude` login fallback (no forwardable token). An anthropic
+ * credential that classifies as an API KEY is metered per-request and does NOT force
+ * the cap. Exported for tests.
  */
-export function effectiveConcurrency(config) {
+export function effectiveConcurrency(config, env = process.env) {
     if (config.chunk.concurrency) {
         return config.chunk.concurrency;
     }
-    return config.auth.some((entry) => entry.mode === "oauth") ? 3 : 6;
+    if (config.auth.some((entry) => entry.mode === "oauth")) {
+        return 3;
+    }
+    if (buildEngineMap(config).usesClaude) {
+        const entry = config.auth.find((auth) => auth.provider === "anthropic");
+        const credential = claudeTokenCredential(entry, env);
+        // No forwardable token ⇒ the `claude` login (a subscription) covers the run; an
+        // "sk-ant-oat…" token is a subscription too. Either caps; an API key does not.
+        if (!credential || credential.kind === "oauth") {
+            return 3;
+        }
+    }
+    return 6;
 }
 export async function runReview(source, options) {
     const { config } = options;
     const started = Date.now();
     const runId = makeRunId();
     const progress = options.onProgress ?? (() => { });
-    const runsRoot = path.join(config.configDir, ".runs");
+    const runsRoot = options.runsDir ?? path.join(config.configDir, ".runs");
     const runDir = path.join(runsRoot, runId);
     const logPath = path.join(runsRoot, "reviews.jsonl");
     // Fail fast on an invalid explicit selection before doing any work. Routing
@@ -97,18 +115,39 @@ export async function runReview(source, options) {
         });
         return output;
     }
-    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
-    // and doing it first means nothing that can throw sits between the chdir and the
-    // guarded blocks — so a prepareAuth failure can't leak the worktree or leave cwd
-    // pointing at it.
-    const auth = await prepareAuth(config);
-    // Read the PR-head tree (not the current checkout) when the source can materialize
-    // it, so the agents' surrounding-source reads and the verifier's re-reads see the
-    // versions that match the diff. Config is already fully loaded in memory, so the
-    // chdir doesn't affect it; run-log/patch paths are absolute; gh/git calls already
-    // ran above. Fails soft to the current directory.
+    // Materialize the PR-head tree (not the current checkout) when the source can, so
+    // the agents' surrounding-source reads and the verifier's re-reads see the versions
+    // that match the diff. Config is already fully loaded in memory, so the chdir below
+    // doesn't affect it; run-log/patch paths are absolute; gh/git calls already ran
+    // above. Failure policy is MODE-DEPENDENT (see resolveReadRoot): CI fails closed —
+    // with a base-SHA checkout the fallback tree is pre-PR content, and silently
+    // reviewing/verifying that drops real findings — while a local run falls back to
+    // the user's own checkout with a warning.
+    // Resolve each agent's engine BEFORE prepareAuth/readRoot, so the per-engine
+    // startup below can't leak the readRoot worktree or a temp auth dir holding a
+    // live credential (buildEngineMap only inspects config, so nothing needs cleanup
+    // yet at this point). Nothing throws here anymore — one run may drive BOTH the
+    // Claude Code CLI engine and OpenCode at once, inferred per agent from its model.
+    //
+    // Scope the engine set to the SELECTED agents so a run whose passes never touch
+    // Claude doesn't start (and fail on a missing CLI/token for) the Claude Code
+    // engine. An explicit `--agents` subset is known here; routing picks from the full
+    // roster later (its router needs an engine up first), so a routed/all run keeps
+    // the full roster and can drive either engine.
+    const { engineOf, modelOf, usesOpencode, usesClaude } = buildEngineMap(config, explicitAgents ?? config.agents);
     const originalCwd = process.cwd();
-    const readRoot = (await source.prepareReadRootAsync?.()) ?? null;
+    const readRoot = await resolveReadRoot(source, options.mode, progress);
+    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
+    // and doing it after readRoot but before chdir means a prepareAuth failure can't
+    // leave cwd pointing at the worktree — it only has the worktree itself to release.
+    let auth;
+    try {
+        auth = await prepareAuth(config);
+    }
+    catch (error) {
+        await readRoot?.cleanup();
+        throw error;
+    }
     const restoreCwd = async () => {
         if (readRoot) {
             process.chdir(originalCwd);
@@ -119,10 +158,21 @@ export async function runReview(source, options) {
         progress("Reviewing the PR-head tree (so reads match the PR, not the checkout).");
         process.chdir(readRoot.dir);
     }
-    progress("Starting OpenCode server…");
-    let handle = null;
+    const starting = [
+        usesClaude ? "Claude Code engine" : null,
+        usesOpencode ? "OpenCode server" : null,
+    ]
+        .filter(Boolean)
+        .join(" + ");
+    progress(`Starting ${starting}…`);
+    // Start each engine the run actually uses. OpenCode first so a claude failure can
+    // close it. Two separate try blocks keep the precise per-engine error messages.
+    let opencodeHandle = null;
+    let claudeHandle = null;
     try {
-        handle = await startOpencode(buildOpencodeConfig(config));
+        if (usesOpencode) {
+            opencodeHandle = await startOpencode(buildOpencodeConfig(config));
+        }
     }
     catch (error) {
         await auth.cleanup();
@@ -130,11 +180,71 @@ export async function runReview(source, options) {
         throw new Error(`Failed to start the OpenCode server. Ensure the \`opencode\` CLI is installed and ` +
             `model credentials are configured (\`ecr doctor\` checks both).\n${errorMessage(error)}`);
     }
-    // Preflight: a model id the server can't resolve would otherwise fail EVERY pass
-    // identically — N indistinguishable coverage gaps, after spending the run's budget
-    // discovering the same fixable thing N times. Throw once, up front, naming the fix.
     try {
-        await assertModelsResolvable(handle, [...config.agents.map((agent) => agent.model), config.coordinator.model], config.auth);
+        if (usesClaude) {
+            claudeHandle = await startClaudeCode(config);
+        }
+    }
+    catch (error) {
+        opencodeHandle?.close();
+        await auth.cleanup();
+        await restoreCwd();
+        throw new Error(`Failed to start the Claude Code engine. Ensure the \`claude\` CLI is installed and ` +
+            `logged into a Max/Team subscription (\`ecr doctor\` checks both).\n${errorMessage(error)}`);
+    }
+    // Build the single carrier handle so every downstream `handle` call is unchanged;
+    // per-agent dispatch happens inside via engineOf. When OpenCode is in use the
+    // carrier is the opencode handle (claude reached via `.claude`); a claude-only run
+    // uses the claude handle itself as the carrier (engineOf maps every id → claude).
+    const engineFn = (agent) => engineOf[agent] ?? "opencode";
+    let handle;
+    if (opencodeHandle) {
+        handle = opencodeHandle;
+        handle.claude = claudeHandle ?? undefined;
+        handle.engineOf = engineFn;
+        const closeOpencode = opencodeHandle.close;
+        handle.close = () => {
+            closeOpencode();
+            claudeHandle?.close(); // claude close is a noop, but keep the composition explicit
+        };
+    }
+    else {
+        handle = claudeHandle; // claude-only: the carrier is the claude handle itself
+        handle.engineOf = engineFn;
+    }
+    // The claude-code engine has no temperature control (the CLI exposes no flag), so
+    // surface a tuned-but-ignored temperature once, here, instead of letting the config
+    // divergence pass silently. Applies whenever any pass is claude-routed.
+    if (usesClaude) {
+        const note = claudeTemperatureNote(config, engineOf);
+        if (note) {
+            progress(`Note: ${note}`);
+        }
+    }
+    // Preflight: a model id an engine can't resolve would otherwise fail EVERY pass
+    // routed to it identically — N indistinguishable coverage gaps, after spending the
+    // run's budget rediscovering the same fixable thing. Throw once, up front, naming
+    // the fix. Split per engine so each engine only ever sees its own model subset: the
+    // OpenCode server never receives an anthropic-claude id (unknown-provider error) and
+    // assertClaudeModels never receives a non-anthropic id (its foreign-id throw).
+    const modelsFor = (eng) => [
+        ...new Set(Object.keys(engineOf)
+            .filter((id) => engineOf[id] === eng)
+            .map((id) => modelOf[id])),
+    ];
+    try {
+        if (opencodeHandle) {
+            const models = modelsFor("opencode");
+            if (models.length > 0) {
+                await assertModelsResolvable(opencodeHandle, models, config.auth);
+            }
+        }
+        if (claudeHandle) {
+            const models = modelsFor("claude-code");
+            if (models.length > 0) {
+                await assertModelsResolvable(claudeHandle, models, config.auth);
+            }
+        }
     }
     catch (error) {
         handle.close();
@@ -163,6 +273,10 @@ export async function runReview(source, options) {
     // log, reported in the log line, and surfaced as a coverage note when it happens.
     const agentModels = {};
     const substituted = new Set();
+    // The buckets whose model was substituted, so the coverage note can name each
+    // one's OWN engine (a mixed run may substitute on either side, for different
+    // reasons — a CLI usage-limit downgrade vs. OpenCode's silent default fallback).
+    const substitutedBuckets = new Set();
     const trackModel = (bucket, configured, actual) => {
         if (!actual) {
             return;
@@ -170,6 +284,7 @@ export async function runReview(source, options) {
         agentModels[bucket] = actual;
         if (configured && actual !== configured) {
             substituted.add(`${bucket}: configured ${configured}, ran ${actual}`);
+            substitutedBuckets.add(bucket);
         }
     };
     try {
@@ -439,10 +554,20 @@ export async function runReview(source, options) {
             for (const line of substituted) {
                 progress(`  ⚠ model substituted — ${line}`);
             }
+            const subEngines = new Set([...substitutedBuckets].map((bucket) => engineOf[bucket] ?? "opencode"));
+            const why = [];
+            if (subEngines.has(CLAUDE_CODE_ENGINE)) {
+                why.push("The Claude Code CLI answered with a different model than configured (usage-limit " +
+                    "downgrades do this on a subscription), so these findings may come from a weaker " +
+                    "model than intended — check the configured model ids and the subscription's limits.");
+            }
+            if (subEngines.has("opencode")) {
+                why.push("OpenCode silently falls back to a default model when the configured id is empty or " +
+                    "unusable, so these findings may come from a different (possibly much weaker) model " +
+                    "than intended — check the agents' `model`, `coordinator.model`, REVIEWER_MODEL, and the provider credential.");
+            }
             incomplete.push(`Some passes did not run on the configured model (${[...substituted].join("; ")}). ` +
-                `OpenCode silently falls back to a default model when the configured id is empty or ` +
-                `unusable, so these findings may come from a different (possibly much weaker) model ` +
-                `than intended — check the agents' \`model\`, \`coordinator.model\`, REVIEWER_MODEL, and the provider credential.`);
+                why.join(" "));
         }
         // Note: routine noise filtering (lockfiles, generated, binary) is expected and
         // NOT a coverage gap — it stays in the run log (filteredFiles), not the
@@ -536,10 +661,22 @@ export async function runReview(source, options) {
         // Surface provider throttling as a fact about the run: passes already waited or
         // backed off, but the operator should still SEE that it happened (a run that
         // was rate-limited is slower and may carry partial passes — that's the cause).
-        await handle.rateLimit.check();
-        if (handle.rateLimit.events > 0) {
-            progress(`  ⚠ provider rate-limited this run ${handle.rateLimit.events} time(s) ` +
-                `(429s in the OpenCode server log) — passes waited it out rather than failing`);
+        // Sum both engines' watches; name a cause only for an engine whose watch fired
+        // (claude events arrive via note() in runClaudePrompt; opencode via its server log).
+        await opencodeHandle?.rateLimit.check();
+        const rlOpencode = opencodeHandle?.rateLimit.events ?? 0;
+        const rlClaude = claudeHandle?.rateLimit.events ?? 0;
+        const rlTotal = rlOpencode + rlClaude;
+        if (rlTotal > 0) {
+            const causes = [];
+            if (rlClaude > 0) {
+                causes.push("subscription rate/usage limits reported by the Claude Code CLI");
+            }
+            if (rlOpencode > 0) {
+                causes.push("429s in the OpenCode server log");
+            }
+            progress(`  ⚠ provider rate-limited this run ${rlTotal} time(s) (${causes.join("; ")}) ` +
+                `— passes waited it out rather than failing`);
         }
         // Every pass says which model actually answered it — in the job log, the step
         // summary table, and the run log — so a wrong or substituted model is always
@@ -561,7 +698,12 @@ export async function runReview(source, options) {
             agentFindings,
             coverageNotes,
             verifierDropped,
-            ...(handle.rateLimit.events > 0 ? { rateLimitEvents: handle.rateLimit.events } : {}),
+            ...(rlTotal > 0
+                ? {
+                    rateLimitEvents: rlTotal,
+                    rateLimitByEngine: { opencode: rlOpencode, claudeCode: rlClaude },
+                }
+                : {}),
             durationMs: Date.now() - started,
             decision: output.decision,
             findingCount: output.findings.length,
@@ -586,7 +728,7 @@ export async function runReview(source, options) {
         throw error;
     }
     finally {
-        handle?.close();
+        handle.close();
         await auth.cleanup();
         await restoreCwd();
     }
@@ -668,6 +810,39 @@ export function reconcileSummary(summary, remaining) {
         "this summary was written, so it may mention issues no longer listed below._\n\n" +
         summary);
 }
+/**
+ * Resolve the tree the review reads from, applying the mode's trust policy:
+ *
+ * - `null` from the source means "nothing to materialize" — reviewing the current
+ *   checkout is intended (local diffs, or `--pr` without a repo). Never an error.
+ * - A materialization FAILURE (throw) is fatal in CI: the checkout there is the
+ *   trusted BASE tree, and falling back to it would silently review and verify
+ *   pre-PR file contents (dropping real findings with no trace in the output).
+ *   The throw propagates to `ecr ci`'s catch, which posts the one terminal
+ *   "not reviewed" comment.
+ * - The same failure in local mode degrades softly to the user's own checkout —
+ *   the user is the trust principal there and sees the warning directly.
+ *
+ * Exported for tests.
+ */
+export async function resolveReadRoot(source, mode, progress) {
+    if (!source.prepareReadRootAsync) {
+        return null;
+    }
+    try {
+        return await source.prepareReadRootAsync();
+    }
+    catch (error) {
+        if (mode === "ci") {
+            throw new Error(`Could not materialize the PR-head tree to review (and the CI checkout is the ` +
+                `trusted base, so reviewing it instead would silently review the wrong ` +
+                `contents): ${errorMessage(error)}`);
+        }
+        progress(`Could not materialize the PR-head tree (${errorMessage(error)}); ` +
+            `reading the current checkout instead — file contents may not match the PR.`);
+        return null;
+    }
+}
 /** Capitalize the first letter (coverage notes read as sentences). */
 function capitalize(text) {
     return text.length > 0 ? text[0].toUpperCase() + text.slice(1) : text;

package/build/core/schema.js

@@ -112,7 +112,12 @@ export function extractJsonObject(text) {
             lastError = error;
         }
     }
-    throw new Error(`Could not extract JSON from model response: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+    throw new Error(lastError === undefined
+        ? // No candidate was even tried: the response held no {...} block at all —
+            // empty output, or prose/pseudo-tool-call text with no JSON in it.
+            `Could not extract JSON from model response: no JSON object found in ` +
+                `${text.trim() === "" ? "an EMPTY response" : `a ${text.length}-char response with no {...}`}`
+        : `Could not extract JSON from model response: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
 }
 /** The router's choice of which agent ids to run. */
 export const RouteOutputSchema = z.object({

package/build/core/scrub.js

@@ -0,0 +1,120 @@
+import { readdir, realpath, rm } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Ambient runtime configuration the OpenCode server (and the Claude-compatible
+ * loaders inside it) discovers from its project directory. The review core chdirs
+ * into a materialized PR-HEAD worktree before starting the server, so every one
+ * of these is attacker-writable in a PR: a plugin or MCP definition is arbitrary
+ * code execution in a process holding the model credential and a comment-capable
+ * GH_TOKEN; a `.env` can repoint a provider base URL; instruction files inject
+ * system-level prompts. OPENCODE_CONFIG_CONTENT (how ECR passes its own config)
+ * MERGES with project config rather than replacing it, so deleting these from the
+ * throwaway worktree is the only isolation that doesn't depend on OpenCode
+ * semantics.
+ *
+ * Exact-name entries match files or directories at any depth; `.env` is matched
+ * as a prefix (`.env`, `.env.local`, …). The PR's CHANGES to these files are
+ * still reviewed — their diffs are inlined in the task prompt — but the reviewer
+ * can no longer open their full head contents, and a finding citing one will
+ * fail verification (a documented tradeoff of the scrub approach).
+ */
+export const AMBIENT_RUNTIME_CONFIG_NAMES = new Set([
+    "opencode.json",
+    "opencode.jsonc",
+    ".opencode",
+    "AGENTS.md",
+    "CLAUDE.md",
+    ".claude",
+    ".mcp.json",
+    ".cursor",
+    ".cursorrules",
+]);
+/** Names never descended into (and never scrubbed as a unit — `.git` is the worktree link). */
+const SKIP_DIRS = new Set([".git", "node_modules"]);
+/** Whether a directory entry is ambient runtime config that must not reach the model runtime. */
+export function isAmbientRuntimeConfig(name) {
+    return AMBIENT_RUNTIME_CONFIG_NAMES.has(name) || name === ".env" || name.startsWith(".env.");
+}
+/**
+ * Remove ambient runtime config from a THROWAWAY materialized tree, at every
+ * depth. Must only ever run on a tree ECR created and will delete (a worktree or
+ * extracted archive) — never on the user's checkout. Returns the repo-relative
+ * paths removed so callers can log them.
+ */
+export async function scrubAmbientRuntimeConfig(root) {
+    const removed = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (isAmbientRuntimeConfig(entry.name)) {
+                await rm(full, { recursive: true, force: true });
+                removed.push(path.relative(root, full));
+                continue;
+            }
+            if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+                await walk(full);
+            }
+        }
+    };
+    await walk(root);
+    return removed.sort();
+}
+/**
+ * Remove symlinks whose fully resolved target lies outside the materialized tree.
+ *
+ * The model runtime's read tools are path-scoped by the LITERAL path argument
+ * (buildClaudeArgs' permission rules, and equally OpenCode's project-root
+ * containment), but the fs layer underneath follows symlinks — so a PR-committed
+ * link (`docs/notes.md -> ~/.claude/.credentials.json`) passes the in-tree check
+ * and reads the out-of-tree target. Git can only materialize regular files,
+ * directories, and symlinks, so stripping escaping symlinks here closes the whole
+ * class.
+ *
+ * Fail closed: a link whose target cannot be resolved (broken, or a chain that
+ * leaves the tree at any hop) is removed too — the target could come into
+ * existence later, and a broken link has no legitimate review value. In-tree
+ * links survive (realpath resolves chains, so an in-tree alias of an in-tree
+ * file is provably contained). Unlike the config scrub, this walk descends into
+ * node_modules (a committed one is attacker content); `.git` stays skipped — in
+ * a worktree it is an ECR-created gitdir link, not PR content.
+ *
+ * Must only ever run on a tree ECR created and will delete. Returns the
+ * repo-relative paths removed so callers can log them.
+ */
+export async function removeEscapingSymlinks(root) {
+    // realpath the boundary itself: tmpdir-based roots are often behind symlinks
+    // (macOS /var -> /private/var), and containment must compare resolved paths.
+    const boundary = await realpath(root);
+    const removed = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                let contained = false;
+                try {
+                    const target = await realpath(full);
+                    contained = target === boundary || target.startsWith(boundary + path.sep);
+                }
+                catch {
+                    // Unresolvable link: leave `contained` false (fail closed).
+                }
+                if (!contained) {
+                    await rm(full, { force: true });
+                    // Relative to the RESOLVED boundary — the walk runs there, and the
+                    // caller's `root` may itself sit behind a symlink (macOS /var).
+                    removed.push(path.relative(boundary, full));
+                }
+                // In-tree directory links are kept but never descended: their contents
+                // are walked once via the real path, and descending would loop on cycles.
+                continue;
+            }
+            if (entry.isDirectory() && entry.name !== ".git") {
+                await walk(full);
+            }
+        }
+    };
+    await walk(boundary);
+    return removed.sort();
+}

package/build/core/throttle.js

@@ -56,6 +56,16 @@ export class RateLimitWatch {
     constructor(file = opencodeLogFile()) {
         this.file = file;
     }
+    /**
+     * Record rate-limit evidence directly, for an engine that has no log file to
+     * scan (the Claude Code CLI surfaces limits per-invocation, not in a log the
+     * way the OpenCode server does). Feeds the same `events`/`recentlyLimited`
+     * signals `check()` would.
+     */
+    note(count = 1) {
+        this.events += count;
+        this.lastSeenAt = Date.now();
+    }
     /** Scan newly-appended log lines for rate-limit evidence. */
     async check() {
         try {

package/build/core/util.js

@@ -5,6 +5,23 @@ export function sleep(ms) {
 export function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * A failure reason safe to post into a PUBLIC PR comment (see `ecr ci`'s failure
+ * notices). `run` (core/exec.ts) throws "Command failed: <cmd> <argv>\n<stderr>" (and
+ * "Command output exceeded …"), which embeds a subprocess's full command line, its
+ * stderr, and absolute runner paths — CI-internal detail of no use to a PR author and
+ * exactly the kind of thing that must not leak into an attacker-visible artifact. Those
+ * shapes collapse to a generic pointer at the workflow log; our own (argv/path-free)
+ * error messages pass through, since they are the actionable ones the fail-fast design
+ * means to surface. Every call site still writes the FULL reason to the job's stderr.
+ */
+export function publicFailureReason(error) {
+    const message = errorMessage(error);
+    if (/^Command (failed|output exceeded)\b/.test(message)) {
+        return "a subprocess (gh, git, or the model CLI) failed — see the workflow logs for details";
+    }
+    return message;
+}
 /** Collapse whitespace + lowercase — for tolerant code matching / fingerprinting. */
 export function normalizeCode(text) {
     return text.replace(/\s+/g, " ").trim().toLowerCase();

package/build/core/verify.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { pathInside } from "./exec.js";
 import { parseVerdict } from "./schema.js";
 import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from "./opencode.js";
 import { buildVerifierSystem, buildVerifierTask } from "./prompts.js";
@@ -50,9 +51,20 @@ export function matchEvidence(evidence, content) {
 }
 /** Read the cited file and grade the evidence against it (see matchEvidence). */
 async function evidencePresence(finding, cwd) {
+    // finding.file is an unconstrained, LLM-authored string produced over untrusted PR
+    // content, so a prompt-injected finding could point it at a host secret. path.resolve
+    // IGNORES cwd when finding.file is already absolute (e.g. ~/.claude/.credentials.json),
+    // and `..` segments escape upward — either would make this raw readFile reach outside
+    // the reviewed tree with the host user's privileges, and the present/absent grading
+    // would leak a content-oracle back into the review. Confine the read to cwd (the
+    // materialized PR-head tree); anything outside is uncheckable, never read.
+    const resolved = path.resolve(cwd, finding.file);
+    if (!pathInside(resolved, cwd)) {
+        return "unknown";
+    }
     let content;
     try {
-        content = await readFile(path.resolve(cwd, finding.file), "utf8");
+        content = await readFile(resolved, "utf8");
     }
     catch {
         return "unknown";