@expo/code-review-cli 0.6.0 → 0.7.0

package/README.md

@@ -110,7 +110,7 @@ is a ready example to adapt.
 | `ecr init [--no-workflow] [--force]` | Scaffold `.expo-code-review/` (config, agents, prompts) + a CI workflow. |
 | `ecr init --monorepo` | …and add a `routing.jsonc` routing manifest (one default scope). |
 | `ecr init --scope <dir>` | Scaffold a per-team scope under `<dir>` and register it in the manifest. |
-| `ecr setup-auth [--yes]` | Walk through getting model credentials for local runs (ChatGPT sign-in and/or API keys), printing the `export` lines for your shell config. |
+| `ecr setup-auth [--yes]` | Walk through getting model credentials for local runs (ChatGPT/Claude sign-in and/or API keys), printing the `export` lines for your shell config. |
 | `ecr review [options]` | Review local changes and print an advisory review (default command). |
 | `ecr review --scope <name>` | Review only one routing scope over just that scope's changed files. |
 | `ecr ci` | Review the current GitHub PR and post/update a comment. For GitHub Actions. |
@@ -545,18 +545,36 @@ set in `config.auth` (credentials come from OpenCode):
     One caveat: OpenCode can't price alias models (they're config-declared), so
     pro passes report `$0` in the run log's cost column — token counts are
     correct, and the OpenAI project dashboard is the source of truth for spend.
-- **Anthropic / Claude (API key)** — set `auth.provider` to `"anthropic"`, point
-  `tokenEnv` at the env var holding a Console API key (e.g. `ANTHROPIC_API_KEY`),
-  and use `anthropic/...` model ids; the key is sent as `x-api-key`. Note that
-  Claude Pro/Max **subscription** tokens cannot be used here: Anthropic prohibits
-  them in third-party tools, and OpenCode has no Anthropic OAuth support — only an
-  API key works.
+- **Anthropic / Claude** — use `anthropic/...` model ids and every anthropic pass
+  runs through the **Claude Code CLI** (`claude -p --output-format json`), inferred
+  from the model. The credential is (in order) a `tokenEnv` you name, an ambient
+  `CLAUDE_CODE_OAUTH_TOKEN`, or your local `claude` login — an `auth` entry is
+  entirely optional. Run `claude setup-token` for a Max/Team subscription token
+  (forwarded as `CLAUDE_CODE_OAUTH_TOKEN`) or point `tokenEnv` at an Anthropic
+  Console API key (`sk-ant-api…`, forwarded as `ANTHROPIC_API_KEY`); the CLI reads
+  either. `ecr setup-auth` walks you through it. Each pass is trust-isolated and
+  read-only: it runs with `--safe-mode` (no `CLAUDE.md`/hooks/MCP/plugins),
+  `--strict-mcp-config`, `--permission-mode dontAsk`, and only the
+  `Read`/`Grep`/`Glob` tools — never `Bash`/`Edit`/`Write`/`WebFetch`/`WebSearch`.
+  The child env is an allowlist that omits ambient `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`
+  (only the configured credential is re-injected).
+  ```jsonc
+  // Optional — no anthropic entry at all falls back to your `claude` login.
+  "auth": { "providers": {
+    "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" }
+  } }
+  ```
 - **Another provider** — the current path is the `REVIEWER_MODEL`
   env override: `opencode auth login` once (pick the provider), then run with
   e.g. `REVIEWER_MODEL=google/gemini-3-pro`. It overrides every agent's model
-  and uses your OpenCode login, so no `auth` block is needed. *(Per-agent
-  provider mixing beyond the alias mechanism above is on the
-  [roadmap](./ROADMAP.md).)*
+  and uses your OpenCode login, so no `auth` block is needed.
+
+Engines are inferred **per agent** from that agent's resolved model alone: an
+`anthropic/…` agent runs through the Claude Code CLI while other agents run through
+OpenCode — in the SAME run. So an anthropic model may coexist with an `openai` (or
+any other) OpenCode provider, and each agent's `model` selects its engine.
+`REVIEWER_MODEL` still overrides every agent's model (and therefore every agent's
+engine), converging the whole run onto one engine.
 
 There is no shared fallback key; if a run fails for lack of credentials, authenticate
 a provider in OpenCode. `ecr doctor` diagnoses setup.
@@ -570,8 +588,11 @@ rediscovering one fixable thing, then reports N coverage gaps. So before any pas
   model, with nothing pointing at the credential. A truncated value, surrounding
   whitespace, or a token that can't work for the configured `auth.mode` is rejected
   by name.
-- **Configured model ids are checked against the running server**, so a typo or an id
-  the provider doesn't have is reported once, up front, with the close matches.
+- **Configured model ids for OpenCode-routed providers are checked against the running
+  server**, so a typo or an id the provider doesn't have is reported once, up front,
+  with the close matches. `anthropic/…` (Claude Code) model ids aren't checked up
+  front — Claude validates them per-request, so a typo there surfaces as a per-pass
+  error instead.
 - **`ecr doctor` reports the `opencode` version actually in use** and warns when a
   different one is first on your `PATH` — runs use the version this package pins.
 

package/build/commands/ci.js

@@ -2,8 +2,8 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { CONFIG_DIRNAME, hasScopeConfig, loadAuthFromRoot, loadReviewConfig, loadScopeConfig, tokenEnvMismatch, } from "../config/load.js";
 import { loadRoutingManifest, resolveScopes, scopedCommentTag, scopePassesBudgetMs, formatOwnerTable, } from "../config/routing.js";
-import { repoRoot, run } from "../core/exec.js";
-import { errorMessage } from "../core/util.js";
+import { repoRoot, resolveTrustedTool, run } from "../core/exec.js";
+import { errorMessage, publicFailureReason } from "../core/util.js";
 import { buildDiffLineIndex } from "../core/render.js";
 import { runReview } from "../core/review.js";
 import { GitHubPRSource } from "../sources/github-pr.js";
@@ -134,7 +134,7 @@ export async function ciCommand(argv = []) {
             const reason = errorMessage(error);
             process.stderr.write(`CI reviewer: could not materialize the PR's base commit for trusted configuration ` +
                 `(failing closed, not reviewing): ${reason}\n`);
-            await postTerminalFailureNote(repo, prNumber, cwd, `it could not load trusted configuration from the PR's base commit (${reason}). ` +
+            await postTerminalFailureNote(repo, prNumber, cwd, `it could not load trusted configuration from the PR's base commit (${publicFailureReason(error)}). ` +
                 `This usually means the runner has no git checkout or no usable GH_TOKEN; re-run once fixed`);
             return;
         }
@@ -285,7 +285,7 @@ async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
             await reporter.report({
                 decision: "approve_with_comments",
                 findings: [],
-                summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed:\n\n> ${reason}`,
+                summary: `⚠️ The AI reviewer failed to run, so this change was **not** reviewed:\n\n> ${publicFailureReason(error)}`,
                 incomplete: [],
             });
         }
@@ -447,9 +447,8 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
             });
         }
         catch (error) {
-            const reason = errorMessage(error);
-            process.stderr.write(`CI reviewer: [${scope.name}] failed (non-blocking): ${reason}\n`);
-            review = failureReview(scope.name, reason);
+            process.stderr.write(`CI reviewer: [${scope.name}] failed (non-blocking): ${errorMessage(error)}\n`);
+            review = failureReview(scope.name, publicFailureReason(error));
         }
         results.push({ scope: scope.name, isDefault, review });
     }
@@ -525,7 +524,8 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
  */
 async function fetchPrLabels(repo, prNumber, cwd) {
     try {
-        const { stdout } = await run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        const { stdout } = await run(gh, [
             "pr",
             "view",
             String(prNumber),

package/build/commands/doctor.js

@@ -3,36 +3,72 @@ import { loadRoutingManifest, resolveScopes, scopePassesBudgetMs, formatOwnerTab
 import readline from "node:readline/promises";
 import { setupAuthCommand } from "./setup-auth.js";
 import { checkProviderAuth } from "../core/auth.js";
-import { opencodeBinSource } from "../core/opencode.js";
-import { git, onPath, repoRoot, run } from "../core/exec.js";
+import { claudeSubscriptionActive, claudeTokenCredential, engineForModel, resolveClaudeCli, } from "../core/claude-code.js";
+import { CLAUDE_CODE_ENGINE, opencodeBinSource } from "../core/opencode.js";
+import { git, onPath, pathInside, repoRoot, resolveOnPath, resolveTrustedTool, run, } from "../core/exec.js";
 import { errorMessage } from "../core/util.js";
+import { tmpdir } from "node:os";
 import path from "node:path";
 const USAGE = `ecr doctor — check environment, config, and credentials
 
 Usage:
   ecr doctor [--list-scopes]
 
-Verifies: opencode + git (+ gh for \`ecr ci\`) on PATH, .expo-code-review/ config is
-valid, agent prompts resolve, and the configured model's token env is set. When a
-routing.jsonc is present, also validates every scope, the auth singleton, scope
-ownership over tracked files, and comment-tag uniqueness.
+Verifies: the engines the config's models actually use — opencode on PATH for
+non-anthropic models, and for anthropic models the \`claude\` CLI plus a usable
+Claude credential (subscription login or token env) — plus git (+ gh for
+\`ecr ci\`), that .expo-code-review/ config is valid, agent prompts resolve, and
+the configured model's token env is set. When a routing.jsonc is present, also
+validates every scope, the auth singleton, scope ownership over tracked files,
+and comment-tag uniqueness.
 
 Options:
   --list-scopes   Print the routing scope table (name, dir, paths, agents, tag)
 `;
 /**
- * `opencode --version`, run from `binDir` if given (so the bundled CLI can be asked
- * directly) or from PATH otherwise. Null when it can't be determined — a version we
- * can't read is worth staying quiet about, not failing over.
+ * `<cliPath> --version`, run from tmpdir() (never the inherited, possibly untrusted
+ * cwd). `cliPath` is an already-resolved absolute path — doctor may run inside a cloned
+ * untrusted repo, so the binary is resolved-and-checked before it reaches here, never a
+ * bare `opencode`. Null when it can't be determined — a version we can't read is worth
+ * staying quiet about, not failing over.
  */
-async function opencodeVersion(binDir) {
-    const command = binDir ? path.join(binDir, "opencode") : "opencode";
-    const { stdout, code } = await run(command, ["--version"], { check: false });
+async function opencodeVersion(cliPath) {
+    const { stdout, code } = await run(cliPath, ["--version"], { check: false, cwd: tmpdir() });
     if (code !== 0) {
         return null;
     }
     return stdout.trim().split("\n")[0]?.trim() || null;
 }
+/**
+ * The engines this repo actually drives, mirroring how real reviews resolve them:
+ * engineForModel over every ROOT agent + coordinator model, PLUS every loaded scope
+ * config's agents + coordinator. A routed scope can select an anthropic/… model while
+ * the root config is OpenCode-only, so without folding scopes in doctor would report
+ * success without ever checking the Claude CLI/login the scoped review needs. A scope
+ * that fails to load is skipped here — the scope-validation block reports it with the
+ * full error. Exported for tests.
+ */
+export async function resolveEngines(root, rootConfig, manifest) {
+    const engines = new Set();
+    const add = (config) => {
+        for (const agent of config.agents) {
+            engines.add(engineForModel(agent.model));
+        }
+        engines.add(engineForModel(config.coordinator.model));
+    };
+    add(rootConfig);
+    if (manifest) {
+        for (const scope of manifest.scopes) {
+            try {
+                add(await loadScopeConfig(root, scope, manifest, rootConfig));
+            }
+            catch {
+                // Malformed scope config: reported by the scope-validation block below.
+            }
+        }
+    }
+    return engines;
+}
 /** Preflight checks so a broken setup surfaces clearly instead of silently no-opping. */
 export async function doctorCommand(argv = []) {
     if (argv.includes("-h") || argv.includes("--help")) {
@@ -64,30 +100,74 @@ export async function doctorCommand(argv = []) {
     if (process.env.ECR_CONFIG_DIR) {
         info(`ECR_CONFIG_DIR override active: root config.jsonc and routing.jsonc read from ${resolveConfigDir(root)} (scope subtrees stay repo-root-relative)`);
     }
+    // Peek at the config to resolve the engine BEFORE the opencode checks: a
+    // claude-code-only repo never touches OpenCode, and a missing `opencode` CLI
+    // must not fail its doctor run. Load errors are swallowed here — the config
+    // block below reports them properly and defaults the engine to OpenCode.
+    let rootConfig;
+    if (hasConfig(root)) {
+        try {
+            rootConfig = await loadReviewConfig(root);
+        }
+        catch {
+            // reported by the config block below
+        }
+    }
+    // Engines actually in use by this config: run engineForModel over every agent
+    // model + the coordinator model, ACROSS the root config AND every routed scope.
+    // Both blocks below may fire in one run (a mixed config drives OpenCode and the
+    // Claude Code CLI at once).
+    let engines = new Set(["opencode"]);
+    // Auth as real reviews resolve it (loadScopeConfig/`ecr ci`): a routing.jsonc
+    // `defaults.auth` OVERRIDES the root config's auth, so the Claude credential
+    // checks below must use the overridden value or a monorepo whose manifest swaps
+    // the anthropic entry gets the wrong checks here. (The engine set is model-only.)
+    let resolvedAuth = rootConfig?.auth ?? [];
+    if (rootConfig) {
+        try {
+            const manifest = await loadRoutingManifest(root);
+            resolvedAuth = loadAuthFromRoot(rootConfig, manifest);
+            engines = await resolveEngines(root, rootConfig, manifest);
+        }
+        catch {
+            // malformed manifest/auth: reported by the blocks below; keep the opencode default
+            engines = new Set(["opencode"]);
+        }
+    }
     // The SDK spawns a bare `opencode`, so the version that actually runs is a PATH
     // lookup. Report which one wins and whether it matches the version this package
     // pins: a stale global install against a newer SDK rejects model ids the SDK
     // considers valid (`ProviderModelNotFoundError`), which is otherwise a baffling
     // failure that only reproduces on one machine. `startOpencode` prepends our own
     // bin dir so the pinned one wins at runtime — this just makes the drift visible.
-    const bin = opencodeBinSource();
-    const opencodeInstalled = (await onPath("opencode")) || bin.pinned;
-    line(opencodeInstalled, opencodeInstalled
-        ? "opencode CLI available"
-        : "opencode CLI NOT found (install `opencode-ai`, or add node_modules/.bin to PATH)");
-    if (opencodeInstalled) {
-        const pinnedVersion = bin.pinned ? await opencodeVersion(bin.dir) : null;
-        const pathVersion = await opencodeVersion(null);
-        if (pinnedVersion) {
-            line(true, `opencode ${pinnedVersion} (bundled with this reviewer; used at runtime)`);
-            if (pathVersion && pathVersion !== pinnedVersion) {
-                warn(`a different opencode ${pathVersion} is first on your PATH — runs use the bundled ${pinnedVersion}, ` +
-                    `but other tooling (and \`opencode\` by hand) will use ${pathVersion}`);
+    if (!engines.has("opencode")) {
+        info("OpenCode is not used by this config (claude-code engine) — skipping its checks");
+    }
+    else {
+        const bin = opencodeBinSource();
+        const opencodeInstalled = (await onPath("opencode")) || bin.pinned;
+        line(opencodeInstalled, opencodeInstalled
+            ? "opencode CLI available"
+            : "opencode CLI NOT found (install `opencode-ai`, or add node_modules/.bin to PATH)");
+        if (opencodeInstalled) {
+            const pinnedVersion = bin.dir ? await opencodeVersion(path.join(bin.dir, "opencode")) : null;
+            // PATH's `opencode`, resolved from a trusted cwd (resolveOnPath) with an in-tree
+            // refusal: doctor may run in a cloned untrusted repo, so this drift probe must
+            // never execute a bare name against the inherited cwd (a committed shim would win
+            // on Windows). onPath above only tests existence — this is the executed one.
+            const pathCli = await resolveOnPath("opencode");
+            const pathVersion = pathCli && !pathInside(pathCli, process.cwd()) ? await opencodeVersion(pathCli) : null;
+            if (pinnedVersion) {
+                line(true, `opencode ${pinnedVersion} (bundled with this reviewer; used at runtime)`);
+                if (pathVersion && pathVersion !== pinnedVersion) {
+                    warn(`a different opencode ${pathVersion} is first on your PATH — runs use the bundled ${pinnedVersion}, ` +
+                        `but other tooling (and \`opencode\` by hand) will use ${pathVersion}`);
+                }
+            }
+            else if (pathVersion) {
+                warn(`using opencode ${pathVersion} from PATH — this reviewer's own \`opencode-ai\` dependency could not be ` +
+                    `resolved, so the CLI and SDK versions can drift (a stale CLI rejects model ids the SDK accepts)`);
             }
-        }
-        else if (pathVersion) {
-            warn(`using opencode ${pathVersion} from PATH — this reviewer's own \`opencode-ai\` dependency could not be ` +
-                `resolved, so the CLI and SDK versions can drift (a stale CLI rejects model ids the SDK accepts)`);
         }
     }
     line(await onPath("git"), "git found on PATH");
@@ -96,7 +176,10 @@ export async function doctorCommand(argv = []) {
     if (await onPath("gh")) {
         let authed = false;
         try {
-            await run("gh", ["auth", "status"], { cwd: root });
+            // resolveTrustedTool refuses an in-tree `gh` (throws) — caught here and treated
+            // as "found but not authenticated", keeping this probe informational, not fatal.
+            const gh = await resolveTrustedTool("gh");
+            await run(gh, ["auth", "status"], { cwd: root });
             authed = true;
         }
         catch {
@@ -112,15 +195,20 @@ export async function doctorCommand(argv = []) {
     else {
         info("gh CLI not on PATH — only needed for `ecr ci` (posting PR comments)");
     }
-    let rootConfig;
     if (!hasConfig(root)) {
         line(false, `no ${".expo-code-review"}/config.jsonc (run \`ecr init\`)`);
     }
     else {
         try {
-            rootConfig = await loadReviewConfig(root);
+            // Reuse the engine-detection peek above; re-load only if that failed so
+            // the error surfaces here with full reporting.
+            rootConfig ??= await loadReviewConfig(root);
             line(true, `config valid: ${rootConfig.agents.length} agent(s) [${rootConfig.agents.map((a) => a.id).join(", ")}], coordinator model ${rootConfig.coordinator.model}`);
             line(rootConfig.agents.every((a) => Boolean(a.promptText.trim())), "all agent prompt files resolved and non-empty");
+            // Set when the Claude Code engine has no usable credential. checkProviderAuth
+            // (below) returns ok:true for every anthropic shape (login fallback), so this
+            // is the only signal that flips the exit code and offers the setup-auth fix.
+            let claudeCredentialMissing = false;
             const readiness = checkProviderAuth(rootConfig);
             line(readiness.ok, `auth: ${readiness.detail}`);
             // A suspicious-but-not-provably-broken credential: worth saying, never a failure
@@ -128,9 +216,55 @@ export async function doctorCommand(argv = []) {
             if (readiness.warning) {
                 warn(`auth: ${readiness.warning}`);
             }
+            // Claude Code engine: the `opencode` block above is not load-bearing for
+            // these configs, so check the `claude` CLI + subscription login instead.
+            try {
+                if (engines.has(CLAUDE_CODE_ENGINE)) {
+                    // Resolve to a trusted absolute path (and refuse an in-tree binary), never a
+                    // bare `claude`: doctor may run inside a cloned untrusted repo, so a
+                    // PR-committed shim must not be the thing we probe. Same resolution the
+                    // review engine uses.
+                    const claudeCliPath = await resolveClaudeCli();
+                    line(Boolean(claudeCliPath), claudeCliPath
+                        ? "claude CLI available (Claude Code engine)"
+                        : "claude CLI NOT found (npm i -g @anthropic-ai/claude-code, then `claude setup-token`)");
+                    if (claudeCliPath) {
+                        const version = await run(claudeCliPath, ["--version"], {
+                            check: false,
+                            cwd: tmpdir(),
+                        });
+                        if (version.code === 0) {
+                            line(true, `claude ${version.stdout.trim().split("\n")[0]?.trim()}`);
+                        }
+                        // Mirror startClaudeCode's credential condition EXACTLY so doctor fails
+                        // iff a review would: a run needs an active `claude` subscription login OR
+                        // a token value (the configured tokenEnv, else an ambient
+                        // CLAUDE_CODE_OAUTH_TOKEN). warn() never flips the exit code, so a missing
+                        // credential must be a line(false) here, not a ⚠.
+                        const claudeEntry = resolvedAuth.find((a) => a.provider === "anthropic");
+                        const hasTokenCredential = Boolean(claudeTokenCredential(claudeEntry));
+                        const subscriptionActive = await claudeSubscriptionActive({ cliPath: claudeCliPath });
+                        if (subscriptionActive) {
+                            info("subscription login: Claude Max/Team account");
+                        }
+                        else if (hasTokenCredential) {
+                            const src = claudeEntry?.tokenEnv ?? "CLAUDE_CODE_OAUTH_TOKEN";
+                            info(`Claude credential: token env ${src} supplies the OAuth token (no active \`claude\` subscription login)`);
+                        }
+                        else {
+                            claudeCredentialMissing = true;
+                            line(false, "no Claude credential: no active `claude` subscription login and no token env " +
+                                "value set — run `ecr setup-auth` (or `claude setup-token`)");
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                line(false, `auth engine: ${errorMessage(error)}`);
+            }
             // A missing credential has a guided fix — offer it right here when someone is
             // at the terminal, rather than making them find the command in the README.
-            if (!readiness.ok) {
+            if (!readiness.ok || claudeCredentialMissing) {
                 if (process.stdin.isTTY && process.stdout.isTTY) {
                     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
                     let runIt = false;

package/build/commands/setup-auth.js

@@ -5,7 +5,8 @@ import path from "node:path";
 import readline from "node:readline/promises";
 import { hasConfig, loadReviewConfig } from "../config/load.js";
 import { jwtExpiryMs } from "../core/auth.js";
-import { opencodeBinSource } from "../core/opencode.js";
+import { claudeSubscriptionActive, resolveClaudeCli } from "../core/claude-code.js";
+import { resolveOpencodeCli } from "../core/opencode.js";
 import { errorMessage } from "../core/util.js";
 const USAGE = `ecr setup-auth — set up model credentials for local runs
 
@@ -15,6 +16,10 @@ getting each credential:
     \`opencode auth login\` (interactive; opens your browser), then prints the
     \`export <tokenEnv>=…\` line to add to your shell config. An existing
     OpenCode ChatGPT sign-in is reused instead of re-authenticating.
+  • a Claude Max/Team subscription (any anthropic/… model): reuses an active
+    \`claude\` login when present, or runs \`claude setup-token\` (interactive;
+    opens your browser) and prints the \`export <tokenEnv>=…\` line for
+    CI/headless runs.
   • an API key (api-key entries): prints where to create the key, the exact
     permissions it needs, and the export line to fill in.
 
@@ -24,10 +29,21 @@ with the default env name.
 Options:
   --yes   Skip confirmation prompts (still interactive during the login itself).
 `;
-export function planFromAuth(auth) {
+export function planFromAuth(auth, models = []) {
     const plan = { manualKeys: [], unsupported: [] };
+    // anthropic is always served by the Claude Code CLI — a `claude setup-token`
+    // subscription login covers it. Trigger on either an explicit anthropic auth
+    // entry OR any anthropic/… model in the roster (an entry is entirely optional).
+    const anthropicEntry = auth.find((entry) => entry.provider === "anthropic");
+    const usesAnthropicModel = models.some((model) => model === "anthropic" || model.startsWith("anthropic/"));
+    if (anthropicEntry || usesAnthropicModel) {
+        plan.claudeLogin = { tokenEnv: anthropicEntry?.tokenEnv ?? "CLAUDE_CODE_OAUTH_TOKEN" };
+    }
     for (const entry of auth) {
-        if (entry.mode === "oauth" && entry.provider === "openai" && entry.tokenEnv) {
+        if (entry.provider === "anthropic") {
+            continue; // handled above (claude engine); mode is irrelevant here.
+        }
+        else if (entry.mode === "oauth" && entry.provider === "openai" && entry.tokenEnv) {
             plan.chatgptLogin = { tokenEnv: entry.tokenEnv };
         }
         else if (entry.mode === "api-key" && entry.tokenEnv) {
@@ -104,7 +120,10 @@ export async function setupAuthCommand(argv = []) {
         let plan;
         if (hasConfig(process.cwd())) {
             const config = await loadReviewConfig(process.cwd());
-            plan = planFromAuth(config.auth);
+            plan = planFromAuth(config.auth, [
+                ...config.agents.map((agent) => agent.model),
+                config.coordinator.model,
+            ]);
         }
         else {
             err("No .expo-code-review config here — setting up the default ChatGPT/Codex flow.");
@@ -112,11 +131,55 @@ export async function setupAuthCommand(argv = []) {
                 { provider: "openai", mode: "oauth", tokenEnv: "CODEX_OAUTH_ACCESS_TOKEN" },
             ]);
         }
-        if (!plan.chatgptLogin && plan.manualKeys.length === 0 && plan.unsupported.length === 0) {
+        if (!plan.chatgptLogin &&
+            !plan.claudeLogin &&
+            plan.manualKeys.length === 0 &&
+            plan.unsupported.length === 0) {
             out("This repo's auth config needs no local credential setup (OpenCode's own login covers it).");
             return;
         }
         const exports = [];
+        if (plan.claudeLogin) {
+            const { tokenEnv } = plan.claudeLogin;
+            if (process.env[tokenEnv]) {
+                err(`✓ ${tokenEnv} is already set in this shell — skipping the Claude subscription login.`);
+            }
+            else {
+                // Resolve to a trusted absolute path (refusing an in-tree binary), never a
+                // bare `claude`: setup-auth may run inside a cloned untrusted repo, so a
+                // PR-committed shim must not be the `claude` we probe or hand the terminal to.
+                const claudeCliPath = await resolveClaudeCli();
+                // A live local `claude` login already covers interactive runs — only CI or
+                // a headless box needs the token in an env var.
+                const loggedIn = await claudeSubscriptionActive({ cliPath: claudeCliPath ?? undefined });
+                if (loggedIn) {
+                    err("✓ A Claude Max/Team subscription login is active locally — `ecr review` works now. " +
+                        `You only need ${tokenEnv} for CI/headless runs.`);
+                }
+                err("`claude setup-token` mints a 1-year subscription token (opens your browser).");
+                if (!(await confirm("Run it now?", yes))) {
+                    err("Skipped `claude setup-token`.");
+                }
+                else if (!claudeCliPath) {
+                    throw new Error("The `claude` CLI is not installed on this host (npm i -g " +
+                        "@anthropic-ai/claude-code); nothing was changed.");
+                }
+                else {
+                    const result = spawnSync(claudeCliPath, ["setup-token"], {
+                        stdio: "inherit",
+                        cwd: os.tmpdir(),
+                    });
+                    if (result.status !== 0) {
+                        throw new Error(`\`claude setup-token\` exited with ${result.status ?? "a signal"}; nothing was changed.`);
+                    }
+                    // setup-token prints the token to the terminal and persists it nowhere we
+                    // can read back, so the user pastes it into the export line themselves.
+                    err(`Copy the token \`claude setup-token\` just printed and paste it in place of the ` +
+                        `placeholder below.`);
+                    exports.push(exportLine(tokenEnv, "<paste the token setup-token printed>"));
+                }
+            }
+        }
         if (plan.chatgptLogin) {
             const { tokenEnv } = plan.chatgptLogin;
             if (process.env[tokenEnv]) {
@@ -141,9 +204,20 @@ export async function setupAuthCommand(argv = []) {
                         err("Skipped the ChatGPT sign-in.");
                     }
                     else {
-                        const binDir = opencodeBinSource().dir;
-                        const opencode = binDir ? path.join(binDir, "opencode") : "opencode";
-                        const result = spawnSync(opencode, ["auth", "login"], { stdio: "inherit" });
+                        // Resolve to a trusted absolute path (our bundled shim, else PATH with an
+                        // in-tree refusal), never a bare `opencode`: setup-auth may run inside a
+                        // cloned untrusted repo, so a PR-committed shim must not be the CLI we hand
+                        // the terminal to. Run from tmpdir(), never the (possibly untrusted) cwd —
+                        // the login writes to OpenCode's global auth store, not the working dir.
+                        const opencodeCli = await resolveOpencodeCli();
+                        if (!opencodeCli) {
+                            throw new Error("The `opencode` CLI is not available (install `opencode-ai`, or add " +
+                                "node_modules/.bin to PATH); nothing was changed.");
+                        }
+                        const result = spawnSync(opencodeCli, ["auth", "login"], {
+                            stdio: "inherit",
+                            cwd: os.tmpdir(),
+                        });
                         if (result.status !== 0) {
                             throw new Error(`\`opencode auth login\` exited with ${result.status ?? "a signal"}; nothing was changed.`);
                         }
@@ -190,9 +264,7 @@ export async function setupAuthCommand(argv = []) {
         for (const entry of plan.unsupported) {
             err("");
             err(`auth for "${entry.provider}" is mode "oauth", which has no automated setup flow here` +
-                (entry.provider === "anthropic"
-                    ? " — and cannot work: Anthropic prohibits subscription tokens in third-party tools. Use an API key instead."
-                    : `. Set ${entry.tokenEnv ?? "its token env"} manually.`));
+                `. Set ${entry.tokenEnv ?? "its token env"} manually.`);
         }
         if (exports.length > 0) {
             const rc = process.env.SHELL?.includes("zsh") ? "~/.zshrc" : "your shell config";

package/build/config/schema.js

@@ -76,9 +76,13 @@ export const ReviewConfigSchema = z.object({
                 // "oauth": tokenEnv holds an OAuth token, injected into an isolated
                 // OpenCode auth.json. For "openai" this is the REFRESH token from a
                 // ChatGPT/Codex sign-in (OpenCode's codex plugin mints access tokens
-                // from it). NOTE: anthropic oauth cannot work — OpenCode has no
-                // anthropic OAuth plugin and Anthropic prohibits subscription tokens
-                // in third-party tools.
+                // from it).
+                // NOTE: provider "anthropic" is ALWAYS served by the Claude Code CLI
+                // (the engine is inferred from the `anthropic/…` model, not this mode) —
+                // for anthropic, mode is irrelevant; tokenEnv optionally names the
+                // credential env (an "sk-ant-oat…" subscription token or an Anthropic
+                // API key), and no entry at all falls back to the machine's `claude`
+                // login. See core/claude-code.ts.
                 mode: z.enum(["api-key", "oauth"]).default("api-key"),
                 tokenEnv: z.string().optional(),
                 // Set ⇒ this provider id is an ALIAS synthesized into the OpenCode