@expo/code-review-cli 0.6.0 → 0.8.0

package/build/core/adjudicate.js

@@ -0,0 +1,194 @@
+import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from "./opencode.js";
+import { buildAdjudicatorSystem, buildAdjudicatorTask } from "./prompts.js";
+import { parseAdjudication } from "./schema.js";
+import { errorMessage } from "./util.js";
+// Adjudication runs after coordination/verification (a serial tail step) and in
+// parallel over records; keep the per-call bound in the shape of the main verifier's
+// VERIFY_TIMEOUT_MS. A call that runs long finalizes on whatever it has.
+const ADJUDICATE_TIMEOUT_MS = 3 * 60 * 1000;
+// @ref LLP 0011#hard-floors-in-code [implements] — secrets/security can NEVER be cleared by a reply, whatever the config; a code floor `protectedCategories` can only widen, never narrow
+/** Categories no reply can ever clear, independent of the configured protected set. */
+export const HARD_FLOOR_CATEGORIES = ["secrets", "security"];
+/**
+ * Whether no config — current or future — can ever let a reply clear this finding.
+ * `feedbackApplied`'s floor and `adjudicateFeedback`'s "don't spend a model call on it"
+ * skip are the same question, so they read it from one place and cannot drift.
+ * Deliberately NOT `config.protectedCategories`/`dismiss`: those are user-tunable, so a
+ * stored verdict on such a finding becomes useful the moment the config changes.
+ */
+function hardFloored(finding) {
+    return finding.severity === "critical" || HARD_FLOOR_CATEGORIES.includes(finding.category);
+}
+// @ref LLP 0011#hard-floors-in-code [constrained-by] — dismissal is gated by `dismiss` alone (default "never"); critical + secrets/security are floored in code, and a prompt-injected verdict can't clear them
+/**
+ * Whether a reply actually removes this finding from the blocking set. `dismiss` is the
+ * one knob that gates clearing — it defaults to "never", so suppression is always an
+ * explicit opt-in. `mode` is a separate axis (how much machinery runs), so
+ * `dismiss: "maintainers"` works under `mode: "annotate"` with no model involved, the
+ * same trust gate as `/dismiss`. NEVER for a critical / secrets / security / protected
+ * finding — those floors live here in code, not in any prompt. A maintainer reply that
+ * CITES the finding's id clears; the PR author's cited reply clears only under
+ * `dismiss: "adjudicated"` with an "accepted" verdict. An untrusted third-party
+ * commenter (neither maintainer nor PR author) never clears — its reply is annotated
+ * only, as is any reply that merely quotes the finding.
+ */
+export function feedbackApplied(finding, record, config) {
+    if (config.mode === "off" || config.dismiss === "never") {
+        return false;
+    }
+    // @ref LLP 0011#a-quote-annotates-an-id-clears [implements] — a quote may annotate, only a cited id may clear, on BOTH clear paths below
+    // A quoted line is not consent: GitHub's "Quote reply" copies a comment the untrusted
+    // PR author wrote, so a maintainer can clear-by-accident (or be led to) on text they
+    // never authored. The `id:<fp>` token is printed only by our own comment and counts
+    // only outside a blockquote, so citing it is an act of the replier.
+    if (record.citedId !== true) {
+        return false;
+    }
+    // A human ran `/undismiss` on this reply-cleared finding: it is pinned back to the
+    // active list, so the still-present reply must not silently re-clear it.
+    if (record.unclearedByHuman) {
+        return false;
+    }
+    if (hardFloored(finding)) {
+        return false;
+    }
+    if (config.protectedCategories.includes(finding.category)) {
+        return false;
+    }
+    if (record.maintainer) {
+        return true;
+    }
+    // The adjudicated path is the PR author's alone. `record.author` is re-derived from
+    // the live comment's unspoofable login every run, so a random PR commenter — even
+    // with a model-accepted rebuttal — can never clear a finding.
+    return (config.dismiss === "adjudicated" && record.verdict === "accepted" && record.author === true);
+}
+// @ref LLP 0011#suppression-is-never-silent [implements] — a verdict binds to the source it judged; both merge paths (reporter + aggregate) share THIS predicate so they can never drift apart
+/**
+ * Strip a stored decision that no longer judges the source under review. A verdict is a
+ * claim about CODE, not only about words, and `fingerprintFinding` deliberately excludes
+ * the line number, so the author can edit away the code a rebuttal relied on while the
+ * finding keeps its identity. Unknown head — no `headSha` for this run, or a record
+ * written before the field existed — counts as different, never as trusted. A record
+ * with no verdict (a maintainer reply, an unjudged annotation) has no source-dependent
+ * decision and passes through untouched. The stale `applied` drops with the verdict:
+ * carrying `true` would hide the finding for one render before the recompute.
+ */
+export function dropStaleVerdict(record, headSha) {
+    if (record.verdict === undefined || (headSha !== undefined && record.sourceSha === headSha)) {
+        return record;
+    }
+    const { verdict: _verdict, reason: _reason, sourceSha: _sourceSha, ...rest } = record;
+    return { ...rest, applied: false };
+}
+// @ref LLP 0011#hard-floors-in-code [constrained-by] — the extra `gh pr view` runs only where the author flag can move an outcome; a skipped lookup reads exactly like a failed one (author:false, clears nothing)
+/**
+ * Whether the PR author's login has to be resolved at all for this config. The `author`
+ * flag gates exactly one thing — the adjudicated clear path in `feedbackApplied` (and,
+ * through it, which replies are worth a model call) — so under any other `dismiss`
+ * value resolving it is a `gh` call that can never move an outcome. Absent config (the
+ * `ecr feedback` crawl) resolves nothing, which is also the fail-closed answer: an
+ * unresolved author marks no reply as the author's and clears nothing.
+ */
+export function feedbackNeedsPrAuthor(config) {
+    return config?.dismiss === "adjudicated";
+}
+/**
+ * Whether the command layer must wire the runReview feedback seam at all: either a
+ * model judges replies ("adjudicate"), or replies may clear findings (`dismiss` opted
+ * in) and `applied` must be computed here even though no model runs. Everything else
+ * (annotate + never) is handled by the reporter at report time, with no seam.
+ */
+export function feedbackNeedsRunSeam(config) {
+    return config.mode === "adjudicate" || (config.mode !== "off" && config.dismiss !== "never");
+}
+/**
+ * Judge each author reply against the source and record its verdict, then recompute
+ * every record's `applied` flag under the hard floors. Bounded: at most
+ * `config.maxAdjudications` model calls per run, run in parallel; records past the cap
+ * are left unjudged and counted in `skipped` (never silently dropped). Fails open — a
+ * model/parse/timeout error on one record keeps it (verdict unset) and never throws.
+ * When mode !== "adjudicate" it makes no model calls at all and only recomputes
+ * `applied` — under `dismiss: "maintainers"` a maintainer reply still clears without
+ * any model; under `dismiss: "never"` nothing does.
+ *
+ * `sourceSha` is the head commit this run reviewed: every verdict decided here is
+ * stamped with it, so a later run can tell whether the verdict still judges the same
+ * source (see mergeFeedback). A source with no resolvable head OID (a local run) stamps
+ * nothing, which makes the verdict non-carrying rather than permanent.
+ */
+export async function adjudicateFeedback(handle, items, config, debug = () => { }, sourceSha) {
+    let cost = 0;
+    let model;
+    const tokens = {};
+    let failed = 0;
+    // Only judge in "adjudicate" mode, and only records without a verdict already decided
+    // on a prior run (the reporter carries those forward — re-judging would re-spend the
+    // budget on the same words). A reply with no text can't be judged. Only the PR
+    // author's replies are worth judging: a maintainer clears without any verdict, and a
+    // third-party commenter can never clear (feedbackApplied), so judging either would
+    // spend the budget on a rebuttal that changes no outcome. A reply that only quotes the
+    // finding can never clear it either, and would otherwise starve a cited reply of the
+    // cap. A finding a human already restored via `/undismiss` is likewise left unjudged.
+    // A hard-floored finding is skipped for the same reason and is deliberately NOT counted
+    // in `skipped` below: that figure means "reduced coverage, raise the cap", and a verdict
+    // no config could ever act on is not coverage a higher cap would buy back.
+    // @ref LLP 0011#hard-floors-in-code [constrained-by] — the code floor also means the model never judges a critical/secrets/security rebuttal: no verdict could move that outcome
+    const toJudge = config.mode === "adjudicate"
+        ? items.filter((item) => item.record.verdict === undefined &&
+            item.record.author === true &&
+            item.record.citedId === true &&
+            !item.record.unclearedByHuman &&
+            !hardFloored(item.finding) &&
+            item.replyText.trim() !== "")
+        : [];
+    // Never truncate silently: the first `maxAdjudications` are judged, the rest are
+    // reported as skipped so the caller can surface reduced coverage.
+    const within = toJudge.slice(0, config.maxAdjudications);
+    const skipped = toJudge.length - within.length;
+    if (skipped > 0) {
+        debug(`Feedback: ${skipped} repl${skipped === 1 ? "y" : "ies"} over ` +
+            `maxAdjudications=${config.maxAdjudications} — left unjudged this run.`);
+    }
+    // A successful call records the verdict against the record it judged; an error leaves
+    // it out of the map, so the record below stays untouched (fail open).
+    const judged = new Map();
+    await Promise.all(within.map(async (item, index) => {
+        try {
+            const { value, cost: callCost, tokens: callTokens, model: callModel, } = await promptAndParse(handle, {
+                // Reuse the verifier's OpenCode agent: it carries exactly the read+grep tool
+                // set the adjudicator needs (open the cited file, trace the path) and the
+                // reviewing model, and its distrust posture matches. The system prompt below
+                // is what makes this an adjudication rather than a verification.
+                agent: VERIFIER_AGENT,
+                system: buildAdjudicatorSystem(),
+                text: buildAdjudicatorTask(item.finding, item.replyText),
+                title: `adjudicate-${index}`,
+                maxWaitMs: ADJUDICATE_TIMEOUT_MS,
+                finalizeOnTimeout: true,
+            }, parseAdjudication);
+            cost += callCost;
+            addTokenUsage(tokens, callTokens);
+            model = callModel ?? model;
+            judged.set(item.record, { verdict: value.verdict, reason: value.reason });
+        }
+        catch (error) {
+            // Fail open: an error leaves the record unjudged and the finding intact.
+            failed++;
+            debug(`Feedback: could not adjudicate a reply (${errorMessage(error)}); leaving it unjudged.`);
+        }
+    }));
+    // Re-emit every record: set the verdict/reason where judged, then recompute `applied`
+    // under the hard floors (this also clears a maintainer reply, which needs no verdict).
+    const records = items.map((item) => {
+        const decision = judged.get(item.record);
+        // A fresh verdict is stamped with the source it judged (when the run knows it), so
+        // the next run re-judges the same reply once that source moves on.
+        // @ref LLP 0011#suppression-is-never-silent [implements] — the verdict is bound to the revision it was decided against
+        const withVerdict = decision
+            ? { ...item.record, verdict: decision.verdict, reason: decision.reason, sourceSha }
+            : item.record;
+        return { ...withVerdict, applied: feedbackApplied(item.finding, withVerdict, config) };
+    });
+    return { records, cost, tokens, model, adjudicated: judged.size, skipped, failed };
+}

package/build/core/auth.js

@@ -1,3 +1,4 @@
+// @ref LLP 0003#credential-resolution-and-forwarding [implements] — deny-list, cross-provider guard, isolated OAuth staging, and the forwarding-site recheck for Claude Code
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
@@ -8,6 +9,21 @@ const PROVIDER_KEY_ENV = {
     google: "GOOGLE_GENERATIVE_AI_API_KEY",
     openrouter: "OPENROUTER_API_KEY",
 };
+/**
+ * Provider-owned credential env vars BEYOND the x-api-key ones above: Anthropic's
+ * OAuth/subscription bearer envs. CLAUDE_CODE_OAUTH_TOKEN holds the long-lived (1-year)
+ * Claude Max/Team subscription token that `ecr setup-auth`/`claude setup-token` export,
+ * and ANTHROPIC_AUTH_TOKEN is Anthropic's documented bearer var. They belong to
+ * anthropic, so the cross-provider guard below refuses a non-anthropic entry that names
+ * one — without this, `{provider:"openai", tokenEnv:"CLAUDE_CODE_OAUTH_TOKEN"}` passes
+ * (neither a FORBIDDEN secret nor a PROVIDER_KEY_ENV value) and prepareAuth forwards the
+ * Anthropic subscription token to a foreign provider as its bearer. They are NOT in
+ * FORBIDDEN_TOKEN_ENVS because an anthropic entry may legitimately name them.
+ */
+const ANTHROPIC_TOKEN_ENVS = {
+    CLAUDE_CODE_OAUTH_TOKEN: "anthropic",
+    ANTHROPIC_AUTH_TOKEN: "anthropic",
+};
 /**
  * Env vars that must NEVER be forwarded to a model provider. `auth.tokenEnv` names
  * the env var whose value becomes the provider credential — but that config is
@@ -17,7 +33,7 @@ const PROVIDER_KEY_ENV = {
  * minted for that provider, so we hard-refuse these well-known unrelated secrets.
  * Defense-in-depth alongside loading config only from the trusted base ref.
  */
-const FORBIDDEN_TOKEN_ENVS = new Set([
+export const FORBIDDEN_TOKEN_ENVS = new Set([
     "GITHUB_TOKEN",
     "GH_TOKEN",
     "ACTIONS_RUNTIME_TOKEN",
@@ -139,6 +155,7 @@ export function checkOauthTokenShape(provider, token, tokenEnv) {
     }
     return ok;
 }
+// @ref LLP 0003#credential-resolution-and-forwarding [implements] — two deny checks: FORBIDDEN_TOKEN_ENVS refuses well-known unrelated secrets; the cross-provider ownership guard refuses a non-anthropic entry naming an ANTHROPIC_TOKEN_ENVS var
 /**
  * Decide whether ONE configured credential is usable, WITHOUT mutating the
  * environment. See checkProviderAuth for the all-entries wrapper.
@@ -159,17 +176,58 @@ export function checkAuthEntry(entry, env = process.env) {
     // point its provider/upstream somewhere else, sending one provider's key to a
     // different provider.
     if (tokenEnv) {
-        const keyOwner = Object.entries(PROVIDER_KEY_ENV).find(([, env]) => env === tokenEnv)?.[0];
+        const keyOwner = Object.entries(PROVIDER_KEY_ENV).find(([, env]) => env === tokenEnv)?.[0] ??
+            ANTHROPIC_TOKEN_ENVS[tokenEnv];
         if (keyOwner && keyOwner !== provider && keyOwner !== upstream) {
             return {
                 ok: false,
                 detail: `auth for ${provider} names tokenEnv "${tokenEnv}", which is ${keyOwner}'s ` +
-                    `well-known key env — refusing to send one provider's credential to another. ` +
+                    `well-known credential env — refusing to send one provider's credential to another. ` +
                     `Use a credential minted for ${provider}${upstream ? ` (upstream ${upstream})` : ""}, ` +
                     `or fix the provider/upstream mapping.`,
             };
         }
     }
+    // anthropic is ALWAYS served by the Claude Code CLI (engine inferred from the
+    // `anthropic/…` model, not from `mode`), so `mode` is irrelevant here. The
+    // credential is the machine's `claude` login, an ambient CLAUDE_CODE_OAUTH_TOKEN,
+    // or a named tokenEnv. The CLI validates the token, so the only token-shape check
+    // here is a coarse exfil guard on a NAMED tokenEnv's value (below); the
+    // FORBIDDEN/cross-provider guards above already block the well-known secrets.
+    if (provider === "anthropic") {
+        // A named-but-unset tokenEnv is NOT fatal: startClaudeCode falls back to the
+        // machine's `claude` login (the common local case — the config names the CI
+        // secret). startClaudeCode still fails fast when neither credential exists.
+        if (tokenEnv && !env[tokenEnv]) {
+            return {
+                ok: true,
+                detail: `anthropic via the Claude Code CLI; falling back to the local \`claude\` login`,
+                warning: `token env "${tokenEnv}" is not set — using the machine's \`claude\` login ` +
+                    `(set it for CI/headless runs; mint with \`claude setup-token\`).`,
+            };
+        }
+        // tokenEnv is set AND present: its value is forwarded to api.anthropic.com as the
+        // bearer. The destination is ALWAYS Anthropic, so a value that is not an Anthropic
+        // credential ("sk-ant-…" covers both the "sk-ant-oat" OAuth token and "sk-ant-api"
+        // keys) cannot authenticate there but CAN be a foreign CI secret the config named
+        // — refuse it. This meets the "cannot be valid" bar the shape heuristics use, and
+        // fires at both prepareAuth and startClaudeCode's forwarding-site recheck.
+        if (tokenEnv && env[tokenEnv] && !env[tokenEnv].startsWith("sk-ant-")) {
+            return {
+                ok: false,
+                detail: `token env "${tokenEnv}" does not hold an Anthropic credential (expected "sk-ant-…", ` +
+                    `the shape \`claude setup-token\` prints, or an Anthropic API key). anthropic is served ` +
+                    `by the Claude Code CLI, which authenticates to Anthropic, so a value of another shape ` +
+                    `cannot work there and would leak that secret to Anthropic — point auth.tokenEnv at a ` +
+                    `token minted for Anthropic.`,
+            };
+        }
+        return {
+            ok: true,
+            detail: `anthropic via the Claude Code CLI; ` +
+                (tokenEnv ? `token env ${tokenEnv} is set` : "using the local `claude` login"),
+        };
+    }
     if (mode === "oauth") {
         if (!tokenEnv) {
             return {
@@ -233,13 +291,49 @@ export function checkAuthEntry(entry, env = process.env) {
     };
 }
 /**
- * Decide whether EVERY configured provider credential is usable, WITHOUT
- * mutating the environment. Shared by `prepareAuth` (fail fast before spinning up
- * the server and every pass) and `doctor` (report), so the two never drift.
+ * The set of providers this config actually routes a model to: the `provider/`
+ * prefix of every agent model plus the coordinator's. Returns null when no model
+ * information is available (e.g. a bare config in a unit test) — callers read that
+ * as "can't scope, consider every entry". Every real config loaded by
+ * loadReviewConfig has agents, so scoping always applies at runtime.
+ *
+ * The fixed cross-cutting/verifier roles reuse an agent's model, so their provider
+ * is already covered by the agent set — mirrors engineForModel's `provider/` split.
+ */
+function providersInUse(config) {
+    const models = [];
+    for (const agent of config.agents ?? []) {
+        if (agent.model) {
+            models.push(agent.model);
+        }
+    }
+    if (config.coordinator?.model) {
+        models.push(config.coordinator.model);
+    }
+    if (models.length === 0) {
+        return null;
+    }
+    const providers = new Set();
+    for (const model of models) {
+        const slash = model.indexOf("/");
+        providers.add(slash > 0 ? model.slice(0, slash) : model);
+    }
+    return providers;
+}
+/**
+ * Decide whether EVERY configured provider credential a model actually uses is
+ * usable, WITHOUT mutating the environment. Shared by `prepareAuth` (fail fast
+ * before spinning up the server and every pass) and `doctor` (report), so the two
+ * never drift.
  *
- * All entries must pass — a mixed setup with one broken credential would fail
- * exactly the passes routed to it, which is the silent-degradation this check
- * exists to prevent. `REVIEWER_MODEL` bypasses provider auth entirely.
+ * Scoped to providers in use: an `auth` entry for a provider no agent routes to is
+ * dead config (the shipped default is `api-key`/openai, so a config that switches
+ * every model to `anthropic/…` but leaves — or omits — the `auth` block would
+ * otherwise be spuriously blocked demanding OPENAI_API_KEY, defeating the
+ * `claude`-login fallback). Only used entries gate the run; all of them must pass —
+ * a mixed setup with one broken credential would fail exactly the passes routed to
+ * it, which is the silent-degradation this check exists to prevent. `REVIEWER_MODEL`
+ * bypasses provider auth entirely.
  */
 export function checkProviderAuth(config, env = process.env) {
     if (env.REVIEWER_MODEL) {
@@ -248,9 +342,13 @@ export function checkProviderAuth(config, env = process.env) {
             detail: `REVIEWER_MODEL override (${env.REVIEWER_MODEL}); using OpenCode's own login for that model`,
         };
     }
+    const inUse = providersInUse(config);
     const details = [];
     const warnings = [];
     for (const entry of config.auth) {
+        if (inUse && !inUse.has(entry.provider)) {
+            continue;
+        }
         const readiness = checkAuthEntry(entry, env);
         if (!readiness.ok) {
             return readiness;
@@ -262,7 +360,10 @@ export function checkProviderAuth(config, env = process.env) {
     }
     return {
         ok: true,
-        detail: details.join("; "),
+        // No used entry (e.g. every model is anthropic and the only `auth` block is the
+        // shipped openai default): the run relies on the Claude Code CLI's own login.
+        detail: details.join("; ") ||
+            "no provider credential needed for the models in use (relying on the engine's own login)",
         ...(warnings.length > 0 ? { warning: warnings.join("; ") } : {}),
     };
 }
@@ -299,6 +400,7 @@ export function jwtExpiryMs(token) {
  *   setup-token style bearers), far-future expiry so OpenCode never tries to
  *   refresh a credential that has no refresh half.
  */
+// @ref LLP 0003#credential-resolution-and-forwarding [implements] — JWT access tokens are used as-is and never refreshed; opaque tokens are stored with expires:0 for the codex refresh flow, only safe when this run is the token's sole consumer (refresh tokens are single-use)
 export function oauthAuthJsonEntry(provider, token) {
     if (provider === "openai" && !isJwtAccessToken(token)) {
         return { type: "oauth", access: "", refresh: token, expires: 0 };
@@ -321,6 +423,7 @@ export function oauthAuthJsonEntry(provider, token) {
  *   per-provider shapes). Isolated so it never touches the developer's real
  *   auth.json.
  */
+// @ref LLP 0003#credential-resolution-and-forwarding [implements] — stages all OAuth credentials into one isolated auth.json under a temp XDG_DATA_HOME; anthropic never passes through this path (its credential goes straight into startClaudeCode's child env)
 export async function prepareAuth(config) {
     const noop = { cleanup: async () => { } };
     // REVIEWER_MODEL is an explicit "use this model with my own creds" override — a
@@ -338,10 +441,24 @@ export async function prepareAuth(config) {
     if (!readiness.ok) {
         throw new Error(readiness.detail);
     }
+    // Same scoping as checkProviderAuth: only forward credentials for providers a
+    // model actually routes to. A dead entry for an unused provider must not have its
+    // tokenEnv copied into a key env — checkProviderAuth skipped its guard, so
+    // forwarding it here would reintroduce the exact secret-forwarding it prevents.
+    const inUse = providersInUse(config);
     const authJson = {};
     for (const entry of config.auth) {
         const { mode, provider, tokenEnv, upstream } = entry;
+        if (inUse && !inUse.has(provider)) {
+            continue;
+        }
         const value = tokenEnv ? process.env[tokenEnv] : undefined;
+        // anthropic is claude-engine-only: it never writes an OpenCode auth.json /
+        // XDG_DATA_HOME nor injects ANTHROPIC_API_KEY here — its credential is passed
+        // per-invocation via the child env built in startClaudeCode.
+        if (provider === "anthropic") {
+            continue;
+        }
         if (mode === "api-key") {
             // Upstream aliases read {env:tokenEnv} from the synthesized provider block.
             if (!upstream && tokenEnv && value) {