@expo/code-review-cli 0.9.2 → 0.10.0

package/README.md

@@ -48,21 +48,19 @@ npx @expo/code-review-cli setup-auth
 npx @expo/code-review-cli doctor
 ```
 
-`setup-auth` reads the repo's config and walks through each credential it needs:
-an OpenAI **API key** (the scaffolded default — it prints where to create the key
-and the exact restricted permissions to grant), and/or a **ChatGPT/Codex
-subscription** sign-in (it runs OpenCode's browser login and extracts the token
-for you). `doctor` offers to run it whenever a credential is missing.
-
-In CI, store the same values as repo secrets (`OPENAI_API_KEY`; plus
-`CODEX_OAUTH_ACCESS_TOKEN` for the mixed setup) — the scaffolded workflow
-forwards them.
-
-**Have a ChatGPT Plus/Pro (Codex) subscription? Use both.** The recommended
-production setup pairs the subscription (runs the default models at no marginal
-cost) with the usage-based key (covers only the pro-tier models the subscription
-excludes) — see [the mixed setup](#other-providers) below. Prefer
-**Anthropic/Claude** or another provider? Same section.
+`setup-auth` reads the repo's config and walks through each credential it needs.
+The scaffolded default is **Anthropic via the Claude Code CLI**: locally your
+`claude` login is enough, and for CI it helps you mint a token with
+`claude setup-token`. It also handles the alternatives (an OpenAI **API key**,
+a **ChatGPT/Codex subscription** sign-in). `doctor` offers to run it whenever a
+credential is missing.
+
+In CI, store the credential as the repo secret the scaffolded workflow forwards
+(`CLAUDE_CODE_REVIEW_SHARED_API_TOKEN` by default — an `sk-ant-oat…` token from
+`claude setup-token`, or an `sk-ant-api…` Console key; the CLI reads either).
+
+Prefer **OpenAI** (API key, or a ChatGPT/Codex subscription, or both mixed) or
+another provider? See [Other providers & auth modes](#other-providers) below.
 
 ### Reviewing (already configured)
 
@@ -196,7 +194,7 @@ your-monorepo/
   // Central guardrails every scope inherits and CANNOT override.
   "defaults": {
     // The ONLY place auth/tokenEnv is honored (besides the root config.jsonc).
-    "auth": { "mode": "api-key", "provider": "openai", "tokenEnv": "OPENAI_API_KEY" },
+    "auth": { "providers": { "anthropic": { "tokenEnv": "CLAUDE_CODE_REVIEW_SHARED_API_TOKEN" } } },
     "enforceAgents": ["security"],            // always runs on every scope, roster or not
     "commentTag": "expo-ai-code-reviewer"     // per-scope markers derive from this
   },
@@ -214,7 +212,7 @@ your-monorepo/
 // apps/api/.expo-code-review/config.jsonc  (the api team owns this)
 {
   // NO "auth" block — locked centrally; a tokenEnv here is rejected by loader + CI guard.
-  "model": "openai/gpt-5.5",
+  "model": "anthropic/claude-sonnet-5",
   "policy": { "includeSuggestions": false },
   "noise":  { "additionalIgnores": ["apps/api/**/__generated__/**"] }
   // shared.md, coordinator.md, agents/*.md live beside this file — the api team's roster.
@@ -316,6 +314,11 @@ Ownership is enforced with CODEOWNERS: `/.expo-code-review/routing.jsonc @your-i
 - **Reporter** — posts/updates a single fingerprinted PR comment (CI), or prints
   a grouped summary (local). Findings below the configured severity floor are
   suppressed.
+- **Whole-review reuse** — automated CI stores a hash of each review job's inputs
+  in the hidden state of that comment. If a restack leaves a scope's files and
+  review configuration unchanged, its complete prior result is reused. Manual
+  `/review`, partial/failed reviews, stack-aware review, and model-adjudicated
+  feedback always run fresh.
 
 Built on the [OpenCode](https://opencode.ai) SDK, which spawns the model provider
 and applies the provider's prompt caching automatically.
@@ -387,7 +390,7 @@ show writes (there is nothing to re-read within the run).
 ---
 description: One line the router uses to decide relevance.
 alwaysRun: true        # run even when the router would skip this agent
-model: openai/gpt-5.5-pro     # override the default model
+model: anthropic/claude-opus-5   # override the default model
 temperature: 0.1
 ---
 
@@ -396,14 +399,14 @@ temperature: 0.1
 
 For a real-world example, see eas-cli's
 [`.expo-code-review/`](https://github.com/expo/eas-cli/tree/main/.expo-code-review)
-— correctness/security/consistency agents, a stronger model for security + the
-coordinator, and per-repo `noise.additionalIgnores`.
+— correctness/security/consistency agents, a stronger model for security, and
+per-repo `noise.additionalIgnores`.
 
 `config.jsonc` (JSONC — comments + trailing commas supported):
 
 ```jsonc
 {
-  "model": "openai/gpt-5.5",                  // default model for the specialists
+  "model": "anthropic/claude-sonnet-5",       // default model for the specialists
   "policy": { "includeSuggestions": false },  // suppress suggestion-severity findings
   "chunk": { "maxChangedLines": 1000, "maxFiles": 20 },  // concurrency defaults: 6 (API key) / 3 (subscription)
   "noise": { "additionalIgnores": ["packages/*/build/**"] },
@@ -412,8 +415,8 @@ coordinator, and per-repo `noise.additionalIgnores`.
               "skipLabel": "ai-review:skip" }, // "label" (only labeled PRs)
   "breakGlass": { "marker": "/skip-review" }, // PR body marker that skips the review
   "commentTag": "expo-ai-code-reviewer",      // hidden tag used to find/update the comment
-  "auth": { "mode": "api-key", "provider": "openai",
-            "tokenEnv": "OPENAI_API_KEY" }
+  "auth": { "providers": {
+    "anthropic": { "tokenEnv": "CLAUDE_CODE_REVIEW_SHARED_API_TOKEN" } } }
 }
 ```
 
@@ -427,15 +430,17 @@ Precedence: **`REVIEWER_MODEL` env** (global override) → per-file **frontmatte
 setup, and a developer can override everything locally.
 
 - **Specialist agents** (correctness/security/consistency) benefit from a
-  reasoning-tier model — **`openai/gpt-5.5`** is the quality/speed sweet spot
-  (the scaffolded default). The **pro tier** finds more but is slower and more
-  expensive, so scope it to the highest-stakes agent: **security runs on
-  `openai/gpt-5.5-pro`** (set in `security.md` frontmatter), the rest on the default.
+  reasoning-tier model — **`anthropic/claude-sonnet-5`** is the quality/speed
+  sweet spot (the scaffolded default). The **Opus tier** finds more but is slower
+  and more expensive, so scope it to the highest-stakes agent: **security runs on
+  `anthropic/claude-opus-5`** (set in `security.md` frontmatter), the rest on the
+  default.
 - **The coordinator** makes the final call (dedupe / re-judge / decide) — worth a
-  strong model; set it in `coordinator.md` frontmatter.
+  strong model; the scaffold pins it to `anthropic/claude-opus-5` in
+  `coordinator.md` frontmatter.
 - If latency/timeouts dominate on big PRs, moving the specialists to a faster model
-  (e.g. `openai/gpt-5.4-mini`) is the most direct lever (a real recall tradeoff —
-  measure it).
+  (e.g. `anthropic/claude-haiku-4-5`) is the most direct lever (a real recall
+  tradeoff — measure it).
 - **Every run logs which model actually answered each pass** — in the job log
   (`Models used — …`), the Actions step summary table, and the run log's
   `agentModels` — and warns loudly if a pass ran on a different model than
@@ -650,11 +655,35 @@ visible even in CI (where the run log is ephemeral).
 <details>
 <summary><b>Other providers & auth modes</b></summary>
 
-The recommended setup is an OpenAI API key — see Usage above. Alternatives, all
-set in `config.auth` (credentials come from OpenCode):
-
-- **ChatGPT/Codex subscription (OAuth) + usage-based API key — the recommended
-  mix.** OpenAI permits subscription auth in third-party tools, and OpenCode
+The scaffolded default is **Anthropic via the Claude Code CLI** — see First-time
+setup above and the Anthropic bullet below for how it authenticates and is
+sandboxed. Everything is set in `config.auth`; non-anthropic providers get their
+credentials through OpenCode.
+
+- **Anthropic / Claude (the default)** — use `anthropic/...` model ids and every
+  anthropic pass runs through the **Claude Code CLI** (`claude -p
+  --output-format stream-json --verbose`), inferred from the model. The
+  credential is (in order) a `tokenEnv` you name, an ambient
+  `CLAUDE_CODE_OAUTH_TOKEN`, or your local
+  `claude` login — an `auth` entry is entirely optional. Run `claude setup-token`
+  for a Max/Team subscription token or point `tokenEnv` at an Anthropic Console
+  API key (`sk-ant-api…`, forwarded as `ANTHROPIC_API_KEY`); the CLI reads
+  either. `ecr setup-auth` walks you through it. Each pass is trust-isolated and
+  read-only: it runs with `--safe-mode` (no `CLAUDE.md`/hooks/MCP/plugins),
+  `--strict-mcp-config`, `--permission-mode dontAsk`, and only the
+  `Read`/`Grep`/`Glob` tools — never `Bash`/`Edit`/`Write`/`WebFetch`/`WebSearch`.
+  The child env is an allowlist that omits ambient `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`
+  (only the configured credential is re-injected).
+  ```jsonc
+  // The scaffolded default. No anthropic entry at all falls back to your
+  // `claude` login.
+  "auth": { "providers": {
+    "anthropic": { "tokenEnv": "CLAUDE_CODE_REVIEW_SHARED_API_TOKEN" }
+  } }
+  ```
+- **OpenAI: ChatGPT/Codex subscription (OAuth) + usage-based API key — the
+  recommended mix if you review with OpenAI.** OpenAI permits subscription auth
+  in third-party tools, and OpenCode
   ships the plugin for it — so the reviewer runs its default models on the
   subscription (zero marginal cost) and reserves the metered key for pro-tier
   models the subscription doesn't offer (`gpt-5.5-pro` is subscription-excluded).
@@ -693,25 +722,6 @@ set in `config.auth` (credentials come from OpenCode):
     One caveat: OpenCode can't price alias models (they're config-declared), so
     pro passes report `$0` in the run log's cost column — token counts are
     correct, and the OpenAI project dashboard is the source of truth for spend.
-- **Anthropic / Claude** — use `anthropic/...` model ids and every anthropic pass
-  runs through the **Claude Code CLI** (`claude -p --output-format json`), inferred
-  from the model. The credential is (in order) a `tokenEnv` you name, an ambient
-  `CLAUDE_CODE_OAUTH_TOKEN`, or your local `claude` login — an `auth` entry is
-  entirely optional. Run `claude setup-token` for a Max/Team subscription token
-  (forwarded as `CLAUDE_CODE_OAUTH_TOKEN`) or point `tokenEnv` at an Anthropic
-  Console API key (`sk-ant-api…`, forwarded as `ANTHROPIC_API_KEY`); the CLI reads
-  either. `ecr setup-auth` walks you through it. Each pass is trust-isolated and
-  read-only: it runs with `--safe-mode` (no `CLAUDE.md`/hooks/MCP/plugins),
-  `--strict-mcp-config`, `--permission-mode dontAsk`, and only the
-  `Read`/`Grep`/`Glob` tools — never `Bash`/`Edit`/`Write`/`WebFetch`/`WebSearch`.
-  The child env is an allowlist that omits ambient `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN`
-  (only the configured credential is re-injected).
-  ```jsonc
-  // Optional — no anthropic entry at all falls back to your `claude` login.
-  "auth": { "providers": {
-    "anthropic": { "tokenEnv": "CLAUDE_CODE_OAUTH_TOKEN" }
-  } }
-  ```
 - **Another provider** — the current path is the `REVIEWER_MODEL`
   env override: `opencode auth login` once (pick the provider), then run with
   e.g. `REVIEWER_MODEL=google/gemini-3-pro`. It overrides every agent's model
@@ -724,8 +734,9 @@ any other) OpenCode provider, and each agent's `model` selects its engine.
 `REVIEWER_MODEL` still overrides every agent's model (and therefore every agent's
 engine), converging the whole run onto one engine.
 
-There is no shared fallback key; if a run fails for lack of credentials, authenticate
-a provider in OpenCode. `ecr doctor` diagnoses setup.
+There is no shared fallback key; if a run fails for lack of credentials, log in
+with `claude` (the default) or authenticate a provider in OpenCode. `ecr doctor`
+diagnoses setup.
 
 **Setup errors fail fast, with the fix in the message.** A bad credential or model id
 would otherwise fail every pass identically — a run that spends its whole budget

package/build/commands/ci.js

@@ -10,6 +10,7 @@ import { buildDiffLineIndex } from "../core/render.js";
 import { applyPins, collectPins, scopedFingerprint } from "../core/schema.js";
 import { dropStaleVerdict, feedbackApplied, feedbackNeedsRunSeam } from "../core/adjudicate.js";
 import { runReview } from "../core/review.js";
+import { reviewCanBeReused, reviewInputHash, reviewMatchesInput } from "../core/review-cache.js";
 import { GitHubPRSource } from "../sources/github-pr.js";
 import { memoizeSource, stackConfirmFromConfig, stackWalkFromConfig } from "../sources/source.js";
 import { GitHubReporter } from "../reporters/github.js";
@@ -428,9 +429,11 @@ async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
     // unchanged (see mergeFeedback). Memoized on the source — no extra API call. A
     // metadata failure leaves it unknown, which re-judges replies instead of trusting a
     // verdict against source we cannot pin.
+    let metadata;
     let headSha;
     try {
-        headSha = (await source.getMetadata()).headOid;
+        metadata = await source.getMetadata();
+        headSha = metadata.headOid;
     }
     catch {
         // leave headSha unset → stored verdicts do not carry (fail safe, costs budget only)
@@ -454,24 +457,67 @@ async function runLegacyCi(source, repo, prNumber, cwd, configRoot, options) {
     catch (error) {
         process.stderr.write(`CI reviewer: break-glass check failed (continuing): ${errorMessage(error)}\n`);
     }
+    const stack = resolveStackWalk(config.stack, noStackAware);
+    const stackConfirm = resolveStackConfirm(config.stack, noStackAware);
+    const feedback = adjudicationSeam(config, reporter);
+    // Dynamic stack context and model-backed reply adjudication have inputs outside
+    // the scoped diff. Keep those paths fresh until their inputs join the cache key.
+    // A maintainer's explicit /review is also always a real rerun.
+    const cacheAllowed = !bypassTriggerGate && !stack && !feedback && metadata !== undefined;
+    let inputHash;
     try {
+        if (cacheAllowed) {
+            try {
+                const prepared = await source.prepareReadRootAsync?.();
+                try {
+                    inputHash = await reviewInputHash({
+                        files: await source.getChangedFiles(),
+                        config,
+                        metadata: metadata,
+                        readRoot: prepared?.dir ?? cwd,
+                        agents,
+                        route,
+                        contextText,
+                    });
+                }
+                finally {
+                    await prepared?.cleanup();
+                }
+            }
+            catch (error) {
+                process.stderr.write(`CI reviewer: could not hash the review input (continuing fresh): ${errorMessage(error)}\n`);
+            }
+            if (inputHash) {
+                try {
+                    const prior = await reporter.readState();
+                    if (prior && reviewMatchesInput(prior.review, prior.inputHash, inputHash)) {
+                        await reporter.report(prior.review, undefined, inputHash);
+                        process.stderr.write("CI reviewer: unchanged review input; reused the previous result.\n");
+                        return;
+                    }
+                }
+                catch (error) {
+                    process.stderr.write(`CI reviewer: could not read the previous review cache (continuing fresh): ${errorMessage(error)}\n`);
+                }
+            }
+        }
         const review = await runReview(source, {
             config,
             mode: "ci",
             agents,
             route,
             contextText,
-            stack: resolveStackWalk(config.stack, noStackAware),
-            stackConfirm: resolveStackConfirm(config.stack, noStackAware),
+            stack,
+            stackConfirm,
             runsDir: workspaceRunsDir(cwd),
             // Adjudicate mode judges the matched replies against the source before the
             // comment is rendered; annotate mode lets the reporter match them at report
             // time. Either way the feedback path is fail-open (runReview swallows its own
             // errors), so it never fails the PR's checks.
-            feedback: adjudicationSeam(config, reporter),
+            feedback,
             onProgress: (message) => process.stderr.write(`${message}\n`),
         });
-        await reporter.report(review, review.feedback);
+        await reporter.report(review, review.feedback, inputHash && reviewCanBeReused(review) ? inputHash : undefined);
         process.stderr.write(`CI reviewer: posted review (${review.decision}).\n`);
     }
     catch (error) {
@@ -600,13 +646,14 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
     };
     // The reviewed head OID also binds each adjudication verdict to the source it judged
     // (see mergeFeedback); unresolved leaves it unknown, so verdicts are re-judged.
+    let metadata;
     let headSha;
     try {
-        const { baseOid, headOid } = await source.getMetadata();
-        if (baseOid) {
-            link.baseSha = baseOid;
+        metadata = await source.getMetadata();
+        if (metadata.baseOid) {
+            link.baseSha = metadata.baseOid;
         }
-        headSha = headOid;
+        headSha = metadata.headOid;
     }
     catch {
         // leave baseSha unset → out-of-diff findings degrade to plain text
@@ -651,11 +698,38 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
     // login. `withLink` is inert for the seam (matchAdjudicationItems renders nothing), so
     // one link-carrying reporter serves both uses.
     const scopeReporter = memoizeByScope((name) => reporterFor(scopedCommentTag(rootTag, name), true));
+    const cacheAllowed = !bypassTriggerGate &&
+        !stackWalk &&
+        !feedbackNeedsRunSeam(rootConfig.feedback) &&
+        metadata !== undefined;
+    let cacheReadRoot;
+    if (cacheAllowed) {
+        try {
+            const prepared = await source.prepareReadRootAsync?.();
+            cacheReadRoot = prepared?.dir ?? cwd;
+            await prepared?.cleanup();
+        }
+        catch (error) {
+            // The fresh run will retry the same materialization and apply CI's ordinary
+            // fail-closed behavior. Cache setup itself never changes that outcome.
+            process.stderr.write(`CI reviewer: could not prepare the review cache input (continuing fresh): ${errorMessage(error)}\n`);
+        }
+    }
+    let priorAggregateState = null;
+    if (cacheReadRoot && mode === "single") {
+        try {
+            priorAggregateState = await singleModeReporter.readState();
+        }
+        catch (error) {
+            process.stderr.write(`CI reviewer: could not read the previous aggregate cache (continuing fresh): ${errorMessage(error)}\n`);
+        }
+    }
     const results = [];
     for (const scope of active) {
         const scopeDef = manifest.scopes.find((entry) => entry.name === scope.name);
         const isDefault = scope.configDir === ".";
         let review;
+        let inputHash;
         try {
             // A scope whose config dir doesn't exist at the TRUSTED base commit is a
             // scope this PR introduces: review it with the root config rather than
@@ -679,26 +753,63 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
                     ? (finding) => scopedFingerprint(isDefault ? null : scope.name, finding)
                     : undefined)
                 : undefined;
-            review = await runReview(source, {
-                config,
-                mode: "ci",
-                agents,
-                route,
-                includePaths: scope.files,
-                contextText,
-                stack: stackWalk,
-                stackConfirm,
-                passesBudgetMs: budget,
-                runsDir: workspaceRunsDir(cwd),
-                feedback: feedbackSeam,
-                onProgress: (message) => process.stderr.write(`[${scope.name}] ${message}\n`),
-            });
+            let cached;
+            if (cacheReadRoot) {
+                try {
+                    const included = new Set(scope.files);
+                    inputHash = await reviewInputHash({
+                        files: changed.filter((file) => included.has(file.path)),
+                        config,
+                        metadata: metadata,
+                        readRoot: cacheReadRoot,
+                        agents,
+                        route,
+                        contextText,
+                    });
+                    if (mode === "single") {
+                        cached = priorAggregateState?.scopes?.find((entry) => entry.scope === scope.name);
+                    }
+                    else {
+                        cached = (await scopeReporter(scope.name).readState()) ?? undefined;
+                    }
+                }
+                catch (error) {
+                    inputHash = undefined;
+                    process.stderr.write(`CI reviewer: [${scope.name}] could not use the previous cache (continuing fresh): ${errorMessage(error)}\n`);
+                }
+            }
+            if (cached && reviewMatchesInput(cached.review, cached.inputHash, inputHash)) {
+                review = cached.review;
+                process.stderr.write(`CI reviewer: [${scope.name}] unchanged review input; reused the previous result.\n`);
+            }
+            else {
+                review = await runReview(source, {
+                    config,
+                    mode: "ci",
+                    agents,
+                    route,
+                    includePaths: scope.files,
+                    contextText,
+                    stack: stackWalk,
+                    stackConfirm,
+                    passesBudgetMs: budget,
+                    runsDir: workspaceRunsDir(cwd),
+                    feedback: feedbackSeam,
+                    onProgress: (message) => process.stderr.write(`[${scope.name}] ${message}\n`),
+                });
+            }
         }
         catch (error) {
             process.stderr.write(`CI reviewer: [${scope.name}] failed (non-blocking): ${errorMessage(error)}\n`);
             review = failureReview(scope.name, publicFailureReason(error));
+            inputHash = undefined;
         }
-        results.push({ scope: scope.name, isDefault, review });
+        results.push({
+            scope: scope.name,
+            isDefault,
+            review,
+            ...(inputHash && reviewCanBeReused(review) ? { inputHash } : {}),
+        });
     }
     if (mode === "single") {
         const aggregate = singleModeReporter;
@@ -707,7 +818,7 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
             // A partial run (--scopes) is authoritative ONLY for the named scopes: merge
             // the other scopes' previous results out of the existing aggregate comment's
             // state so re-running one scope doesn't silently discard the rest.
-            const prior = (await aggregate.readState())?.scopes ?? [];
+            const prior = (priorAggregateState ?? (await aggregate.readState()))?.scopes ?? [];
             finalResults = mergePartialAggregate(results, prior, scopesFilter, manifest.scopes.map((scope) => scope.name));
         }
         if (finalResults.length === 0) {
@@ -754,7 +865,7 @@ async function runRoutedCi(source, manifest, repo, prNumber, cwd, configRoot, op
             const reporter = scopeReporter(scope.name);
             const result = results.find((entry) => entry.scope === scope.name);
             if (result) {
-                await reporter.report(result.review, result.review.feedback);
+                await reporter.report(result.review, result.review.feedback, result.inputHash);
             }
             else {
                 // A reconciled scope with zero matched files gets its stale comment deleted.

package/build/commands/init.js

@@ -24,9 +24,10 @@ Options:
   --no-workflow   Skip writing the CI workflows (review, command, and dismiss
                   under .github/workflows/)
   --token-env <name[,name…]>
-                  Env var(s) holding the model credential (default OPENAI_API_KEY,
-                  e.g. CLAUDE_CODE_OAUTH_TOKEN). The scaffolded workflows forward
-                  the matching repo secret(s) and expect this tokenEnv
+                  Env var(s) holding the model credential (default
+                  CLAUDE_CODE_REVIEW_SHARED_API_TOKEN, e.g. OPENAI_API_KEY). The
+                  scaffolded workflows forward the matching repo secret(s) and
+                  expect this tokenEnv
   --force         Overwrite existing files
   --force-workflows
                   Overwrite only the CI workflow files, keeping your customized
@@ -34,7 +35,7 @@ Options:
                   --token-env on an already-scaffolded repo.
   -h, --help      Show this help
 `;
-const DEFAULT_TOKEN_ENV = "OPENAI_API_KEY";
+const DEFAULT_TOKEN_ENV = "CLAUDE_CODE_REVIEW_SHARED_API_TOKEN";
 export async function initCommand(argv) {
     if (argv.includes("-h") || argv.includes("--help")) {
         process.stdout.write(USAGE);
@@ -96,7 +97,7 @@ async function scaffold(argv) {
     }
     // The reverse of the guard above: --force-workflows (or --force) always rewrites
     // the review workflows from the pristine template, which forwards the default
-    // OPENAI_API_KEY unless --token-env names the credential again. An adopter who
+    // Anthropic token env unless --token-env names the credential again. An adopter who
     // scaffolded with a non-default tokenEnv and later refreshes the workflow YAML
     // without re-passing --token-env would silently lose the forwarded secret, and
     // CI would keep passing the auth lock but run with an empty credential. Refuse
@@ -109,7 +110,7 @@ async function scaffold(argv) {
                 `${baked}, but this run has no --token-env, so rewriting them would restore the ` +
                 `default ${DEFAULT_TOKEN_ENV} and CI would run with an empty credential. Re-run with ` +
                 `--token-env ${baked} to keep the current credential, or --token-env ${DEFAULT_TOKEN_ENV} ` +
-                `to reset to OpenAI on purpose.`);
+                `to reset to the default on purpose.`);
         }
     }
     // Create only the config dir; let copyInto create prompts/ so it reports
@@ -149,14 +150,15 @@ async function scaffold(argv) {
     const steps = [
         `Customize ${CONFIG_DIRNAME}/agents/*.md (and shared.md, coordinator.md) for this repo.`,
         // --token-env only rewires the workflows; the scaffolded config.jsonc still
-        // declares OPENAI_API_KEY, and CI's `ecr verify-config` refuses to review
-        // until the config's tokenEnv set matches the workflow's expected set.
+        // declares the default Anthropic tokenEnv, and CI's `ecr verify-config`
+        // refuses to review until the config's tokenEnv set matches the workflow's
+        // expected set.
         ...(tokenEnvs.join(",") !== DEFAULT_TOKEN_ENV
             ? [
                 `Point ${CONFIG_DIRNAME}/config.jsonc at ${tokenEnvs.length > 1 ? "these credentials" : "this credential"}: set \`auth\` (and \`model\`) per the file's comments — CI's \`ecr verify-config\` refuses to review until the config names ${names}.`,
             ]
             : []),
-        "Configure a model provider in OpenCode (or set REVIEWER_MODEL).",
+        "Log in with `claude` (or run `ecr setup-auth`) so local runs have a credential.",
         "Run `ecr doctor`, then `ecr review`.",
         withWorkflow
             ? `Add the ${names} repo secret${tokenEnvs.length > 1 ? "s" : ""} referenced by the workflow, then add an \`ai-review\` label to a PR.`
@@ -491,11 +493,14 @@ export function substituteTokenEnv(raw, tokenEnvs) {
         return raw;
     }
     const expectedFallback = `vars.ECR_EXPECTED_TOKEN_ENV || '${DEFAULT_TOKEN_ENV}'`;
+    // Byte-identical to the credential block in templates/workflow.yml AND
+    // templates/command.yml (both flow through this function).
     const credentialBlock = [
-        "          # OpenAI API key — the env var named by auth.tokenEnv in config.jsonc.",
-        "          # Store it as a repo secret; a project-scoped key restricted to model",
-        "          # inference (with a spend limit) is all the reviewer needs.",
-        "          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}",
+        "          # Anthropic review credential — the env var named by auth.tokenEnv in",
+        "          # config.jsonc. Store it as a repo secret: an `sk-ant-oat…` token minted",
+        "          # by `claude setup-token`, or an `sk-ant-api…` Console key (the Claude",
+        "          # Code CLI reads either).",
+        "          CLAUDE_CODE_REVIEW_SHARED_API_TOKEN: ${{ secrets.CLAUDE_CODE_REVIEW_SHARED_API_TOKEN }}",
     ].join("\n");
     if (!raw.includes(expectedFallback) || !raw.includes(credentialBlock)) {
         throw new Error("workflow template drifted: tokenEnv markers not found (report this bug)");

package/build/core/adjudicate.js

@@ -166,6 +166,7 @@ export async function adjudicateFeedback(handle, items, config, debug = () => {
                 title: `adjudicate-${index}`,
                 maxWaitMs: ADJUDICATE_TIMEOUT_MS,
                 finalizeOnTimeout: true,
+                onActivity: (line) => debug(`  [adjudicator] #${index + 1}: ${line}`),
             }, parseAdjudication);
             cost += callCost;
             addTokenUsage(tokens, callTokens);

package/build/core/auth.js

@@ -13,7 +13,9 @@ const PROVIDER_KEY_ENV = {
  * Provider-owned credential env vars BEYOND the x-api-key ones above: Anthropic's
  * OAuth/subscription bearer envs. CLAUDE_CODE_OAUTH_TOKEN holds the long-lived (1-year)
  * Claude Max/Team subscription token that `ecr setup-auth`/`claude setup-token` export,
- * and ANTHROPIC_AUTH_TOKEN is Anthropic's documented bearer var. They belong to
+ * ANTHROPIC_AUTH_TOKEN is Anthropic's documented bearer var, and
+ * CLAUDE_CODE_REVIEW_SHARED_API_TOKEN is the SCAFFOLDED DEFAULT tokenEnv (see
+ * templates/config.jsonc) — it always holds an Anthropic credential. They belong to
  * anthropic, so the cross-provider guard below refuses a non-anthropic entry that names
  * one — without this, `{provider:"openai", tokenEnv:"CLAUDE_CODE_OAUTH_TOKEN"}` passes
  * (neither a FORBIDDEN secret nor a PROVIDER_KEY_ENV value) and prepareAuth forwards the
@@ -23,6 +25,7 @@ const PROVIDER_KEY_ENV = {
 const ANTHROPIC_TOKEN_ENVS = {
     CLAUDE_CODE_OAUTH_TOKEN: "anthropic",
     ANTHROPIC_AUTH_TOKEN: "anthropic",
+    CLAUDE_CODE_REVIEW_SHARED_API_TOKEN: "anthropic",
 };
 /**
  * Env vars that must NEVER be forwarded to a model provider. `auth.tokenEnv` names