@humanbased/crosscheck 1.6.1-beta.5 → 1.7.0-beta.22

package/dist/reviewers/opencode.js

@@ -0,0 +1,293 @@
+import { execa } from 'execa';
+import { rmSync, mkdtempSync, renameSync, existsSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { DEFAULT_REVIEW_INSTRUCTIONS } from '../lib/workflow.js';
+import { resolveOpenCodeModel } from '../lib/review-models.js';
+import { withTimeoutRetry } from '../lib/with-timeout-retry.js';
+import { vendorFailureSummary } from '../lib/vendor-error-summary.js';
+import { tierTimeoutMs } from './tier-timeouts.js';
+import { buildOpenCodeEnv } from './opencode-env.js';
+import { loadRepositoryReviewGuidance } from '../lib/repository-guidance.js';
+import { withCredentialFreeOrigin } from '../lib/clone.js';
+// OpenCode's reasoning-effort ladder is the `#variant` suffix on
+// `--model provider/model#variant`. Variants are provider-defined, not one
+// global ladder like claude/codex: deepseek-v4-* (the opencode models
+// crosscheck ships policy for) expose none / high / max, with no low/medium.
+// Whitelist rather than translation — anything outside this vocabulary falls
+// back to `high` instead of reaching the CLI as an unsupported variant.
+const OPENCODE_EFFORT_MAP = {
+    none: 'none',
+    high: 'high',
+    max: 'max',
+};
+export function opencodeEffort(effort) {
+    return (effort && OPENCODE_EFFORT_MAP[effort]) ?? 'high';
+}
+export function parseOpenCodeOutput(raw) {
+    let review = '';
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let reasoningTokens = 0;
+    let sawTokens = false;
+    for (const line of raw.split('\n')) {
+        if (!line.trim())
+            continue;
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            // Non-JSON line (progress/log noise) — skip, never fail the whole parse.
+            continue;
+        }
+        if (event.type === 'text' && event.part?.text)
+            review += event.part.text;
+        if (event.type === 'step_finish' && event.part?.tokens) {
+            // Each model step emits its own payload; accumulate rather than overwrite,
+            // and include reasoning so a multi-step run is not undercounted.
+            const t = event.part.tokens;
+            if (typeof t.input === 'number')
+                inputTokens += t.input;
+            if (typeof t.output === 'number')
+                outputTokens += t.output;
+            if (typeof t.reasoning === 'number')
+                reasoningTokens += t.reasoning;
+            sawTokens = true;
+        }
+    }
+    const tokensUsed = sawTokens ? inputTokens + outputTokens + reasoningTokens : undefined;
+    return { review, tokensUsed };
+}
+// OpenCode follows the same VERDICT rule as claude/codex, so a well-behaved run
+// ends with the line. Match it case-insensitively: a `Verdict: BLOCK` that the
+// old exact-match check missed then received an appended APPROVE, which the
+// parser read as the final verdict. When no verdict was stated at all, default
+// to NEEDS WORK — never APPROVE, which would clear a PR on a verdict nobody
+// gave (an empty or refusing body is caught earlier by detectInconclusiveReview).
+export function inferVerdictFromOpenCodeOutput(text) {
+    return /\bVERDICT\s*:/i.test(text) ? text : `${text}\n\nVERDICT: NEEDS WORK`;
+}
+// Detect transient OpenCode errors that should be retried (rate limits, socket
+// disconnects). OpenCode reports these through the same shapes as codex.
+function isRetryableOpenCodeError(message) {
+    return /socket.*closed|429|rate limit|connection.*reset|econnreset/i.test(message);
+}
+const MAX_OPENCODE_RETRIES = 2;
+const OPENCODE_RETRY_DELAY_MS = 5000;
+// Scans stderr bottom-up for the first fatal/error line, skipping OpenCode
+// header/log boilerplate.
+function extractOpenCodeErrorSummary(stderr) {
+    const lines = stderr.split('\n').map(l => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const l = lines[i];
+        if (/^(fatal|error):/i.test(l))
+            return l;
+    }
+    return lines.filter(l => !l.startsWith('---') &&
+        !/^\d{4}-\d{2}-\d{2}T\d/.test(l) &&
+        !/ WARN /i.test(l)).at(-1);
+}
+// OpenCode auto-discovers a project's own opencode.json / .opencode directory
+// from the working directory upward, and loads any plugin they register. In an
+// untrusted checkout that is an arbitrary-code channel independent of the
+// prompt, and OpenCode v2 has no `--pure` / config override flag to suppress it.
+// Remove them before the run so only the operator's global config applies. The
+// clone is a throwaway and a review reads the diff, not these files.
+// A restrictive permission policy for the untrusted run. OpenCode v2 has no
+// sandbox flag, so this is the tool-denial layer: a review inspects the diff by
+// running read-only git, so allow exactly those shell commands and deny every
+// other one. `--auto` auto-approves `ask` but cannot widen a `deny`.
+// `allowEdit` is left for the fix step, which must write files.
+export function opencodePolicy(allowEdit) {
+    return {
+        permissions: [
+            { action: 'shell', resource: '*', effect: 'deny' },
+            { action: 'shell', resource: 'git status *', effect: 'allow' },
+            { action: 'shell', resource: 'git diff *', effect: 'allow' },
+            { action: 'shell', resource: 'git log *', effect: 'allow' },
+            { action: 'shell', resource: 'git show *', effect: 'allow' },
+            ...(allowEdit ? [] : [{ action: 'edit', resource: '*', effect: 'deny' }]),
+        ],
+    };
+}
+export function isolateCheckoutOpenCodeConfig(repoDir, allowEdit = false) {
+    const backupDir = mkdtempSync(join(tmpdir(), 'crosscheck-oc-config-'));
+    const moved = [];
+    for (const rel of ['opencode.json', 'opencode.jsonc', '.opencode']) {
+        const from = join(repoDir, rel);
+        if (!existsSync(from))
+            continue;
+        const to = join(backupDir, rel.replace(/[/\\]/g, '_'));
+        try {
+            renameSync(from, to);
+            moved.push({ from, to });
+        }
+        catch { /* best effort */ }
+    }
+    // Install the policy as the project config this run will load; remove it on
+    // restore so a later fix's `git add -A` cannot stage it.
+    let policyWritten = false;
+    try {
+        writeFileSync(join(repoDir, 'opencode.json'), JSON.stringify(opencodePolicy(allowEdit), null, 2));
+        policyWritten = true;
+    }
+    catch { /* best effort */ }
+    // Restore the checkout's own config so a later fix step does not stage these
+    // tracked deletions as changed files (git add -A would then commit and push).
+    return () => {
+        if (policyWritten) {
+            try {
+                rmSync(join(repoDir, 'opencode.json'), { force: true });
+            }
+            catch { /* best effort */ }
+        }
+        const failed = [];
+        for (const { from, to } of moved.reverse()) {
+            try {
+                renameSync(to, from);
+            }
+            catch {
+                failed.push(from);
+            }
+        }
+        // Delete the backup only when every path was restored. If the agent recreated
+        // a conflicting path, keep the backup and fail loudly so the original tracked
+        // configuration is never silently lost.
+        if (failed.length > 0) {
+            throw new Error(`could not restore OpenCode config: ${failed.join(', ')} (backup kept at ${backupDir})`);
+        }
+        try {
+            rmSync(backupDir, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+    };
+}
+export async function runOpenCodeReview(repoDir, baseBranch, prTitle, quality, vendor, stepInstructions, onLog, timeoutMs, onRetry, issueContext, _skillSession) {
+    const model = resolveOpenCodeModel(quality, vendor);
+    const effort = opencodeEffort(vendor.effort);
+    const tierTimeout = tierTimeoutMs(quality.tier);
+    // timeoutMs: 0 → no cap (crazy/halfcrazy); undefined → tier-based default; positive → user-specified
+    const resolvedTimeout = timeoutMs === undefined ? tierTimeout : timeoutMs === 0 ? undefined : timeoutMs;
+    const focusLine = quality.focus.length > 0
+        ? `Focus areas: ${quality.focus.join(', ')}.`
+        : '';
+    const customLine = quality.custom_prompt ?? '';
+    const behaviorInstructions = stepInstructions ?? DEFAULT_REVIEW_INSTRUCTIONS;
+    const repositoryGuidance = loadRepositoryReviewGuidance(repoDir, baseBranch);
+    // Same block order as runClaudeReview/runCodexReview, so the same PR gets the
+    // same brief whichever vendor draws it: behaviour block ends on the verdict
+    // rule, repository guidance after it (reference material, not a first step).
+    const prompt = [
+        `You are reviewing a pull request titled: "${prTitle}".`,
+        `The branch \`${baseBranch}\` is the base. Review only the changes introduced in this PR.`,
+        issueContext ?? '',
+        focusLine,
+        customLine,
+        behaviorInstructions,
+        repositoryGuidance,
+    ].filter(Boolean).join('\n\n');
+    // OpenCode takes the prompt on stdin (like claude/codex): `opencode run` with
+    // no message argument reads stdin, and keeping the prompt out of argv stops
+    // repository guidance from reaching the process list. `--standalone` runs a
+    // private server, so a review of untrusted code never shares a session with
+    // the operator's interactive work. `--auto` is required even for a read-only
+    // review: a headless run auto-rejects permission requests otherwise, and
+    // reviewing a diff can trip `external_directory` (the clone lives outside the
+    // agent's workspace root) which is fatal without it. The env allowlist and
+    // the throwaway clone bound the blast radius of the widened permissions.
+    //
+    // OpenCode has no separate effort flag — reasoning effort is the `#variant`
+    // suffix on `--model provider/model#variant`. Without a pinned model there is
+    // nowhere to hang the suffix, so `vendors.opencode.effort` is honoured only
+    // when `vendors.opencode.model` is set; otherwise OpenCode's configured
+    // default model AND its default variant run, and `effort` is reported but
+    // not applied (it is not a claim the CLI was given).
+    const modelArgs = model ? ['--model', `${model}#${effort}`] : [];
+    const args = ['run', '--format', 'json', '--auto', '--standalone', ...modelArgs];
+    onLog?.(`  running: opencode run --format json --auto --standalone${model ? ` --model ${model}#${effort}` : ''}`);
+    let lastErr = undefined;
+    for (let attempt = 1; attempt <= MAX_OPENCODE_RETRIES; attempt++) {
+        try {
+            const { result: { stdout }, retried } = await withCredentialFreeOrigin(repoDir, () => {
+                // Hide any OpenCode config the untrusted checkout carries while the agent
+                // runs; restore it after so a later fix step cannot stage the deletion.
+                const restoreConfig = isolateCheckoutOpenCodeConfig(repoDir);
+                return withTimeoutRetry(resolvedTimeout, (t) => execa('opencode', args, {
+                    cwd: repoDir,
+                    timeout: t,
+                    input: prompt,
+                    // extendEnv: false or execa merges process.env back in and the
+                    // allowlist means nothing.
+                    extendEnv: false,
+                    // No `${repoDir}/node_modules/.bin` on PATH: the checkout is untrusted
+                    // and a committed `node_modules/.bin/opencode` would shadow the real
+                    // executable. A review only reads the diff, so repo-local tools are
+                    // not needed the way codex.ts assumed they were.
+                    env: buildOpenCodeEnv(),
+                }), {
+                    onRetry: (effectiveMs, delayMs) => (onRetry ?? onLog)?.(`  ⏱ opencode timed out at ${effectiveMs / 1000}s — waiting ${delayMs / 1000}s and retrying once`),
+                }).finally(restoreConfig);
+            });
+            const { review: parsedReview, tokensUsed } = parseOpenCodeOutput(stdout ?? '');
+            const rawReview = parsedReview.trim();
+            const review = inferVerdictFromOpenCodeOutput(rawReview);
+            // Report effort only when a pinned model actually carried the #variant;
+            // with no model there is no suffix, so claiming a level would be false.
+            return { review, tokensUsed, model: model ?? 'default', effort: model ? effort : undefined, retried };
+        }
+        catch (err) {
+            const execa = err;
+            const rawStderr = execa.stderr ?? '';
+            const fullMessage = rawStderr || execa.message || '';
+            if (isRetryableOpenCodeError(fullMessage) && attempt < MAX_OPENCODE_RETRIES) {
+                const delay = OPENCODE_RETRY_DELAY_MS * attempt; // 5s, 10s
+                onLog?.(`  opencode: transient error (${fullMessage.slice(0, 80)}), retrying in ${delay / 1000}s (attempt ${attempt}/${MAX_OPENCODE_RETRIES})...`);
+                await new Promise(resolve => setTimeout(resolve, delay));
+                lastErr = err;
+                continue;
+            }
+            const effectiveMs = execa.effectiveTimeoutMs ?? resolvedTimeout;
+            const retryNote = execa.retryDelayMs !== undefined ? ' (retried once)' : '';
+            const summary = execa.timedOut
+                ? `timed out after ${effectiveMs !== undefined ? effectiveMs / 1000 : '?'}s${retryNote} — PR diff may be too large (tier: ${quality.tier})`
+                : vendorFailureSummary(execa, extractOpenCodeErrorSummary);
+            const thrown = Object.assign(new Error(`opencode: ${summary}`), {
+                exitCode: execa.exitCode,
+                timedOut: execa.timedOut,
+                stderr: rawStderr,
+                effectiveTimeoutMs: effectiveMs,
+                retryDelayMs: execa.retryDelayMs,
+            });
+            throw thrown;
+        }
+    }
+    if (lastErr)
+        throw lastErr;
+    throw new Error('opencode: unexpected retry loop exit');
+}
+export async function checkOpenCodeAuth() {
+    try {
+        // `--format json` returns one record per provider, so human-readable headers
+        // and summaries can never be miscounted as authenticated providers the way
+        // the text form's line count could.
+        const { stdout } = await execa('opencode', ['auth', 'list', '--format', 'json'], { timeout: 10_000 });
+        let parsed;
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch {
+            parsed = null;
+        }
+        const providers = Array.isArray(parsed) ? parsed : [];
+        if (providers.length === 0) {
+            return { ok: false, detail: 'no providers configured — run: opencode auth login' };
+        }
+        return { ok: true, detail: `${providers.length} provider(s) configured` };
+    }
+    catch (err) {
+        const error = err;
+        return { ok: false, detail: error.stderr ?? error.message ?? 'not found' };
+    }
+}
+//# sourceMappingURL=opencode.js.map

package/dist/reviewers/opencode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../../src/reviewers/opencode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,iEAAiE;AACjE,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAA;AAC1D,CAAC;AAiBD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC1B,IAAI,KAAoB,CAAA;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;QACxE,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACvD,2EAA2E;YAC3E,iEAAiE;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;YAC3B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,WAAW,IAAI,CAAC,CAAC,KAAK,CAAA;YACvD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,YAAY,IAAI,CAAC,CAAC,MAAM,CAAA;YAC1D,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;gBAAE,eAAe,IAAI,CAAC,CAAC,SAAS,CAAA;YACnE,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;AAC/B,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,yBAAyB,CAAA;AAC9E,CAAC;AAED,+EAA+E;AAC/E,yEAAyE;AACzE,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,2EAA2E;AAC3E,0BAA0B;AAC1B,SAAS,2BAA2B,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACpB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CACnB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACV,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,iFAAiF;AACjF,+EAA+E;AAC/E,qEAAqE;AACrE,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,SAAkB;IAC/C,OAAO;QACL,WAAW,EAAE;YACX,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;YAClD,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;SAC1E;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAe,EAAE,SAAS,GAAG,KAAK;IAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAwC,EAAE,CAAA;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACpF,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACjG,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,GAAG,EAAE;QACV,IAAI,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAClH,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC;gBAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;QAC1D,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,wCAAwC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAA;QAC1G,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACzF,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,MAA4B,EAC5B,gBAAyB,EACzB,KAA6B,EAC7B,SAAkB,EAClB,OAA+B,EAC/B,YAAqB,EACrB,aAAsC;IAEtC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,qGAAqG;IACrG,MAAM,eAAe,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC7C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAE9C,MAAM,oBAAoB,GAAG,gBAAgB,IAAI,2BAA2B,CAAA;IAC5E,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAE5E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG;QACb,6CAA6C,OAAO,IAAI;QACxD,gBAAgB,UAAU,gEAAgE;QAC1F,YAAY,IAAI,EAAE;QAClB,SAAS;QACT,UAAU;QACV,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IAEhF,KAAK,EAAE,CAAC,4DAA4D,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjH,IAAI,OAAO,GAAY,SAAS,CAAA;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnF,0EAA0E;gBAC1E,wEAAwE;gBACxE,MAAM,aAAa,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;gBAC5D,OAAO,gBAAgB,CACrB,eAAe,EACf,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;oBAC7B,GAAG,EAAE,OAAO;oBACZ,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,MAAM;oBACb,+DAA+D;oBAC/D,2BAA2B;oBAC3B,SAAS,EAAE,KAAK;oBAChB,uEAAuE;oBACvE,qEAAqE;oBACrE,oEAAoE;oBACpE,iDAAiD;oBACjD,GAAG,EAAE,gBAAgB,EAAE;iBACxB,CAAC,EACF;oBACE,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAChC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,6BAA6B,WAAW,GAAG,IAAI,eAAe,OAAO,GAAG,IAAI,qBAAqB,CAAC;iBAC1H,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;YAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAA;YACrC,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAA;YACxD,wEAAwE;YACxE,wEAAwE;YACxE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAA;QACvG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAwJ,CAAA;YACtK,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;YACpC,MAAM,WAAW,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;YAEpD,IAAI,wBAAwB,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,uBAAuB,GAAG,OAAO,CAAA,CAAC,UAAU;gBAC1D,KAAK,EAAE,CAAC,gCAAgC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,oBAAoB,MAAM,CAAC,CAAA;gBAClJ,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC9D,OAAO,GAAG,GAAG,CAAA;gBACb,SAAQ;YACV,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,eAAe,CAAA;YAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;gBAC5B,CAAC,CAAC,mBAAmB,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,sCAAsC,OAAO,CAAC,IAAI,GAAG;gBAC3I,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAA;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,SAAS;gBACjB,kBAAkB,EAAE,WAAW;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAA;YACF,MAAM,MAAM,CAAA;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAA;IAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACrG,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,IAAI,CAAA;QAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAA;QACpF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,yBAAyB,EAAE,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,WAAW,EAAE,CAAA;IAC5E,CAAC;AACH,CAAC"}

package/get-started.md

@@ -37,7 +37,7 @@
 
 ## Prerequisites
 
-You need GitHub CLI and at least one authenticated AI reviewer CLI before crosscheck can run a one-shot review. Install both Claude Code and Codex only if you want cross-vendor review routing.
+You need GitHub CLI and at least one authenticated AI reviewer CLI before crosscheck can run a one-shot review. Install both Claude Code and Codex only if you want cross-vendor review routing. OpenCode is an optional third harness, disabled by default.
 
 ### Claude Code
 
@@ -65,6 +65,15 @@ printenv OPENAI_API_KEY | codex login --with-api-key
 
 Then set `auth: api-key` in your config to enable model selection.
 
+### OpenCode
+
+```bash
+npm install -g @opencode/cli
+opencode auth login   # sign in to a provider (e.g. DeepSeek, Anthropic, OpenAI)
+```
+
+OpenCode is **opt-in**: enable it with `vendors.opencode.enabled: true` (or `crosscheck onboard`). Its model and provider come from your OpenCode config (`opencode auth login` / `opencode.json`) — crosscheck pins no model by default, so reviews run against whichever model OpenCode is configured to use. Reasoning effort is carried as the `#variant` suffix on `--model provider/model#variant`, so `vendors.opencode.effort` (none | high | max) applies only when `vendors.opencode.model` is also set.
+
 ### GitHub CLI
 
 ```bash
@@ -794,6 +803,7 @@ crosscheck status
   Auth
   ✓ codex                  authenticated
   ✓ claude                 2.1.x (Claude Code)
+  ✓ opencode               v2.x
   ✓ GITHUB_TOKEN           via gh auth login
   ✓ WEBHOOK_SECRET         auto-managed at ~/.crosscheck/webhook-secret
 
@@ -804,6 +814,8 @@ crosscheck status
     enabled skills         code-review-skill (by @awesome-skills, MIT), diagnosing-bugs (by @mattpocock, MIT)
     codex auth             subscription
     claude model           sonnet
+    opencode enabled       false
+    opencode model         configured in opencode.json
     per-review budget      $2.00/review
 
   Impact
@@ -817,6 +829,7 @@ crosscheck status
   CLIs
     codex                  codex-cli 0.128.0
     claude                 2.1.x (Claude Code)
+    opencode               v2.x
 ```
 
 | Flag | Description |
@@ -1192,8 +1205,8 @@ vendors:
   codex:
     enabled: true
     auth: subscription      # subscription | api-key
-    model: gpt-5.6-terra    # pins the review model; unset = tier model (api-key) / CLI default (subscription)
-    effort: medium          # low | medium | high | xhigh | max | ultra (ultra: terra/sol only)
+    model: gpt-6.1-sol      # pins the review model; unset = tier model (api-key) / CLI default (subscription)
+    effort: medium          # low | medium | high | xhigh | max | ultra
     # timeout_sec: 1200     # max seconds per CLI call; unset = tier-based (300/600/1200)
 
   claude:
@@ -1202,6 +1215,16 @@ vendors:
     effort: medium          # low | medium | high | max
     # timeout_sec: 1200     # max seconds per CLI call; unset = tier-based (300/600/1200)
 
+  # Opt-in third harness; disabled by default. Its model/provider come from
+  # `opencode auth login` / opencode.json, not from a crosscheck catalog.
+  # Reasoning effort rides the `--model provider/model#variant` suffix, so
+  # `effort` applies only when `model` is also set.
+  opencode:
+    enabled: false
+    # model: provider/model   # e.g. alibaba-cn/deepseek-v4-pro; unset = opencode.json default
+    effort: high              # none | high | max
+    # timeout_sec: 1200       # max seconds per CLI call; unset = tier-based (300/600/1200)
+
 # ── Quality ───────────────────────────────────────────────────────────────────
 quality:
   # Structured findings and incremental follow-ups; set false for legacy prose reviews.
@@ -1285,12 +1308,18 @@ routing:
   claude_reviews_patterns:
     - "Generated with \\[OpenAI Codex\\]"   # Codex attribution footer
     - "Co-Authored-By: codex"               # commit trailer
+  opencode_reviews_patterns:
+    - "Generated with \\[OpenCode\\]"       # OpenCode attribution footer
+    - "Co-Authored-By: opencode"            # commit trailer
 
-  # Branch prefix detection (signal 3). Claude Code uses claude/, Codex uses codex/.
+  # Branch prefix detection (signal 3). Claude Code uses claude/, Codex uses
+  # codex/, OpenCode uses opencode/.
   claude_branch_prefixes:
     - "claude/"
   codex_branch_prefixes:
     - "codex/"
+  opencode_branch_prefixes:
+    - "opencode/"
 
   # Restrict reviews to PRs opened by these GitHub logins.
   # Auto-filled with your GitHub login by `crosscheck init` or first `crosscheck watch`.
@@ -1304,6 +1333,11 @@ routing:
   author_routes:
     your-github-login: claude   # your PRs → treated as Claude-authored → Codex reviews
 
+  # Reviewer for PRs crosscheck cannot attribute (origin: human). 'auto' = the
+  # first authenticated vendor (codex, then claude, then opencode); an explicit
+  # 'codex' | 'claude' | 'opencode' always uses that vendor; null = skip the PR.
+  fallback_reviewer: auto
+
 # ── Tunnel (watch mode only) ──────────────────────────────────────────────────
 # localhost.run (default) — SSH tunnel, zero install, URL changes on reconnect.
 # smee — stable relay via smee.io; events queued while offline.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanbased/crosscheck",
-  "version": "1.6.1-beta.5",
+  "version": "1.7.0-beta.22",
   "description": "AI code review pipeline that turns agent-written PRs into merge-ready patches",
   "bin": {
     "crosscheck": "dist/cli.js",