@humanbased/crosscheck 1.6.1-beta.5 → 1.7.0-beta.25

package/dist/reviewers/opencode.js

@@ -0,0 +1,293 @@
+import { execa } from 'execa';
+import { rmSync, mkdtempSync, renameSync, existsSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { DEFAULT_REVIEW_INSTRUCTIONS } from '../lib/workflow.js';
+import { resolveOpenCodeModel } from '../lib/review-models.js';
+import { withTimeoutRetry } from '../lib/with-timeout-retry.js';
+import { vendorFailureSummary } from '../lib/vendor-error-summary.js';
+import { tierTimeoutMs } from './tier-timeouts.js';
+import { buildOpenCodeEnv } from './opencode-env.js';
+import { loadRepositoryReviewGuidance } from '../lib/repository-guidance.js';
+import { withCredentialFreeOrigin } from '../lib/clone.js';
+// OpenCode's reasoning-effort ladder is the `#variant` suffix on
+// `--model provider/model#variant`. Variants are provider-defined, not one
+// global ladder like claude/codex: deepseek-v4-* (the opencode models
+// crosscheck ships policy for) expose none / high / max, with no low/medium.
+// Whitelist rather than translation — anything outside this vocabulary falls
+// back to `high` instead of reaching the CLI as an unsupported variant.
+const OPENCODE_EFFORT_MAP = {
+    none: 'none',
+    high: 'high',
+    max: 'max',
+};
+export function opencodeEffort(effort) {
+    return (effort && OPENCODE_EFFORT_MAP[effort]) ?? 'high';
+}
+export function parseOpenCodeOutput(raw) {
+    let review = '';
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let reasoningTokens = 0;
+    let sawTokens = false;
+    for (const line of raw.split('\n')) {
+        if (!line.trim())
+            continue;
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            // Non-JSON line (progress/log noise) — skip, never fail the whole parse.
+            continue;
+        }
+        if (event.type === 'text' && event.part?.text)
+            review += event.part.text;
+        if (event.type === 'step_finish' && event.part?.tokens) {
+            // Each model step emits its own payload; accumulate rather than overwrite,
+            // and include reasoning so a multi-step run is not undercounted.
+            const t = event.part.tokens;
+            if (typeof t.input === 'number')
+                inputTokens += t.input;
+            if (typeof t.output === 'number')
+                outputTokens += t.output;
+            if (typeof t.reasoning === 'number')
+                reasoningTokens += t.reasoning;
+            sawTokens = true;
+        }
+    }
+    const tokensUsed = sawTokens ? inputTokens + outputTokens + reasoningTokens : undefined;
+    return { review, tokensUsed };
+}
+// OpenCode follows the same VERDICT rule as claude/codex, so a well-behaved run
+// ends with the line. Match it case-insensitively: a `Verdict: BLOCK` that the
+// old exact-match check missed then received an appended APPROVE, which the
+// parser read as the final verdict. When no verdict was stated at all, default
+// to NEEDS WORK — never APPROVE, which would clear a PR on a verdict nobody
+// gave (an empty or refusing body is caught earlier by detectInconclusiveReview).
+export function inferVerdictFromOpenCodeOutput(text) {
+    return /\bVERDICT\s*:/i.test(text) ? text : `${text}\n\nVERDICT: NEEDS WORK`;
+}
+// Detect transient OpenCode errors that should be retried (rate limits, socket
+// disconnects). OpenCode reports these through the same shapes as codex.
+function isRetryableOpenCodeError(message) {
+    return /socket.*closed|429|rate limit|connection.*reset|econnreset/i.test(message);
+}
+const MAX_OPENCODE_RETRIES = 2;
+const OPENCODE_RETRY_DELAY_MS = 5000;
+// Scans stderr bottom-up for the first fatal/error line, skipping OpenCode
+// header/log boilerplate.
+function extractOpenCodeErrorSummary(stderr) {
+    const lines = stderr.split('\n').map(l => l.trim()).filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const l = lines[i];
+        if (/^(fatal|error):/i.test(l))
+            return l;
+    }
+    return lines.filter(l => !l.startsWith('---') &&
+        !/^\d{4}-\d{2}-\d{2}T\d/.test(l) &&
+        !/ WARN /i.test(l)).at(-1);
+}
+// OpenCode auto-discovers a project's own opencode.json / .opencode directory
+// from the working directory upward, and loads any plugin they register. In an
+// untrusted checkout that is an arbitrary-code channel independent of the
+// prompt, and OpenCode v2 has no `--pure` / config override flag to suppress it.
+// Remove them before the run so only the operator's global config applies. The
+// clone is a throwaway and a review reads the diff, not these files.
+// A restrictive permission policy for the untrusted run. OpenCode v2 has no
+// sandbox flag, so this is the tool-denial layer: a review inspects the diff by
+// running read-only git, so allow exactly those shell commands and deny every
+// other one. `--auto` auto-approves `ask` but cannot widen a `deny`.
+// `allowEdit` is left for the fix step, which must write files.
+export function opencodePolicy(allowEdit) {
+    return {
+        permissions: [
+            { action: 'shell', resource: '*', effect: 'deny' },
+            { action: 'shell', resource: 'git status *', effect: 'allow' },
+            { action: 'shell', resource: 'git diff *', effect: 'allow' },
+            { action: 'shell', resource: 'git log *', effect: 'allow' },
+            { action: 'shell', resource: 'git show *', effect: 'allow' },
+            ...(allowEdit ? [] : [{ action: 'edit', resource: '*', effect: 'deny' }]),
+        ],
+    };
+}
+export function isolateCheckoutOpenCodeConfig(repoDir, allowEdit = false) {
+    const backupDir = mkdtempSync(join(tmpdir(), 'crosscheck-oc-config-'));
+    const moved = [];
+    for (const rel of ['opencode.json', 'opencode.jsonc', '.opencode']) {
+        const from = join(repoDir, rel);
+        if (!existsSync(from))
+            continue;
+        const to = join(backupDir, rel.replace(/[/\\]/g, '_'));
+        try {
+            renameSync(from, to);
+            moved.push({ from, to });
+        }
+        catch { /* best effort */ }
+    }
+    // Install the policy as the project config this run will load; remove it on
+    // restore so a later fix's `git add -A` cannot stage it.
+    let policyWritten = false;
+    try {
+        writeFileSync(join(repoDir, 'opencode.json'), JSON.stringify(opencodePolicy(allowEdit), null, 2));
+        policyWritten = true;
+    }
+    catch { /* best effort */ }
+    // Restore the checkout's own config so a later fix step does not stage these
+    // tracked deletions as changed files (git add -A would then commit and push).
+    return () => {
+        if (policyWritten) {
+            try {
+                rmSync(join(repoDir, 'opencode.json'), { force: true });
+            }
+            catch { /* best effort */ }
+        }
+        const failed = [];
+        for (const { from, to } of moved.reverse()) {
+            try {
+                renameSync(to, from);
+            }
+            catch {
+                failed.push(from);
+            }
+        }
+        // Delete the backup only when every path was restored. If the agent recreated
+        // a conflicting path, keep the backup and fail loudly so the original tracked
+        // configuration is never silently lost.
+        if (failed.length > 0) {
+            throw new Error(`could not restore OpenCode config: ${failed.join(', ')} (backup kept at ${backupDir})`);
+        }
+        try {
+            rmSync(backupDir, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+    };
+}
+export async function runOpenCodeReview(repoDir, baseBranch, prTitle, quality, vendor, stepInstructions, onLog, timeoutMs, onRetry, issueContext, _skillSession) {
+    const model = resolveOpenCodeModel(quality, vendor);
+    const effort = opencodeEffort(vendor.effort);
+    const tierTimeout = tierTimeoutMs(quality.tier);
+    // timeoutMs: 0 → no cap (crazy/halfcrazy); undefined → tier-based default; positive → user-specified
+    const resolvedTimeout = timeoutMs === undefined ? tierTimeout : timeoutMs === 0 ? undefined : timeoutMs;
+    const focusLine = quality.focus.length > 0
+        ? `Focus areas: ${quality.focus.join(', ')}.`
+        : '';
+    const customLine = quality.custom_prompt ?? '';
+    const behaviorInstructions = stepInstructions ?? DEFAULT_REVIEW_INSTRUCTIONS;
+    const repositoryGuidance = loadRepositoryReviewGuidance(repoDir, baseBranch);
+    // Same block order as runClaudeReview/runCodexReview, so the same PR gets the
+    // same brief whichever vendor draws it: behaviour block ends on the verdict
+    // rule, repository guidance after it (reference material, not a first step).
+    const prompt = [
+        `You are reviewing a pull request titled: "${prTitle}".`,
+        `The branch \`${baseBranch}\` is the base. Review only the changes introduced in this PR.`,
+        issueContext ?? '',
+        focusLine,
+        customLine,
+        behaviorInstructions,
+        repositoryGuidance,
+    ].filter(Boolean).join('\n\n');
+    // OpenCode takes the prompt on stdin (like claude/codex): `opencode run` with
+    // no message argument reads stdin, and keeping the prompt out of argv stops
+    // repository guidance from reaching the process list. `--standalone` runs a
+    // private server, so a review of untrusted code never shares a session with
+    // the operator's interactive work. `--auto` is required even for a read-only
+    // review: a headless run auto-rejects permission requests otherwise, and
+    // reviewing a diff can trip `external_directory` (the clone lives outside the
+    // agent's workspace root) which is fatal without it. The env allowlist and
+    // the throwaway clone bound the blast radius of the widened permissions.
+    //
+    // OpenCode has no separate effort flag — reasoning effort is the `#variant`
+    // suffix on `--model provider/model#variant`. Without a pinned model there is
+    // nowhere to hang the suffix, so `vendors.opencode.effort` is honoured only
+    // when `vendors.opencode.model` is set; otherwise OpenCode's configured
+    // default model AND its default variant run, and `effort` is reported but
+    // not applied (it is not a claim the CLI was given).
+    const modelArgs = model ? ['--model', `${model}#${effort}`] : [];
+    const args = ['run', '--format', 'json', '--auto', '--standalone', ...modelArgs];
+    onLog?.(`  running: opencode run --format json --auto --standalone${model ? ` --model ${model}#${effort}` : ''}`);
+    let lastErr = undefined;
+    for (let attempt = 1; attempt <= MAX_OPENCODE_RETRIES; attempt++) {
+        try {
+            const { result: { stdout }, retried } = await withCredentialFreeOrigin(repoDir, () => {
+                // Hide any OpenCode config the untrusted checkout carries while the agent
+                // runs; restore it after so a later fix step cannot stage the deletion.
+                const restoreConfig = isolateCheckoutOpenCodeConfig(repoDir);
+                return withTimeoutRetry(resolvedTimeout, (t) => execa('opencode', args, {
+                    cwd: repoDir,
+                    timeout: t,
+                    input: prompt,
+                    // extendEnv: false or execa merges process.env back in and the
+                    // allowlist means nothing.
+                    extendEnv: false,
+                    // No `${repoDir}/node_modules/.bin` on PATH: the checkout is untrusted
+                    // and a committed `node_modules/.bin/opencode` would shadow the real
+                    // executable. A review only reads the diff, so repo-local tools are
+                    // not needed the way codex.ts assumed they were.
+                    env: buildOpenCodeEnv(),
+                }), {
+                    onRetry: (effectiveMs, delayMs) => (onRetry ?? onLog)?.(`  ⏱ opencode timed out at ${effectiveMs / 1000}s — waiting ${delayMs / 1000}s and retrying once`),
+                }).finally(restoreConfig);
+            });
+            const { review: parsedReview, tokensUsed } = parseOpenCodeOutput(stdout ?? '');
+            const rawReview = parsedReview.trim();
+            const review = inferVerdictFromOpenCodeOutput(rawReview);
+            // Report effort only when a pinned model actually carried the #variant;
+            // with no model there is no suffix, so claiming a level would be false.
+            return { review, tokensUsed, model: model ?? 'default', effort: model ? effort : undefined, retried };
+        }
+        catch (err) {
+            const execa = err;
+            const rawStderr = execa.stderr ?? '';
+            const fullMessage = rawStderr || execa.message || '';
+            if (isRetryableOpenCodeError(fullMessage) && attempt < MAX_OPENCODE_RETRIES) {
+                const delay = OPENCODE_RETRY_DELAY_MS * attempt; // 5s, 10s
+                onLog?.(`  opencode: transient error (${fullMessage.slice(0, 80)}), retrying in ${delay / 1000}s (attempt ${attempt}/${MAX_OPENCODE_RETRIES})...`);
+                await new Promise(resolve => setTimeout(resolve, delay));
+                lastErr = err;
+                continue;
+            }
+            const effectiveMs = execa.effectiveTimeoutMs ?? resolvedTimeout;
+            const retryNote = execa.retryDelayMs !== undefined ? ' (retried once)' : '';
+            const summary = execa.timedOut
+                ? `timed out after ${effectiveMs !== undefined ? effectiveMs / 1000 : '?'}s${retryNote} — PR diff may be too large (tier: ${quality.tier})`
+                : vendorFailureSummary(execa, extractOpenCodeErrorSummary);
+            const thrown = Object.assign(new Error(`opencode: ${summary}`), {
+                exitCode: execa.exitCode,
+                timedOut: execa.timedOut,
+                stderr: rawStderr,
+                effectiveTimeoutMs: effectiveMs,
+                retryDelayMs: execa.retryDelayMs,
+            });
+            throw thrown;
+        }
+    }
+    if (lastErr)
+        throw lastErr;
+    throw new Error('opencode: unexpected retry loop exit');
+}
+export async function checkOpenCodeAuth() {
+    try {
+        // `--format json` returns one record per provider, so human-readable headers
+        // and summaries can never be miscounted as authenticated providers the way
+        // the text form's line count could.
+        const { stdout } = await execa('opencode', ['auth', 'list', '--format', 'json'], { timeout: 10_000 });
+        let parsed;
+        try {
+            parsed = JSON.parse(stdout);
+        }
+        catch {
+            parsed = null;
+        }
+        const providers = Array.isArray(parsed) ? parsed : [];
+        if (providers.length === 0) {
+            return { ok: false, detail: 'no providers configured — run: opencode auth login' };
+        }
+        return { ok: true, detail: `${providers.length} provider(s) configured` };
+    }
+    catch (err) {
+        const error = err;
+        return { ok: false, detail: error.stderr ?? error.message ?? 'not found' };
+    }
+}
+//# sourceMappingURL=opencode.js.map

package/dist/reviewers/opencode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode.js","sourceRoot":"","sources":["../../src/reviewers/opencode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAE3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,iEAAiE;AACjE,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAA;AAED,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAA;AAC1D,CAAC;AAiBD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC1B,IAAI,KAAoB,CAAA;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;QACxE,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACvD,2EAA2E;YAC3E,iEAAiE;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;YAC3B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,WAAW,IAAI,CAAC,CAAC,KAAK,CAAA;YACvD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,YAAY,IAAI,CAAC,CAAC,MAAM,CAAA;YAC1D,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;gBAAE,eAAe,IAAI,CAAC,CAAC,SAAS,CAAA;YACnE,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;AAC/B,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,kFAAkF;AAClF,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,yBAAyB,CAAA;AAC9E,CAAC;AAED,+EAA+E;AAC/E,yEAAyE;AACzE,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAC9B,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,2EAA2E;AAC3E,0BAA0B;AAC1B,SAAS,2BAA2B,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACpB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CACnB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACV,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,iFAAiF;AACjF,+EAA+E;AAC/E,qEAAqE;AACrE,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,SAAkB;IAC/C,OAAO;QACL,WAAW,EAAE;YACX,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;YAClD,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE;YAC9D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;YAC3D,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;SAC1E;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAe,EAAE,SAAS,GAAG,KAAK;IAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAwC,EAAE,CAAA;IACrD,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC;YAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACpF,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACjG,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO,GAAG,EAAE;QACV,IAAI,aAAa,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAAC,CAAC;QAClH,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC;gBAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;QAC1D,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,wCAAwC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,SAAS,GAAG,CAAC,CAAA;QAC1G,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACzF,CAAC,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,MAA4B,EAC5B,gBAAyB,EACzB,KAA6B,EAC7B,SAAkB,EAClB,OAA+B,EAC/B,YAAqB,EACrB,aAAsC;IAEtC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,qGAAqG;IACrG,MAAM,eAAe,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvG,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC7C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAE9C,MAAM,oBAAoB,GAAG,gBAAgB,IAAI,2BAA2B,CAAA;IAC5E,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAE5E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG;QACb,6CAA6C,OAAO,IAAI;QACxD,gBAAgB,UAAU,gEAAgE;QAC1F,YAAY,IAAI,EAAE;QAClB,SAAS;QACT,UAAU;QACV,oBAAoB;QACpB,kBAAkB;KACnB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAE9B,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IAEhF,KAAK,EAAE,CAAC,4DAA4D,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjH,IAAI,OAAO,GAAY,SAAS,CAAA;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnF,0EAA0E;gBAC1E,wEAAwE;gBACxE,MAAM,aAAa,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;gBAC5D,OAAO,gBAAgB,CACrB,eAAe,EACf,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;oBAC7B,GAAG,EAAE,OAAO;oBACZ,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,MAAM;oBACb,+DAA+D;oBAC/D,2BAA2B;oBAC3B,SAAS,EAAE,KAAK;oBAChB,uEAAuE;oBACvE,qEAAqE;oBACrE,oEAAoE;oBACpE,iDAAiD;oBACjD,GAAG,EAAE,gBAAgB,EAAE;iBACxB,CAAC,EACF;oBACE,OAAO,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAChC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC,6BAA6B,WAAW,GAAG,IAAI,eAAe,OAAO,GAAG,IAAI,qBAAqB,CAAC;iBAC1H,CACF,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAC1B,CAAC,CAAC,CAAA;YAEF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;YAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAA;YACrC,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAA;YACxD,wEAAwE;YACxE,wEAAwE;YACxE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAA;QACvG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,GAAwJ,CAAA;YACtK,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;YACpC,MAAM,WAAW,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,CAAA;YAEpD,IAAI,wBAAwB,CAAC,WAAW,CAAC,IAAI,OAAO,GAAG,oBAAoB,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,uBAAuB,GAAG,OAAO,CAAA,CAAC,UAAU;gBAC1D,KAAK,EAAE,CAAC,gCAAgC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,KAAK,GAAG,IAAI,cAAc,OAAO,IAAI,oBAAoB,MAAM,CAAC,CAAA;gBAClJ,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC9D,OAAO,GAAG,GAAG,CAAA;gBACb,SAAQ;YACV,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,IAAI,eAAe,CAAA;YAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;gBAC5B,CAAC,CAAC,mBAAmB,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,sCAAsC,OAAO,CAAC,IAAI,GAAG;gBAC3I,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAA;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,EAAE;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,SAAS;gBACjB,kBAAkB,EAAE,WAAW;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAA;YACF,MAAM,MAAM,CAAA;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,MAAM,OAAO,CAAA;IAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,oCAAoC;QACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACrG,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,IAAI,CAAA;QAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAA;QACpF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,yBAAyB,EAAE,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,WAAW,EAAE,CAAA;IAC5E,CAAC;AACH,CAAC"}

package/get-started.md

@@ -37,7 +37,7 @@
 
 ## Prerequisites
 
-You need GitHub CLI and at least one authenticated AI reviewer CLI before crosscheck can run a one-shot review. Install both Claude Code and Codex only if you want cross-vendor review routing.
+You need GitHub CLI and at least one authenticated AI reviewer CLI before crosscheck can run a one-shot review. Install both Claude Code and Codex only if you want cross-vendor review routing. OpenCode is an optional third harness, disabled by default.
 
 ### Claude Code
 
@@ -65,6 +65,15 @@ printenv OPENAI_API_KEY | codex login --with-api-key
 
 Then set `auth: api-key` in your config to enable model selection.
 
+### OpenCode
+
+```bash
+npm install -g @opencode/cli
+opencode auth login   # sign in to a provider (e.g. DeepSeek, Anthropic, OpenAI)
+```
+
+OpenCode is **opt-in**: enable it with `vendors.opencode.enabled: true` (or `crosscheck onboard`). Its model and provider come from your OpenCode config (`opencode auth login` / `opencode.json`) — crosscheck pins no model by default, so reviews run against whichever model OpenCode is configured to use. Reasoning effort is carried as the `#variant` suffix on `--model provider/model#variant`, so `vendors.opencode.effort` (none | high | max) applies only when `vendors.opencode.model` is also set.
+
 ### GitHub CLI
 
 ```bash
@@ -384,6 +393,10 @@ What it checks: `codex` CLI, `claude` CLI, `gh` CLI, GitHub auth, and webhook-se
 
 ### `crosscheck onboard`
 
+Interactive onboarding starts with a checklist of Claude, Codex, and OpenCode, including tools that are not installed or need login. Select one or more tools first, then choose to run the displayed installation/login command, handle setup in another terminal and check again, skip that tool, or cancel. Commands run only when explicitly chosen. Setup rechecks each tool after installation/login and again before saving; skipped or unready tools are never enabled. One ready selection uses single-vendor mode; multiple ready selections use cross-vendor mode. Existing choices are preselected, and OpenCode is unchecked by default on fresh mixed installs.
+
+With `--yes`, no installation/login commands run and no tools are selected interactively: existing opt-outs are preserved and unavailable tools are disabled. If no enabled reviewer is available, setup stops without writing config. A fresh OpenCode-only installation enables OpenCode. These checks verify installation and saved login/provider configuration, not a live request to each model or provider account permissions.
+
 The recommended first-time setup command. Walks through ten steps interactively and writes a ready-to-use config.
 
 ```bash
@@ -396,7 +409,7 @@ crosscheck onboard --reconfigure  # re-run setup even if config already exists
 
 **The ten steps:**
 
-**Step 1 — Environment check.** Verifies codex CLI, claude CLI, gh CLI, and GitHub token. At least one AI CLI must be authenticated; gh auth is always required. Prints ✓/✗ with fix hints.
+**Step 1 — Environment check.** Verifies codex CLI, claude CLI, gh CLI, and GitHub token. GitHub auth is required. Interactive setup can start without an installed AI tool and then guides tool selection, installation, and login; `--yes` requires an enabled ready tool.
 
 **Step 2 — Deployment mode.** Choose how crosscheck scopes itself:
 - `personal` — monitors your personal repos + all orgs you belong to; reviews only PRs you author
@@ -404,9 +417,9 @@ crosscheck onboard --reconfigure  # re-run setup even if config already exists
 
 **Step 3 — Repo selection.** Lists accessible repos and orgs; you pick which ones to watch. Org-level selection covers all repos in the org with one webhook.
 
-**Step 4 — Review mode.** If both CLIs are available, choose:
-- `cross-vendor` — Claude reviews Codex PRs; Codex reviews Claude PRs (recommended when using both agents)
-- `single-vendor` — one AI reviews all PRs (default when only one CLI is installed)
+**Step 4 — Review mode.** Uses the tools retained after guided setup:
+- `cross-vendor` — enabled tools review PRs written by another tool (used for multiple ready selections)
+- `single-vendor` — one AI reviews all PRs (used for one ready selection)
 
 **Step 5 — Primary author.** In personal cross-vendor mode, choose which agent usually authors your PRs so Crosscheck can route reviews to the other vendor.
 
@@ -794,6 +807,7 @@ crosscheck status
   Auth
   ✓ codex                  authenticated
   ✓ claude                 2.1.x (Claude Code)
+  ✓ opencode               v2.x
   ✓ GITHUB_TOKEN           via gh auth login
   ✓ WEBHOOK_SECRET         auto-managed at ~/.crosscheck/webhook-secret
 
@@ -804,6 +818,8 @@ crosscheck status
     enabled skills         code-review-skill (by @awesome-skills, MIT), diagnosing-bugs (by @mattpocock, MIT)
     codex auth             subscription
     claude model           sonnet
+    opencode enabled       false
+    opencode model         configured in opencode.json
     per-review budget      $2.00/review
 
   Impact
@@ -817,6 +833,7 @@ crosscheck status
   CLIs
     codex                  codex-cli 0.128.0
     claude                 2.1.x (Claude Code)
+    opencode               v2.x
 ```
 
 | Flag | Description |
@@ -1192,8 +1209,8 @@ vendors:
   codex:
     enabled: true
     auth: subscription      # subscription | api-key
-    model: gpt-5.6-terra    # pins the review model; unset = tier model (api-key) / CLI default (subscription)
-    effort: medium          # low | medium | high | xhigh | max | ultra (ultra: terra/sol only)
+    model: gpt-6.1-sol      # pins the review model; unset = tier model (api-key) / CLI default (subscription)
+    effort: medium          # low | medium | high | xhigh | max | ultra
     # timeout_sec: 1200     # max seconds per CLI call; unset = tier-based (300/600/1200)
 
   claude:
@@ -1202,6 +1219,16 @@ vendors:
     effort: medium          # low | medium | high | max
     # timeout_sec: 1200     # max seconds per CLI call; unset = tier-based (300/600/1200)
 
+  # Opt-in third harness; disabled by default. Its model/provider come from
+  # `opencode auth login` / opencode.json, not from a crosscheck catalog.
+  # Reasoning effort rides the `--model provider/model#variant` suffix, so
+  # `effort` applies only when `model` is also set.
+  opencode:
+    enabled: false
+    # model: provider/model   # e.g. alibaba-cn/deepseek-v4-pro; unset = opencode.json default
+    effort: high              # none | high | max
+    # timeout_sec: 1200       # max seconds per CLI call; unset = tier-based (300/600/1200)
+
 # ── Quality ───────────────────────────────────────────────────────────────────
 quality:
   # Structured findings and incremental follow-ups; set false for legacy prose reviews.
@@ -1285,12 +1312,18 @@ routing:
   claude_reviews_patterns:
     - "Generated with \\[OpenAI Codex\\]"   # Codex attribution footer
     - "Co-Authored-By: codex"               # commit trailer
+  opencode_reviews_patterns:
+    - "Generated with \\[OpenCode\\]"       # OpenCode attribution footer
+    - "Co-Authored-By: opencode"            # commit trailer
 
-  # Branch prefix detection (signal 3). Claude Code uses claude/, Codex uses codex/.
+  # Branch prefix detection (signal 3). Claude Code uses claude/, Codex uses
+  # codex/, OpenCode uses opencode/.
   claude_branch_prefixes:
     - "claude/"
   codex_branch_prefixes:
     - "codex/"
+  opencode_branch_prefixes:
+    - "opencode/"
 
   # Restrict reviews to PRs opened by these GitHub logins.
   # Auto-filled with your GitHub login by `crosscheck init` or first `crosscheck watch`.
@@ -1304,6 +1337,11 @@ routing:
   author_routes:
     your-github-login: claude   # your PRs → treated as Claude-authored → Codex reviews
 
+  # Reviewer for PRs crosscheck cannot attribute (origin: human). 'auto' = the
+  # first authenticated vendor (codex, then claude, then opencode); an explicit
+  # 'codex' | 'claude' | 'opencode' always uses that vendor; null = skip the PR.
+  fallback_reviewer: auto
+
 # ── Tunnel (watch mode only) ──────────────────────────────────────────────────
 # localhost.run (default) — SSH tunnel, zero install, URL changes on reconnect.
 # smee — stable relay via smee.io; events queued while offline.

package/get-started.zh.md

@@ -354,6 +354,10 @@ crosscheck init --config /path/to/crosscheck.config.yml
 
 ### `crosscheck onboard`
 
+交互式初始化先列出 Claude、Codex、OpenCode，标明可用、待登录或未安装；可以先勾选一个或多个想用的工具，再逐个安装、登录。向导显示将运行的命令，只有明确选择执行时才运行；也可以在另一终端处理后重新检测、跳过该工具或取消。安装和登录完成后会重新检测，保存前再次校验；跳过或尚未准备好的工具不会启用。最终保留一个工具时使用单工具模式，保留多个时使用多工具模式。已有选择会预先勾选；首次混合安装默认不勾选 OpenCode。
+
+使用 `--yes` 时不安装、不登录、不弹出工具选择，保留已有禁用设置并过滤不可用工具；没有已启用且可用的工具就停止保存。首次配置且只有 OpenCode 可用时会启用它。检测覆盖安装和已有登录/供应商配置，不代表已实际调用每个模型或验证供应商账户权限。
+
 推荐的首次配置命令，交互式引导完成七个步骤并写入可用配置。
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humanbased/crosscheck",
-  "version": "1.6.1-beta.5",
+  "version": "1.7.0-beta.25",
   "description": "AI code review pipeline that turns agent-written PRs into merge-ready patches",
   "bin": {
     "crosscheck": "dist/cli.js",