@open-cr-agent/cli 0.1.0

package/dist/review/render.js

@@ -0,0 +1,152 @@
+import { coverageGaps, serializeOutput, toReportOutput, } from "@open-cr-agent/core";
+import { forTerminal } from "./terminal.js";
+const SEVERITIES = ["critical", "warning", "suggestion"];
+const VERIFICATION = {
+    confirmed: "verified",
+    uncertain: "unverified",
+    unchecked: "not verified",
+};
+// JSON.stringify escapes C0 controls but not C1 controls or bidirectional
+// overrides, which a terminal or an editor would act on.
+export function renderJson(report) {
+    return `${safeJson(toReportOutput(report))}\n`;
+}
+export const safeJson = serializeOutput;
+export function renderText(report, sessionDir) {
+    const incomplete = report.tasks.filter((t) => t.status !== "completed");
+    const { notReviewed, nothingReviewed } = coverageGaps(report.coverage);
+    const lines = [
+        `Review: ${report.changeRequest.title}`,
+        coverageLine(report),
+        ...(nothingReviewed
+            ? ["Verdict: not reached (nothing was reviewed)"]
+            : [`Verdict: ${report.verdict.replaceAll("_", " ")}`, ...indented(report.summary, "  ")]),
+        "",
+    ];
+    if (report.findings.length === 0) {
+        lines.push(emptyMessage(report, nothingReviewed, notReviewed), "");
+    }
+    else {
+        for (const [file, findings] of groupByFile(report.findings)) {
+            lines.push(file);
+            for (const finding of findings)
+                lines.push(...renderFinding(finding));
+            lines.push("");
+        }
+    }
+    lines.push(summaryLine(report));
+    const override = report.changeRequest.override;
+    if (override && report.verdict === "significant_concerns") {
+        lines.push(`Overridden by ${override.by}: ${override.reason}`);
+    }
+    // Only true while no confirmed critical blocks, and low-confidence
+    // findings do not count at all.
+    const unverified = report.verdict === "significant_concerns"
+        ? 0
+        : report.findings.filter((f) => f.severity === "critical" && f.verification !== "confirmed" && !f.lowConfidence).length;
+    if (unverified > 0) {
+        lines.push(`${unverified} critical finding(s) are not verified, so the verdict is at most minor issues.`);
+    }
+    if (report.unverifiedCriticals > 0) {
+        lines.push(`Incomplete: verification failed or ran out of budget for ${report.unverifiedCriticals} critical finding(s); check them yourself.`);
+    }
+    const { refuted } = report;
+    if (refuted.length > 0) {
+        lines.push(`Verification dropped ${refuted.length} finding(s) the code disproves (see the JSON report).`);
+    }
+    if (report.remembered.length > 0) {
+        lines.push(`${report.remembered.length} finding(s) matched the repository's memory and were not reported.`);
+    }
+    const rereview = report.rereview;
+    if (report.scope?.mode === "incremental") {
+        lines.push(`Reviewed only what changed since ${report.scope.since.slice(0, 7)}.`);
+    }
+    else if (report.scope) {
+        lines.push(`Reviewed every file again: ${report.scope.reason}.`);
+    }
+    if (rereview) {
+        lines.push(`Since the last review: ${rereview.fixed.length} fixed, ${rereview.dismissed.length} dismissed by reviewers, ${rereview.notReproduced.length} not reported again but unchanged, ${rereview.notRechecked.length} not re-checked, ${rereview.unchanged.length} in unchanged files (still open ones count in the verdict).`);
+    }
+    const ambiguous = report.anchoring?.ambiguous ?? 0;
+    if (ambiguous > 0) {
+        lines.push(`${ambiguous} finding(s) quote code that appears in several places; shown without a line.`);
+    }
+    const judged = report.judgement;
+    if (judged && judged.merged.length + judged.dropped.length > 0) {
+        lines.push(`Judge merged ${judged.merged.length} duplicate group(s) and dropped ${judged.dropped.length} finding(s) (see the JSON report).`);
+    }
+    if (incomplete.length > 0) {
+        lines.push(`Incomplete: ${incomplete.length} of ${report.tasks.length} review task(s) did not finish.`);
+    }
+    if (notReviewed > 0) {
+        lines.push(`Incomplete: ${notReviewed} selected file(s) were not reviewed.`);
+    }
+    for (const warning of report.warnings)
+        lines.push(`Warning: ${warning}`);
+    if (sessionDir)
+        lines.push(`Session: ${sessionDir}`);
+    return forTerminal(`${lines.join("\n")}\n`);
+}
+function emptyMessage(report, nothingReviewed, notReviewed) {
+    if (nothingReviewed)
+        return "Nothing was reviewed.";
+    if (notReviewed > 0)
+        return "No issues found in the files that were reviewed.";
+    const open = report.rereview
+        ? report.rereview.notReproduced.length +
+            report.rereview.notRechecked.length +
+            report.rereview.unchanged.length
+        : 0;
+    if (open > 0)
+        return `No new issues; ${open} earlier finding(s) are still open.`;
+    if (!report.coverage.some((c) => c.status !== "excluded")) {
+        return "Nothing to review: no changed file was selected.";
+    }
+    return "No issues found.";
+}
+function coverageLine(report) {
+    const count = (status) => report.coverage.filter((c) => c.status === status).length;
+    const unreviewed = count("unreviewed");
+    return [
+        `Risk tier: ${report.tier}`,
+        `${count("reviewed")} reviewed`,
+        `${count("failed")} failed`,
+        ...(unreviewed > 0 ? [`${unreviewed} not covered by any reviewer`] : []),
+        ...(count("unchanged") > 0 ? [`${count("unchanged")} unchanged since the last review`] : []),
+        `${count("excluded")} excluded`,
+    ].join(" · ");
+}
+function renderFinding(finding) {
+    const location = finding.lineRange
+        ? finding.lineRange.start === finding.lineRange.end
+            ? `L${finding.lineRange.start}`
+            : `L${finding.lineRange.start}-${finding.lineRange.end}`
+        : "file";
+    const indent = " ".repeat(4);
+    const confidence = `${finding.lowConfidence ? " (low confidence)" : ""} [${VERIFICATION[finding.verification ?? "unchecked"]}]`;
+    const lines = [
+        `  ${finding.severity.padEnd(10)} ${location.padEnd(9)} ${finding.title}${confidence} #${finding.fingerprint.slice(0, 8)}`,
+    ];
+    lines.push(...indented(finding.body, indent));
+    if (finding.suggestion)
+        lines.push(...indented(`Suggestion: ${finding.suggestion}`, indent));
+    return lines;
+}
+function indented(text, indent) {
+    return text.split("\n").map((line) => `${indent}${line}`);
+}
+function groupByFile(findings) {
+    const groups = new Map();
+    for (const finding of [...findings].sort((a, b) => a.file.localeCompare(b.file))) {
+        const list = groups.get(finding.file) ?? [];
+        list.push(finding);
+        groups.set(finding.file, list);
+    }
+    return groups;
+}
+function summaryLine(report) {
+    const counts = SEVERITIES.map((s) => `${report.findings.filter((f) => f.severity === s).length} ${s}`);
+    const { inputTokens, cachedTokens, outputTokens, reasoningTokens, costUsd } = report.usage;
+    return `${report.findings.length} finding(s) (${counts.join(", ")}) · tokens: ${inputTokens} in (${cachedTokens} cached), ${outputTokens} out, ${reasoningTokens} reasoning · $${costUsd.toFixed(4)}`;
+}
+//# sourceMappingURL=render.js.map

package/dist/review/target.d.ts

@@ -0,0 +1,15 @@
+import type { OcraPlugin, PluginRegistry, VcsAdapter } from "@open-cr-agent/core";
+import type { PullRequestTarget, ReviewArgs } from "./args.js";
+import { type CliConfig } from "./config.js";
+export interface ReviewTarget {
+    config: CliConfig;
+    plugins: OcraPlugin[];
+    createVcs(registry: PluginRegistry): VcsAdapter;
+    readTrusted?: (path: string) => Promise<string | undefined>;
+    publish: boolean;
+}
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function localTarget(args: ReviewArgs, cwd: string, root: string, env: Env, warn: (message: string) => void, fetchImpl?: typeof fetch): Promise<ReviewTarget>;
+export declare function pullRequestTarget(pr: PullRequestTarget, cwd: string, root: string, env: Env, warn: (message: string) => void, fetchImpl?: typeof fetch, ignoreRepoConfig?: boolean): Promise<ReviewTarget>;
+export {};
+//# sourceMappingURL=target.d.ts.map

package/dist/review/target.js

@@ -0,0 +1,89 @@
+import { DEFAULT_BOT_LOGIN, GitHubApi } from "@open-cr-agent/vcs-github";
+import { ensureCommits, filesChangedSince, LocalGitAdapter } from "@open-cr-agent/vcs-local";
+import { ConfigError, loadConfig } from "./config.js";
+import { loadExternalPlugins } from "./plugins.js";
+export async function localTarget(args, cwd, root, env, warn, fetchImpl) {
+    const config = await loadConfig(root, env, {
+        repository: !args.ignoreRepoConfig,
+        warn,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    });
+    return {
+        config,
+        plugins: await loadExternalPlugins(config.plugins, root),
+        createVcs: (registry) => registry.createVcs("local", { cwd, target: args.target }),
+        ...(args.ignoreRepoConfig ? { readTrusted: untrustedTreeReader(args, cwd) } : {}),
+        publish: false,
+    };
+}
+// --no-repo-config is for code you do not trust, so the files that steer a
+// review (.ocra/memory.json can silence findings, rules and AGENTS.md shape
+// the prompts) are not taken from it either: from the base of a range, which
+// you chose, and otherwise not at all.
+function untrustedTreeReader(args, cwd) {
+    if (args.target.mode !== "range")
+        return async () => undefined;
+    const base = new LocalGitAdapter({ cwd, target: { mode: "commit", commit: args.target.from } });
+    return (path) => base.readFile(path);
+}
+// The pull request's own files are untrusted: configuration, guidelines and
+// rules come from its base commit, and repository plugins never load.
+export async function pullRequestTarget(pr, cwd, root, env, warn, fetchImpl, ignoreRepoConfig = false) {
+    const token = env.GITHUB_TOKEN ?? env.GH_TOKEN;
+    if (!token)
+        throw new ConfigError("--pr needs a GitHub token in GITHUB_TOKEN or GH_TOKEN");
+    const [owner = "", repo = ""] = (pr.repo ?? (await repositoryName(root, env))).split("/");
+    const apiOptions = { token, ...(env.GITHUB_API_URL ? { baseUrl: env.GITHUB_API_URL } : {}) };
+    const api = new GitHubApi({ owner, repo }, fetchImpl ? { ...apiOptions, fetch: fetchImpl } : apiOptions);
+    const pull = await api.getPullRequest(pr.number);
+    await ensureCommits(root, [pull.base.sha, pull.head.sha], [`pull/${pr.number}/head`]);
+    const base = new LocalGitAdapter({ cwd, target: { mode: "commit", commit: pull.base.sha } });
+    const readTrusted = (path) => base.readFile(path);
+    const config = await loadConfig(root, env, {
+        repository: !ignoreRepoConfig,
+        read: readTrusted,
+        warn,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    });
+    if (config.plugins.length > 0) {
+        warn("plugins in .ocra/config.json are not loaded for pull requests");
+    }
+    const code = new LocalGitAdapter({
+        cwd,
+        target: { mode: "range", from: pull.base.sha, to: pull.head.sha },
+    });
+    return {
+        config,
+        plugins: [],
+        createVcs: (registry) => registry.createVcs("github", {
+            owner,
+            repo,
+            number: pr.number,
+            token,
+            ...(env.GITHUB_API_URL ? { apiUrl: env.GITHUB_API_URL } : {}),
+            botLogin: config.github.botLogin ?? DEFAULT_BOT_LOGIN,
+            requestChanges: config.github.requestChanges ?? false,
+            code,
+            snapshot: pull,
+            history: {
+                filesChangedSince: (from, to) => filesChangedSince(root, from, to),
+            },
+            ...(fetchImpl ? { fetch: fetchImpl } : {}),
+        }),
+        readTrusted,
+        publish: pr.publish,
+    };
+}
+async function repositoryName(root, env) {
+    if (env.GITHUB_REPOSITORY)
+        return env.GITHUB_REPOSITORY;
+    const url = await new LocalGitAdapter({ cwd: root, target: { mode: "workspace" } })
+        .remoteUrl("origin")
+        .catch(() => undefined);
+    const match = url && /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(url);
+    if (!match?.[1]) {
+        throw new ConfigError("Cannot tell which GitHub repository this is; pass --repo owner/name");
+    }
+    return match[1];
+}
+//# sourceMappingURL=target.js.map

package/dist/review/terminal.d.ts

@@ -0,0 +1,2 @@
+export declare function forTerminal(text: string): string;
+//# sourceMappingURL=terminal.d.ts.map

package/dist/review/terminal.js

@@ -0,0 +1,12 @@
+import { isUnsafeCodePoint } from "@open-cr-agent/core";
+// Findings, commit messages and errors can carry text a diff planted; none of
+// it may drive the user's terminal. C0 and C1 controls (ANSI and OSC escapes
+// start with ESC or a C1 code) except tab and newline, carriage returns, and
+// bidirectional overrides ("Trojan Source") become U+FFFD.
+export function forTerminal(text) {
+    let out = "";
+    for (const char of text)
+        out += isUnsafeCodePoint(char.codePointAt(0) ?? 0) ? "�" : char;
+    return out;
+}
+//# sourceMappingURL=terminal.js.map

package/dist/run.d.ts

@@ -0,0 +1,6 @@
+import { type ReviewDeps } from "./review/command.js";
+import type { Output } from "./review/progress.js";
+export declare const VERSION: string;
+export declare function defaultDeps(): ReviewDeps;
+export declare function run(argv: string[], out: Output, err: Output, deps?: ReviewDeps): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.js

@@ -0,0 +1,101 @@
+import { writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { parseArgs } from "node:util";
+import { errorMessage } from "@open-cr-agent/core";
+import { memoryCommand } from "./memory.js";
+import { parseReviewArgs, REVIEW_USAGE, UsageError } from "./review/args.js";
+import { BUILTIN_PLUGINS, EXIT, reviewCommand } from "./review/command.js";
+import { forTerminal } from "./review/terminal.js";
+// src/ and dist/ both sit one level below the package root.
+export const VERSION = createRequire(import.meta.url)("../package.json").version;
+const USAGE = `Usage: ocra <command> [options]
+
+Commands:
+  review      Review code changes (run "ocra review --help" for options)
+  memory      Remember findings the team accepts (run "ocra memory --help")
+
+Options:
+  -h, --help     Show help
+  -v, --version  Show version
+`;
+export function defaultDeps() {
+    return {
+        cwd: process.cwd(),
+        env: process.env,
+        builtinPlugins: BUILTIN_PLUGINS,
+        writeFile: (path, content) => writeFile(path, content, "utf8"),
+        now: Date.now,
+        heartbeatMs: 30_000,
+        onInterrupt(handler) {
+            let signals = 0;
+            const listener = () => {
+                signals += 1;
+                if (signals > 1)
+                    process.exit(EXIT.interrupted);
+                handler();
+            };
+            process.on("SIGINT", listener);
+            process.on("SIGTERM", listener);
+            return () => {
+                process.off("SIGINT", listener);
+                process.off("SIGTERM", listener);
+            };
+        },
+    };
+}
+export async function run(argv, out, err, deps = defaultDeps()) {
+    const [command, ...rest] = argv;
+    if (command === "review")
+        return review(rest, out, err, deps);
+    if (command === "memory") {
+        try {
+            return await memoryCommand(rest, out, deps.cwd);
+        }
+        catch (error) {
+            err.write(`ocra: ${forTerminal(errorMessage(error))}\n`);
+            return EXIT.error;
+        }
+    }
+    if (command !== undefined && !command.startsWith("-")) {
+        err.write(`Unknown command: ${command}\n\n${USAGE}`);
+        return EXIT.error;
+    }
+    let values;
+    try {
+        values = parseArgs({
+            args: argv,
+            strict: true,
+            options: { help: { type: "boolean", short: "h" }, version: { type: "boolean", short: "v" } },
+        }).values;
+    }
+    catch (error) {
+        err.write(`${errorMessage(error)}\n\n${USAGE}`);
+        return EXIT.error;
+    }
+    if (values.version) {
+        out.write(`${VERSION}\n`);
+        return EXIT.ok;
+    }
+    out.write(USAGE);
+    return EXIT.ok;
+}
+async function review(argv, out, err, deps) {
+    try {
+        const args = parseReviewArgs(argv);
+        if (args === "help") {
+            out.write(REVIEW_USAGE);
+            return EXIT.ok;
+        }
+        return await reviewCommand(args, { out, err }, deps);
+    }
+    catch (error) {
+        if (error instanceof UsageError) {
+            err.write(`${error.message}\n\n${REVIEW_USAGE}`);
+        }
+        else {
+            err.write(`ocra: ${forTerminal(errorMessage(error))}\n`);
+        }
+        return EXIT.error;
+    }
+}
+//# sourceMappingURL=run.js.map

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@open-cr-agent/cli",
+  "version": "0.1.0",
+  "description": "ocra: open-source multi-agent code review for local changes and GitHub pull requests",
+  "keywords": [
+    "code-review",
+    "cli",
+    "llm",
+    "agents",
+    "github-action"
+  ],
+  "license": "Apache-2.0",
+  "homepage": "https://ocra.majincheng.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jma49/Open-CR-Agent.git",
+    "directory": "packages/cli"
+  },
+  "bugs": "https://github.com/jma49/Open-CR-Agent/issues",
+  "engines": {
+    "node": ">=22.19"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "ocra": "./dist/main.js"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "dependencies": {
+    "@open-cr-agent/core": "0.1.0",
+    "@open-cr-agent/runtime-opencode": "0.1.0",
+    "@open-cr-agent/vcs-github": "0.1.0",
+    "@open-cr-agent/vcs-local": "0.1.0",
+    "zod": "^4.6.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}