@open-cr-agent/cli 0.1.1 → 0.2.0

package/dist/review/args.d.ts

@@ -1,13 +1,19 @@
 import type { LocalTarget } from "@open-cr-agent/vcs-local";
-export type OutputFormat = "text" | "json";
+export type OutputFormat = "text" | "json" | "sarif";
 export interface PullRequestTarget {
     number: number;
     repo?: string;
     publish: boolean;
 }
+export interface MergeRequestTarget {
+    iid: number;
+    project?: string;
+    publish: boolean;
+}
 export interface ReviewArgs {
     target: LocalTarget;
     pullRequest?: PullRequestTarget;
+    mergeRequest?: MergeRequestTarget;
     format: OutputFormat;
     output?: string;
     ignoreRepoConfig?: true;
@@ -19,6 +25,6 @@ export interface ReviewArgs {
 }
 export declare class UsageError extends Error {
 }
-export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --publish          With --pr: post the review to the pull request\n  --full             With --pr: review every file, not only what changed since\n                     the previous review\n  --format <format>  text (default) or json\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables\n  -h, --help         Show help\n";
+export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables\n  -h, --help         Show help\n";
 export declare function parseReviewArgs(argv: string[]): ReviewArgs | "help";
 //# sourceMappingURL=args.d.ts.map

package/dist/review/args.js

@@ -11,10 +11,12 @@ Options:
   --commit <sha>     Review a single commit
   --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)
   --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)
-  --publish          With --pr: post the review to the pull request
-  --full             With --pr: review every file, not only what changed since
-                     the previous review
-  --format <format>  text (default) or json
+  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)
+  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)
+  --publish          With --pr or --mr: post the review to it
+  --full             With --pr or --mr: review every file, not only what
+                     changed since the previous review
+  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)
   --output <file>    Write the result to a file instead of stdout
   --reviewers <ids>  Run only these reviewers (comma-separated)
   --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest
@@ -38,13 +40,21 @@ export function parseReviewArgs(argv) {
     if (positionals.length > 0)
         throw new UsageError(`Unexpected argument: ${positionals[0]}`);
     const format = values.format ?? "text";
-    if (format !== "text" && format !== "json") {
-        throw new UsageError(`--format must be text or json, got ${format}`);
+    if (format !== "text" && format !== "json" && format !== "sarif") {
+        throw new UsageError(`--format must be text, json or sarif, got ${format}`);
     }
     const args = { target: target(values), format };
     const pullRequest = pullRequestTarget(values);
+    const mergeRequest = mergeRequestTarget(values);
+    if (pullRequest && mergeRequest)
+        throw new UsageError("--pr cannot be combined with --mr");
+    if (!pullRequest && !mergeRequest && values.publish) {
+        throw new UsageError("--publish requires --pr or --mr");
+    }
     if (pullRequest)
         args.pullRequest = pullRequest;
+    if (mergeRequest)
+        args.mergeRequest = mergeRequest;
     if (values.output !== undefined)
         args.output = values.output;
     if (values["no-repo-config"])
@@ -52,13 +62,15 @@ export function parseReviewArgs(argv) {
     if (values.ultra)
         args.ultra = true;
     if (values.full) {
-        if (!pullRequest)
-            throw new UsageError("--full needs --pr");
+        if (!pullRequest && !mergeRequest)
+            throw new UsageError("--full needs --pr or --mr");
         args.full = true;
     }
     if (values.plan) {
         if (values.publish)
             throw new UsageError("--plan cannot be combined with --publish");
+        if (format === "sarif")
+            throw new UsageError("--plan has no findings for --format sarif");
         args.plan = true;
     }
     if (values["max-cost-usd"] !== undefined) {
@@ -97,6 +109,8 @@ function parse(argv) {
             plan: { type: "boolean" },
             pr: { type: "string" },
             repo: { type: "string" },
+            mr: { type: "string" },
+            project: { type: "string" },
             publish: { type: "boolean" },
             help: { type: "boolean", short: "h" },
         },
@@ -104,8 +118,6 @@ function parse(argv) {
 }
 function pullRequestTarget(values) {
     if (values.pr === undefined) {
-        if (values.publish)
-            throw new UsageError("--publish requires --pr");
         if (values.repo !== undefined)
             throw new UsageError("--repo requires --pr");
         return undefined;
@@ -125,6 +137,29 @@ function pullRequestTarget(values) {
         target.repo = values.repo;
     return target;
 }
+// A GitLab project is a numeric id or a full path, "group/sub/project".
+const PROJECT = /^(\d+|[\w.-]+(\/[\w.-]+)+)$/;
+function mergeRequestTarget(values) {
+    if (values.mr === undefined) {
+        if (values.project !== undefined)
+            throw new UsageError("--project requires --mr");
+        return undefined;
+    }
+    if (values.from !== undefined || values.to !== undefined || values.commit !== undefined) {
+        throw new UsageError("--mr cannot be combined with --from, --to or --commit");
+    }
+    const iid = Number(values.mr);
+    if (!Number.isInteger(iid) || iid <= 0) {
+        throw new UsageError(`--mr must be a merge request number, got ${values.mr}`);
+    }
+    if (values.project !== undefined && !PROJECT.test(values.project)) {
+        throw new UsageError(`--project must be a project id or group/project, got ${values.project}`);
+    }
+    const target = { iid, publish: values.publish === true };
+    if (values.project !== undefined)
+        target.project = values.project;
+    return target;
+}
 function target(values) {
     if (values.commit !== undefined) {
         if (values.from !== undefined || values.to !== undefined) {

package/dist/review/command.js

@@ -2,18 +2,22 @@ import { join, relative, resolve } from "node:path";
 import { agentsMdReviewerPlugin, correctnessReviewerPlugin, coverageGaps, defaultSelectionPolicy, docsReviewerPlugin, newSessionId, performanceReviewerPlugin, previewReview, runReview, securityReviewerPlugin, sessionJsonlPlugin, startPlugins, toPlanOutput, } from "@open-cr-agent/core";
 import { opencodeRuntimePlugin } from "@open-cr-agent/runtime-opencode";
 import { githubPlugin } from "@open-cr-agent/vcs-github";
+import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
 import { findRepositoryRoot, localGitPlugin } from "@open-cr-agent/vcs-local";
+import { VERSION } from "../version.js";
 import { ConfigError } from "./config.js";
 import { renderPlan } from "./plan-render.js";
 import { ProgressPrinter } from "./progress.js";
 import { renderJson, renderText, safeJson } from "./render.js";
-import { localTarget, pullRequestTarget } from "./target.js";
+import { renderSarif } from "./sarif.js";
+import { localTarget, mergeRequestTarget, pullRequestTarget } from "./target.js";
 import { forTerminal } from "./terminal.js";
 export const SESSIONS_DIR = ".ocra/sessions";
 export const EXIT = { ok: 0, blocking: 1, error: 2, incomplete: 3, interrupted: 130 };
 export const BUILTIN_PLUGINS = [
     localGitPlugin,
     githubPlugin,
+    gitlabPlugin,
     opencodeRuntimePlugin,
     correctnessReviewerPlugin,
     securityReviewerPlugin,
@@ -25,9 +29,12 @@ export const BUILTIN_PLUGINS = [
 export async function reviewCommand(args, io, deps) {
     const root = await findRepositoryRoot(deps.cwd);
     const warn = (message) => io.err.write(`[ocra] Warning: ${forTerminal(message)}\n`);
+    const ignoreRepoConfig = args.ignoreRepoConfig === true;
     const target = args.pullRequest
-        ? await pullRequestTarget(args.pullRequest, deps.cwd, root, deps.env, warn, deps.fetch, args.ignoreRepoConfig === true)
-        : await localTarget(args, deps.cwd, root, deps.env, warn, deps.fetch);
+        ? await pullRequestTarget(args.pullRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig)
+        : args.mergeRequest
+            ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig)
+            : await localTarget(args, deps.cwd, root, deps.env, warn, deps.fetch);
     const { config } = target;
     const session = { dir: join(root, SESSIONS_DIR), id: newSessionId() };
     // A plan calls no model and writes no session log.
@@ -61,7 +68,11 @@ export async function reviewCommand(args, io, deps) {
             await deps.writeFile(resolve(deps.cwd, args.output), rendered);
         return EXIT.ok;
     }
-    const runtime = registry.createRuntime(config.runtime, { models: config.models, env: deps.env });
+    const runtime = registry.createRuntime(config.runtime, {
+        models: config.models,
+        env: deps.env,
+        providers: config.providers,
+    });
     const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
     const interrupt = new AbortController();
     const stopListening = deps.onInterrupt?.(() => {
@@ -94,7 +105,11 @@ export async function reviewCommand(args, io, deps) {
         await runtime.dispose?.();
     }
     const sessionDir = relative(deps.cwd, join(session.dir, session.id)) || ".";
-    const rendered = args.format === "json" ? renderJson(report) : renderText(report, sessionDir);
+    const rendered = args.format === "json"
+        ? renderJson(report)
+        : args.format === "sarif"
+            ? renderSarif(report, VERSION)
+            : renderText(report, sessionDir);
     if (args.output === undefined) {
         io.out.write(rendered);
     }
@@ -118,7 +133,7 @@ export async function reviewCommand(args, io, deps) {
         finally {
             stopHolding?.();
         }
-        io.err.write("[ocra] Published the review to the pull request\n");
+        io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
     }
     return exitCode(report, io.err);
 }
@@ -165,7 +180,7 @@ function exitCode(report, err) {
     // Incomplete comes first, even over a blocking verdict: the action lets
     // exit 1 pass unless fail-on-concerns is set, and a review that missed
     // files or could not check a critical finding must never pass.
-    const { notReviewed } = coverageGaps(report.coverage);
+    const { notReviewed } = coverageGaps(report);
     if (notReviewed > 0) {
         err.write(`[ocra] ${notReviewed} selected file(s) were not reviewed; the review is incomplete.\n`);
         return EXIT.incomplete;

package/dist/review/config.d.ts

@@ -1,4 +1,4 @@
-import { type ModelChains, type RepoRule } from "@open-cr-agent/core";
+import { type CustomProvider, type ModelChains, type RepoRule } from "@open-cr-agent/core";
 import { z } from "zod";
 export declare const CONFIG_PATH = ".ocra/config.json";
 declare const configSchema: z.ZodObject<{
@@ -31,10 +31,21 @@ declare const configSchema: z.ZodObject<{
         }>>;
     }, z.core.$strict>>>;
     pluginSettings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodLiteral<"openai-compatible">;
+        baseUrl: z.ZodURL;
+        apiKeyEnv: z.ZodOptional<z.ZodString>;
+        models: z.ZodRecord<z.ZodString, z.ZodObject<{
+            input: z.ZodNumber;
+            output: z.ZodNumber;
+            cachedInput: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     extends: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models"> & {
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "providers"> & {
     models: ModelChains;
+    providers: Record<string, CustomProvider>;
     rules: RepoRule[];
 };
 export interface LoadOptions {

package/dist/review/config.js

@@ -7,6 +7,40 @@ export const CONFIG_PATH = ".ocra/config.json";
 const modelChain = z
     .union([z.string().min(1), z.array(z.string().min(1)).min(1)])
     .transform((value) => (typeof value === "string" ? [value] : value));
+// Where review code is sent: over https, or plain http only to this machine.
+// OpenCode replaces {env:NAME} and {file:path} anywhere in its configuration,
+// so an address with braces could carry a variable or a file (the checkout's
+// .git/config holds its token) to the endpoint.
+const endpoint = z
+    .url()
+    .refine((value) => {
+    const url = new URL(value);
+    if (url.protocol === "https:")
+        return true;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    return (url.protocol === "http:" &&
+        (host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host)));
+}, "must be an https URL, or http on this machine (localhost, 127.0.0.1, ::1)")
+    .refine((value) => !/[{}]/.test(value), "must not contain { or }");
+// The platforms' and clouds' credentials never go to a model endpoint; the
+// same prefixes are never passed to the runtime by prefix (server-env.ts).
+const PLATFORM_TOKENS = /^(GITHUB_|GH_|GITLAB_|CI_|ACTIONS_|RUNNER_|AWS_|AZURE_|NPM_|SSH_|OCRA_)/;
+const price = z.number().min(0).max(10_000);
+const providerSchema = z
+    .object({
+    type: z.literal("openai-compatible"),
+    baseUrl: endpoint,
+    apiKeyEnv: z
+        .string()
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be an environment variable name")
+        .refine((name) => !PLATFORM_TOKENS.test(name), "must not name a platform or cloud credential")
+        .optional(),
+    // Prices in US dollars per million tokens; 0 means unpriced.
+    models: z
+        .record(z.string().regex(/^[\w./:@-]{1,200}$/), z.object({ input: price, output: price, cachedInput: price.optional() }).strict())
+        .refine((models) => Object.keys(models).length > 0, "must list at least one model"),
+})
+    .strict();
 const configSchema = z
     .object({
     models: z
@@ -40,6 +74,7 @@ const configSchema = z
         .strict())
         .default({}),
     pluginSettings: z.record(z.string(), z.unknown()).default({}),
+    providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
     extends: z.string().min(1).optional(),
 })
     .strict();
@@ -70,7 +105,36 @@ export async function loadConfig(root, env, options = { repository: true }) {
         if (chain.length > 0)
             models[tier] = chain;
     }
-    return { ...parsed, models, rules };
+    for (const model of unpriced(parsed.providers, models)) {
+        options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
+    }
+    return { ...parsed, models, providers: toProviders(parsed.providers), rules };
+}
+function toProviders(declared) {
+    return Object.fromEntries(Object.entries(declared).map(([id, p]) => [
+        id,
+        {
+            baseUrl: p.baseUrl,
+            ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}),
+            models: Object.fromEntries(Object.entries(p.models).map(([model, price]) => [
+                model,
+                {
+                    input: price.input,
+                    output: price.output,
+                    ...(price.cachedInput === undefined ? {} : { cachedInput: price.cachedInput }),
+                },
+            ])),
+        },
+    ]));
+}
+// Models of declared providers, named in a chain, priced at 0 per token.
+function unpriced(providers, models) {
+    const named = new Set(Object.values(models).flat());
+    return [...named].filter((model) => {
+        const slash = model.indexOf("/");
+        const price = providers[model.slice(0, slash)]?.models[model.slice(slash + 1)];
+        return price !== undefined && price.input === 0 && price.output === 0;
+    });
 }
 // The user's own checkout, read like any local file (links followed): unlike
 // the review's reads, which never follow links (vcs-local), this is trusted

package/dist/review/remote-config.d.ts

@@ -16,6 +16,7 @@ export declare const remoteConfigSchema: z.ZodObject<{
     exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
     reviewers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     github: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
         path: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
         rule: z.ZodString;

package/dist/review/remote-config.js

@@ -3,8 +3,9 @@ import { repoRuleSchema } from "@open-cr-agent/core";
 import { z } from "zod";
 const MAX_BYTES = 256 * 1024;
 const TIMEOUT_MS = 10_000;
-// What a shared configuration may set: settings and rules, never plugins or
-// a runtime, because it is fetched from outside the repository.
+// What a shared configuration may set: settings, rules and model providers
+// (a company gateway, for example), never plugins or a runtime, because it
+// is fetched from outside the repository.
 export const remoteConfigSchema = z
     .object({
     models: z.record(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
@@ -19,6 +20,7 @@ export const remoteConfigSchema = z
     exclude: z.array(z.string()).optional(),
     reviewers: z.record(z.string(), z.unknown()).optional(),
     github: z.record(z.string(), z.unknown()).optional(),
+    providers: z.record(z.string(), z.unknown()).optional(),
     rules: z.array(repoRuleSchema).max(500).optional(),
 })
     .strict();
@@ -47,6 +49,12 @@ export async function fetchRemoteConfig(spec, fetchImpl = fetch) {
     const parsed = remoteConfigSchema.safeParse(JSON.parse(body));
     if (!parsed.success)
         throw new Error(`${url.href} is invalid: ${z.prettifyError(parsed.error)}`);
+    // A provider decides where the code under review goes: unpinned, whoever
+    // serves the file could send it to an endpoint of their choosing.
+    if (pinned === undefined && Object.keys(parsed.data.providers ?? {}).length > 0) {
+        const digest = createHash("sha256").update(body).digest("hex");
+        throw new Error(`${url.href} declares providers, which a shared configuration may do only when pinned; check its content, then extend "${address}#sha256=${digest}"`);
+    }
     return parsed.data;
 }
 // Stops reading at the limit instead of buffering whatever the server sends.
@@ -73,7 +81,7 @@ async function readLimited(response, limit, name) {
 export function mergeConfig(remote, local) {
     const { rules: _rules, ...settings } = remote;
     const merged = { ...settings, ...local };
-    for (const key of ["models", "reviewers", "github"]) {
+    for (const key of ["models", "reviewers", "github", "providers"]) {
         const a = settings[key];
         const b = local[key];
         if (a !== undefined || b !== undefined)

package/dist/review/render.js

@@ -14,7 +14,7 @@ export function renderJson(report) {
 export const safeJson = serializeOutput;
 export function renderText(report, sessionDir) {
     const incomplete = report.tasks.filter((t) => t.status !== "completed");
-    const { notReviewed, nothingReviewed } = coverageGaps(report.coverage);
+    const { notReviewed, nothingReviewed } = coverageGaps(report);
     const lines = [
         `Review: ${report.changeRequest.title}`,
         coverageLine(report),
@@ -79,7 +79,10 @@ export function renderText(report, sessionDir) {
         lines.push(`Incomplete: ${incomplete.length} of ${report.tasks.length} review task(s) did not finish.`);
     }
     if (notReviewed > 0) {
-        lines.push(`Incomplete: ${notReviewed} selected file(s) were not reviewed.`);
+        const limit = report.spendLimit?.reached
+            ? `; the spend limit of $${report.spendLimit.usd} was reached`
+            : "";
+        lines.push(`Incomplete: ${notReviewed} selected file(s) were not reviewed${limit}.`);
     }
     for (const warning of report.warnings)
         lines.push(`Warning: ${warning}`);
@@ -111,7 +114,7 @@ function coverageLine(report) {
         `Risk tier: ${report.tier}`,
         `${count("reviewed")} reviewed`,
         `${count("failed")} failed`,
-        ...(unreviewed > 0 ? [`${unreviewed} not covered by any reviewer`] : []),
+        ...(unreviewed > 0 ? [`${unreviewed} not started`] : []),
         ...(count("unchanged") > 0 ? [`${count("unchanged")} unchanged since the last review`] : []),
         `${count("excluded")} excluded`,
     ].join(" · ");
@@ -147,6 +150,12 @@ function groupByFile(findings) {
 function summaryLine(report) {
     const counts = SEVERITIES.map((s) => `${report.findings.filter((f) => f.severity === s).length} ${s}`);
     const { inputTokens, cachedTokens, outputTokens, reasoningTokens, costUsd } = report.usage;
-    return `${report.findings.length} finding(s) (${counts.join(", ")}) · tokens: ${inputTokens} in (${cachedTokens} cached), ${outputTokens} out, ${reasoningTokens} reasoning · $${costUsd.toFixed(4)}`;
+    return `${report.findings.length} finding(s) (${counts.join(", ")}) · tokens: ${inputTokens} in (${cachedTokens} cached), ${outputTokens} out, ${reasoningTokens} reasoning · $${costUsd.toFixed(4)}${spendLimit(report)}`;
+}
+function spendLimit(report) {
+    const limit = report.spendLimit;
+    if (!limit)
+        return "";
+    return ` of $${limit.usd}${limit.reached ? " (limit reached)" : ""}`;
 }
 //# sourceMappingURL=render.js.map

package/dist/review/sarif.d.ts

@@ -0,0 +1,4 @@
+import { type ReviewReport } from "@open-cr-agent/core";
+export declare function renderSarif(report: ReviewReport, version: string): string;
+export declare function plainText(text: string): string;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/review/sarif.js

@@ -0,0 +1,147 @@
+import { coverageGaps, serializeOutput, } from "@open-cr-agent/core";
+// `--format sarif`: the review as a SARIF 2.1.0 log, for code scanning and
+// security dashboards. One rule per reviewer category, one result per
+// finding. Findings an earlier review reported in files this run did not
+// review again stay open, so they are results too, marked unchanged.
+// https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+const SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
+const LEVEL = {
+    critical: "error",
+    warning: "warning",
+    suggestion: "note",
+};
+export function renderSarif(report, version) {
+    const open = [
+        ...(report.rereview?.unchanged ?? []),
+        ...(report.rereview?.notReproduced ?? []),
+        ...(report.rereview?.notRechecked ?? []),
+    ];
+    const categories = [
+        ...new Set([...report.findings.map((f) => f.category), ...(open.length > 0 ? [CARRIED] : [])]),
+    ].sort();
+    const index = new Map(categories.map((c, i) => [c, i]));
+    const { notReviewed } = coverageGaps(report);
+    const log = {
+        $schema: SCHEMA,
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "ocra",
+                        informationUri: "https://ocra.majincheng.com",
+                        version,
+                        semanticVersion: version,
+                        rules: categories.map((id) => ({
+                            id,
+                            name: id,
+                            shortDescription: {
+                                text: id === CARRIED ? CARRIED_DESCRIPTION : `Findings of ocra's ${id} reviewer`,
+                            },
+                            properties: { tags: [id] },
+                        })),
+                    },
+                },
+                invocations: [
+                    {
+                        executionSuccessful: notReviewed === 0 && report.unverifiedCriticals === 0,
+                        toolExecutionNotifications: [
+                            ...(notReviewed > 0
+                                ? [
+                                    {
+                                        level: "warning",
+                                        message: { text: `${notReviewed} selected file(s) were not reviewed` },
+                                    },
+                                ]
+                                : []),
+                            ...report.warnings.map((w) => ({
+                                level: "warning",
+                                message: { text: plainText(w) },
+                            })),
+                        ],
+                    },
+                ],
+                results: [
+                    ...report.findings.map((f) => fromFinding(f, index)),
+                    ...open.map((f) => fromPrior(f, index)),
+                ],
+                properties: {
+                    verdict: report.verdict,
+                    tier: report.tier,
+                    baseSha: report.changeRequest.baseSha,
+                    headSha: report.changeRequest.headSha,
+                    notReviewed: report.coverage
+                        .filter((c) => c.status === "failed" || c.status === "unreviewed")
+                        .map((c) => c.path),
+                    unverifiedCriticals: report.unverifiedCriticals,
+                    costUsd: report.usage.costUsd,
+                },
+            },
+        ],
+    };
+    return `${serializeOutput(log)}\n`;
+}
+// Open findings an earlier review reported, carried over under their own
+// rule: their reviewer category is not recorded in the review state.
+const CARRIED = "ocra-carried-over";
+const CARRIED_DESCRIPTION = "Findings an earlier review reported that are still open in files this run did not review again";
+function fromFinding(f, index) {
+    const text = [f.title, f.body, ...(f.suggestion ? [`Suggestion: ${f.suggestion}`] : [])].join("\n\n");
+    return {
+        ruleId: f.category,
+        ruleIndex: index.get(f.category) ?? 0,
+        level: LEVEL[f.severity],
+        message: { text: plainText(text) },
+        locations: [location(f.file, f.lineRange)],
+        partialFingerprints: { "ocra/v1": f.fingerprint },
+        properties: {
+            reviewer: f.reviewer,
+            severity: f.severity,
+            verification: f.verification ?? "unchecked",
+            status: f.status === "unfixed" ? "unfixed" : "new",
+            ...(f.lowConfidence ? { lowConfidence: true } : {}),
+        },
+    };
+}
+function fromPrior(f, index) {
+    return {
+        ruleId: CARRIED,
+        ruleIndex: index.get(CARRIED) ?? 0,
+        level: LEVEL[f.severity],
+        message: { text: plainText(f.title) },
+        // The review state keeps no lines for them, so they apply to the file.
+        locations: [location(f.file)],
+        partialFingerprints: { "ocra/v1": f.fingerprint },
+        baselineState: "unchanged",
+        properties: { severity: f.severity, verification: f.verification ?? "unchecked" },
+    };
+}
+function location(file, lines) {
+    return {
+        physicalLocation: {
+            // Each segment percent-encoded: a path may hold "#", "?" or spaces,
+            // which a URI would read as a fragment, a query or an error.
+            artifactLocation: {
+                uri: file.split("/").map(encodeURIComponent).join("/"),
+                uriBaseId: "%SRCROOT%",
+            },
+            ...(lines ? { region: { startLine: lines.start, endLine: lines.end } } : {}),
+        },
+    };
+}
+// SARIF viewers turn "[text](target)" in a message into a link (SARIF
+// 3.11.6), and some turn bare web addresses into links too. Text from a
+// reviewed change or a model must do neither: every backslash and bracket is
+// escaped, backslashes first so a planted "\[" cannot undo the escape, and
+// web addresses get a zero-width space in their scheme or after "www", as in
+// pull request comments (vcs-platform's safeMarkdown, which also handles
+// markup SARIF text does not have). Braces are doubled, since "{0}" is a
+// placeholder (SARIF 3.11.5); GitHub shows "{{" as "{".
+export function plainText(text) {
+    return text
+        .replace(/[\\[\]]/g, (c) => `\\${c}`)
+        .replace(/[{}]/g, (c) => c + c)
+        .replace(/\b(https?|ftp)(?=:\/\/)/gi, "$1​")
+        .replace(/\bwww(?=\.)/gi, "www​");
+}
+//# sourceMappingURL=sarif.js.map

package/dist/review/target.d.ts

@@ -1,5 +1,5 @@
 import type { OcraPlugin, PluginRegistry, VcsAdapter } from "@open-cr-agent/core";
-import type { PullRequestTarget, ReviewArgs } from "./args.js";
+import type { MergeRequestTarget, PullRequestTarget, ReviewArgs } from "./args.js";
 import { type CliConfig } from "./config.js";
 export interface ReviewTarget {
     config: CliConfig;
@@ -7,9 +7,11 @@ export interface ReviewTarget {
     createVcs(registry: PluginRegistry): VcsAdapter;
     readTrusted?: (path: string) => Promise<string | undefined>;
     publish: boolean;
+    publishesTo?: string;
 }
 type Env = Readonly<Record<string, string | undefined>>;
 export declare function localTarget(args: ReviewArgs, cwd: string, root: string, env: Env, warn: (message: string) => void, fetchImpl?: typeof fetch): Promise<ReviewTarget>;
 export declare function pullRequestTarget(pr: PullRequestTarget, cwd: string, root: string, env: Env, warn: (message: string) => void, fetchImpl?: typeof fetch, ignoreRepoConfig?: boolean): Promise<ReviewTarget>;
+export declare function mergeRequestTarget(mr: MergeRequestTarget, cwd: string, root: string, env: Env, warn: (message: string) => void, fetchImpl?: typeof fetch, ignoreRepoConfig?: boolean): Promise<ReviewTarget>;
 export {};
 //# sourceMappingURL=target.d.ts.map

package/dist/review/target.js

@@ -1,4 +1,5 @@
 import { DEFAULT_BOT_LOGIN, GitHubApi } from "@open-cr-agent/vcs-github";
+import { GitLabApi } from "@open-cr-agent/vcs-gitlab";
 import { ensureCommits, filesChangedSince, LocalGitAdapter } from "@open-cr-agent/vcs-local";
 import { ConfigError, loadConfig } from "./config.js";
 import { loadExternalPlugins } from "./plugins.js";
@@ -72,8 +73,117 @@ export async function pullRequestTarget(pr, cwd, root, env, warn, fetchImpl, ign
         }),
         readTrusted,
         publish: pr.publish,
+        publishesTo: "pull request",
     };
 }
+const GITLAB_API = "https://gitlab.com/api/v4";
+// Like a pull request: configuration, guidelines and rules come from the
+// target branch the merge request was based on, and repository plugins never
+// load. GitLab CI sets CI_API_V4_URL and CI_PROJECT_ID; GITLAB_TOKEN must be
+// a token that may write notes, which CI_JOB_TOKEN may not.
+export async function mergeRequestTarget(mr, cwd, root, env, warn, fetchImpl, ignoreRepoConfig = false) {
+    const token = env.GITLAB_TOKEN;
+    if (!token) {
+        throw new ConfigError("--mr needs a GitLab token in GITLAB_TOKEN: a project access token with the api scope and the Developer role (CI_JOB_TOKEN cannot post comments)");
+    }
+    const origin = await originUrl(root);
+    const project = mr.project ?? env.CI_PROJECT_ID ?? gitlabProject(origin);
+    const apiUrl = gitlabApi(env.CI_API_V4_URL, remoteHost(origin), warn);
+    const api = new GitLabApi(project, {
+        token,
+        baseUrl: apiUrl,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    });
+    const merge = await api.getMergeRequest(mr.iid);
+    const refs = merge.diff_refs;
+    if (!refs)
+        throw new ConfigError(`merge request !${mr.iid} has no diff yet; try again shortly`);
+    await ensureCommits(root, [refs.start_sha, refs.head_sha], [`refs/merge-requests/${mr.iid}/head`]);
+    const base = new LocalGitAdapter({ cwd, target: { mode: "commit", commit: refs.start_sha } });
+    const readTrusted = (path) => base.readFile(path);
+    const config = await loadConfig(root, env, {
+        repository: !ignoreRepoConfig,
+        read: readTrusted,
+        warn,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    });
+    if (config.plugins.length > 0) {
+        warn("plugins in .ocra/config.json are not loaded for merge requests");
+    }
+    const code = new LocalGitAdapter({
+        cwd,
+        target: { mode: "range", from: refs.start_sha, to: refs.head_sha },
+    });
+    return {
+        config,
+        plugins: [],
+        createVcs: (registry) => registry.createVcs("gitlab", {
+            project: /^\d+$/.test(project) ? Number(project) : project,
+            iid: mr.iid,
+            token,
+            apiUrl,
+            code,
+            snapshot: merge,
+            history: {
+                filesChangedSince: (from, to) => filesChangedSince(root, from, to),
+            },
+            ...(fetchImpl ? { fetch: fetchImpl } : {}),
+        }),
+        readTrusted,
+        publish: mr.publish,
+        publishesTo: "merge request",
+    };
+}
+function originUrl(root) {
+    return new LocalGitAdapter({ cwd: root, target: { mode: "workspace" } })
+        .remoteUrl("origin")
+        .catch(() => undefined);
+}
+// Where GITLAB_TOKEN goes: to CI_API_V4_URL, which GitLab CI sets, or else
+// to gitlab.com, but only when origin is there too or is no remote host. A
+// token for a self-managed instance must not travel to gitlab.com because
+// the address was left out.
+function gitlabApi(configured, origin, warn) {
+    if (configured) {
+        const api = remoteHost(configured);
+        if (api && origin && site(api) !== site(origin)) {
+            warn(`CI_API_V4_URL is on ${api} but origin is on ${origin}; GITLAB_TOKEN goes to ${api}`);
+        }
+        return configured;
+    }
+    if (origin && site(origin) !== "gitlab.com") {
+        throw new ConfigError(`origin is on ${origin}, not gitlab.com: set CI_API_V4_URL to its API, such as https://${origin}/api/v4, so that GITLAB_TOKEN goes only there`);
+    }
+    return GITLAB_API;
+}
+// GitLab.com answers on subdomains too, such as altssh.gitlab.com for SSH.
+function site(host) {
+    return host === "gitlab.com" || host.endsWith(".gitlab.com") ? "gitlab.com" : host;
+}
+// The host of https://host/…, ssh://user@host:port/… or user@host:path; none
+// for a local path, including C:\ on Windows.
+function remoteHost(url) {
+    if (!url)
+        return undefined;
+    if (/^[\w+.-]+:\/\//.test(url)) {
+        try {
+            const parsed = new URL(url);
+            return parsed.protocol === "file:" ? undefined : parsed.hostname.toLowerCase() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return /^(?:[^@\s/]+@)?([^:/\s\\]+):(?![\\/])/.exec(url)?.[1]?.toLowerCase();
+}
+// The project behind the origin remote: any host, since GitLab runs on many.
+function gitlabProject(url) {
+    const match = url && /^(?:[\w+.-]+:\/\/[^/]+\/|[^@\s]+@[^:]+:)(.+?)(?:\.git)?\/?$/.exec(url);
+    if (!match?.[1]) {
+        throw new ConfigError("Cannot tell which GitLab project this is; pass --project <id|path>");
+    }
+    return match[1];
+}
 async function repositoryName(root, env) {
     if (env.GITHUB_REPOSITORY)
         return env.GITHUB_REPOSITORY;

package/dist/run.d.ts

@@ -1,6 +1,5 @@
 import { type ReviewDeps } from "./review/command.js";
 import type { Output } from "./review/progress.js";
-export declare const VERSION: string;
 export declare function defaultDeps(): ReviewDeps;
 export declare function run(argv: string[], out: Output, err: Output, deps?: ReviewDeps): Promise<number>;
 //# sourceMappingURL=run.d.ts.map

package/dist/run.js

@@ -1,13 +1,11 @@
 import { writeFile } from "node:fs/promises";
-import { createRequire } from "node:module";
 import { parseArgs } from "node:util";
 import { errorMessage } from "@open-cr-agent/core";
 import { memoryCommand } from "./memory.js";
 import { parseReviewArgs, REVIEW_USAGE, UsageError } from "./review/args.js";
 import { BUILTIN_PLUGINS, EXIT, reviewCommand } from "./review/command.js";
 import { forTerminal } from "./review/terminal.js";
-// src/ and dist/ both sit one level below the package root.
-export const VERSION = createRequire(import.meta.url)("../package.json").version;
+import { VERSION } from "./version.js";
 const USAGE = `Usage: ocra <command> [options]
 
 Commands:

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -0,0 +1,4 @@
+import { createRequire } from "node:module";
+// src/ and dist/ both sit one level below the package root.
+export const VERSION = createRequire(import.meta.url)("../package.json").version;
+//# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-cr-agent/cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "ocra: open-source multi-agent code review for local changes and GitHub pull requests",
   "keywords": [
     "code-review",
@@ -35,10 +35,11 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@open-cr-agent/core": "0.1.1",
-    "@open-cr-agent/runtime-opencode": "0.1.1",
-    "@open-cr-agent/vcs-github": "0.1.1",
-    "@open-cr-agent/vcs-local": "0.1.1",
+    "@open-cr-agent/core": "0.2.0",
+    "@open-cr-agent/runtime-opencode": "0.2.0",
+    "@open-cr-agent/vcs-github": "0.2.0",
+    "@open-cr-agent/vcs-gitlab": "0.2.0",
+    "@open-cr-agent/vcs-local": "0.2.0",
     "zod": "^4.6.5"
   },
   "publishConfig": {