@open-cr-agent/cli 0.2.0 → 0.4.0

package/dist/review/args.js

@@ -1,5 +1,10 @@
 import { parseArgs } from "node:util";
-export class UsageError extends Error {
+import { OcraError } from "@open-cr-agent/core";
+export class UsageError extends OcraError {
+    constructor(message) {
+        super("INPUT_USAGE", message);
+        this.name = "UsageError";
+    }
 }
 export const REVIEW_USAGE = `Usage: ocra review [options]
 
@@ -20,10 +25,18 @@ Options:
   --output <file>    Write the result to a file instead of stdout
   --reviewers <ids>  Run only these reviewers (comma-separated)
   --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest
+  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, …)
+                     that fall on the change; repeatable; not with --plan
   --plan             Show files, bundles, review tasks and prompt sizes; call no model
   --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)
+  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)
+  --seed <n>         Sampling seed, where the runtime and provider support one
+  --config <file>    Read this configuration file instead of the repository's
+                     .ocra/config.json; it applies with --no-repo-config too
   --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted
-                     code); models come from OCRA_MODEL_* variables
+                     code); models come from OCRA_MODEL_* variables or --config
+  --no-upload        When signed in to ocra Cloud, do not send this review's
+                     counts (verdict, numbers of findings, files, tokens)
   -h, --help         Show help
 `;
 export function parseReviewArgs(argv) {
@@ -59,6 +72,8 @@ export function parseReviewArgs(argv) {
         args.output = values.output;
     if (values["no-repo-config"])
         args.ignoreRepoConfig = true;
+    if (values["no-upload"])
+        args.noUpload = true;
     if (values.ultra)
         args.ultra = true;
     if (values.full) {
@@ -79,6 +94,30 @@ export function parseReviewArgs(argv) {
             throw new UsageError(`--max-cost-usd must be a positive number, got ${values["max-cost-usd"]}`);
         args.maxCostUsd = max;
     }
+    if (values.temperature !== undefined) {
+        const temperature = Number(values.temperature);
+        if (values.temperature.trim() === "" || !(temperature >= 0 && temperature <= 2)) {
+            throw new UsageError(`--temperature must be a number from 0 to 2, got ${values.temperature}`);
+        }
+        args.temperature = temperature;
+    }
+    if (values.seed !== undefined) {
+        const seed = Number(values.seed);
+        if (!/^\d+$/.test(values.seed) || seed > 2 ** 31 - 1) {
+            throw new UsageError(`--seed must be a whole number from 0 to 2147483647, got ${values.seed}`);
+        }
+        args.seed = seed;
+    }
+    if (values.config !== undefined) {
+        if (values.config === "")
+            throw new UsageError("--config needs a file");
+        args.configFile = values.config;
+    }
+    if (values["import-sarif"] !== undefined && values["import-sarif"].length > 0) {
+        if (values.plan)
+            throw new UsageError("--import-sarif is not used by --plan");
+        args.importSarif = values["import-sarif"];
+    }
     if (values.reviewers !== undefined) {
         const ids = values.reviewers
             .split(",")
@@ -102,9 +141,14 @@ function parse(argv) {
             format: { type: "string" },
             output: { type: "string" },
             "no-repo-config": { type: "boolean" },
+            "no-upload": { type: "boolean" },
+            config: { type: "string" },
             reviewers: { type: "string" },
             "max-cost-usd": { type: "string" },
+            "import-sarif": { type: "string", multiple: true },
             ultra: { type: "boolean" },
+            temperature: { type: "string" },
+            seed: { type: "string" },
             full: { type: "boolean" },
             plan: { type: "boolean" },
             pr: { type: "string" },

package/dist/review/cloud-providers.d.ts

@@ -0,0 +1,12 @@
+import type { CustomProvider, ModelChains } from "@open-cr-agent/core";
+import { type CloudDeps } from "../cloud.js";
+export declare const CLOUD_PREFIX = "ocra-";
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export declare const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function withCloudProviders(models: ModelChains, providers: Readonly<Record<string, CustomProvider>>, env: Env, deps: CloudDeps | undefined, warn: (message: string) => void): Promise<{
+    providers: Record<string, CustomProvider>;
+    env: Env;
+}>;
+export {};
+//# sourceMappingURL=cloud-providers.d.ts.map

package/dist/review/cloud-providers.js

@@ -0,0 +1,59 @@
+import { OcraError } from "@open-cr-agent/core";
+import { cloudSession } from "../cloud.js";
+// Models named ocra-<provider>/<model> go through the ocra Cloud gateway with
+// the key stored there for <provider> (ADR-0024). Each such provider becomes
+// an OpenAI-compatible endpoint declared for this run, authorized by the
+// signed-in session's access token. Without such a model nothing here reads
+// the session or touches the network.
+export const CLOUD_PREFIX = "ocra-";
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+// A review may run for half an hour; start it with a token that outlives it.
+const MIN_TOKEN_MS = 35 * 60_000;
+export async function withCloudProviders(models, providers, env, deps, warn) {
+    const wanted = new Map();
+    for (const model of Object.values(models).flat()) {
+        const slash = model.indexOf("/");
+        const id = model.slice(0, slash);
+        if (slash < 0 || !id.startsWith(CLOUD_PREFIX) || providers[id])
+            continue;
+        const set = wanted.get(id) ?? new Set();
+        set.add(model.slice(slash + 1));
+        wanted.set(id, set);
+    }
+    if (wanted.size === 0)
+        return { providers: { ...providers }, env };
+    const names = [...wanted.keys()].join(", ");
+    if (env.OCRA_CLOUD === "off") {
+        throw new OcraError("CONFIG_INVALID", `Models name ocra Cloud (${names}) but OCRA_CLOUD=off`);
+    }
+    const session = deps && (await cloudSession(deps, MIN_TOKEN_MS));
+    if (!session) {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): sign in with ocra login`);
+    }
+    const res = await deps.fetch(`${session.server}/api/providers`, {
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!res.ok) {
+        throw new OcraError("RUNTIME_START_FAILED", `ocra Cloud answered ${res.status} for its providers`);
+    }
+    const listed = (await res.json()).providers ?? [];
+    const declared = { ...providers };
+    for (const [id, modelIds] of wanted) {
+        const name = id.slice(CLOUD_PREFIX.length);
+        const chat = listed
+            .find((p) => p.name === name)
+            ?.paths.find((path) => path.endsWith("/chat/completions"));
+        if (!chat) {
+            throw new OcraError("CONFIG_INVALID", `ocra Cloud has no OpenAI-compatible chat endpoint for "${name}" (named by ${id})`);
+        }
+        declared[id] = {
+            baseUrl: `${session.server}/api/gateway/${name}${chat.slice(0, -"/chat/completions".length)}`,
+            apiKeyEnv: CLOUD_TOKEN_ENV,
+            models: Object.fromEntries([...modelIds].map((m) => [m, { input: 0, output: 0 }])),
+        };
+    }
+    warn(`${names}: models through ocra Cloud are not priced, so reported cost and --max-cost-usd do not count them`);
+    return { providers: declared, env: { ...env, [CLOUD_TOKEN_ENV]: session.access_token } };
+}
+//# sourceMappingURL=cloud-providers.js.map

package/dist/review/cloud-upload.d.ts

@@ -0,0 +1,40 @@
+import { type ModelChains, type ReviewReport } from "@open-cr-agent/core";
+import { type CloudDeps } from "../cloud.js";
+export type ReviewSource = "local" | "github" | "gitlab";
+export type ReviewUpload = {
+    runId: string;
+    repoHash: string;
+    source: ReviewSource;
+    tier: string;
+    verdict: string;
+    complete: boolean;
+    findings: {
+        critical: number;
+        warning: number;
+        suggestion: number;
+    };
+    files: {
+        reviewed: number;
+        notReviewed: number;
+    };
+    tasks: {
+        completed: number;
+        failed: number;
+    };
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+        costUsd: number;
+    };
+    durationMs: number;
+    ocraVersion: string;
+};
+export declare function uploadOf(report: ReviewReport, source: ReviewSource, repoHash: string, durationMs: number): ReviewUpload;
+export declare function repoHash(root: string, credentialsPath: string): Promise<string>;
+/** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
+export declare function cloudEnabled(deps: CloudDeps): Promise<boolean>;
+/** Sends the counts; a failure is a warning, never a failed review. */
+export declare function uploadReview(upload: ReviewUpload, deps: CloudDeps, warn: (message: string) => void): Promise<boolean>;
+/** The default models chosen on the web, for a review that configures none. */
+export declare function defaultModels(deps: CloudDeps): Promise<ModelChains>;
+//# sourceMappingURL=cloud-upload.d.ts.map

package/dist/review/cloud-upload.js

@@ -0,0 +1,135 @@
+import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { coverageGaps } from "@open-cr-agent/core";
+import { cloudSession, readCredentials } from "../cloud.js";
+import { VERSION } from "../version.js";
+// After a review, a signed-in CLI sends ocra Cloud its counts (ADR-0024):
+// the verdict, how many findings of each severity, files and tasks, tokens
+// and time. Never a path, a title, a finding's text or code. The repository
+// is a hash salted with a value that stays on this machine, so the server
+// can group reviews of one repository without learning which it is.
+const run = promisify(execFile);
+export function uploadOf(report, source, repoHash, durationMs) {
+    const severity = (s) => report.findings.filter((f) => f.severity === s).length;
+    const gaps = coverageGaps(report);
+    return {
+        runId: report.runId,
+        repoHash,
+        source,
+        tier: report.tier,
+        verdict: report.verdict,
+        complete: gaps.notReviewed === 0,
+        findings: {
+            critical: severity("critical"),
+            warning: severity("warning"),
+            suggestion: severity("suggestion"),
+        },
+        files: {
+            reviewed: report.coverage.filter((c) => c.status === "reviewed").length,
+            notReviewed: gaps.notReviewed,
+        },
+        tasks: {
+            completed: report.tasks.filter((t) => t.status === "completed").length,
+            failed: report.tasks.filter((t) => t.status === "failed").length,
+        },
+        usage: {
+            inputTokens: report.usage.inputTokens,
+            outputTokens: report.usage.outputTokens,
+            costUsd: report.usage.costUsd ?? 0,
+        },
+        durationMs: Math.round(durationMs),
+        ocraVersion: VERSION,
+    };
+}
+/** The repository's origin without credentials, or its root path when it has none. */
+async function repositoryId(root) {
+    try {
+        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], {
+            timeout: 10_000,
+        });
+        const url = stdout.trim();
+        return url
+            .replace(/^[a-z+]+:\/\/[^@/]*@/i, (m) => m.slice(0, m.indexOf("//") + 2))
+            .replace(/\.git$/, "")
+            .toLowerCase();
+    }
+    catch {
+        return root;
+    }
+}
+/** A random salt kept beside the credentials, made on first use. */
+async function salt(credentialsPath) {
+    const path = join(dirname(credentialsPath), "upload-salt");
+    try {
+        const existing = (await readFile(path, "utf8")).trim();
+        if (/^[0-9a-f]{64}$/.test(existing))
+            return existing;
+    }
+    catch { }
+    const fresh = randomBytes(32).toString("hex");
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${fresh}\n`, { mode: 0o600 });
+    return fresh;
+}
+export async function repoHash(root, credentialsPath) {
+    return createHash("sha256")
+        .update(`${await salt(credentialsPath)}:${await repositoryId(root)}`)
+        .digest("hex");
+}
+/** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
+export async function cloudEnabled(deps) {
+    return (deps.env.OCRA_CLOUD !== "off" && (await readCredentials(deps.credentialsPath)) !== undefined);
+}
+/** Sends the counts; a failure is a warning, never a failed review. */
+export async function uploadReview(upload, deps, warn) {
+    try {
+        const session = await cloudSession(deps);
+        if (!session)
+            return false;
+        const res = await deps.fetch(`${session.server}/api/reviews`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${session.access_token}`,
+                "user-agent": `ocra/${VERSION}`,
+            },
+            body: JSON.stringify(upload),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok) {
+            warn(`ocra Cloud did not take the review's counts (HTTP ${res.status})`);
+            return false;
+        }
+        return true;
+    }
+    catch (error) {
+        warn(`could not send the review's counts to ocra Cloud: ${error instanceof Error ? error.name : "error"}`);
+        return false;
+    }
+}
+/** The default models chosen on the web, for a review that configures none. */
+export async function defaultModels(deps) {
+    const session = await cloudSession(deps);
+    if (!session)
+        return {};
+    const res = await deps.fetch(`${session.server}/api/preferences/models`, {
+        headers: { authorization: `Bearer ${session.access_token}`, "user-agent": `ocra/${VERSION}` },
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok)
+        return {};
+    const body = (await res.json());
+    const chains = {};
+    for (const tier of ["top", "standard", "light"]) {
+        const list = body.models?.[tier];
+        if (Array.isArray(list) && list.every((m) => typeof m === "string" && m.startsWith("ocra-"))) {
+            if (list.length > 0)
+                chains[tier] = list;
+        }
+    }
+    return chains;
+}
+//# sourceMappingURL=cloud-upload.js.map

package/dist/review/command.d.ts

@@ -1,6 +1,8 @@
 import { type OcraPlugin } from "@open-cr-agent/core";
+import type { CloudDeps } from "../cloud.js";
 import type { ReviewArgs } from "./args.js";
 import { type Output } from "./progress.js";
+import type { RuntimeLoaders } from "./runtimes.js";
 export declare const SESSIONS_DIR = ".ocra/sessions";
 export declare const EXIT: {
     readonly ok: 0;
@@ -14,10 +16,12 @@ export interface ReviewDeps {
     cwd: string;
     env: Readonly<Record<string, string | undefined>>;
     builtinPlugins: readonly OcraPlugin[];
+    runtimes: RuntimeLoaders;
     writeFile(path: string, content: string): Promise<void>;
     now(): number;
     heartbeatMs: number;
     fetch?: typeof fetch;
+    cloud?: CloudDeps;
     onInterrupt?(handler: () => void): () => void;
 }
 export declare function reviewCommand(args: ReviewArgs, io: {

package/dist/review/command.js

@@ -1,15 +1,20 @@
 import { join, relative, resolve } from "node:path";
-import { agentsMdReviewerPlugin, correctnessReviewerPlugin, coverageGaps, defaultSelectionPolicy, docsReviewerPlugin, newSessionId, performanceReviewerPlugin, previewReview, runReview, securityReviewerPlugin, sessionJsonlPlugin, startPlugins, toPlanOutput, } from "@open-cr-agent/core";
-import { opencodeRuntimePlugin } from "@open-cr-agent/runtime-opencode";
+import { agentsMdReviewerPlugin, correctnessReviewerPlugin, coverageGaps, docsReviewerPlugin, performanceReviewerPlugin, review, securityReviewerPlugin, sessionJsonlPlugin, startPlugins, } from "@open-cr-agent/core";
+import { defaultSelectionPolicy, newRunId, previewReview, toPlanOutput, } from "@open-cr-agent/core/internal";
 import { githubPlugin } from "@open-cr-agent/vcs-github";
 import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
-import { findRepositoryRoot, localGitPlugin } from "@open-cr-agent/vcs-local";
+import { localGitPlugin } from "@open-cr-agent/vcs-local";
+import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
 import { VERSION } from "../version.js";
+import { withCloudProviders } from "./cloud-providers.js";
+import { cloudEnabled, defaultModels, repoHash, uploadOf, uploadReview } from "./cloud-upload.js";
 import { ConfigError } from "./config.js";
 import { renderPlan } from "./plan-render.js";
 import { ProgressPrinter } from "./progress.js";
+import { configHash, requestedSampling } from "./provenance.js";
 import { renderJson, renderText, safeJson } from "./render.js";
 import { renderSarif } from "./sarif.js";
+import { loadSarifLogs } from "./sarif-input.js";
 import { localTarget, mergeRequestTarget, pullRequestTarget } from "./target.js";
 import { forTerminal } from "./terminal.js";
 export const SESSIONS_DIR = ".ocra/sessions";
@@ -18,7 +23,6 @@ export const BUILTIN_PLUGINS = [
     localGitPlugin,
     githubPlugin,
     gitlabPlugin,
-    opencodeRuntimePlugin,
     correctnessReviewerPlugin,
     securityReviewerPlugin,
     performanceReviewerPlugin,
@@ -30,17 +34,20 @@ export async function reviewCommand(args, io, deps) {
     const root = await findRepositoryRoot(deps.cwd);
     const warn = (message) => io.err.write(`[ocra] Warning: ${forTerminal(message)}\n`);
     const ignoreRepoConfig = args.ignoreRepoConfig === true;
+    const configFile = args.configFile ? resolve(deps.cwd, args.configFile) : undefined;
+    const localArgs = configFile ? { ...args, configFile } : args;
     const target = args.pullRequest
-        ? await pullRequestTarget(args.pullRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig)
+        ? await pullRequestTarget(args.pullRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
         : args.mergeRequest
-            ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig)
-            : await localTarget(args, deps.cwd, root, deps.env, warn, deps.fetch);
+            ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
+            : await localTarget(localArgs, deps.cwd, root, deps.env, warn, deps.fetch);
     const { config } = target;
-    const session = { dir: join(root, SESSIONS_DIR), id: newSessionId() };
-    // A plan calls no model and writes no session log.
+    const session = { dir: join(root, SESSIONS_DIR), id: newRunId() };
+    // A plan calls no model, writes no session log and imports no runtime: it
+    // works without the optional runtime-opencode.
     const builtins = args.plan
         ? deps.builtinPlugins.filter((p) => p.name !== sessionJsonlPlugin.name)
-        : deps.builtinPlugins;
+        : [...deps.builtinPlugins, ...(await builtinRuntime(deps.runtimes, config.runtime))];
     const registry = await startPlugins([...builtins, ...target.plugins], {
         settings: args.plan
             ? config.pluginSettings
@@ -55,6 +62,8 @@ export async function reviewCommand(args, io, deps) {
             vcs,
             reviewers: registry.reviewers,
             reviewerOverrides: overrides,
+            effort: config.effort,
+            roles: config.roles,
             rules: [...registry.rules, ...config.rules],
             selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
@@ -68,10 +77,23 @@ export async function reviewCommand(args, io, deps) {
             await deps.writeFile(resolve(deps.cwd, args.output), rendered);
         return EXIT.ok;
     }
+    const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
+    const sampling = requestedSampling(config, args);
+    const cloudDeps = deps.cloud;
+    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
+    let models = config.models;
+    if (cloudDeps && signedIn && Object.values(models).every((chain) => !chain?.length)) {
+        models = await defaultModels(cloudDeps);
+        if (Object.keys(models).length > 0) {
+            io.err.write("[ocra] No models configured: using your default models from ocra Cloud\n");
+        }
+    }
+    const cloud = await withCloudProviders(models, config.providers, deps.env, cloudDeps, warn);
     const runtime = registry.createRuntime(config.runtime, {
-        models: config.models,
-        env: deps.env,
-        providers: config.providers,
+        models,
+        env: cloud.env,
+        providers: cloud.providers,
+        ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
     });
     const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
     const interrupt = new AbortController();
@@ -80,14 +102,18 @@ export async function reviewCommand(args, io, deps) {
         interrupt.abort();
     });
     let report;
+    const started = deps.now();
     try {
-        report = await runReview({
+        report = await review({
+            runId: session.id,
             signal: interrupt.signal,
             ...runOptions(config),
             reviewerOverrides: overrides,
+            provenance: { ocraVersion: VERSION, configHash: configHash(config, args), sampling },
             ...(args.maxCostUsd !== undefined ? { maxCostUsd: args.maxCostUsd } : {}),
             ...(args.ultra ? { ultra: true } : {}),
             ...(args.full ? { fullReview: true } : {}),
+            ...(sarif.length > 0 ? { sarif } : {}),
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
             vcs,
             runtime,
@@ -135,11 +161,25 @@ export async function reviewCommand(args, io, deps) {
         }
         io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
     }
+    if (signedIn && cloudDeps && !args.noUpload) {
+        const source = args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local";
+        const upload = uploadOf(report, source, await repoHash(root, cloudDeps.credentialsPath), deps.now() - started);
+        if (await uploadReview(upload, cloudDeps, warn)) {
+            io.err.write("[ocra] Sent this review's counts to ocra Cloud (--no-upload to skip)\n");
+        }
+    }
     return exitCode(report, io.err);
 }
+// A runtime not built in comes from a plugin of the configuration.
+async function builtinRuntime(runtimes, name) {
+    const load = Object.hasOwn(runtimes, name) ? runtimes[name] : undefined;
+    return load ? [await load()] : [];
+}
 function runOptions(config) {
     const options = {
         selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
+        effort: config.effort,
+        roles: config.roles,
     };
     if (config.concurrency !== undefined)
         options.concurrency = config.concurrency;

package/dist/review/config.d.ts

@@ -1,12 +1,36 @@
-import { type CustomProvider, type ModelChains, type RepoRule } from "@open-cr-agent/core";
+import { type CustomProvider, type ModelChains, OcraError, type RepoRule, type TierEfforts } from "@open-cr-agent/core";
 import { z } from "zod";
 export declare const CONFIG_PATH = ".ocra/config.json";
 declare const configSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
     models: z.ZodDefault<z.ZodObject<{
         top: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         standard: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         light: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
     }, z.core.$strict>>;
+    effort: z.ZodDefault<z.ZodObject<{
+        top: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        standard: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        light: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>;
     concurrency: z.ZodOptional<z.ZodNumber>;
     taskTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
     runTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
@@ -14,13 +38,20 @@ declare const configSchema: z.ZodObject<{
     judge: z.ZodOptional<z.ZodBoolean>;
     maxCostUsd: z.ZodOptional<z.ZodNumber>;
     maxTasks: z.ZodOptional<z.ZodNumber>;
+    sampling: z.ZodOptional<z.ZodObject<{
+        temperature: z.ZodOptional<z.ZodNumber>;
+        seed: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
     github: z.ZodDefault<z.ZodObject<{
         requestChanges: z.ZodOptional<z.ZodBoolean>;
         botLogin: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     include: z.ZodDefault<z.ZodArray<z.ZodString>>;
     exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    runtime: z.ZodDefault<z.ZodString>;
+    runtime: z.ZodDefault<z.ZodUnion<[z.ZodEnum<{
+        direct: "direct";
+        opencode: "opencode";
+    }>, z.ZodString]>>;
     plugins: z.ZodDefault<z.ZodArray<z.ZodString>>;
     reviewers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -29,6 +60,26 @@ declare const configSchema: z.ZodObject<{
             lite: "lite";
             trivial: "trivial";
         }>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+    roles: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        helper: "helper";
+        judge: "judge";
+        verifier: "verifier";
+    }> & z.core.$partial, z.ZodObject<{
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
     }, z.core.$strict>>>;
     pluginSettings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -40,21 +91,32 @@ declare const configSchema: z.ZodObject<{
             output: z.ZodNumber;
             cachedInput: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            openai: "openai";
+            openrouter: "openrouter";
+        }>>;
     }, z.core.$strict>>>;
     extends: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "providers"> & {
+export declare const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
+export declare function configJsonSchema(): Record<string, unknown>;
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers"> & {
     models: ModelChains;
+    effort: TierEfforts;
     providers: Record<string, CustomProvider>;
     rules: RepoRule[];
 };
 export interface LoadOptions {
     repository: boolean;
     read?: (path: string) => Promise<string | undefined>;
+    file?: string;
     fetch?: typeof fetch;
     warn?: (message: string) => void;
 }
-export declare class ConfigError extends Error {
+export declare class ConfigError extends OcraError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
 }
 export declare function loadConfig(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<CliConfig>;
 export {};