@open-cr-agent/cli 0.3.0 → 0.4.0

package/README.md

@@ -2,7 +2,7 @@
 
 `ocra` is the command line of [Open-CR-Agent](https://github.com/jma49/Open-CR-Agent), an open-source multi-agent code reviewer for local changes and GitHub pull requests. Deterministic code selects and bundles the files, matches rules and anchors comments; LLM reviewers make the judgment calls, and a verification pass checks what they report.
 
-This is an early 0.x release: options and output may change between minor versions. What the reviews find and miss is measured on the [quality page](https://ocra.majincheng.com/en/docs/quality).
+This is an early 0.x release: options and output may change between minor versions. What the reviews find and miss is measured on the [quality page](https://ocracloud.com/en/docs/quality).
 
 ## Install
 
@@ -34,8 +34,8 @@ Pull requests can also be reviewed by the GitHub Action: inline comments, one su
 
 ## Documentation
 
-- [Quickstart](https://ocra.majincheng.com/en/docs/quickstart) and the manual, in [English](https://ocra.majincheng.com/en/docs) and [中文](https://ocra.majincheng.com/zh/docs)
-- [GitHub pull requests](https://ocra.majincheng.com/en/docs/github)
+- [Quickstart](https://ocracloud.com/en/docs/quickstart) and the manual, in [English](https://ocracloud.com/en/docs) and [中文](https://ocracloud.com/zh/docs)
+- [GitHub pull requests](https://ocracloud.com/en/docs/github)
 - [Changelog](https://github.com/jma49/Open-CR-Agent/blob/main/CHANGELOG.md) and [issues](https://github.com/jma49/Open-CR-Agent/issues)
 
 ## License

package/dist/cloud.d.ts

@@ -0,0 +1,32 @@
+import type { Output } from "./review/progress.js";
+/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
+export declare const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
+export declare const LOGIN_USAGE: string;
+export type Credentials = {
+    server: string;
+    login: string;
+    access_token: string;
+    refresh_token: string;
+    /** Epoch milliseconds when the access token expires. */
+    expires_at: number;
+};
+export type CloudDeps = {
+    env: Readonly<Record<string, string | undefined>>;
+    fetch: typeof fetch;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+    openBrowser: (url: string) => void;
+    credentialsPath: string;
+    clientName: string;
+};
+export declare function defaultCloudDeps(env?: CloudDeps["env"]): CloudDeps;
+export declare function credentialsPath(env: CloudDeps["env"]): string;
+export declare function readCredentials(path: string): Promise<Credentials | undefined>;
+/**
+ * The saved session with a live access token, refreshed (and saved) when
+ * it has expired or is about to; undefined when not signed in or the
+ * session was revoked.
+ */
+export declare function cloudSession(deps: CloudDeps, minValidityMs?: number): Promise<Credentials | undefined>;
+export declare function cloudCommand(command: "login" | "logout" | "whoami", argv: string[], out: Output, err: Output, deps: CloudDeps): Promise<number>;
+//# sourceMappingURL=cloud.d.ts.map

package/dist/cloud.js

@@ -0,0 +1,262 @@
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { parseArgs } from "node:util";
+import { errorMessage } from "@open-cr-agent/core/internal";
+import { UsageError } from "./review/args.js";
+import { forTerminal } from "./review/terminal.js";
+import { VERSION } from "./version.js";
+// ocra Cloud sign-in (ADR-0024): `ocra login` runs the OAuth device flow
+// (RFC 8628) against ocra Cloud, `ocra whoami` shows the account, and
+// `ocra logout` ends the session. Nothing here runs unless one of these
+// commands is used: a self-hosted user never sees a login prompt.
+/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
+export const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
+export const LOGIN_USAGE = `Usage: ocra login [--no-browser]
+       ocra logout
+       ocra whoami
+
+Sign in to ocra Cloud with GitHub, so reviews can use the model keys stored
+there. ocra login shows a code, opens the browser to confirm it, and saves the
+session to ${credentialsHint()} (readable only by you).
+
+Environment:
+  OCRA_CLOUD=off   Disable ocra Cloud: these commands refuse to run
+  OCRA_CLOUD_URL   Another ocra Cloud server (default ${DEFAULT_CLOUD_URL})
+`;
+export function defaultCloudDeps(env = process.env) {
+    return {
+        env,
+        fetch: globalThis.fetch,
+        now: Date.now,
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        openBrowser,
+        credentialsPath: credentialsPath(env),
+        clientName: `${hostname()} (ocra ${VERSION})`,
+    };
+}
+function credentialsHint() {
+    return process.platform === "win32"
+        ? "%APPDATA%\\ocra\\credentials.json"
+        : "~/.config/ocra/credentials.json";
+}
+export function credentialsPath(env) {
+    const base = process.platform === "win32"
+        ? (env.APPDATA ?? join(homedir(), "AppData", "Roaming"))
+        : (env.XDG_CONFIG_HOME ?? join(homedir(), ".config"));
+    return join(base, "ocra", "credentials.json");
+}
+function cloudUrl(env) {
+    const named = env.OCRA_CLOUD_URL || DEFAULT_CLOUD_URL;
+    let url;
+    try {
+        url = new URL(named);
+    }
+    catch {
+        throw new UsageError(`OCRA_CLOUD_URL is not a URL: ${named}`);
+    }
+    if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+        throw new UsageError(`OCRA_CLOUD_URL must use https: ${url}`);
+    }
+    return url.origin;
+}
+function openBrowser(url) {
+    const [cmd, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    try {
+        const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // The URL is printed as well; a missing opener is not an error.
+    }
+}
+export async function readCredentials(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const c = JSON.parse(text);
+    if (!c.server || !c.access_token || !c.refresh_token || typeof c.expires_at !== "number") {
+        return undefined;
+    }
+    return c;
+}
+async function writeCredentials(path, c) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(c, null, 2)}\n`, { mode: 0o600 });
+    // writeFile keeps the mode of a file that already exists.
+    await chmod(path, 0o600);
+}
+async function postJson(deps, url, body, token) {
+    const res = await deps.fetch(url, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "user-agent": `ocra/${VERSION}`,
+            ...(token ? { authorization: `Bearer ${token}` } : {}),
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(30_000),
+    });
+    return {
+        status: res.status,
+        body: (await res.json().catch(() => ({}))),
+    };
+}
+async function fetchMe(deps, server, token) {
+    const res = await deps.fetch(`${server}/api/me`, {
+        headers: { authorization: `Bearer ${token}`, "user-agent": `ocra/${VERSION}` },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (res.status === 401)
+        return undefined;
+    if (!res.ok)
+        throw new Error(`ocra Cloud answered ${res.status}`);
+    return (await res.json());
+}
+/**
+ * The saved session with a live access token, refreshed (and saved) when
+ * it has expired or is about to; undefined when not signed in or the
+ * session was revoked.
+ */
+export async function cloudSession(deps, minValidityMs = 60_000) {
+    const saved = await readCredentials(deps.credentialsPath);
+    if (!saved)
+        return undefined;
+    if (saved.expires_at - deps.now() > minValidityMs)
+        return saved;
+    const { status, body } = await postJson(deps, `${saved.server}/api/device/refresh`, {
+        refresh_token: saved.refresh_token,
+    });
+    const t = body;
+    if (status !== 200 || !t.access_token || !t.refresh_token || !t.expires_in)
+        return undefined;
+    const next = {
+        ...saved,
+        access_token: t.access_token,
+        refresh_token: t.refresh_token,
+        expires_at: deps.now() + t.expires_in * 1000,
+    };
+    await writeCredentials(deps.credentialsPath, next);
+    return next;
+}
+export async function cloudCommand(command, argv, out, err, deps) {
+    const { values } = parseArgs({
+        args: argv,
+        strict: true,
+        options: { "no-browser": { type: "boolean" }, help: { type: "boolean", short: "h" } },
+    });
+    if (values.help) {
+        out.write(LOGIN_USAGE);
+        return 0;
+    }
+    if (deps.env.OCRA_CLOUD === "off") {
+        err.write("ocra Cloud is off (OCRA_CLOUD=off).\n");
+        return 2;
+    }
+    if (command === "whoami")
+        return whoami(out, err, deps);
+    if (command === "logout")
+        return logout(out, deps);
+    return login(out, err, deps, !values["no-browser"]);
+}
+async function whoami(out, err, deps) {
+    const session = await cloudSession(deps);
+    if (!session) {
+        err.write("Not signed in. Run ocra login.\n");
+        return 1;
+    }
+    const me = await fetchMe(deps, session.server, session.access_token);
+    if (!me) {
+        err.write("The saved session was revoked. Run ocra login.\n");
+        return 1;
+    }
+    out.write(forTerminal(`${me.login} on ${session.server}\n`));
+    return 0;
+}
+async function logout(out, deps) {
+    const saved = await readCredentials(deps.credentialsPath);
+    if (saved) {
+        // Ends the session on the server too; the local file goes either way.
+        const session = await cloudSession(deps).catch(() => undefined);
+        if (session) {
+            await postJson(deps, `${session.server}/api/auth/logout`, {}, session.access_token).catch(() => { });
+        }
+    }
+    await rm(deps.credentialsPath, { force: true });
+    out.write(saved ? "Signed out.\n" : "Not signed in.\n");
+    return 0;
+}
+async function login(out, err, deps, browser) {
+    const server = cloudUrl(deps.env);
+    const start = await postJson(deps, `${server}/api/device/code`, { client_name: deps.clientName });
+    const code = start.body;
+    if (start.status !== 200 ||
+        !code.device_code ||
+        !code.user_code ||
+        !code.verification_uri_complete) {
+        err.write(`ocra Cloud did not start a login (HTTP ${start.status}). Try again in a minute.\n`);
+        return 2;
+    }
+    out.write(forTerminal(`Confirm this code in your browser: ${code.user_code}\n` +
+        `  ${code.verification_uri_complete}\n` +
+        `(or open ${code.verification_uri} and type it)\n\nWaiting for approval...\n`));
+    if (browser)
+        deps.openBrowser(code.verification_uri_complete);
+    let interval = (code.interval ?? 5) * 1000;
+    const deadline = deps.now() + (code.expires_in ?? 600) * 1000;
+    while (deps.now() < deadline) {
+        await deps.sleep(interval);
+        let answer;
+        try {
+            answer = await postJson(deps, `${server}/api/device/token`, {
+                device_code: code.device_code,
+            });
+        }
+        catch (error) {
+            // A dropped connection is retried on the next tick.
+            err.write(forTerminal(`(${errorMessage(error)}; retrying)\n`));
+            continue;
+        }
+        const t = answer.body;
+        if (answer.status === 200 && t.access_token && t.refresh_token && t.expires_in) {
+            const me = await fetchMe(deps, server, t.access_token);
+            const credentials = {
+                server,
+                login: me?.login ?? "",
+                access_token: t.access_token,
+                refresh_token: t.refresh_token,
+                expires_at: deps.now() + t.expires_in * 1000,
+            };
+            await writeCredentials(deps.credentialsPath, credentials);
+            out.write(forTerminal(`Signed in as ${credentials.login}.\n`));
+            return 0;
+        }
+        if (t.error === "authorization_pending")
+            continue;
+        if (t.error === "slow_down") {
+            interval = typeof t.interval === "number" ? t.interval * 1000 : interval + 5000;
+            continue;
+        }
+        if (t.error === "access_denied") {
+            err.write("Login denied in the browser.\n");
+            return 1;
+        }
+        if (t.error === "expired_token")
+            break;
+        err.write(forTerminal(`Login failed: ${t.error ?? `HTTP ${answer.status}`}\n`));
+        return 2;
+    }
+    err.write("The code expired before it was confirmed. Run ocra login again.\n");
+    return 1;
+}
+//# sourceMappingURL=cloud.js.map

package/dist/review/args.d.ts

@@ -25,12 +25,13 @@ export interface ReviewArgs {
     plan?: true;
     importSarif?: string[];
     configFile?: string;
+    noUpload?: true;
     temperature?: number;
     seed?: number;
 }
 export declare class UsageError extends OcraError {
     constructor(message: string);
 }
-export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  -h, --help         Show help\n";
+export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  --no-upload        When signed in to ocra Cloud, do not send this review's\n                     counts (verdict, numbers of findings, files, tokens)\n  -h, --help         Show help\n";
 export declare function parseReviewArgs(argv: string[]): ReviewArgs | "help";
 //# sourceMappingURL=args.d.ts.map

package/dist/review/args.js

@@ -35,6 +35,8 @@ Options:
                      .ocra/config.json; it applies with --no-repo-config too
   --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted
                      code); models come from OCRA_MODEL_* variables or --config
+  --no-upload        When signed in to ocra Cloud, do not send this review's
+                     counts (verdict, numbers of findings, files, tokens)
   -h, --help         Show help
 `;
 export function parseReviewArgs(argv) {
@@ -70,6 +72,8 @@ export function parseReviewArgs(argv) {
         args.output = values.output;
     if (values["no-repo-config"])
         args.ignoreRepoConfig = true;
+    if (values["no-upload"])
+        args.noUpload = true;
     if (values.ultra)
         args.ultra = true;
     if (values.full) {
@@ -137,6 +141,7 @@ function parse(argv) {
             format: { type: "string" },
             output: { type: "string" },
             "no-repo-config": { type: "boolean" },
+            "no-upload": { type: "boolean" },
             config: { type: "string" },
             reviewers: { type: "string" },
             "max-cost-usd": { type: "string" },

package/dist/review/cloud-providers.d.ts

@@ -0,0 +1,12 @@
+import type { CustomProvider, ModelChains } from "@open-cr-agent/core";
+import { type CloudDeps } from "../cloud.js";
+export declare const CLOUD_PREFIX = "ocra-";
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export declare const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function withCloudProviders(models: ModelChains, providers: Readonly<Record<string, CustomProvider>>, env: Env, deps: CloudDeps | undefined, warn: (message: string) => void): Promise<{
+    providers: Record<string, CustomProvider>;
+    env: Env;
+}>;
+export {};
+//# sourceMappingURL=cloud-providers.d.ts.map

package/dist/review/cloud-providers.js

@@ -0,0 +1,59 @@
+import { OcraError } from "@open-cr-agent/core";
+import { cloudSession } from "../cloud.js";
+// Models named ocra-<provider>/<model> go through the ocra Cloud gateway with
+// the key stored there for <provider> (ADR-0024). Each such provider becomes
+// an OpenAI-compatible endpoint declared for this run, authorized by the
+// signed-in session's access token. Without such a model nothing here reads
+// the session or touches the network.
+export const CLOUD_PREFIX = "ocra-";
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+// A review may run for half an hour; start it with a token that outlives it.
+const MIN_TOKEN_MS = 35 * 60_000;
+export async function withCloudProviders(models, providers, env, deps, warn) {
+    const wanted = new Map();
+    for (const model of Object.values(models).flat()) {
+        const slash = model.indexOf("/");
+        const id = model.slice(0, slash);
+        if (slash < 0 || !id.startsWith(CLOUD_PREFIX) || providers[id])
+            continue;
+        const set = wanted.get(id) ?? new Set();
+        set.add(model.slice(slash + 1));
+        wanted.set(id, set);
+    }
+    if (wanted.size === 0)
+        return { providers: { ...providers }, env };
+    const names = [...wanted.keys()].join(", ");
+    if (env.OCRA_CLOUD === "off") {
+        throw new OcraError("CONFIG_INVALID", `Models name ocra Cloud (${names}) but OCRA_CLOUD=off`);
+    }
+    const session = deps && (await cloudSession(deps, MIN_TOKEN_MS));
+    if (!session) {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): sign in with ocra login`);
+    }
+    const res = await deps.fetch(`${session.server}/api/providers`, {
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!res.ok) {
+        throw new OcraError("RUNTIME_START_FAILED", `ocra Cloud answered ${res.status} for its providers`);
+    }
+    const listed = (await res.json()).providers ?? [];
+    const declared = { ...providers };
+    for (const [id, modelIds] of wanted) {
+        const name = id.slice(CLOUD_PREFIX.length);
+        const chat = listed
+            .find((p) => p.name === name)
+            ?.paths.find((path) => path.endsWith("/chat/completions"));
+        if (!chat) {
+            throw new OcraError("CONFIG_INVALID", `ocra Cloud has no OpenAI-compatible chat endpoint for "${name}" (named by ${id})`);
+        }
+        declared[id] = {
+            baseUrl: `${session.server}/api/gateway/${name}${chat.slice(0, -"/chat/completions".length)}`,
+            apiKeyEnv: CLOUD_TOKEN_ENV,
+            models: Object.fromEntries([...modelIds].map((m) => [m, { input: 0, output: 0 }])),
+        };
+    }
+    warn(`${names}: models through ocra Cloud are not priced, so reported cost and --max-cost-usd do not count them`);
+    return { providers: declared, env: { ...env, [CLOUD_TOKEN_ENV]: session.access_token } };
+}
+//# sourceMappingURL=cloud-providers.js.map

package/dist/review/cloud-upload.d.ts

@@ -0,0 +1,40 @@
+import { type ModelChains, type ReviewReport } from "@open-cr-agent/core";
+import { type CloudDeps } from "../cloud.js";
+export type ReviewSource = "local" | "github" | "gitlab";
+export type ReviewUpload = {
+    runId: string;
+    repoHash: string;
+    source: ReviewSource;
+    tier: string;
+    verdict: string;
+    complete: boolean;
+    findings: {
+        critical: number;
+        warning: number;
+        suggestion: number;
+    };
+    files: {
+        reviewed: number;
+        notReviewed: number;
+    };
+    tasks: {
+        completed: number;
+        failed: number;
+    };
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+        costUsd: number;
+    };
+    durationMs: number;
+    ocraVersion: string;
+};
+export declare function uploadOf(report: ReviewReport, source: ReviewSource, repoHash: string, durationMs: number): ReviewUpload;
+export declare function repoHash(root: string, credentialsPath: string): Promise<string>;
+/** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
+export declare function cloudEnabled(deps: CloudDeps): Promise<boolean>;
+/** Sends the counts; a failure is a warning, never a failed review. */
+export declare function uploadReview(upload: ReviewUpload, deps: CloudDeps, warn: (message: string) => void): Promise<boolean>;
+/** The default models chosen on the web, for a review that configures none. */
+export declare function defaultModels(deps: CloudDeps): Promise<ModelChains>;
+//# sourceMappingURL=cloud-upload.d.ts.map

package/dist/review/cloud-upload.js

@@ -0,0 +1,135 @@
+import { execFile } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { coverageGaps } from "@open-cr-agent/core";
+import { cloudSession, readCredentials } from "../cloud.js";
+import { VERSION } from "../version.js";
+// After a review, a signed-in CLI sends ocra Cloud its counts (ADR-0024):
+// the verdict, how many findings of each severity, files and tasks, tokens
+// and time. Never a path, a title, a finding's text or code. The repository
+// is a hash salted with a value that stays on this machine, so the server
+// can group reviews of one repository without learning which it is.
+const run = promisify(execFile);
+export function uploadOf(report, source, repoHash, durationMs) {
+    const severity = (s) => report.findings.filter((f) => f.severity === s).length;
+    const gaps = coverageGaps(report);
+    return {
+        runId: report.runId,
+        repoHash,
+        source,
+        tier: report.tier,
+        verdict: report.verdict,
+        complete: gaps.notReviewed === 0,
+        findings: {
+            critical: severity("critical"),
+            warning: severity("warning"),
+            suggestion: severity("suggestion"),
+        },
+        files: {
+            reviewed: report.coverage.filter((c) => c.status === "reviewed").length,
+            notReviewed: gaps.notReviewed,
+        },
+        tasks: {
+            completed: report.tasks.filter((t) => t.status === "completed").length,
+            failed: report.tasks.filter((t) => t.status === "failed").length,
+        },
+        usage: {
+            inputTokens: report.usage.inputTokens,
+            outputTokens: report.usage.outputTokens,
+            costUsd: report.usage.costUsd ?? 0,
+        },
+        durationMs: Math.round(durationMs),
+        ocraVersion: VERSION,
+    };
+}
+/** The repository's origin without credentials, or its root path when it has none. */
+async function repositoryId(root) {
+    try {
+        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], {
+            timeout: 10_000,
+        });
+        const url = stdout.trim();
+        return url
+            .replace(/^[a-z+]+:\/\/[^@/]*@/i, (m) => m.slice(0, m.indexOf("//") + 2))
+            .replace(/\.git$/, "")
+            .toLowerCase();
+    }
+    catch {
+        return root;
+    }
+}
+/** A random salt kept beside the credentials, made on first use. */
+async function salt(credentialsPath) {
+    const path = join(dirname(credentialsPath), "upload-salt");
+    try {
+        const existing = (await readFile(path, "utf8")).trim();
+        if (/^[0-9a-f]{64}$/.test(existing))
+            return existing;
+    }
+    catch { }
+    const fresh = randomBytes(32).toString("hex");
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${fresh}\n`, { mode: 0o600 });
+    return fresh;
+}
+export async function repoHash(root, credentialsPath) {
+    return createHash("sha256")
+        .update(`${await salt(credentialsPath)}:${await repositoryId(root)}`)
+        .digest("hex");
+}
+/** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
+export async function cloudEnabled(deps) {
+    return (deps.env.OCRA_CLOUD !== "off" && (await readCredentials(deps.credentialsPath)) !== undefined);
+}
+/** Sends the counts; a failure is a warning, never a failed review. */
+export async function uploadReview(upload, deps, warn) {
+    try {
+        const session = await cloudSession(deps);
+        if (!session)
+            return false;
+        const res = await deps.fetch(`${session.server}/api/reviews`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${session.access_token}`,
+                "user-agent": `ocra/${VERSION}`,
+            },
+            body: JSON.stringify(upload),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok) {
+            warn(`ocra Cloud did not take the review's counts (HTTP ${res.status})`);
+            return false;
+        }
+        return true;
+    }
+    catch (error) {
+        warn(`could not send the review's counts to ocra Cloud: ${error instanceof Error ? error.name : "error"}`);
+        return false;
+    }
+}
+/** The default models chosen on the web, for a review that configures none. */
+export async function defaultModels(deps) {
+    const session = await cloudSession(deps);
+    if (!session)
+        return {};
+    const res = await deps.fetch(`${session.server}/api/preferences/models`, {
+        headers: { authorization: `Bearer ${session.access_token}`, "user-agent": `ocra/${VERSION}` },
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok)
+        return {};
+    const body = (await res.json());
+    const chains = {};
+    for (const tier of ["top", "standard", "light"]) {
+        const list = body.models?.[tier];
+        if (Array.isArray(list) && list.every((m) => typeof m === "string" && m.startsWith("ocra-"))) {
+            if (list.length > 0)
+                chains[tier] = list;
+        }
+    }
+    return chains;
+}
+//# sourceMappingURL=cloud-upload.js.map

package/dist/review/command.d.ts

@@ -1,4 +1,5 @@
 import { type OcraPlugin } from "@open-cr-agent/core";
+import type { CloudDeps } from "../cloud.js";
 import type { ReviewArgs } from "./args.js";
 import { type Output } from "./progress.js";
 import type { RuntimeLoaders } from "./runtimes.js";
@@ -20,6 +21,7 @@ export interface ReviewDeps {
     now(): number;
     heartbeatMs: number;
     fetch?: typeof fetch;
+    cloud?: CloudDeps;
     onInterrupt?(handler: () => void): () => void;
 }
 export declare function reviewCommand(args: ReviewArgs, io: {

package/dist/review/command.js

@@ -6,6 +6,8 @@ import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
 import { localGitPlugin } from "@open-cr-agent/vcs-local";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
 import { VERSION } from "../version.js";
+import { withCloudProviders } from "./cloud-providers.js";
+import { cloudEnabled, defaultModels, repoHash, uploadOf, uploadReview } from "./cloud-upload.js";
 import { ConfigError } from "./config.js";
 import { renderPlan } from "./plan-render.js";
 import { ProgressPrinter } from "./progress.js";
@@ -60,6 +62,8 @@ export async function reviewCommand(args, io, deps) {
             vcs,
             reviewers: registry.reviewers,
             reviewerOverrides: overrides,
+            effort: config.effort,
+            roles: config.roles,
             rules: [...registry.rules, ...config.rules],
             selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
@@ -75,10 +79,20 @@ export async function reviewCommand(args, io, deps) {
     }
     const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
     const sampling = requestedSampling(config, args);
+    const cloudDeps = deps.cloud;
+    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
+    let models = config.models;
+    if (cloudDeps && signedIn && Object.values(models).every((chain) => !chain?.length)) {
+        models = await defaultModels(cloudDeps);
+        if (Object.keys(models).length > 0) {
+            io.err.write("[ocra] No models configured: using your default models from ocra Cloud\n");
+        }
+    }
+    const cloud = await withCloudProviders(models, config.providers, deps.env, cloudDeps, warn);
     const runtime = registry.createRuntime(config.runtime, {
-        models: config.models,
-        env: deps.env,
-        providers: config.providers,
+        models,
+        env: cloud.env,
+        providers: cloud.providers,
         ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
     });
     const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
@@ -88,6 +102,7 @@ export async function reviewCommand(args, io, deps) {
         interrupt.abort();
     });
     let report;
+    const started = deps.now();
     try {
         report = await review({
             runId: session.id,
@@ -146,6 +161,13 @@ export async function reviewCommand(args, io, deps) {
         }
         io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
     }
+    if (signedIn && cloudDeps && !args.noUpload) {
+        const source = args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local";
+        const upload = uploadOf(report, source, await repoHash(root, cloudDeps.credentialsPath), deps.now() - started);
+        if (await uploadReview(upload, cloudDeps, warn)) {
+            io.err.write("[ocra] Sent this review's counts to ocra Cloud (--no-upload to skip)\n");
+        }
+    }
     return exitCode(report, io.err);
 }
 // A runtime not built in comes from a plugin of the configuration.
@@ -156,6 +178,8 @@ async function builtinRuntime(runtimes, name) {
 function runOptions(config) {
     const options = {
         selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
+        effort: config.effort,
+        roles: config.roles,
     };
     if (config.concurrency !== undefined)
         options.concurrency = config.concurrency;

package/dist/review/config.d.ts

@@ -1,4 +1,4 @@
-import { type CustomProvider, type ModelChains, OcraError, type RepoRule } from "@open-cr-agent/core";
+import { type CustomProvider, type ModelChains, OcraError, type RepoRule, type TierEfforts } from "@open-cr-agent/core";
 import { z } from "zod";
 export declare const CONFIG_PATH = ".ocra/config.json";
 declare const configSchema: z.ZodObject<{
@@ -8,6 +8,29 @@ declare const configSchema: z.ZodObject<{
         standard: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         light: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
     }, z.core.$strict>>;
+    effort: z.ZodDefault<z.ZodObject<{
+        top: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        standard: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        light: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>;
     concurrency: z.ZodOptional<z.ZodNumber>;
     taskTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
     runTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
@@ -37,6 +60,26 @@ declare const configSchema: z.ZodObject<{
             lite: "lite";
             trivial: "trivial";
         }>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+    roles: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        helper: "helper";
+        judge: "judge";
+        verifier: "verifier";
+    }> & z.core.$partial, z.ZodObject<{
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
     }, z.core.$strict>>>;
     pluginSettings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -48,13 +91,18 @@ declare const configSchema: z.ZodObject<{
             output: z.ZodNumber;
             cachedInput: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            openai: "openai";
+            openrouter: "openrouter";
+        }>>;
     }, z.core.$strict>>>;
     extends: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
 export declare function configJsonSchema(): Record<string, unknown>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "providers"> & {
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers"> & {
     models: ModelChains;
+    effort: TierEfforts;
     providers: Record<string, CustomProvider>;
     rules: RepoRule[];
 };

package/dist/review/config.js

@@ -1,10 +1,13 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { OcraError, } from "@open-cr-agent/core";
-import { RISK_TIERS } from "@open-cr-agent/core/internal";
+import { AGENT_ROLES, EFFORT_LEVELS, RISK_TIERS } from "@open-cr-agent/core/internal";
 import { z } from "zod";
 import { fetchRemoteConfig, mergeConfig } from "./remote-config.js";
 export const CONFIG_PATH = ".ocra/config.json";
+// How much a model reasons before answering (ADR-0025); unset leaves the
+// provider's default.
+const effort = z.enum(EFFORT_LEVELS);
 const modelChain = z
     .union([z.string().min(1), z.array(z.string().min(1)).min(1)])
     .transform((value) => (typeof value === "string" ? [value] : value));
@@ -40,6 +43,9 @@ const providerSchema = z
     models: z
         .record(z.string().regex(/^[\w./:@-]{1,200}$/), z.object({ input: price, output: price, cachedInput: price.optional() }).strict())
         .refine((models) => Object.keys(models).length > 0, "must list at least one model"),
+    // How the endpoint takes a reasoning effort: "openai" sends
+    // reasoning_effort (the default), "openrouter" sends reasoning.effort.
+    effort: z.enum(["openai", "openrouter"]).optional(),
 })
     .strict();
 // The runtimes ocra ships; a plugin may register another name, so the
@@ -53,6 +59,11 @@ const configSchema = z
         .partial()
         .strict()
         .default({}),
+    effort: z
+        .object({ top: effort, standard: effort, light: effort })
+        .partial()
+        .strict()
+        .default({}),
     concurrency: z.number().int().min(1).max(32).optional(),
     taskTimeoutMinutes: z.number().positive().optional(),
     runTimeoutMinutes: z.number().positive().optional(),
@@ -88,10 +99,14 @@ const configSchema = z
         .object({
         enabled: z.boolean(),
         minTier: z.enum(RISK_TIERS),
+        effort,
     })
         .partial()
         .strict())
         .default({}),
+    roles: z
+        .partialRecord(z.enum(AGENT_ROLES), z.object({ effort }).partial().strict())
+        .default({}),
     pluginSettings: z.record(z.string(), z.unknown()).default({}),
     providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
     extends: z.string().min(1).optional(),
@@ -116,6 +131,11 @@ const MODEL_ENV = {
     standard: "OCRA_MODEL_STANDARD",
     light: "OCRA_MODEL_LIGHT",
 };
+const EFFORT_ENV = {
+    top: "OCRA_EFFORT_TOP",
+    standard: "OCRA_EFFORT_STANDARD",
+    light: "OCRA_EFFORT_LIGHT",
+};
 export class ConfigError extends OcraError {
     constructor(message, options) {
         super("CONFIG_INVALID", message, options);
@@ -144,10 +164,29 @@ export async function loadConfig(root, env, options = { repository: true }) {
         if (chain.length > 0)
             models[tier] = chain;
     }
+    const efforts = {
+        ...parsed.effort,
+    };
+    for (const [tier, name] of Object.entries(EFFORT_ENV)) {
+        const value = env[name]?.trim();
+        if (!value)
+            continue;
+        const level = effort.safeParse(value);
+        if (!level.success) {
+            throw new ConfigError(`${name} must be one of ${EFFORT_LEVELS.join(", ")}`);
+        }
+        efforts[tier] = level.data;
+    }
     for (const model of unpriced(parsed.providers, models)) {
         options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
     }
-    return { ...parsed, models, providers: toProviders(parsed.providers), rules };
+    return {
+        ...parsed,
+        models,
+        effort: efforts,
+        providers: toProviders(parsed.providers),
+        rules,
+    };
 }
 function toProviders(declared) {
     return Object.fromEntries(Object.entries(declared).map(([id, p]) => [
@@ -155,6 +194,7 @@ function toProviders(declared) {
         {
             baseUrl: p.baseUrl,
             ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}),
+            ...(p.effort ? { effort: p.effort } : {}),
             models: Object.fromEntries(Object.entries(p.models).map(([model, price]) => [
                 model,
                 {

package/dist/review/plan-render.js

@@ -20,7 +20,7 @@ export function renderPlan(preview) {
     lines.push("", `Review tasks: ${preview.tasks.length}`);
     const width = Math.max(0, ...preview.tasks.map((t) => t.taskId.length));
     for (const t of preview.tasks) {
-        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}  ${t.bundle}`);
+        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}${t.effort === undefined ? "" : `  effort ${t.effort}`}  ${t.bundle}`);
     }
     if (preview.skipped.length > 0) {
         lines.push("", "Skipped by the review matrix:");

package/dist/review/provenance.js

@@ -12,11 +12,14 @@ export function requestedSampling(config, args) {
 // The effective configuration and the flags that change what is reviewed
 // and how, so two runs can tell they were set up alike. Keys are names of
 // environment variables, never their values; a password written into a
-// URL is dropped. Sampling is recorded on its own.
+// URL is dropped. Sampling is recorded on its own. Effort is covered; left
+// unset it adds nothing, so configurations that set none keep their hash.
 export function configHash(config, args) {
-    const { sampling: _, providers, extends: shared, ...rest } = config;
+    const { sampling: _, providers, extends: shared, effort, roles, ...rest } = config;
     return stableHash({
         ...rest,
+        ...(Object.keys(effort).length > 0 ? { effort } : {}),
+        ...(Object.keys(roles).length > 0 ? { roles } : {}),
         ...(shared === undefined ? {} : { extends: withoutCredentials(shared) }),
         providers: Object.fromEntries(Object.entries(providers).map(([id, p]) => [
             id,

package/dist/review/remote-config.d.ts

@@ -6,6 +6,11 @@ export declare const remoteConfigSchema: z.ZodObject<{
         standard: "standard";
         top: "top";
     }>, z.ZodUnknown>>;
+    effort: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        light: "light";
+        standard: "standard";
+        top: "top";
+    }> & z.core.$partial, z.ZodUnknown>>;
     concurrency: z.ZodOptional<z.ZodUnknown>;
     taskTimeoutMinutes: z.ZodOptional<z.ZodUnknown>;
     runTimeoutMinutes: z.ZodOptional<z.ZodUnknown>;
@@ -16,6 +21,7 @@ export declare const remoteConfigSchema: z.ZodObject<{
     include: z.ZodOptional<z.ZodArray<z.ZodString>>;
     exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
     reviewers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     github: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     rules: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/dist/review/remote-config.js

@@ -11,6 +11,7 @@ export const remoteConfigSchema = z
     .object({
     $schema: z.string().optional(),
     models: z.record(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
+    effort: z.partialRecord(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
     concurrency: z.unknown().optional(),
     taskTimeoutMinutes: z.unknown().optional(),
     runTimeoutMinutes: z.unknown().optional(),
@@ -21,6 +22,7 @@ export const remoteConfigSchema = z
     include: z.array(z.string()).optional(),
     exclude: z.array(z.string()).optional(),
     reviewers: z.record(z.string(), z.unknown()).optional(),
+    roles: z.record(z.string(), z.unknown()).optional(),
     github: z.record(z.string(), z.unknown()).optional(),
     providers: z.record(z.string(), z.unknown()).optional(),
     rules: z.array(repoRuleSchema).max(500).optional(),
@@ -83,7 +85,7 @@ async function readLimited(response, limit, name) {
 export function mergeConfig(remote, local) {
     const { rules: _rules, ...settings } = remote;
     const merged = { ...settings, ...local };
-    for (const key of ["models", "reviewers", "github", "providers"]) {
+    for (const key of ["models", "effort", "reviewers", "roles", "github", "providers"]) {
         const a = settings[key];
         const b = local[key];
         if (a !== undefined || b !== undefined)

package/dist/review/sarif.js

@@ -31,7 +31,7 @@ export function renderSarif(report, version) {
                 tool: {
                     driver: {
                         name: "ocra",
-                        informationUri: "https://ocra.majincheng.com",
+                        informationUri: "https://ocracloud.com",
                         version,
                         semanticVersion: version,
                         rules: categories.map((id) => ({

package/dist/review/target.js

@@ -90,7 +90,7 @@ const GITLAB_API = "https://gitlab.com/api/v4";
 export async function mergeRequestTarget(mr, cwd, root, env, warn, fetchImpl, ignoreRepoConfig = false, configFile) {
     const token = env.GITLAB_TOKEN;
     if (!token) {
-        throw new OcraError("CONFIG_CREDENTIALS_MISSING", "--mr needs a GitLab token in GITLAB_TOKEN: a project access token with the api scope and the Developer role (CI_JOB_TOKEN cannot post comments)");
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", "--mr needs a GitLab token in GITLAB_TOKEN with the api scope and the Developer role: a project access token, or on GitLab.com Free a personal access token of a dedicated account (CI_JOB_TOKEN cannot post comments)");
     }
     const origin = await originUrl(root);
     const project = mr.project ?? env.CI_PROJECT_ID ?? gitlabProject(origin);

package/dist/run.js

@@ -2,6 +2,7 @@ import { writeFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
 import { isOcraError } from "@open-cr-agent/core";
 import { errorMessage } from "@open-cr-agent/core/internal";
+import { cloudCommand, defaultCloudDeps, LOGIN_USAGE } from "./cloud.js";
 import { memoryCommand } from "./memory.js";
 import { metricsCommand } from "./metrics.js";
 import { parseReviewArgs, REVIEW_USAGE, UsageError } from "./review/args.js";
@@ -15,6 +16,9 @@ Commands:
   review      Review code changes (run "ocra review --help" for options)
   memory      Remember findings the team accepts (run "ocra memory --help")
   metrics     Counts over past reviews: runs, cost, findings, per reviewer (run "ocra metrics --help")
+  login       Sign in to ocra Cloud (in development; run "ocra login --help")
+  logout      Sign out of ocra Cloud
+  whoami      Show the ocra Cloud account
 
 Options:
   -h, --help     Show help
@@ -27,6 +31,7 @@ export function defaultDeps() {
         builtinPlugins: BUILTIN_PLUGINS,
         runtimes: BUILTIN_RUNTIMES,
         writeFile: (path, content) => writeFile(path, content, "utf8"),
+        cloud: defaultCloudDeps(process.env),
         now: Date.now,
         heartbeatMs: 30_000,
         onInterrupt(handler) {
@@ -61,6 +66,18 @@ export async function run(argv, out, err, deps = defaultDeps()) {
             return EXIT.error;
         }
     }
+    if (command === "login" || command === "logout" || command === "whoami") {
+        try {
+            return await cloudCommand(command, rest, out, err, defaultCloudDeps(deps.env));
+        }
+        catch (error) {
+            if (error instanceof UsageError)
+                err.write(`${error.message}\n\n${LOGIN_USAGE}`);
+            else
+                err.write(failure(error));
+            return EXIT.error;
+        }
+    }
     if (command !== undefined && !command.startsWith("-")) {
         err.write(`Unknown command: ${command}\n\n${USAGE}`);
         return EXIT.error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-cr-agent/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "ocra: open-source multi-agent code review for local changes and GitHub pull requests",
   "keywords": [
     "code-review",
@@ -10,7 +10,7 @@
     "github-action"
   ],
   "license": "Apache-2.0",
-  "homepage": "https://ocra.majincheng.com",
+  "homepage": "https://ocracloud.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/jma49/Open-CR-Agent.git",
@@ -37,15 +37,15 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@open-cr-agent/core": "0.3.0",
-    "@open-cr-agent/runtime-direct": "0.3.0",
-    "@open-cr-agent/vcs-github": "0.3.0",
-    "@open-cr-agent/vcs-gitlab": "0.3.0",
-    "@open-cr-agent/vcs-local": "0.3.0",
+    "@open-cr-agent/core": "0.4.0",
+    "@open-cr-agent/runtime-direct": "0.4.0",
+    "@open-cr-agent/vcs-github": "0.4.0",
+    "@open-cr-agent/vcs-gitlab": "0.4.0",
+    "@open-cr-agent/vcs-local": "0.4.0",
     "zod": "^4.6.5"
   },
   "optionalDependencies": {
-    "@open-cr-agent/runtime-opencode": "0.3.0"
+    "@open-cr-agent/runtime-opencode": "0.4.0"
   },
   "publishConfig": {
     "access": "public"