@open-cr-agent/cli 0.3.0 → 0.5.0

package/dist/review/command.js

@@ -5,14 +5,21 @@ import { githubPlugin } from "@open-cr-agent/vcs-github";
 import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
 import { localGitPlugin } from "@open-cr-agent/vcs-local";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
+import { pluginsDir } from "../plugin-store.js";
 import { VERSION } from "../version.js";
-import { ConfigError } from "./config.js";
+import { accountPlugins } from "./account-plugins.js";
+import { withCloudProviders } from "./cloud-providers.js";
+import { prepareCloudReview, sendToCloud } from "./cloud-review.js";
+import { fetchAccountSettings, layerAccountSettings } from "./cloud-settings.js";
+import { cloudEnabled } from "./cloud-upload.js";
+import { agentChains, ConfigError } from "./config.js";
 import { renderPlan } from "./plan-render.js";
 import { ProgressPrinter } from "./progress.js";
 import { configHash, requestedSampling } from "./provenance.js";
 import { renderJson, renderText, safeJson } from "./render.js";
 import { renderSarif } from "./sarif.js";
 import { loadSarifLogs } from "./sarif-input.js";
+import { effectiveSettings, renderSettings } from "./settings-sources.js";
 import { localTarget, mergeRequestTarget, pullRequestTarget } from "./target.js";
 import { forTerminal } from "./terminal.js";
 export const SESSIONS_DIR = ".ocra/sessions";
@@ -39,34 +46,74 @@ export async function reviewCommand(args, io, deps) {
         : args.mergeRequest
             ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
             : await localTarget(localArgs, deps.cwd, root, deps.env, warn, deps.fetch);
-    const { config } = target;
+    // The account's settings fill what the repository leaves out (ADR-0027);
+    // unreachable, they cost a warning, so a plan still works offline.
+    const cloudDeps = deps.cloud;
+    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
+    let config = target.config;
+    let filled = [];
+    let fromAccount = { plugins: [], pluginSettings: {} };
+    if (cloudDeps && signedIn) {
+        const account = await fetchAccountSettings(cloudDeps, warn);
+        if (account?.settings) {
+            ({ config, filled } = layerAccountSettings(config, account.settings));
+            // The account's default for --ultra; there is no --no-ultra to refuse it.
+            if (account.settings.ultra === true && !args.ultra)
+                filled.push("ultra");
+            if (filled.length > 0) {
+                io.err.write(`[ocra] From your ocra Cloud settings: ${filled.join(", ")}\n`);
+            }
+        }
+        if (account)
+            fromAccount = account.plugins;
+    }
+    const ultra = args.ultra === true || filled.includes("ultra");
     const session = { dir: join(root, SESSIONS_DIR), id: newRunId() };
     // A plan calls no model, writes no session log and imports no runtime: it
     // works without the optional runtime-opencode.
     const builtins = args.plan
         ? deps.builtinPlugins.filter((p) => p.name !== sessionJsonlPlugin.name)
         : [...deps.builtinPlugins, ...(await builtinRuntime(deps.runtimes, config.runtime))];
-    const registry = await startPlugins([...builtins, ...target.plugins], {
+    const account = await accountPlugins(fromAccount, {
+        allowed: target.accountPlugins,
+        configured: config.plugins,
+        taken: [...builtins, ...target.plugins],
+        dir: pluginsDir(deps.env),
+        warn,
+    });
+    // The repository's own settings win; a repository plugin's come from it alone.
+    const pluginSettings = { ...account.settings, ...config.pluginSettings };
+    const registry = await startPlugins([...builtins, ...target.plugins, ...account.plugins], {
         settings: args.plan
-            ? config.pluginSettings
-            : { ...config.pluginSettings, [sessionJsonlPlugin.name]: session },
+            ? pluginSettings
+            : { ...pluginSettings, [sessionJsonlPlugin.name]: session },
         env: deps.env,
         warn,
     });
     const vcs = target.createVcs(registry);
+    const rules = [
+        ...registry.rules.map((rule) => ({ ...rule, source: "plugin" })),
+        ...config.rules,
+    ];
     const overrides = reviewerOverrides(config, args, registry.reviewers.map((r) => r.id));
     if (args.plan) {
         const preview = await previewReview({
             vcs,
             reviewers: registry.reviewers,
             reviewerOverrides: overrides,
-            rules: [...registry.rules, ...config.rules],
+            effort: config.effort,
+            roles: config.roles,
+            models: config.models,
+            rules,
             selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
-            ...(args.ultra ? { ultra: true } : {}),
+            ...(ultra ? { ultra: true } : {}),
             ...(config.maxTasks !== undefined ? { maxTasks: config.maxTasks } : {}),
         });
-        const rendered = args.format === "json" ? `${safeJson(toPlanOutput(preview))}\n` : renderPlan(preview);
+        const settings = effectiveSettings(target.config, config, filled);
+        const rendered = args.format === "json"
+            ? `${safeJson({ ...toPlanOutput(preview), settings, ...accountOf(config) })}\n`
+            : renderPlan(preview) + renderSettings(settings, config.accountSettings);
         if (args.output === undefined)
             io.out.write(rendered);
         else
@@ -74,11 +121,17 @@ export async function reviewCommand(args, io, deps) {
         return EXIT.ok;
     }
     const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
+    // The repository's hash and the account's memory for it (ADR-0028).
+    const cloudReview = cloudDeps && signedIn ? await prepareCloudReview(root, cloudDeps, warn) : undefined;
     const sampling = requestedSampling(config, args);
+    const models = config.models;
+    const agentModels = agentChains({ reviewers: overrides, roles: config.roles });
+    const cloud = await withCloudProviders([...Object.values(models), ...Object.values(agentModels)], config.providers, deps.env, cloudDeps, warn);
     const runtime = registry.createRuntime(config.runtime, {
-        models: config.models,
-        env: deps.env,
-        providers: config.providers,
+        models,
+        ...(Object.keys(agentModels).length > 0 ? { agentModels } : {}),
+        env: cloud.env,
+        providers: cloud.providers,
         ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
     });
     const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
@@ -88,22 +141,30 @@ export async function reviewCommand(args, io, deps) {
         interrupt.abort();
     });
     let report;
+    const started = deps.now();
     try {
         report = await review({
             runId: session.id,
             signal: interrupt.signal,
             ...runOptions(config),
+            models,
             reviewerOverrides: overrides,
-            provenance: { ocraVersion: VERSION, configHash: configHash(config, args), sampling },
+            provenance: {
+                ocraVersion: VERSION,
+                configHash: configHash(config, ultra ? { ...args, ultra: true } : args),
+                sampling,
+                ...accountOf(config),
+            },
             ...(args.maxCostUsd !== undefined ? { maxCostUsd: args.maxCostUsd } : {}),
-            ...(args.ultra ? { ultra: true } : {}),
+            ...(ultra ? { ultra: true } : {}),
             ...(args.full ? { fullReview: true } : {}),
             ...(sarif.length > 0 ? { sarif } : {}),
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
             vcs,
             runtime,
             reviewers: registry.reviewers,
-            rules: [...registry.rules, ...config.rules],
+            rules,
+            ...(cloudReview?.memory.length ? { accountMemory: cloudReview.memory } : {}),
             onEvent: (event) => {
                 registry.emit(event);
                 progress.onEvent(event);
@@ -128,6 +189,9 @@ export async function reviewCommand(args, io, deps) {
         await deps.writeFile(resolve(deps.cwd, args.output), rendered);
         io.err.write(`[ocra] Wrote ${args.output}\n`);
     }
+    const hidden = report.remembered.filter((e) => e.source === "account").length;
+    if (hidden > 0)
+        io.err.write(`[ocra] ${hidden} finding(s) hidden by your ocra Cloud memory\n`);
     if (interrupt.signal.aborted)
         return EXIT.interrupted;
     if (target.publish) {
@@ -146,8 +210,19 @@ export async function reviewCommand(args, io, deps) {
         }
         io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
     }
+    if (cloudReview && cloudDeps && !args.noUpload) {
+        await sendToCloud(report, cloudReview, cloudDeps, {
+            source: args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local",
+            durationMs: deps.now() - started,
+            err: io.err,
+            warn,
+        });
+    }
     return exitCode(report, io.err);
 }
+function accountOf(config) {
+    return config.accountSettings ? { accountSettings: config.accountSettings } : {};
+}
 // A runtime not built in comes from a plugin of the configuration.
 async function builtinRuntime(runtimes, name) {
     const load = Object.hasOwn(runtimes, name) ? runtimes[name] : undefined;
@@ -156,6 +231,8 @@ async function builtinRuntime(runtimes, name) {
 function runOptions(config) {
     const options = {
         selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
+        effort: config.effort,
+        roles: config.roles,
     };
     if (config.concurrency !== undefined)
         options.concurrency = config.concurrency;

package/dist/review/config.d.ts

@@ -1,13 +1,37 @@
-import { type CustomProvider, type ModelChains, OcraError, type RepoRule } from "@open-cr-agent/core";
+import { type CustomProvider, type ModelChains, OcraError, type ReviewerOverrides, type RoleSettings, type SourcedRule, type TierEfforts } from "@open-cr-agent/core";
 import { z } from "zod";
 export declare const CONFIG_PATH = ".ocra/config.json";
-declare const configSchema: z.ZodObject<{
+export declare const DEFAULT_RUNTIME = "opencode";
+export declare const configSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     models: z.ZodDefault<z.ZodObject<{
         top: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         standard: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         light: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
     }, z.core.$strict>>;
+    effort: z.ZodDefault<z.ZodObject<{
+        top: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        standard: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        light: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>;
     concurrency: z.ZodOptional<z.ZodNumber>;
     taskTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
     runTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
@@ -25,7 +49,7 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     include: z.ZodDefault<z.ZodArray<z.ZodString>>;
     exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    runtime: z.ZodDefault<z.ZodUnion<[z.ZodEnum<{
+    runtime: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
         direct: "direct";
         opencode: "opencode";
     }>, z.ZodString]>>;
@@ -37,6 +61,28 @@ declare const configSchema: z.ZodObject<{
             lite: "lite";
             trivial: "trivial";
         }>>;
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+    roles: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        helper: "helper";
+        judge: "judge";
+        verifier: "verifier";
+    }> & z.core.$partial, z.ZodObject<{
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
     }, z.core.$strict>>>;
     pluginSettings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -48,15 +94,25 @@ declare const configSchema: z.ZodObject<{
             output: z.ZodNumber;
             cachedInput: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            openai: "openai";
+            openrouter: "openrouter";
+        }>>;
     }, z.core.$strict>>>;
     extends: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
 export declare function configJsonSchema(): Record<string, unknown>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "providers"> & {
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers" | "runtime"> & {
+    runtime: string;
+    runtimeSet: boolean;
     models: ModelChains;
+    effort: TierEfforts;
     providers: Record<string, CustomProvider>;
-    rules: RepoRule[];
+    rules: SourcedRule[];
+    accountSettings?: {
+        version: string | null;
+    };
 };
 export interface LoadOptions {
     repository: boolean;
@@ -71,5 +127,8 @@ export declare class ConfigError extends OcraError {
     });
 }
 export declare function loadConfig(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<CliConfig>;
-export {};
+export declare function agentChains(config: {
+    reviewers: ReviewerOverrides;
+    roles: RoleSettings;
+}): Record<string, readonly string[]>;
 //# sourceMappingURL=config.d.ts.map

package/dist/review/config.js

@@ -1,10 +1,13 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { OcraError, } from "@open-cr-agent/core";
-import { RISK_TIERS } from "@open-cr-agent/core/internal";
+import { AGENT_ROLES, EFFORT_LEVELS, RISK_TIERS } from "@open-cr-agent/core/internal";
 import { z } from "zod";
 import { fetchRemoteConfig, mergeConfig } from "./remote-config.js";
 export const CONFIG_PATH = ".ocra/config.json";
+// How much a model reasons before answering (ADR-0025); unset leaves the
+// provider's default.
+const effort = z.enum(EFFORT_LEVELS);
 const modelChain = z
     .union([z.string().min(1), z.array(z.string().min(1)).min(1)])
     .transform((value) => (typeof value === "string" ? [value] : value));
@@ -40,12 +43,16 @@ const providerSchema = z
     models: z
         .record(z.string().regex(/^[\w./:@-]{1,200}$/), z.object({ input: price, output: price, cachedInput: price.optional() }).strict())
         .refine((models) => Object.keys(models).length > 0, "must list at least one model"),
+    // How the endpoint takes a reasoning effort: "openai" sends
+    // reasoning_effort (the default), "openrouter" sends reasoning.effort.
+    effort: z.enum(["openai", "openrouter"]).optional(),
 })
     .strict();
 // The runtimes ocra ships; a plugin may register another name, so the
 // schema lists these for editors and still accepts any other string.
 const BUILTIN_RUNTIMES = ["opencode", "direct"];
-const configSchema = z
+export const DEFAULT_RUNTIME = "opencode";
+export const configSchema = z
     .object({
     $schema: z.string().optional(),
     models: z
@@ -53,6 +60,11 @@ const configSchema = z
         .partial()
         .strict()
         .default({}),
+    effort: z
+        .object({ top: effort, standard: effort, light: effort })
+        .partial()
+        .strict()
+        .default({}),
     concurrency: z.number().int().min(1).max(32).optional(),
     taskTimeoutMinutes: z.number().positive().optional(),
     runTimeoutMinutes: z.number().positive().optional(),
@@ -81,17 +93,25 @@ const configSchema = z
         .default({}),
     include: z.array(z.string().min(1)).default([]),
     exclude: z.array(z.string().min(1)).default([]),
-    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).default("opencode"),
+    // Unset means "opencode"; loadConfig fills it in and records whether the
+    // file chose, so account defaults (ADR-0025) apply only where it did not.
+    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).optional(),
     plugins: z.array(z.string().min(1)).default([]),
     reviewers: z
         .record(z.string(), z
         .object({
         enabled: z.boolean(),
         minTier: z.enum(RISK_TIERS),
+        // The reviewer's own chain, for its review tasks and plan call.
+        models: modelChain,
+        effort,
     })
         .partial()
         .strict())
         .default({}),
+    roles: z
+        .partialRecord(z.enum(AGENT_ROLES), z.object({ models: modelChain, effort }).partial().strict())
+        .default({}),
     pluginSettings: z.record(z.string(), z.unknown()).default({}),
     providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
     extends: z.string().min(1).optional(),
@@ -116,6 +136,11 @@ const MODEL_ENV = {
     standard: "OCRA_MODEL_STANDARD",
     light: "OCRA_MODEL_LIGHT",
 };
+const EFFORT_ENV = {
+    top: "OCRA_EFFORT_TOP",
+    standard: "OCRA_EFFORT_STANDARD",
+    light: "OCRA_EFFORT_LIGHT",
+};
 export class ConfigError extends OcraError {
     constructor(message, options) {
         super("CONFIG_INVALID", message, options);
@@ -144,10 +169,34 @@ export async function loadConfig(root, env, options = { repository: true }) {
         if (chain.length > 0)
             models[tier] = chain;
     }
-    for (const model of unpriced(parsed.providers, models)) {
+    const efforts = {
+        ...parsed.effort,
+    };
+    for (const [tier, name] of Object.entries(EFFORT_ENV)) {
+        const value = env[name]?.trim();
+        if (!value)
+            continue;
+        const level = effort.safeParse(value);
+        if (!level.success) {
+            throw new ConfigError(`${name} must be one of ${EFFORT_LEVELS.join(", ")}`);
+        }
+        efforts[tier] = level.data;
+    }
+    for (const model of unpriced(parsed.providers, [
+        ...Object.values(models),
+        ...Object.values(agentChains(parsed)),
+    ])) {
         options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
     }
-    return { ...parsed, models, providers: toProviders(parsed.providers), rules };
+    return {
+        ...parsed,
+        runtime: parsed.runtime ?? DEFAULT_RUNTIME,
+        runtimeSet: parsed.runtime !== undefined,
+        models,
+        effort: efforts,
+        providers: toProviders(parsed.providers),
+        rules: rules.map((rule) => ({ ...rule, source: "shared" })),
+    };
 }
 function toProviders(declared) {
     return Object.fromEntries(Object.entries(declared).map(([id, p]) => [
@@ -155,6 +204,7 @@ function toProviders(declared) {
         {
             baseUrl: p.baseUrl,
             ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}),
+            ...(p.effort ? { effort: p.effort } : {}),
             models: Object.fromEntries(Object.entries(p.models).map(([model, price]) => [
                 model,
                 {
@@ -166,9 +216,23 @@ function toProviders(declared) {
         },
     ]));
 }
+// The reviewers' and roles' own chains, by agent id (ADR-0025); a disabled
+// reviewer's is left out, since it makes no call.
+export function agentChains(config) {
+    const chains = {};
+    for (const [id, setting] of Object.entries(config.reviewers)) {
+        if (setting.models && setting.enabled !== false)
+            chains[id] = setting.models;
+    }
+    for (const [role, setting] of Object.entries(config.roles)) {
+        if (setting?.models)
+            chains[role] = setting.models;
+    }
+    return chains;
+}
 // Models of declared providers, named in a chain, priced at 0 per token.
-function unpriced(providers, models) {
-    const named = new Set(Object.values(models).flat());
+function unpriced(providers, chains) {
+    const named = new Set(chains.flatMap((chain) => chain ?? []));
     return [...named].filter((model) => {
         const slash = model.indexOf("/");
         const price = providers[model.slice(0, slash)]?.models[model.slice(slash + 1)];

package/dist/review/plan-render.js

@@ -20,7 +20,7 @@ export function renderPlan(preview) {
     lines.push("", `Review tasks: ${preview.tasks.length}`);
     const width = Math.max(0, ...preview.tasks.map((t) => t.taskId.length));
     for (const t of preview.tasks) {
-        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}  ${t.bundle}`);
+        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}${t.effort === undefined ? "" : `  effort ${t.effort}`}${t.models === undefined ? "" : `  models ${t.models.join(", ")}`}  ${t.bundle}`);
     }
     if (preview.skipped.length > 0) {
         lines.push("", "Skipped by the review matrix:");

package/dist/review/plugins.d.ts

@@ -1,3 +1,13 @@
 import type { OcraPlugin } from "@open-cr-agent/core";
 export declare function loadExternalPlugins(specifiers: readonly string[], root: string): Promise<OcraPlugin[]>;
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export declare function loadAccountPlugins(names: readonly string[], dir: string, warn: (message: string) => void): Promise<{
+    name: string;
+    plugin: OcraPlugin;
+}[]>;
 //# sourceMappingURL=plugins.d.ts.map

package/dist/review/plugins.js

@@ -1,6 +1,8 @@
+import { realpath } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, join, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
+import { installedEntry, readAllowed } from "../plugin-store.js";
 import { ConfigError } from "./config.js";
 // Plugins listed in the repository config execute code, so they are resolved
 // only from the repository's own dependencies or relative paths inside it.
@@ -29,4 +31,47 @@ function resolvePlugin(specifier, root) {
 function isPlugin(value) {
     return (typeof value === "object" && value !== null && typeof value.name === "string");
 }
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export async function loadAccountPlugins(names, dir, warn) {
+    const allowed = new Map((await readAllowed(dir)).map((p) => [p.name, p]));
+    const missing = names.filter((name) => !allowed.has(name));
+    if (missing.length > 0) {
+        warn(`your ocra Cloud settings name plugins this machine has not allowed, so they do not load: ${missing.join(", ")}; allow each with ocra plugins allow <name>@<version>`);
+    }
+    const loaded = [];
+    for (const name of names) {
+        const record = allowed.get(name);
+        if (!record)
+            continue;
+        try {
+            const installed = await installedEntry(dir, name);
+            if (installed?.version !== record.version || installed.integrity !== record.integrity) {
+                throw new Error(`it is not the ${record.version} allowed here; run ocra plugins allow ${name}@<version> again`);
+            }
+            const module = await import(pathToFileURL(await allowedEntry(dir, name)).href);
+            const plugin = module.default ?? module.plugin;
+            if (!isPlugin(plugin))
+                throw new Error('it exports no ocra plugin as default or "plugin"');
+            loaded.push({ name, plugin });
+        }
+        catch (error) {
+            warn(`skipping plugin ${name} from your ocra Cloud settings: ${error.message}`);
+        }
+    }
+    return loaded;
+}
+// Node's resolution walks up past the directory to any node_modules above
+// it; the entry must be inside the allowed package itself.
+async function allowedEntry(dir, name) {
+    const entry = await realpath(createRequire(join(dir, "package.json")).resolve(name));
+    const root = await realpath(join(dir, "node_modules", name));
+    if (!entry.startsWith(`${root}${sep}`))
+        throw new Error(`it resolves outside ${dir}`);
+    return entry;
+}
 //# sourceMappingURL=plugins.js.map

package/dist/review/provenance.js

@@ -12,11 +12,24 @@ export function requestedSampling(config, args) {
 // The effective configuration and the flags that change what is reviewed
 // and how, so two runs can tell they were set up alike. Keys are names of
 // environment variables, never their values; a password written into a
-// URL is dropped. Sampling is recorded on its own.
+// URL is dropped. Sampling is recorded on its own. Effort is covered; left
+// unset it adds nothing, so configurations that set none keep their hash.
+// The ocra Cloud account settings (ADR-0027) add their version and rules
+// only when they were layered in, so a signed-out run keeps its hash.
 export function configHash(config, args) {
-    const { sampling: _, providers, extends: shared, ...rest } = config;
+    // runtimeSet says where the runtime came from, not what ran: the runtime is hashed.
+    const { sampling: _, runtimeSet: _set, providers, extends: shared, effort, roles, rules, accountSettings, ...rest } = config;
+    const bare = (account) => rules
+        .filter((rule) => (rule.source === "account") === account)
+        .map(({ path, rule }) => ({ path, rule }));
     return stableHash({
         ...rest,
+        rules: bare(false),
+        ...(accountSettings
+            ? { account: { version: accountSettings.version, rules: bare(true) } }
+            : {}),
+        ...(Object.keys(effort).length > 0 ? { effort } : {}),
+        ...(Object.keys(roles).length > 0 ? { roles } : {}),
         ...(shared === undefined ? {} : { extends: withoutCredentials(shared) }),
         providers: Object.fromEntries(Object.entries(providers).map(([id, p]) => [
             id,

package/dist/review/remote-config.d.ts

@@ -6,6 +6,11 @@ export declare const remoteConfigSchema: z.ZodObject<{
         standard: "standard";
         top: "top";
     }>, z.ZodUnknown>>;
+    effort: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        light: "light";
+        standard: "standard";
+        top: "top";
+    }> & z.core.$partial, z.ZodUnknown>>;
     concurrency: z.ZodOptional<z.ZodUnknown>;
     taskTimeoutMinutes: z.ZodOptional<z.ZodUnknown>;
     runTimeoutMinutes: z.ZodOptional<z.ZodUnknown>;
@@ -16,6 +21,7 @@ export declare const remoteConfigSchema: z.ZodObject<{
     include: z.ZodOptional<z.ZodArray<z.ZodString>>;
     exclude: z.ZodOptional<z.ZodArray<z.ZodString>>;
     reviewers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     github: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     rules: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/dist/review/remote-config.js

@@ -11,6 +11,7 @@ export const remoteConfigSchema = z
     .object({
     $schema: z.string().optional(),
     models: z.record(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
+    effort: z.partialRecord(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
     concurrency: z.unknown().optional(),
     taskTimeoutMinutes: z.unknown().optional(),
     runTimeoutMinutes: z.unknown().optional(),
@@ -21,6 +22,7 @@ export const remoteConfigSchema = z
     include: z.array(z.string()).optional(),
     exclude: z.array(z.string()).optional(),
     reviewers: z.record(z.string(), z.unknown()).optional(),
+    roles: z.record(z.string(), z.unknown()).optional(),
     github: z.record(z.string(), z.unknown()).optional(),
     providers: z.record(z.string(), z.unknown()).optional(),
     rules: z.array(repoRuleSchema).max(500).optional(),
@@ -83,7 +85,7 @@ async function readLimited(response, limit, name) {
 export function mergeConfig(remote, local) {
     const { rules: _rules, ...settings } = remote;
     const merged = { ...settings, ...local };
-    for (const key of ["models", "reviewers", "github", "providers"]) {
+    for (const key of ["models", "effort", "reviewers", "roles", "github", "providers"]) {
         const a = settings[key];
         const b = local[key];
         if (a !== undefined || b !== undefined)

package/dist/review/render.js

@@ -55,8 +55,13 @@ export function renderText(report, sessionDir) {
     if (refuted.length > 0) {
         lines.push(`Verification dropped ${refuted.length} finding(s) the code disproves (see the JSON report).`);
     }
-    if (report.remembered.length > 0) {
-        lines.push(`${report.remembered.length} finding(s) matched the repository's memory and were not reported.`);
+    const fromRepository = report.remembered.filter((e) => e.source === "repository").length;
+    const fromAccount = report.remembered.length - fromRepository;
+    if (fromRepository > 0) {
+        lines.push(`${fromRepository} finding(s) matched the repository's memory and were not reported.`);
+    }
+    if (fromAccount > 0) {
+        lines.push(`${fromAccount} finding(s) matched your ocra Cloud memory and were not reported.`);
     }
     const rereview = report.rereview;
     if (report.scope?.mode === "incremental") {

package/dist/review/sarif.js

@@ -31,7 +31,7 @@ export function renderSarif(report, version) {
                 tool: {
                     driver: {
                         name: "ocra",
-                        informationUri: "https://ocra.majincheng.com",
+                        informationUri: "https://ocracloud.com",
                         version,
                         semanticVersion: version,
                         rules: categories.map((id) => ({

package/dist/review/settings-sources.d.ts

@@ -0,0 +1,11 @@
+import type { CliConfig } from "./config.js";
+export type SettingSource = "file" | "account" | "file+account" | "default";
+export interface EffectiveSetting {
+    key: string;
+    value?: unknown;
+    source: SettingSource;
+}
+/** file: the configuration before the account's settings; effective: after; filled: what they filled. */
+export declare function effectiveSettings(file: CliConfig, effective: CliConfig, filled: readonly string[]): EffectiveSetting[];
+export declare function renderSettings(settings: readonly EffectiveSetting[], account: CliConfig["accountSettings"]): string;
+//# sourceMappingURL=settings-sources.d.ts.map