@open-cr-agent/cli 0.4.0 → 0.5.0

package/dist/account-salt.d.ts

@@ -0,0 +1,7 @@
+import type { CloudDeps } from "./cloud.js";
+export declare function accountSaltPath(credentialsPath: string): string;
+/** The account's salt, or null; throws when the server cannot be asked. */
+export declare function fetchAccountSalt(deps: Pick<CloudDeps, "fetch">, server: string, token: string): Promise<string | null>;
+/** Keeps the salt beside the credentials (0600), or removes it when the account has none. */
+export declare function saveAccountSalt(credentialsPath: string, salt: string | null): Promise<void>;
+//# sourceMappingURL=account-salt.d.ts.map

package/dist/account-salt.js

@@ -0,0 +1,43 @@
+import { chmod, mkdir, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { VERSION } from "./version.js";
+// The account's repository-hash salt (ADR-0028, 4). The server answers one
+// only while the account shares findings, so that a repository hashes alike
+// on every machine of the account; null means the per-machine salt stays.
+// It is kept beside the credentials, readable only by this user, and
+// refreshed at login and by each signed-in review.
+const SALT = /^[0-9a-f]{64}$/;
+export function accountSaltPath(credentialsPath) {
+    return join(dirname(credentialsPath), "account-salt");
+}
+/** The account's salt, or null; throws when the server cannot be asked. */
+export async function fetchAccountSalt(deps, server, token) {
+    const res = await deps.fetch(`${server}/api/account/salt`, {
+        headers: { authorization: `Bearer ${token}`, "user-agent": `ocra/${VERSION}` },
+        signal: AbortSignal.timeout(15_000),
+    });
+    // A server without account salts shares no findings.
+    if (res.status === 404)
+        return null;
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    const body = (await res.json());
+    if (body.salt === null)
+        return null;
+    if (typeof body.salt === "string" && SALT.test(body.salt))
+        return body.salt;
+    throw new Error("the answer is not a salt");
+}
+/** Keeps the salt beside the credentials (0600), or removes it when the account has none. */
+export async function saveAccountSalt(credentialsPath, salt) {
+    const path = accountSaltPath(credentialsPath);
+    if (salt === null) {
+        await rm(path, { force: true });
+        return;
+    }
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${salt}\n`, { mode: 0o600 });
+    // writeFile keeps the mode of a file that already exists.
+    await chmod(path, 0o600);
+}
+//# sourceMappingURL=account-salt.js.map

package/dist/cloud.d.ts

@@ -21,6 +21,8 @@ export type CloudDeps = {
 };
 export declare function defaultCloudDeps(env?: CloudDeps["env"]): CloudDeps;
 export declare function credentialsPath(env: CloudDeps["env"]): string;
+/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
+export declare function ocraConfigDir(env: CloudDeps["env"]): string;
 export declare function readCredentials(path: string): Promise<Credentials | undefined>;
 /**
  * The saved session with a live access token, refreshed (and saved) when

package/dist/cloud.js

@@ -4,6 +4,7 @@ import { homedir, hostname } from "node:os";
 import { dirname, join } from "node:path";
 import { parseArgs } from "node:util";
 import { errorMessage } from "@open-cr-agent/core/internal";
+import { fetchAccountSalt, saveAccountSalt } from "./account-salt.js";
 import { UsageError } from "./review/args.js";
 import { forTerminal } from "./review/terminal.js";
 import { VERSION } from "./version.js";
@@ -42,10 +43,14 @@ function credentialsHint() {
         : "~/.config/ocra/credentials.json";
 }
 export function credentialsPath(env) {
+    return join(ocraConfigDir(env), "credentials.json");
+}
+/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
+export function ocraConfigDir(env) {
     const base = process.platform === "win32"
         ? (env.APPDATA ?? join(homedir(), "AppData", "Roaming"))
         : (env.XDG_CONFIG_HOME ?? join(homedir(), ".config"));
-    return join(base, "ocra", "credentials.json");
+    return join(base, "ocra");
 }
 function cloudUrl(env) {
     const named = env.OCRA_CLOUD_URL || DEFAULT_CLOUD_URL;
@@ -193,6 +198,7 @@ async function logout(out, deps) {
         }
     }
     await rm(deps.credentialsPath, { force: true });
+    await saveAccountSalt(deps.credentialsPath, null);
     out.write(saved ? "Signed out.\n" : "Not signed in.\n");
     return 0;
 }
@@ -238,6 +244,10 @@ async function login(out, err, deps, browser) {
                 expires_at: deps.now() + t.expires_in * 1000,
             };
             await writeCredentials(deps.credentialsPath, credentials);
+            // Best effort: each signed-in review asks again.
+            await fetchAccountSalt(deps, server, t.access_token)
+                .then((salt) => saveAccountSalt(deps.credentialsPath, salt))
+                .catch(() => { });
             out.write(forTerminal(`Signed in as ${credentials.login}.\n`));
             return 0;
         }

package/dist/plugin-store.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+export declare function isPackageName(name: string): boolean;
+export declare function isExactVersion(version: string): boolean;
+declare const allowedSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    integrity: z.ZodString;
+}, z.core.$strict>;
+export type AllowedPlugin = z.infer<typeof allowedSchema>;
+export declare function pluginsDir(env: Readonly<Record<string, string | undefined>>): string;
+export declare function readAllowed(dir: string): Promise<AllowedPlugin[]>;
+export declare function writeAllowed(dir: string, plugins: readonly AllowedPlugin[]): Promise<void>;
+export declare function ensureDir(dir: string): Promise<void>;
+/** What npm's lockfile in the directory says it installed for a package. */
+export declare function installedEntry(dir: string, name: string): Promise<{
+    version?: string;
+    integrity?: string;
+} | undefined>;
+export {};
+//# sourceMappingURL=plugin-store.d.ts.map

package/dist/plugin-store.js

@@ -0,0 +1,84 @@
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { ocraConfigDir } from "./cloud.js";
+import { ConfigError } from "./review/config.js";
+// The plugins this machine allows its ocra Cloud account to name (ADR-0027):
+// installed by `ocra plugins allow` into a directory of the user's own, never
+// the reviewed checkout, and recorded with the integrity npm installed.
+// npm's package-name rules, less a leading "-" or "." that npm could read as
+// an option or a path; at most 214 characters.
+const PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+// An exact version: no range, tag or URL.
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function isPackageName(name) {
+    return name.length <= 214 && PACKAGE_NAME.test(name);
+}
+export function isExactVersion(version) {
+    return version.length <= 256 && EXACT_VERSION.test(version);
+}
+const allowedSchema = z
+    .object({
+    name: z.string().refine(isPackageName),
+    version: z.string().refine(isExactVersion),
+    integrity: z.string().min(1),
+})
+    .strict();
+const fileSchema = z.object({ plugins: z.array(allowedSchema) }).strict();
+export function pluginsDir(env) {
+    return join(ocraConfigDir(env), "plugins");
+}
+export async function readAllowed(dir) {
+    let text;
+    try {
+        text = await readFile(join(dir, "plugins.json"), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        data = undefined;
+    }
+    const parsed = fileSchema.safeParse(data);
+    if (!parsed.success) {
+        throw new ConfigError(`${join(dir, "plugins.json")} is invalid; allow the plugins again or remove it`);
+    }
+    return parsed.data.plugins;
+}
+export async function writeAllowed(dir, plugins) {
+    await ensureDir(dir);
+    const path = join(dir, "plugins.json");
+    const sorted = [...plugins].sort((a, b) => (a.name < b.name ? -1 : 1));
+    await writeFile(path, `${JSON.stringify({ plugins: sorted }, null, 2)}\n`, { mode: 0o600 });
+    // writeFile keeps the mode of a file that already exists.
+    await chmod(path, 0o600);
+}
+export async function ensureDir(dir) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+}
+/** What npm's lockfile in the directory says it installed for a package. */
+export async function installedEntry(dir, name) {
+    let lock;
+    try {
+        lock = JSON.parse(await readFile(join(dir, "package-lock.json"), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    const entry = lock.packages?.[`node_modules/${name}`];
+    if (typeof entry !== "object" || entry === null)
+        return undefined;
+    const { version, integrity } = entry;
+    return {
+        ...(typeof version === "string" ? { version } : {}),
+        ...(typeof integrity === "string" ? { integrity } : {}),
+    };
+}
+//# sourceMappingURL=plugin-store.js.map

package/dist/plugins-command.d.ts

@@ -0,0 +1,15 @@
+import type { Output } from "./review/progress.js";
+export declare const PLUGINS_USAGE = "Usage: ocra plugins allow <name>@<version>\n       ocra plugins deny <name>\n       ocra plugins list\n\nYour ocra Cloud settings may name plugins; a review loads one only if this\nmachine allows it. allow shows the package and who published it, installs that\nexact version with install scripts off into a directory of your own, and\nrecords its integrity; deny removes it.\n";
+/** Runs npm with these arguments, never through a shell; resolves with its standard output. */
+export type NpmRunner = (args: readonly string[]) => Promise<string>;
+export interface PluginsDeps {
+    dir: string;
+    npm: NpmRunner;
+}
+export declare function pluginsCommand(argv: readonly string[], out: Output, deps: PluginsDeps): Promise<number>;
+export declare function parseSpec(spec: string): {
+    name: string;
+    version: string;
+};
+export declare function defaultNpm(env?: NodeJS.ProcessEnv): NpmRunner;
+//# sourceMappingURL=plugins-command.d.ts.map

package/dist/plugins-command.js

@@ -0,0 +1,183 @@
+import { execFile } from "node:child_process";
+import { access, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { ensureDir, installedEntry, isExactVersion, isPackageName, readAllowed, writeAllowed, } from "./plugin-store.js";
+import { UsageError } from "./review/args.js";
+import { ConfigError } from "./review/config.js";
+import { forTerminal } from "./review/terminal.js";
+// `ocra plugins` (ADR-0027): the user's own decision, on each machine, to
+// let their ocra Cloud account load a third-party plugin, like adding a
+// dependency. The account names packages; only what is allowed here loads.
+export const PLUGINS_USAGE = `Usage: ocra plugins allow <name>@<version>
+       ocra plugins deny <name>
+       ocra plugins list
+
+Your ocra Cloud settings may name plugins; a review loads one only if this
+machine allows it. allow shows the package and who published it, installs that
+exact version with install scripts off into a directory of your own, and
+records its integrity; deny removes it.
+`;
+export async function pluginsCommand(argv, out, deps) {
+    const [action, target, ...extra] = argv;
+    if (action === "--help" || action === "-h" || action === "help") {
+        out.write(PLUGINS_USAGE);
+        return 0;
+    }
+    if (extra.length > 0)
+        throw new UsageError(`Unexpected argument: ${extra[0]}`);
+    if (action === "list" && target === undefined)
+        return list(out, deps.dir);
+    if (action === "allow" && target !== undefined)
+        return allow(target, out, deps);
+    if (action === "deny" && target !== undefined)
+        return deny(target, out, deps);
+    throw new UsageError(action ? `Unknown or incomplete command: plugins ${action}` : "");
+}
+async function list(out, dir) {
+    const allowed = await readAllowed(dir);
+    if (allowed.length === 0) {
+        out.write("No plugins allowed. Allow one with: ocra plugins allow <name>@<version>\n");
+        return 0;
+    }
+    for (const p of allowed)
+        out.write(`${p.name}@${p.version}  ${p.integrity}\n`);
+    out.write(`(installed in ${dir})\n`);
+    return 0;
+}
+export function parseSpec(spec) {
+    const at = spec.lastIndexOf("@");
+    const name = at > 0 ? spec.slice(0, at) : spec;
+    const version = at > 0 ? spec.slice(at + 1) : "";
+    if (!isPackageName(name))
+        throw new UsageError(`Not an npm package name: ${forTerminal(name)}`);
+    if (!isExactVersion(version)) {
+        throw new UsageError(`Name an exact version, such as ${name}@1.2.3: a range or tag could install something else later`);
+    }
+    return { name, version };
+}
+async function allow(spec, out, deps) {
+    const { name, version } = parseSpec(spec);
+    const view = describe(await deps.npm(["view", `${name}@${version}`, "--json"]));
+    if (view.name !== name || view.version !== version) {
+        throw new ConfigError(`npm did not resolve ${name}@${version} to that exact version`);
+    }
+    out.write(forTerminal([
+        `Package:      ${view.name}@${view.version}`,
+        `Published by: ${view.publisher ?? "unknown"}`,
+        `Maintainers:  ${view.maintainers.join(", ") || "unknown"}`,
+        `Integrity:    ${view.integrity ?? "unknown"}`,
+        `Installing into ${deps.dir} with install scripts off`,
+        "",
+    ].join("\n")));
+    await ensureDir(deps.dir);
+    // npm installs into the nearest package.json; one of the directory's own
+    // keeps it from walking up to a project.
+    const manifest = join(deps.dir, "package.json");
+    if (!(await exists(manifest))) {
+        await writeFile(manifest, `${JSON.stringify({ private: true }, null, 2)}\n`, { mode: 0o600 });
+    }
+    await deps.npm([
+        "install",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--save-exact",
+        "--prefix",
+        deps.dir,
+        `${name}@${version}`,
+    ]);
+    const installed = await installedEntry(deps.dir, name);
+    if (installed?.version !== version || !installed.integrity) {
+        throw new ConfigError(`npm did not install ${name}@${version} into ${deps.dir}`);
+    }
+    if (view.integrity && view.integrity !== installed.integrity) {
+        throw new ConfigError(`${name}@${version} installed with another integrity than the registry lists; not allowed`);
+    }
+    const entry = { name, version, integrity: installed.integrity };
+    const allowed = (await readAllowed(deps.dir)).filter((p) => p.name !== name);
+    await writeAllowed(deps.dir, [...allowed, entry]);
+    out.write(`Allowed ${name}@${version}: your ocra Cloud settings can now load it here.\n`);
+    return 0;
+}
+async function deny(name, out, deps) {
+    if (!isPackageName(name))
+        throw new UsageError(`Not an npm package name: ${forTerminal(name)}`);
+    const allowed = await readAllowed(deps.dir);
+    const kept = allowed.filter((p) => p.name !== name);
+    if (kept.length === allowed.length) {
+        out.write(`${name} was not allowed.\n`);
+        return 0;
+    }
+    // The record is what loading checks; removing the files is housekeeping.
+    await writeAllowed(deps.dir, kept);
+    try {
+        await deps.npm([
+            "uninstall",
+            "--ignore-scripts",
+            "--no-audit",
+            "--no-fund",
+            "--prefix",
+            deps.dir,
+            name,
+        ]);
+    }
+    catch {
+        await rm(join(deps.dir, "node_modules", name), { recursive: true, force: true });
+    }
+    out.write(`Denied ${name}: it no longer loads.\n`);
+    return 0;
+}
+function describe(stdout) {
+    let data;
+    try {
+        data = JSON.parse(stdout);
+    }
+    catch {
+        throw new ConfigError("npm view did not answer with JSON");
+    }
+    if (Array.isArray(data))
+        data = data.length === 1 ? data[0] : undefined;
+    if (typeof data !== "object" || data === null) {
+        throw new ConfigError("npm view did not describe one version");
+    }
+    const v = data;
+    const person = (p) => typeof p === "string"
+        ? p
+        : typeof p === "object" && p !== null && typeof p.name === "string"
+            ? p.name
+            : undefined;
+    const integrity = v.dist?.integrity ?? v["dist.integrity"];
+    const publisher = person(v._npmUser);
+    return {
+        ...(typeof v.name === "string" ? { name: v.name } : {}),
+        ...(typeof v.version === "string" ? { version: v.version } : {}),
+        ...(publisher ? { publisher } : {}),
+        maintainers: (Array.isArray(v.maintainers) ? v.maintainers : [])
+            .map(person)
+            .filter((m) => m !== undefined),
+        ...(typeof integrity === "string" ? { integrity } : {}),
+    };
+}
+async function exists(path) {
+    return access(path).then(() => true, () => false);
+}
+// npm on Windows is npm.cmd, which execFile cannot run without a shell; run
+// the npm that ships with this Node directly instead.
+export function defaultNpm(env = process.env) {
+    const [file, prefix] = process.platform === "win32"
+        ? [
+            process.execPath,
+            [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")],
+        ]
+        : ["npm", []];
+    return (args) => new Promise((resolve, reject) => {
+        execFile(file, [...prefix, ...args], { env, timeout: 5 * 60_000, maxBuffer: 16 * 1024 * 1024, shell: false }, (error, stdout, stderr) => {
+            if (error) {
+                reject(new ConfigError(`npm ${args[0]} failed: ${forTerminal(String(stderr).trim().split("\n").slice(-3).join(" ") || error.message)}`));
+            }
+            else
+                resolve(String(stdout));
+        });
+    });
+}
+//# sourceMappingURL=plugins-command.js.map

package/dist/review/account-plugins.d.ts

@@ -0,0 +1,23 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+export interface AccountPlugins {
+    plugins: string[];
+    pluginSettings: Record<string, unknown>;
+}
+export declare function parseAccountPlugins(body: unknown, warn: (message: string) => void): AccountPlugins;
+/**
+ * The account's plugins this review loads, and their settings. Only where a
+ * repository's plugins could load (allowed: never for pull or merge requests,
+ * never with --no-repo-config); a package the configuration already lists
+ * loads as the configuration's, and a plugin whose name is taken is skipped.
+ */
+export declare function accountPlugins(account: AccountPlugins, options: {
+    allowed: boolean;
+    configured: readonly string[];
+    taken: readonly OcraPlugin[];
+    dir: string;
+    warn: (message: string) => void;
+}): Promise<{
+    plugins: OcraPlugin[];
+    settings: Record<string, unknown>;
+}>;
+//# sourceMappingURL=account-plugins.d.ts.map

package/dist/review/account-plugins.js

@@ -0,0 +1,54 @@
+import { isPackageName } from "../plugin-store.js";
+import { loadAccountPlugins } from "./plugins.js";
+const MAX_PLUGINS = 50;
+export function parseAccountPlugins(body, warn) {
+    const settings = record(record(body).settings);
+    const listed = Array.isArray(settings.plugins) ? settings.plugins : [];
+    const plugins = [
+        ...new Set(listed.filter((p) => typeof p === "string" && isPackageName(p))),
+    ].slice(0, MAX_PLUGINS);
+    const refused = listed.filter((p) => typeof p !== "string" || !isPackageName(p));
+    if (refused.length > 0 || (settings.plugins !== undefined && !Array.isArray(settings.plugins))) {
+        warn(`ignoring plugins in your ocra Cloud settings that are not npm package names: ${refused.map((p) => JSON.stringify(p)).join(", ") || JSON.stringify(settings.plugins)}`);
+    }
+    if (listed.length > MAX_PLUGINS) {
+        warn(`your ocra Cloud settings name more than ${MAX_PLUGINS} plugins; the rest are ignored`);
+    }
+    return { plugins, pluginSettings: record(settings.pluginSettings) };
+}
+/**
+ * The account's plugins this review loads, and their settings. Only where a
+ * repository's plugins could load (allowed: never for pull or merge requests,
+ * never with --no-repo-config); a package the configuration already lists
+ * loads as the configuration's, and a plugin whose name is taken is skipped.
+ */
+export async function accountPlugins(account, options) {
+    const names = account.plugins.filter((name) => !options.configured.includes(name));
+    if (names.length === 0)
+        return { plugins: [], settings: {} };
+    if (!options.allowed) {
+        options.warn(`plugins from your ocra Cloud settings do not load for pull or merge requests or with --no-repo-config: ${names.join(", ")}`);
+        return { plugins: [], settings: {} };
+    }
+    const taken = new Set(options.taken.map((p) => p.name));
+    const plugins = [];
+    const settings = {};
+    for (const { name, plugin } of await loadAccountPlugins(names, options.dir, options.warn)) {
+        if (taken.has(plugin.name)) {
+            options.warn(`skipping plugin ${name} from your ocra Cloud settings: a plugin named "${plugin.name}" is already loaded`);
+            continue;
+        }
+        taken.add(plugin.name);
+        plugins.push(plugin);
+        if (Object.hasOwn(account.pluginSettings, plugin.name)) {
+            settings[plugin.name] = account.pluginSettings[plugin.name];
+        }
+    }
+    return { plugins, settings };
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
+//# sourceMappingURL=account-plugins.js.map

package/dist/review/account-settings.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+declare const SETTINGS: {
+    readonly concurrency: z.ZodOptional<z.ZodNumber>;
+    readonly taskTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
+    readonly runTimeoutMinutes: z.ZodOptional<z.ZodNumber>;
+    readonly maxCostUsd: z.ZodOptional<z.ZodNumber>;
+    readonly maxTasks: z.ZodOptional<z.ZodNumber>;
+    readonly verify: z.ZodOptional<z.ZodBoolean>;
+    readonly judge: z.ZodOptional<z.ZodBoolean>;
+    readonly sampling: z.ZodOptional<z.ZodObject<{
+        temperature: z.ZodOptional<z.ZodNumber>;
+        seed: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    readonly include: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    readonly exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    readonly rules: z.ZodArray<z.ZodObject<{
+        path: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+        rule: z.ZodString;
+    }, z.core.$strict>>;
+    readonly ultra: z.ZodBoolean;
+};
+declare const AGENTS: {
+    readonly effort: z.ZodDefault<z.ZodObject<{
+        top: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        standard: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+        light: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>;
+    readonly reviewers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        minTier: z.ZodOptional<z.ZodEnum<{
+            full: "full";
+            lite: "lite";
+            trivial: "trivial";
+        }>>;
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+    readonly roles: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
+        helper: "helper";
+        judge: "judge";
+        verifier: "verifier";
+    }> & z.core.$partial, z.ZodObject<{
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        effort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            medium: "medium";
+            minimal: "minimal";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+};
+declare const TOP: {
+    readonly models: z.ZodDefault<z.ZodObject<{
+        top: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        standard: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        light: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+    }, z.core.$strict>>;
+    readonly runtime: z.ZodEnum<{
+        direct: "direct";
+        opencode: "opencode";
+    }>;
+};
+type Parsed<T extends Record<string, z.ZodType>> = {
+    [K in keyof T]?: z.output<T[K]>;
+};
+export type AccountSettings = Parsed<typeof TOP> & Parsed<typeof AGENTS> & Parsed<typeof SETTINGS> & {
+    version: string | null;
+};
+/** The account's settings, and warnings naming what was refused or ignored. */
+export declare function parseAccountSettings(data: unknown): {
+    settings: AccountSettings;
+    warnings: string[];
+};
+export {};
+//# sourceMappingURL=account-settings.d.ts.map