@open-cr-agent/cli 0.4.0 → 0.5.0

package/dist/review/cloud-upload.js

@@ -3,14 +3,17 @@ import { createHash, randomBytes } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { coverageGaps } from "@open-cr-agent/core";
+import { coverageGaps, } from "@open-cr-agent/core";
+import { verificationSchema } from "@open-cr-agent/core/internal";
 import { cloudSession, readCredentials } from "../cloud.js";
 import { VERSION } from "../version.js";
 // After a review, a signed-in CLI sends ocra Cloud its counts (ADR-0024):
 // the verdict, how many findings of each severity, files and tasks, tokens
-// and time. Never a path, a title, a finding's text or code. The repository
-// is a hash salted with a value that stays on this machine, so the server
-// can group reviews of one repository without learning which it is.
+// and time. A path, a title, a finding's text or code go only when the
+// account shares findings (ADR-0028, cloud-findings.ts). The repository is
+// a salted hash, so the server can group reviews of one repository without
+// learning which it is: the salt stays on this machine, or is the account's
+// while it shares findings, so the hash matches on all its machines.
 const run = promisify(execFile);
 export function uploadOf(report, source, repoHash, durationMs) {
     const severity = (s) => report.findings.filter((f) => f.severity === s).length;
@@ -42,6 +45,61 @@ export function uploadOf(report, source, repoHash, durationMs) {
         },
         durationMs: Math.round(durationMs),
         ocraVersion: VERSION,
+        ...perReviewer(report),
+    };
+}
+// Counted as `ocra metrics` counts one report: a failed or timed-out task is
+// failed, a finding without a verification is unchecked, a dismissal outranks
+// a fix, and a fixed or dismissed finding is attributed to the reviewer of a
+// finding with its fingerprint in this report, or to none.
+function perReviewer(report) {
+    const reviewers = new Map();
+    const of = (id) => {
+        let r = reviewers.get(id);
+        if (!r) {
+            r = {
+                tasks: 0,
+                failedTasks: 0,
+                findings: { critical: 0, warning: 0, suggestion: 0 },
+                costUsd: 0,
+                fixed: 0,
+                dismissed: 0,
+            };
+            reviewers.set(id, r);
+        }
+        return r;
+    };
+    for (const task of report.tasks) {
+        const r = of(task.reviewer);
+        r.tasks += 1;
+        if (task.status === "failed" || task.status === "timed_out")
+            r.failedTasks += 1;
+        r.costUsd += task.usage.costUsd;
+    }
+    const verification = Object.fromEntries(verificationSchema.options.map((v) => [v, 0]));
+    const reviewerOf = new Map();
+    for (const finding of report.findings) {
+        of(finding.reviewer).findings[finding.severity] += 1;
+        verification[finding.verification ?? "unchecked"] += 1;
+        if (!reviewerOf.has(finding.fingerprint))
+            reviewerOf.set(finding.fingerprint, finding.reviewer);
+    }
+    const dismissed = new Set((report.rereview?.dismissed ?? []).map((f) => f.fingerprint));
+    const fixed = new Set((report.rereview?.fixed ?? []).map((f) => f.fingerprint).filter((fp) => !dismissed.has(fp)));
+    for (const fp of fixed) {
+        const reviewer = reviewerOf.get(fp);
+        if (reviewer)
+            of(reviewer).fixed += 1;
+    }
+    for (const fp of dismissed) {
+        const reviewer = reviewerOf.get(fp);
+        if (reviewer)
+            of(reviewer).dismissed += 1;
+    }
+    return {
+        reviewers: Object.fromEntries([...reviewers].sort(([a], [b]) => a.localeCompare(b))),
+        verification,
+        outcomes: { fixed: fixed.size, dismissed: dismissed.size },
     };
 }
 /** The repository's origin without credentials, or its root path when it has none. */
@@ -60,8 +118,8 @@ async function repositoryId(root) {
         return root;
     }
 }
-/** A random salt kept beside the credentials, made on first use. */
-async function salt(credentialsPath) {
+/** This machine's random salt, kept beside the credentials, made on first use. */
+async function machineSalt(credentialsPath) {
     const path = join(dirname(credentialsPath), "upload-salt");
     try {
         const existing = (await readFile(path, "utf8")).trim();
@@ -74,21 +132,27 @@ async function salt(credentialsPath) {
     await writeFile(path, `${fresh}\n`, { mode: 0o600 });
     return fresh;
 }
-export async function repoHash(root, credentialsPath) {
+/** The repository's hash, salted with the account's salt when given, else this machine's. */
+export async function repoHash(root, credentialsPath, accountSalt) {
+    const salt = accountSalt ?? (await machineSalt(credentialsPath));
     return createHash("sha256")
-        .update(`${await salt(credentialsPath)}:${await repositoryId(root)}`)
+        .update(`${salt}:${await repositoryId(root)}`)
         .digest("hex");
 }
 /** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
 export async function cloudEnabled(deps) {
     return (deps.env.OCRA_CLOUD !== "off" && (await readCredentials(deps.credentialsPath)) !== undefined);
 }
-/** Sends the counts; a failure is a warning, never a failed review. */
-export async function uploadReview(upload, deps, warn) {
+/**
+ * Sends the counts, and the findings when given; answers how many findings
+ * the server kept, or undefined when it took nothing. A failure is a
+ * warning, never a failed review.
+ */
+export async function uploadReview(upload, deps, warn, findings) {
     try {
         const session = await cloudSession(deps);
         if (!session)
-            return false;
+            return undefined;
         const res = await deps.fetch(`${session.server}/api/reviews`, {
             method: "POST",
             headers: {
@@ -96,40 +160,21 @@ export async function uploadReview(upload, deps, warn) {
                 authorization: `Bearer ${session.access_token}`,
                 "user-agent": `ocra/${VERSION}`,
             },
-            body: JSON.stringify(upload),
+            // The counts stay in `findings`; the shared list goes in `findingList`.
+            body: JSON.stringify(findings ? { ...upload, findingList: findings } : upload),
             signal: AbortSignal.timeout(15_000),
         });
         if (!res.ok) {
             warn(`ocra Cloud did not take the review's counts (HTTP ${res.status})`);
-            return false;
+            return undefined;
         }
-        return true;
+        const answer = (await res.json().catch(() => ({})));
+        const kept = answer.findings;
+        return { findings: typeof kept === "number" && Number.isInteger(kept) && kept > 0 ? kept : 0 };
     }
     catch (error) {
         warn(`could not send the review's counts to ocra Cloud: ${error instanceof Error ? error.name : "error"}`);
-        return false;
-    }
-}
-/** The default models chosen on the web, for a review that configures none. */
-export async function defaultModels(deps) {
-    const session = await cloudSession(deps);
-    if (!session)
-        return {};
-    const res = await deps.fetch(`${session.server}/api/preferences/models`, {
-        headers: { authorization: `Bearer ${session.access_token}`, "user-agent": `ocra/${VERSION}` },
-        signal: AbortSignal.timeout(15_000),
-    });
-    if (!res.ok)
-        return {};
-    const body = (await res.json());
-    const chains = {};
-    for (const tier of ["top", "standard", "light"]) {
-        const list = body.models?.[tier];
-        if (Array.isArray(list) && list.every((m) => typeof m === "string" && m.startsWith("ocra-"))) {
-            if (list.length > 0)
-                chains[tier] = list;
-        }
+        return undefined;
     }
-    return chains;
 }
 //# sourceMappingURL=cloud-upload.js.map

package/dist/review/command.d.ts

@@ -1,5 +1,6 @@
 import { type OcraPlugin } from "@open-cr-agent/core";
 import type { CloudDeps } from "../cloud.js";
+import type { NpmRunner } from "../plugins-command.js";
 import type { ReviewArgs } from "./args.js";
 import { type Output } from "./progress.js";
 import type { RuntimeLoaders } from "./runtimes.js";
@@ -22,6 +23,7 @@ export interface ReviewDeps {
     heartbeatMs: number;
     fetch?: typeof fetch;
     cloud?: CloudDeps;
+    npm?: NpmRunner;
     onInterrupt?(handler: () => void): () => void;
 }
 export declare function reviewCommand(args: ReviewArgs, io: {

package/dist/review/command.js

@@ -5,16 +5,21 @@ import { githubPlugin } from "@open-cr-agent/vcs-github";
 import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
 import { localGitPlugin } from "@open-cr-agent/vcs-local";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
+import { pluginsDir } from "../plugin-store.js";
 import { VERSION } from "../version.js";
+import { accountPlugins } from "./account-plugins.js";
 import { withCloudProviders } from "./cloud-providers.js";
-import { cloudEnabled, defaultModels, repoHash, uploadOf, uploadReview } from "./cloud-upload.js";
-import { ConfigError } from "./config.js";
+import { prepareCloudReview, sendToCloud } from "./cloud-review.js";
+import { fetchAccountSettings, layerAccountSettings } from "./cloud-settings.js";
+import { cloudEnabled } from "./cloud-upload.js";
+import { agentChains, ConfigError } from "./config.js";
 import { renderPlan } from "./plan-render.js";
 import { ProgressPrinter } from "./progress.js";
 import { configHash, requestedSampling } from "./provenance.js";
 import { renderJson, renderText, safeJson } from "./render.js";
 import { renderSarif } from "./sarif.js";
 import { loadSarifLogs } from "./sarif-input.js";
+import { effectiveSettings, renderSettings } from "./settings-sources.js";
 import { localTarget, mergeRequestTarget, pullRequestTarget } from "./target.js";
 import { forTerminal } from "./terminal.js";
 export const SESSIONS_DIR = ".ocra/sessions";
@@ -41,21 +46,55 @@ export async function reviewCommand(args, io, deps) {
         : args.mergeRequest
             ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
             : await localTarget(localArgs, deps.cwd, root, deps.env, warn, deps.fetch);
-    const { config } = target;
+    // The account's settings fill what the repository leaves out (ADR-0027);
+    // unreachable, they cost a warning, so a plan still works offline.
+    const cloudDeps = deps.cloud;
+    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
+    let config = target.config;
+    let filled = [];
+    let fromAccount = { plugins: [], pluginSettings: {} };
+    if (cloudDeps && signedIn) {
+        const account = await fetchAccountSettings(cloudDeps, warn);
+        if (account?.settings) {
+            ({ config, filled } = layerAccountSettings(config, account.settings));
+            // The account's default for --ultra; there is no --no-ultra to refuse it.
+            if (account.settings.ultra === true && !args.ultra)
+                filled.push("ultra");
+            if (filled.length > 0) {
+                io.err.write(`[ocra] From your ocra Cloud settings: ${filled.join(", ")}\n`);
+            }
+        }
+        if (account)
+            fromAccount = account.plugins;
+    }
+    const ultra = args.ultra === true || filled.includes("ultra");
     const session = { dir: join(root, SESSIONS_DIR), id: newRunId() };
     // A plan calls no model, writes no session log and imports no runtime: it
     // works without the optional runtime-opencode.
     const builtins = args.plan
         ? deps.builtinPlugins.filter((p) => p.name !== sessionJsonlPlugin.name)
         : [...deps.builtinPlugins, ...(await builtinRuntime(deps.runtimes, config.runtime))];
-    const registry = await startPlugins([...builtins, ...target.plugins], {
+    const account = await accountPlugins(fromAccount, {
+        allowed: target.accountPlugins,
+        configured: config.plugins,
+        taken: [...builtins, ...target.plugins],
+        dir: pluginsDir(deps.env),
+        warn,
+    });
+    // The repository's own settings win; a repository plugin's come from it alone.
+    const pluginSettings = { ...account.settings, ...config.pluginSettings };
+    const registry = await startPlugins([...builtins, ...target.plugins, ...account.plugins], {
         settings: args.plan
-            ? config.pluginSettings
-            : { ...config.pluginSettings, [sessionJsonlPlugin.name]: session },
+            ? pluginSettings
+            : { ...pluginSettings, [sessionJsonlPlugin.name]: session },
         env: deps.env,
         warn,
     });
     const vcs = target.createVcs(registry);
+    const rules = [
+        ...registry.rules.map((rule) => ({ ...rule, source: "plugin" })),
+        ...config.rules,
+    ];
     const overrides = reviewerOverrides(config, args, registry.reviewers.map((r) => r.id));
     if (args.plan) {
         const preview = await previewReview({
@@ -64,13 +103,17 @@ export async function reviewCommand(args, io, deps) {
             reviewerOverrides: overrides,
             effort: config.effort,
             roles: config.roles,
-            rules: [...registry.rules, ...config.rules],
+            models: config.models,
+            rules,
             selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
-            ...(args.ultra ? { ultra: true } : {}),
+            ...(ultra ? { ultra: true } : {}),
             ...(config.maxTasks !== undefined ? { maxTasks: config.maxTasks } : {}),
         });
-        const rendered = args.format === "json" ? `${safeJson(toPlanOutput(preview))}\n` : renderPlan(preview);
+        const settings = effectiveSettings(target.config, config, filled);
+        const rendered = args.format === "json"
+            ? `${safeJson({ ...toPlanOutput(preview), settings, ...accountOf(config) })}\n`
+            : renderPlan(preview) + renderSettings(settings, config.accountSettings);
         if (args.output === undefined)
             io.out.write(rendered);
         else
@@ -78,19 +121,15 @@ export async function reviewCommand(args, io, deps) {
         return EXIT.ok;
     }
     const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
+    // The repository's hash and the account's memory for it (ADR-0028).
+    const cloudReview = cloudDeps && signedIn ? await prepareCloudReview(root, cloudDeps, warn) : undefined;
     const sampling = requestedSampling(config, args);
-    const cloudDeps = deps.cloud;
-    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
-    let models = config.models;
-    if (cloudDeps && signedIn && Object.values(models).every((chain) => !chain?.length)) {
-        models = await defaultModels(cloudDeps);
-        if (Object.keys(models).length > 0) {
-            io.err.write("[ocra] No models configured: using your default models from ocra Cloud\n");
-        }
-    }
-    const cloud = await withCloudProviders(models, config.providers, deps.env, cloudDeps, warn);
+    const models = config.models;
+    const agentModels = agentChains({ reviewers: overrides, roles: config.roles });
+    const cloud = await withCloudProviders([...Object.values(models), ...Object.values(agentModels)], config.providers, deps.env, cloudDeps, warn);
     const runtime = registry.createRuntime(config.runtime, {
         models,
+        ...(Object.keys(agentModels).length > 0 ? { agentModels } : {}),
         env: cloud.env,
         providers: cloud.providers,
         ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
@@ -108,17 +147,24 @@ export async function reviewCommand(args, io, deps) {
             runId: session.id,
             signal: interrupt.signal,
             ...runOptions(config),
+            models,
             reviewerOverrides: overrides,
-            provenance: { ocraVersion: VERSION, configHash: configHash(config, args), sampling },
+            provenance: {
+                ocraVersion: VERSION,
+                configHash: configHash(config, ultra ? { ...args, ultra: true } : args),
+                sampling,
+                ...accountOf(config),
+            },
             ...(args.maxCostUsd !== undefined ? { maxCostUsd: args.maxCostUsd } : {}),
-            ...(args.ultra ? { ultra: true } : {}),
+            ...(ultra ? { ultra: true } : {}),
             ...(args.full ? { fullReview: true } : {}),
             ...(sarif.length > 0 ? { sarif } : {}),
             ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
             vcs,
             runtime,
             reviewers: registry.reviewers,
-            rules: [...registry.rules, ...config.rules],
+            rules,
+            ...(cloudReview?.memory.length ? { accountMemory: cloudReview.memory } : {}),
             onEvent: (event) => {
                 registry.emit(event);
                 progress.onEvent(event);
@@ -143,6 +189,9 @@ export async function reviewCommand(args, io, deps) {
         await deps.writeFile(resolve(deps.cwd, args.output), rendered);
         io.err.write(`[ocra] Wrote ${args.output}\n`);
     }
+    const hidden = report.remembered.filter((e) => e.source === "account").length;
+    if (hidden > 0)
+        io.err.write(`[ocra] ${hidden} finding(s) hidden by your ocra Cloud memory\n`);
     if (interrupt.signal.aborted)
         return EXIT.interrupted;
     if (target.publish) {
@@ -161,15 +210,19 @@ export async function reviewCommand(args, io, deps) {
         }
         io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
     }
-    if (signedIn && cloudDeps && !args.noUpload) {
-        const source = args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local";
-        const upload = uploadOf(report, source, await repoHash(root, cloudDeps.credentialsPath), deps.now() - started);
-        if (await uploadReview(upload, cloudDeps, warn)) {
-            io.err.write("[ocra] Sent this review's counts to ocra Cloud (--no-upload to skip)\n");
-        }
+    if (cloudReview && cloudDeps && !args.noUpload) {
+        await sendToCloud(report, cloudReview, cloudDeps, {
+            source: args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local",
+            durationMs: deps.now() - started,
+            err: io.err,
+            warn,
+        });
     }
     return exitCode(report, io.err);
 }
+function accountOf(config) {
+    return config.accountSettings ? { accountSettings: config.accountSettings } : {};
+}
 // A runtime not built in comes from a plugin of the configuration.
 async function builtinRuntime(runtimes, name) {
     const load = Object.hasOwn(runtimes, name) ? runtimes[name] : undefined;

package/dist/review/config.d.ts

@@ -1,7 +1,8 @@
-import { type CustomProvider, type ModelChains, OcraError, type RepoRule, type TierEfforts } from "@open-cr-agent/core";
+import { type CustomProvider, type ModelChains, OcraError, type ReviewerOverrides, type RoleSettings, type SourcedRule, type TierEfforts } from "@open-cr-agent/core";
 import { z } from "zod";
 export declare const CONFIG_PATH = ".ocra/config.json";
-declare const configSchema: z.ZodObject<{
+export declare const DEFAULT_RUNTIME = "opencode";
+export declare const configSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     models: z.ZodDefault<z.ZodObject<{
         top: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
@@ -48,7 +49,7 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     include: z.ZodDefault<z.ZodArray<z.ZodString>>;
     exclude: z.ZodDefault<z.ZodArray<z.ZodString>>;
-    runtime: z.ZodDefault<z.ZodUnion<[z.ZodEnum<{
+    runtime: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
         direct: "direct";
         opencode: "opencode";
     }>, z.ZodString]>>;
@@ -60,6 +61,7 @@ declare const configSchema: z.ZodObject<{
             lite: "lite";
             trivial: "trivial";
         }>>;
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         effort: z.ZodOptional<z.ZodEnum<{
             high: "high";
             low: "low";
@@ -73,6 +75,7 @@ declare const configSchema: z.ZodObject<{
         judge: "judge";
         verifier: "verifier";
     }> & z.core.$partial, z.ZodObject<{
+        models: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
         effort: z.ZodOptional<z.ZodEnum<{
             high: "high";
             low: "low";
@@ -100,11 +103,16 @@ declare const configSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
 export declare function configJsonSchema(): Record<string, unknown>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers"> & {
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers" | "runtime"> & {
+    runtime: string;
+    runtimeSet: boolean;
     models: ModelChains;
     effort: TierEfforts;
     providers: Record<string, CustomProvider>;
-    rules: RepoRule[];
+    rules: SourcedRule[];
+    accountSettings?: {
+        version: string | null;
+    };
 };
 export interface LoadOptions {
     repository: boolean;
@@ -119,5 +127,8 @@ export declare class ConfigError extends OcraError {
     });
 }
 export declare function loadConfig(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<CliConfig>;
-export {};
+export declare function agentChains(config: {
+    reviewers: ReviewerOverrides;
+    roles: RoleSettings;
+}): Record<string, readonly string[]>;
 //# sourceMappingURL=config.d.ts.map

package/dist/review/config.js

@@ -51,7 +51,8 @@ const providerSchema = z
 // The runtimes ocra ships; a plugin may register another name, so the
 // schema lists these for editors and still accepts any other string.
 const BUILTIN_RUNTIMES = ["opencode", "direct"];
-const configSchema = z
+export const DEFAULT_RUNTIME = "opencode";
+export const configSchema = z
     .object({
     $schema: z.string().optional(),
     models: z
@@ -92,20 +93,24 @@ const configSchema = z
         .default({}),
     include: z.array(z.string().min(1)).default([]),
     exclude: z.array(z.string().min(1)).default([]),
-    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).default("opencode"),
+    // Unset means "opencode"; loadConfig fills it in and records whether the
+    // file chose, so account defaults (ADR-0025) apply only where it did not.
+    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).optional(),
     plugins: z.array(z.string().min(1)).default([]),
     reviewers: z
         .record(z.string(), z
         .object({
         enabled: z.boolean(),
         minTier: z.enum(RISK_TIERS),
+        // The reviewer's own chain, for its review tasks and plan call.
+        models: modelChain,
         effort,
     })
         .partial()
         .strict())
         .default({}),
     roles: z
-        .partialRecord(z.enum(AGENT_ROLES), z.object({ effort }).partial().strict())
+        .partialRecord(z.enum(AGENT_ROLES), z.object({ models: modelChain, effort }).partial().strict())
         .default({}),
     pluginSettings: z.record(z.string(), z.unknown()).default({}),
     providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
@@ -177,15 +182,20 @@ export async function loadConfig(root, env, options = { repository: true }) {
         }
         efforts[tier] = level.data;
     }
-    for (const model of unpriced(parsed.providers, models)) {
+    for (const model of unpriced(parsed.providers, [
+        ...Object.values(models),
+        ...Object.values(agentChains(parsed)),
+    ])) {
         options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
     }
     return {
         ...parsed,
+        runtime: parsed.runtime ?? DEFAULT_RUNTIME,
+        runtimeSet: parsed.runtime !== undefined,
         models,
         effort: efforts,
         providers: toProviders(parsed.providers),
-        rules,
+        rules: rules.map((rule) => ({ ...rule, source: "shared" })),
     };
 }
 function toProviders(declared) {
@@ -206,9 +216,23 @@ function toProviders(declared) {
         },
     ]));
 }
+// The reviewers' and roles' own chains, by agent id (ADR-0025); a disabled
+// reviewer's is left out, since it makes no call.
+export function agentChains(config) {
+    const chains = {};
+    for (const [id, setting] of Object.entries(config.reviewers)) {
+        if (setting.models && setting.enabled !== false)
+            chains[id] = setting.models;
+    }
+    for (const [role, setting] of Object.entries(config.roles)) {
+        if (setting?.models)
+            chains[role] = setting.models;
+    }
+    return chains;
+}
 // Models of declared providers, named in a chain, priced at 0 per token.
-function unpriced(providers, models) {
-    const named = new Set(Object.values(models).flat());
+function unpriced(providers, chains) {
+    const named = new Set(chains.flatMap((chain) => chain ?? []));
     return [...named].filter((model) => {
         const slash = model.indexOf("/");
         const price = providers[model.slice(0, slash)]?.models[model.slice(slash + 1)];

package/dist/review/plan-render.js

@@ -20,7 +20,7 @@ export function renderPlan(preview) {
     lines.push("", `Review tasks: ${preview.tasks.length}`);
     const width = Math.max(0, ...preview.tasks.map((t) => t.taskId.length));
     for (const t of preview.tasks) {
-        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}${t.effort === undefined ? "" : `  effort ${t.effort}`}  ${t.bundle}`);
+        lines.push(`  ${t.taskId.padEnd(width)}  ~${number.format(t.promptTokens)} prompt tokens${t.planPromptTokens === undefined ? "" : ` + plan ~${number.format(t.planPromptTokens)}`}${t.effort === undefined ? "" : `  effort ${t.effort}`}${t.models === undefined ? "" : `  models ${t.models.join(", ")}`}  ${t.bundle}`);
     }
     if (preview.skipped.length > 0) {
         lines.push("", "Skipped by the review matrix:");

package/dist/review/plugins.d.ts

@@ -1,3 +1,13 @@
 import type { OcraPlugin } from "@open-cr-agent/core";
 export declare function loadExternalPlugins(specifiers: readonly string[], root: string): Promise<OcraPlugin[]>;
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export declare function loadAccountPlugins(names: readonly string[], dir: string, warn: (message: string) => void): Promise<{
+    name: string;
+    plugin: OcraPlugin;
+}[]>;
 //# sourceMappingURL=plugins.d.ts.map

package/dist/review/plugins.js

@@ -1,6 +1,8 @@
+import { realpath } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { isAbsolute, join, resolve } from "node:path";
+import { isAbsolute, join, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
+import { installedEntry, readAllowed } from "../plugin-store.js";
 import { ConfigError } from "./config.js";
 // Plugins listed in the repository config execute code, so they are resolved
 // only from the repository's own dependencies or relative paths inside it.
@@ -29,4 +31,47 @@ function resolvePlugin(specifier, root) {
 function isPlugin(value) {
     return (typeof value === "object" && value !== null && typeof value.name === "string");
 }
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export async function loadAccountPlugins(names, dir, warn) {
+    const allowed = new Map((await readAllowed(dir)).map((p) => [p.name, p]));
+    const missing = names.filter((name) => !allowed.has(name));
+    if (missing.length > 0) {
+        warn(`your ocra Cloud settings name plugins this machine has not allowed, so they do not load: ${missing.join(", ")}; allow each with ocra plugins allow <name>@<version>`);
+    }
+    const loaded = [];
+    for (const name of names) {
+        const record = allowed.get(name);
+        if (!record)
+            continue;
+        try {
+            const installed = await installedEntry(dir, name);
+            if (installed?.version !== record.version || installed.integrity !== record.integrity) {
+                throw new Error(`it is not the ${record.version} allowed here; run ocra plugins allow ${name}@<version> again`);
+            }
+            const module = await import(pathToFileURL(await allowedEntry(dir, name)).href);
+            const plugin = module.default ?? module.plugin;
+            if (!isPlugin(plugin))
+                throw new Error('it exports no ocra plugin as default or "plugin"');
+            loaded.push({ name, plugin });
+        }
+        catch (error) {
+            warn(`skipping plugin ${name} from your ocra Cloud settings: ${error.message}`);
+        }
+    }
+    return loaded;
+}
+// Node's resolution walks up past the directory to any node_modules above
+// it; the entry must be inside the allowed package itself.
+async function allowedEntry(dir, name) {
+    const entry = await realpath(createRequire(join(dir, "package.json")).resolve(name));
+    const root = await realpath(join(dir, "node_modules", name));
+    if (!entry.startsWith(`${root}${sep}`))
+        throw new Error(`it resolves outside ${dir}`);
+    return entry;
+}
 //# sourceMappingURL=plugins.js.map

package/dist/review/provenance.js

@@ -14,10 +14,20 @@ export function requestedSampling(config, args) {
 // environment variables, never their values; a password written into a
 // URL is dropped. Sampling is recorded on its own. Effort is covered; left
 // unset it adds nothing, so configurations that set none keep their hash.
+// The ocra Cloud account settings (ADR-0027) add their version and rules
+// only when they were layered in, so a signed-out run keeps its hash.
 export function configHash(config, args) {
-    const { sampling: _, providers, extends: shared, effort, roles, ...rest } = config;
+    // runtimeSet says where the runtime came from, not what ran: the runtime is hashed.
+    const { sampling: _, runtimeSet: _set, providers, extends: shared, effort, roles, rules, accountSettings, ...rest } = config;
+    const bare = (account) => rules
+        .filter((rule) => (rule.source === "account") === account)
+        .map(({ path, rule }) => ({ path, rule }));
     return stableHash({
         ...rest,
+        rules: bare(false),
+        ...(accountSettings
+            ? { account: { version: accountSettings.version, rules: bare(true) } }
+            : {}),
         ...(Object.keys(effort).length > 0 ? { effort } : {}),
         ...(Object.keys(roles).length > 0 ? { roles } : {}),
         ...(shared === undefined ? {} : { extends: withoutCredentials(shared) }),

package/dist/review/render.js

@@ -55,8 +55,13 @@ export function renderText(report, sessionDir) {
     if (refuted.length > 0) {
         lines.push(`Verification dropped ${refuted.length} finding(s) the code disproves (see the JSON report).`);
     }
-    if (report.remembered.length > 0) {
-        lines.push(`${report.remembered.length} finding(s) matched the repository's memory and were not reported.`);
+    const fromRepository = report.remembered.filter((e) => e.source === "repository").length;
+    const fromAccount = report.remembered.length - fromRepository;
+    if (fromRepository > 0) {
+        lines.push(`${fromRepository} finding(s) matched the repository's memory and were not reported.`);
+    }
+    if (fromAccount > 0) {
+        lines.push(`${fromAccount} finding(s) matched your ocra Cloud memory and were not reported.`);
     }
     const rereview = report.rereview;
     if (report.scope?.mode === "incremental") {