@open-cr-agent/cli 0.4.0 → 0.6.0

package/dist/cloud/credentials.js

@@ -0,0 +1,52 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { ocraConfigDir } from "../config/user-dir.js";
+import { writePrivateFile } from "./private-file.js";
+export function credentialsHint() {
+    return process.platform === "win32"
+        ? "%APPDATA%\\ocra\\credentials.json"
+        : "~/.config/ocra/credentials.json";
+}
+export function credentialsPath(env) {
+    return join(ocraConfigDir(env), "credentials.json");
+}
+/**
+ * The saved session; undefined when there is none or the file does not hold
+ * one, which `warn` hears about (a file cut short by a crash, or edited).
+ */
+export async function readCredentials(path, warn) {
+    const saved = await loadCredentials(path);
+    if (saved !== "unreadable")
+        return saved;
+    warn?.(`ignoring ${path}: it holds no ocra Cloud session; run ocra login to sign in again`);
+    return undefined;
+}
+export async function loadCredentials(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    let c;
+    try {
+        c = JSON.parse(text);
+    }
+    catch {
+        return "unreadable";
+    }
+    if (typeof c !== "object" ||
+        c === null ||
+        !c.server ||
+        !c.access_token ||
+        !c.refresh_token ||
+        typeof c.expires_at !== "number") {
+        return "unreadable";
+    }
+    return c;
+}
+export async function writeCredentials(path, c) {
+    await writePrivateFile(path, `${JSON.stringify(c, null, 2)}\n`);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/cloud/deps.d.ts

@@ -0,0 +1,14 @@
+/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
+export declare const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
+export type CloudDeps = {
+    env: Readonly<Record<string, string | undefined>>;
+    fetch: typeof fetch;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+    openBrowser: (url: string) => void;
+    credentialsPath: string;
+    clientName: string;
+};
+export declare function defaultCloudDeps(env?: CloudDeps["env"]): CloudDeps;
+export declare function cloudUrl(env: CloudDeps["env"]): string;
+//# sourceMappingURL=deps.d.ts.map

package/dist/cloud/deps.js

@@ -0,0 +1,34 @@
+import { hostname } from "node:os";
+import { setTimeout as sleep } from "node:timers/promises";
+import { UsageError } from "../io/usage-error.js";
+import { VERSION } from "../version.js";
+import { openBrowser } from "./browser.js";
+import { credentialsPath } from "./credentials.js";
+/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
+export const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
+export function defaultCloudDeps(env = process.env) {
+    return {
+        env,
+        fetch: globalThis.fetch,
+        now: Date.now,
+        sleep: (ms) => sleep(ms),
+        openBrowser: (url) => openBrowser(url),
+        credentialsPath: credentialsPath(env),
+        clientName: `${hostname()} (ocra ${VERSION})`,
+    };
+}
+export function cloudUrl(env) {
+    const named = env.OCRA_CLOUD_URL || DEFAULT_CLOUD_URL;
+    let url;
+    try {
+        url = new URL(named);
+    }
+    catch {
+        throw new UsageError(`OCRA_CLOUD_URL is not a URL: ${named}`);
+    }
+    if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+        throw new UsageError(`OCRA_CLOUD_URL must use https: ${url}`);
+    }
+    return url.origin;
+}
+//# sourceMappingURL=deps.js.map

package/dist/cloud/file-lock.d.ts

@@ -0,0 +1,14 @@
+export type LockTiming = {
+    /** How long to wait for another holder before going on without the lock. */
+    waitMs: number;
+    /** A lock older than this was left by a process that died holding it. */
+    staleMs: number;
+    pollMs: number;
+};
+/**
+ * Runs `fn` holding the lock at `path`. When it cannot be had within
+ * `waitMs`, `fn` runs anyway: the lock only narrows races its callers must
+ * still survive, and a stuck holder must not stop a review.
+ */
+export declare function withFileLock<T>(path: string, fn: () => Promise<T>, timing?: LockTiming): Promise<T>;
+//# sourceMappingURL=file-lock.d.ts.map

package/dist/cloud/file-lock.js

@@ -0,0 +1,77 @@
+import { randomBytes } from "node:crypto";
+import { readFile, rm, stat, writeFile } from "node:fs/promises";
+import { setTimeout as sleep } from "node:timers/promises";
+import { errnoCode, isNotFound } from "@open-cr-agent/core/internal";
+const TIMING = { waitMs: 10_000, staleMs: 30_000, pollMs: 50 };
+/**
+ * Runs `fn` holding the lock at `path`. When it cannot be had within
+ * `waitMs`, `fn` runs anyway: the lock only narrows races its callers must
+ * still survive, and a stuck holder must not stop a review.
+ */
+export async function withFileLock(path, fn, timing = TIMING) {
+    const token = await acquire(path, timing);
+    try {
+        return await fn();
+    }
+    finally {
+        if (token)
+            await release(path, token);
+    }
+}
+async function acquire(path, timing) {
+    const token = randomBytes(8).toString("hex");
+    const deadline = Date.now() + timing.waitMs;
+    for (;;) {
+        try {
+            await writeFile(path, JSON.stringify({ token, at: Date.now(), pid: process.pid }), {
+                flag: "wx",
+                mode: 0o600,
+            });
+            return token;
+        }
+        catch (error) {
+            // A lock that cannot be made at all (a read-only directory) is no lock.
+            if (errnoCode(error) !== "EEXIST")
+                return undefined;
+        }
+        const age = await ageOf(path);
+        if (age === undefined)
+            continue;
+        if (age > timing.staleMs) {
+            await rm(path, { force: true });
+            continue;
+        }
+        if (Date.now() >= deadline)
+            return undefined;
+        await sleep(timing.pollMs);
+    }
+}
+/** Milliseconds since the lock was taken; undefined when it is gone. */
+async function ageOf(path) {
+    try {
+        const at = JSON.parse(await readFile(path, "utf8")).at;
+        if (typeof at === "number")
+            return Date.now() - at;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return undefined;
+    }
+    // Being written, or not a lock of ours: its file's own time stands in.
+    try {
+        return Date.now() - (await stat(path)).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function release(path, token) {
+    try {
+        const held = JSON.parse(await readFile(path, "utf8"));
+        // Broken as stale and taken by another: theirs now.
+        if (held.token === token)
+            await rm(path, { force: true });
+    }
+    catch { }
+}
+//# sourceMappingURL=file-lock.js.map

package/dist/cloud/findings.d.ts

@@ -0,0 +1,8 @@
+import { type SharedFinding } from "@open-cr-agent/cloud-contract";
+import type { ReviewReport } from "@open-cr-agent/core";
+/** The report's findings as uploaded, redacted and bounded; `left` counts those not sent. */
+export declare function sharedFindings(report: Pick<ReviewReport, "findings">): {
+    findings: SharedFinding[];
+    left: number;
+};
+//# sourceMappingURL=findings.d.ts.map

package/dist/cloud/findings.js

@@ -0,0 +1,58 @@
+import { MAX_FIELD, MAX_FINDINGS, MAX_TOTAL_BYTES, redact, } from "@open-cr-agent/cloud-contract";
+// The findings a review sends ocra Cloud when the account shares them
+// (ADR-0028, 2): what the web needs to show the review, after the contract's
+// redaction pass and within its bounds. The server redacts and bounds again;
+// this pass keeps a secret from leaving the machine at all. It catches
+// patterns, not every secret.
+/** The report's findings as uploaded, redacted and bounded; `left` counts those not sent. */
+export function sharedFindings(report) {
+    const findings = [];
+    let total = 0;
+    for (const finding of report.findings.slice(0, MAX_FINDINGS)) {
+        const shared = share(finding);
+        const size = textBytes(shared);
+        if (total + size > MAX_TOTAL_BYTES)
+            break;
+        total += size;
+        findings.push(shared);
+    }
+    return { findings, left: report.findings.length - findings.length };
+}
+function share(f) {
+    let redacted = false;
+    let truncated = false;
+    const text = (value) => {
+        const r = redact(value);
+        redacted ||= r.redacted;
+        if (r.text.length <= MAX_FIELD)
+            return r.text;
+        truncated = true;
+        const cut = r.text.slice(0, MAX_FIELD);
+        // Never leave half of a surrogate pair at the cut.
+        return /[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut;
+    };
+    const shared = {
+        fingerprint: f.fingerprint,
+        reviewer: f.reviewer,
+        severity: f.severity,
+        category: text(f.category),
+        verification: f.verification ?? "unchecked",
+        file: text(f.file),
+        lineStart: f.lineRange?.start ?? null,
+        lineEnd: f.lineRange?.end ?? null,
+        title: text(f.title),
+        body: text(f.body),
+        suggestion: f.suggestion === undefined ? null : text(f.suggestion),
+        code: text(f.existingCode),
+    };
+    if (redacted)
+        shared.redacted = true;
+    if (truncated)
+        shared.truncated = true;
+    return shared;
+}
+// Bytes as sent, escapes included, so the body stays under the server's limit.
+function textBytes(f) {
+    return [f.title, f.body, f.suggestion ?? "", f.code ?? ""].reduce((sum, s) => sum + Buffer.byteLength(JSON.stringify(s)), 0);
+}
+//# sourceMappingURL=findings.js.map

package/dist/cloud/gateway-token.d.ts

@@ -0,0 +1,18 @@
+import type { Credentials } from "./credentials.js";
+import type { CloudDeps } from "./deps.js";
+export declare const RENEW_BEFORE_MS: number;
+export declare class GatewayToken {
+    private timer;
+    private stopped;
+    private failing;
+    private credentials;
+    private readonly deps;
+    private readonly warn;
+    constructor(credentials: Credentials, deps: CloudDeps, warn: (message: string) => void);
+    get value(): string;
+    start(): void;
+    stop(): void;
+    private schedule;
+    private renew;
+}
+//# sourceMappingURL=gateway-token.d.ts.map

package/dist/cloud/gateway-token.js

@@ -0,0 +1,63 @@
+import { MAX_TIMER_MS } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+// The access token a run's models use at the ocra Cloud gateway lives an
+// hour; a run may last longer. While the run lasts, the token is renewed a
+// few minutes before it expires, for a runtime that reads its key at each
+// call (the direct runtime does).
+export const RENEW_BEFORE_MS = 5 * 60_000;
+const RETRY_MS = 60_000;
+export class GatewayToken {
+    timer;
+    stopped = false;
+    failing = false;
+    credentials;
+    deps;
+    warn;
+    constructor(credentials, deps, warn) {
+        this.credentials = credentials;
+        this.deps = deps;
+        this.warn = warn;
+    }
+    get value() {
+        return this.credentials.access_token;
+    }
+    start() {
+        this.schedule(this.credentials.expires_at - RENEW_BEFORE_MS - this.deps.now());
+    }
+    stop() {
+        this.stopped = true;
+        clearTimeout(this.timer);
+    }
+    schedule(delayMs) {
+        if (this.stopped)
+            return;
+        this.timer = setTimeout(() => void this.renew(), Math.min(Math.max(delayMs, 0), MAX_TIMER_MS));
+        this.timer.unref?.();
+    }
+    async renew() {
+        let reason;
+        try {
+            // Asking for more than the token has left renews it.
+            const session = await new CloudClient(this.deps).session(2 * RENEW_BEFORE_MS);
+            if (this.stopped)
+                return;
+            if (session.kind === "ok") {
+                this.credentials = session.credentials;
+                this.failing = false;
+                this.start();
+                return;
+            }
+            reason = session.kind === "signed-out" ? "you signed out" : sessionLostReason(session);
+        }
+        catch (error) {
+            reason = error instanceof Error ? error.message : "error";
+        }
+        if (!this.failing) {
+            this.warn(`could not renew the ocra Cloud token (${reason}); model calls through ocra Cloud fail once it expires`);
+            this.failing = true;
+        }
+        if (this.deps.now() < this.credentials.expires_at)
+            this.schedule(RETRY_MS);
+    }
+}
+//# sourceMappingURL=gateway-token.js.map

package/dist/cloud/memory.d.ts

@@ -0,0 +1,8 @@
+import type { MemoryEntry } from "@open-cr-agent/core";
+import type { CloudDeps } from "./deps.js";
+/** The account's entries for the repository; [] and a warning when they cannot be read. */
+export declare function fetchAccountMemory(deps: CloudDeps, repoHash: string, warn: (message: string) => void): Promise<MemoryEntry[]>;
+/** Whether the account remembers any finding, for any repository; false when that cannot be read. */
+export declare function accountHasMemory(deps: CloudDeps): Promise<boolean>;
+export declare function parseAccountMemory(list: readonly unknown[], warn: (message: string) => void): MemoryEntry[];
+//# sourceMappingURL=memory.d.ts.map

package/dist/cloud/memory.js

@@ -0,0 +1,68 @@
+import { MAX_MEMORY_PER_REPO } from "@open-cr-agent/cloud-contract";
+import { errorMessage } from "@open-cr-agent/core";
+import { memoryEntrySchema } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+// The findings the account remembers for one repository (ADR-0028, 4), set
+// from the web. A review applies them with .ocra/memory.json's.
+/** The account's entries for the repository; [] and a warning when they cannot be read. */
+export async function fetchAccountMemory(deps, repoHash, warn) {
+    const cannotRead = (reason) => {
+        warn(`could not read your ocra Cloud memory (${reason}); the review applies the repository's alone`);
+        return [];
+    };
+    let answer;
+    try {
+        answer = await new CloudClient(deps).memory(repoHash);
+    }
+    catch (error) {
+        return cannotRead(errorMessage(error));
+    }
+    switch (answer.kind) {
+        case "ok":
+            return parseAccountMemory(answer.value, warn);
+        case "signed-out":
+            return [];
+        case "status":
+            // A server without account memory has none to apply.
+            return answer.status === 404 ? [] : cannotRead(`HTTP ${answer.status}`);
+        case "malformed":
+            warn("ignoring your ocra Cloud memory: the server's answer has no entries");
+            return [];
+        default:
+            return cannotRead(sessionLostReason(answer));
+    }
+}
+/** Whether the account remembers any finding, for any repository; false when that cannot be read. */
+export async function accountHasMemory(deps) {
+    try {
+        const answer = await new CloudClient(deps).memory();
+        return answer.kind === "ok" && answer.value.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function parseAccountMemory(list, warn) {
+    const entries = [];
+    let refused = 0;
+    // The server keeps no more per repository; more is not an answer to trust.
+    for (const raw of list.slice(0, MAX_MEMORY_PER_REPO)) {
+        const r = (typeof raw === "object" && raw !== null ? raw : {});
+        const parsed = memoryEntrySchema.safeParse({
+            fingerprint: r.fingerprint,
+            file: r.file,
+            title: r.title,
+            reason: r.reason,
+            ...(typeof r.createdAt === "string" ? { added: r.createdAt.slice(0, 10) } : {}),
+        });
+        if (parsed.success)
+            entries.push(parsed.data);
+        else
+            refused += 1;
+    }
+    if (refused > 0) {
+        warn(`ignoring ${refused} ocra Cloud memory entr${refused > 1 ? "ies" : "y"} this version of ocra cannot read`);
+    }
+    return entries;
+}
+//# sourceMappingURL=memory.js.map

package/dist/cloud/private-file.d.ts

@@ -0,0 +1,8 @@
+/** Writes the file atomically, readable only by this user. */
+export declare function writePrivateFile(path: string, text: string): Promise<void>;
+/**
+ * Writes the file atomically unless it exists: false when another writer
+ * made it first, whose content then stands.
+ */
+export declare function createPrivateFile(path: string, text: string): Promise<boolean>;
+//# sourceMappingURL=private-file.d.ts.map

package/dist/cloud/private-file.js

@@ -0,0 +1,46 @@
+import { randomBytes } from "node:crypto";
+import { link, mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { errnoCode } from "@open-cr-agent/core/internal";
+// Files only this user may read (the ocra Cloud session, the salts), written
+// so that no reader, another ocra process included, ever sees one half
+// written: the text goes to a temporary file in the same directory, created
+// 0600, which then replaces the file in one rename.
+/** Writes the file atomically, readable only by this user. */
+export async function writePrivateFile(path, text) {
+    const temp = await writeTemp(path, text);
+    try {
+        await rename(temp, path);
+    }
+    catch (error) {
+        await rm(temp, { force: true });
+        throw error;
+    }
+}
+/**
+ * Writes the file atomically unless it exists: false when another writer
+ * made it first, whose content then stands.
+ */
+export async function createPrivateFile(path, text) {
+    const temp = await writeTemp(path, text);
+    try {
+        await link(temp, path);
+        return true;
+    }
+    catch (error) {
+        if (errnoCode(error) === "EEXIST")
+            return false;
+        throw error;
+    }
+    finally {
+        await rm(temp, { force: true });
+    }
+}
+async function writeTemp(path, text) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString("hex")}.tmp`);
+    // "wx": a fresh file, so the mode applies; never one that already exists.
+    await writeFile(temp, text, { mode: 0o600, flag: "wx" });
+    return temp;
+}
+//# sourceMappingURL=private-file.js.map

package/dist/cloud/providers.d.ts

@@ -0,0 +1,18 @@
+import type { CustomProvider } from "@open-cr-agent/core";
+import type { CloudDeps } from "./deps.js";
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export declare const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+/** The run the models serve: how long it may last, and whether its runtime reads a key at each call. */
+export type CloudRun = {
+    timeoutMs: number;
+    keyReadPerCall: boolean;
+};
+export type CloudProviders = {
+    providers: Record<string, CustomProvider>;
+    env: Env;
+    stop(): void;
+};
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function withCloudProviders(chains: readonly (readonly string[] | undefined)[], providers: Readonly<Record<string, CustomProvider>>, env: Env, deps: CloudDeps | undefined, warn: (message: string) => void, run?: CloudRun): Promise<CloudProviders>;
+export {};
+//# sourceMappingURL=providers.d.ts.map

package/dist/cloud/providers.js

@@ -0,0 +1,132 @@
+import { CLOUD_PREFIX, EFFORT_STYLES, GATEWAY_PATH, isCloudModel, } from "@open-cr-agent/cloud-contract";
+import { errorMessage, OcraError } from "@open-cr-agent/core";
+import { REVIEW_DEFAULTS } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+import { GatewayToken } from "./gateway-token.js";
+// Models named ocra-<provider>/<model> go through the ocra Cloud gateway with
+// the key stored there for <provider> (ADR-0024). Each such provider becomes
+// an OpenAI-compatible endpoint declared for this run, authorized by the
+// signed-in session's access token. Without such a model nothing here reads
+// the session or touches the network.
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+// A review runs 25 minutes at most by default; start it with a token that
+// outlives that, and ask for one that outlives a longer run.
+const MIN_TOKEN_MS = 35 * 60_000;
+const TOKEN_MARGIN_MS = 10 * 60_000;
+// chains: every chain of the run, the tiers' and the agents' own.
+export async function withCloudProviders(chains, providers, env, deps, warn, run = { timeoutMs: REVIEW_DEFAULTS.runTimeoutMs, keyReadPerCall: false }) {
+    const wanted = new Map();
+    const dropped = [];
+    for (const model of chains.flatMap((chain) => chain ?? [])) {
+        const slash = model.indexOf("/");
+        const id = model.slice(0, slash);
+        if (slash < 0 || !id.startsWith(CLOUD_PREFIX) || providers[id])
+            continue;
+        if (!isCloudModel(model)) {
+            dropped.push(JSON.stringify(model));
+            continue;
+        }
+        const set = wanted.get(id) ?? new Set();
+        set.add(model.slice(slash + 1));
+        wanted.set(id, set);
+    }
+    if (dropped.length > 0) {
+        warn(`ignoring ${dropped.join(", ")}: an ocra Cloud model is ${CLOUD_PREFIX}<provider>/<model>, with a provider of lowercase letters, digits and - and a model of letters, digits and ./:@_-`);
+    }
+    if (wanted.size === 0)
+        return { providers: { ...providers }, env, stop: () => { } };
+    const names = [...wanted.keys()].join(", ");
+    if (env.OCRA_CLOUD === "off") {
+        throw new OcraError("CONFIG_INVALID", `Models name ocra Cloud (${names}) but OCRA_CLOUD=off`);
+    }
+    const client = deps ? new CloudClient(deps) : undefined;
+    // A runtime that reads the key once needs a token that outlives the run;
+    // one that reads it at each call gets it renewed during the run.
+    const needed = run.timeoutMs + TOKEN_MARGIN_MS;
+    const minValidity = run.keyReadPerCall ? MIN_TOKEN_MS : Math.max(MIN_TOKEN_MS, needed);
+    const state = client ? await client.session(minValidity) : { kind: "signed-out" };
+    if (!client || !deps || state.kind === "signed-out") {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): sign in with ocra login`);
+    }
+    if (state.kind === "revoked") {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): ${sessionLostReason(state)}`);
+    }
+    const unreachable = (reason) => new OcraError("RUNTIME_START_FAILED", `Models name ocra Cloud (${names}) but ocra Cloud could not be reached (${reason})`);
+    if (state.kind === "unreachable")
+        throw unreachable(state.reason);
+    const session = state.credentials;
+    let answer;
+    try {
+        answer = await client.providers(session.server);
+    }
+    catch (error) {
+        throw unreachable(errorMessage(error));
+    }
+    if (answer.kind === "status" && (answer.status >= 500 || answer.status === 429)) {
+        throw unreachable(`HTTP ${answer.status}`);
+    }
+    if (answer.kind === "malformed") {
+        throw new OcraError("RUNTIME_START_FAILED", "ocra Cloud's answer for its providers is not a list of providers");
+    }
+    if (answer.kind !== "ok") {
+        throw new OcraError("RUNTIME_START_FAILED", `ocra Cloud answered ${answer.status} for its providers`);
+    }
+    const listed = answer.value;
+    const declared = { ...providers };
+    for (const [id, modelIds] of wanted) {
+        const name = id.slice(CLOUD_PREFIX.length);
+        const entry = listed.find((p) => p.name === name);
+        const paths = entry?.paths ?? [];
+        const valid = paths.filter((path) => typeof path === "string" && GATEWAY_PATH.test(path));
+        if (valid.length < paths.length) {
+            warn(`ignoring ${paths.length - valid.length} gateway path(s) ocra Cloud listed for "${name}" that are not plain paths`);
+        }
+        const chat = valid.find((path) => path.endsWith("/chat/completions"));
+        if (!chat) {
+            throw new OcraError("CONFIG_INVALID", `ocra Cloud has no OpenAI-compatible chat endpoint for "${name}" (named by ${id})`);
+        }
+        declared[id] = {
+            baseUrl: `${session.server}/api/gateway/${name}${chat.slice(0, -"/chat/completions".length)}`,
+            apiKeyEnv: CLOUD_TOKEN_ENV,
+            models: Object.fromEntries([...modelIds].map((m) => [m, { input: 0, output: 0 }])),
+            ...effortStyleOf(entry?.effort, name, warn),
+        };
+    }
+    warn(`${names}: models through ocra Cloud are not priced, so reported cost and --max-cost-usd do not count them`);
+    if (!run.keyReadPerCall) {
+        const left = session.expires_at - deps.now();
+        if (left < needed) {
+            warn(`this run may last ${minutes(run.timeoutMs)} minutes, but its runtime reads the ocra Cloud token once and the token lasts ${minutes(left)}: model calls through ocra Cloud fail after that (use "runtime": "direct", which renews it, or a shorter runTimeoutMinutes)`);
+        }
+        return {
+            providers: declared,
+            env: { ...env, [CLOUD_TOKEN_ENV]: session.access_token },
+            stop: () => { },
+        };
+    }
+    const token = new GatewayToken(session, deps, warn);
+    token.start();
+    // The token is read at each call, so a renewed one is used from then on.
+    const live = Object.defineProperty({ ...env }, CLOUD_TOKEN_ENV, {
+        get: () => token.value,
+        enumerable: true,
+    });
+    return { providers: declared, env: live, stop: () => token.stop() };
+}
+function minutes(ms) {
+    return Math.floor(ms / 60_000);
+}
+// How the gateway's provider takes a reasoning effort, as ocra Cloud lists
+// it; unlisted, the runtime's default (OpenAI's reasoning_effort). A style
+// this version of ocra does not know is refused rather than guessed.
+function effortStyleOf(style, name, warn) {
+    if (style === undefined)
+        return {};
+    const known = EFFORT_STYLES.find((s) => s === style);
+    if (known)
+        return { effort: known };
+    warn(`ignoring the effort style ocra Cloud listed for "${name}", which this version of ocra does not know; efforts go as OpenAI's reasoning_effort`);
+    return {};
+}
+//# sourceMappingURL=providers.js.map

package/dist/cloud/review.d.ts

@@ -0,0 +1,28 @@
+import type { ReviewSource } from "@open-cr-agent/cloud-contract";
+import type { MemoryEntry, ReviewReport } from "@open-cr-agent/core";
+import type { Output } from "../io/output.js";
+import { type CloudSessionLost } from "./client.js";
+import type { CloudDeps } from "./deps.js";
+export type CloudReview = {
+    repoHash: string;
+    shareFindings: boolean;
+    memory: MemoryEntry[];
+};
+/** What a review loses when ocra Cloud cannot be used for it, said once. */
+export declare function sessionLostWarning(lost: Exclude<CloudSessionLost, {
+    kind: "signed-out";
+}>): string;
+/**
+ * Undefined when the saved session is gone; a failure to reach ocra Cloud is
+ * one warning. The repository is the pull or merge request's when given,
+ * else origin's.
+ */
+export declare function prepareCloudReview(root: string, deps: CloudDeps, warn: (message: string) => void, repository?: string): Promise<CloudReview | undefined>;
+/** Sends the counts, and the findings when the account shares them. */
+export declare function sendToCloud(report: ReviewReport, cloud: CloudReview, deps: CloudDeps, run: {
+    source: ReviewSource;
+    durationMs: number;
+    err: Output;
+    warn: (message: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=review.d.ts.map