@open-cr-agent/cli 0.4.0 → 0.6.0

package/dist/commands/metrics.d.ts

@@ -0,0 +1,45 @@
+import type { Severity, Verification } from "@open-cr-agent/core";
+import type { Output } from "../io/output.js";
+declare const METRICS_VERSION = 1;
+interface ReviewerMetrics {
+    tasks: number;
+    failedTasks: number;
+    findings: number;
+    costUsd: number;
+    fixed: number;
+    dismissed: number;
+    acceptanceRate: number | null;
+}
+export interface Metrics {
+    version: typeof METRICS_VERSION;
+    sessionsDir: string;
+    since?: string;
+    runs: {
+        total: number;
+        byVerdict: Record<string, number>;
+        incomplete: number;
+        unreadable: number;
+    };
+    cost: {
+        usd: number;
+        inputTokens: number;
+        outputTokens: number;
+        usdPerRun: number | null;
+    };
+    findings: {
+        reported: number;
+        unique: number;
+        bySeverity: Record<Severity, number>;
+        byVerification: Record<Verification, number>;
+    };
+    outcomes: {
+        fixed: number;
+        dismissed: number;
+        acceptanceRate: number | null;
+    };
+    reviewers: Record<string, ReviewerMetrics>;
+}
+export declare function metricsCommand(argv: string[], out: Output, cwd: string): Promise<number>;
+export declare function collectMetrics(dir: string, since?: Date): Promise<Metrics>;
+export {};
+//# sourceMappingURL=metrics.d.ts.map

package/dist/{metrics.js → commands/metrics.js}

@@ -1,13 +1,12 @@
-import { readdir, readFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { reportOutputSchema, } from "@open-cr-agent/core";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
-import { UsageError } from "./review/args.js";
-import { SESSIONS_DIR } from "./review/command.js";
-import { forTerminal } from "./review/terminal.js";
-export const METRICS_VERSION = 1;
-export const METRICS_USAGE = `Usage: ocra metrics [options]
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+import { UsageError } from "../io/usage-error.js";
+import { listSessions, readSessionReport, SESSIONS_DIR, sessionStart, sessionsDir, } from "../session/store.js";
+const METRICS_VERSION = 1;
+const METRICS_USAGE = `Usage: ocra metrics [options]
 
 Counts over the finished reviews in ${SESSIONS_DIR}: runs, cost, findings,
 what reviewers later fixed or dismissed, per reviewer. Reads each session's
@@ -33,18 +32,18 @@ export async function metricsCommand(argv, out, cwd) {
     });
     if (values.help) {
         out.write(METRICS_USAGE);
-        return 0;
+        return EXIT.ok;
     }
     const format = values.format ?? "text";
     if (format !== "text" && format !== "json")
         throw new UsageError("--format must be text or json");
     const since = values.since === undefined ? undefined : parseSince(values.since);
-    const sessionsDir = values.sessions
+    const dir = values.sessions
         ? resolve(cwd, values.sessions)
-        : join(await findRepositoryRoot(cwd), SESSIONS_DIR);
-    const metrics = await collectMetrics(sessionsDir, since);
+        : sessionsDir(await findRepositoryRoot(cwd));
+    const metrics = await collectMetrics(dir, since);
     out.write(format === "json" ? `${JSON.stringify(metrics, null, 2)}\n` : renderMetrics(metrics));
-    return 0;
+    return EXIT.ok;
 }
 function parseSince(text) {
     const date = new Date(text);
@@ -52,55 +51,34 @@ function parseSince(text) {
         throw new UsageError(`--since needs an ISO 8601 date, not "${text}"`);
     return date;
 }
-// A session directory is named by its run id, whose first part is the start
-// time (newRunId in core); that is what --since compares against.
-export function sessionStart(id) {
-    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z/.exec(id);
-    if (!m)
-        return undefined;
-    const [, y, mo, d, h, mi, s] = m;
-    return new Date(`${y}-${mo}-${d}T${h}:${mi}:${s}Z`);
-}
-export async function collectMetrics(sessionsDir, since) {
-    const names = (await readdir(sessionsDir).catch(() => []))
-        .filter((n) => !n.startsWith("."))
-        .filter((n) => {
+export async function collectMetrics(dir, since) {
+    // --since compares the start time in each session's id.
+    const names = (await listSessions(dir)).filter((n) => {
         const start = sessionStart(n);
         return since === undefined || (start !== undefined && start >= since);
-    })
-        .sort();
+    });
     const reports = [];
     let unreadable = 0;
     for (const name of names) {
-        const report = await readReport(join(sessionsDir, name, "report.json"));
+        const report = await readSessionReport(join(dir, name));
         if (report)
             reports.push(report);
         else
             unreadable += 1;
     }
     return aggregate(reports, {
-        sessionsDir,
+        sessionsDir: dir,
         unreadable,
         ...(since ? { since: since.toISOString() } : {}),
     });
 }
-async function readReport(path) {
-    let data;
-    try {
-        data = JSON.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        return undefined;
-    }
-    const parsed = reportOutputSchema.safeParse(data);
-    return parsed.success ? parsed.data : undefined;
-}
 function aggregate(reports, meta) {
     const byVerdict = {};
     const bySeverity = { critical: 0, warning: 0, suggestion: 0 };
     const byVerification = { confirmed: 0, uncertain: 0, unchecked: 0 };
     const reviewers = new Map();
     const reviewerOf = new Map();
+    const recorded = new Map();
     const unique = new Set();
     const fixed = new Set();
     const dismissed = new Set();
@@ -148,22 +126,31 @@ function aggregate(reports, meta) {
             if (!reviewerOf.has(finding.fingerprint))
                 reviewerOf.set(finding.fingerprint, finding.reviewer);
         }
-        for (const f of report.rereview?.fixed ?? [])
+        for (const f of report.rereview?.fixed ?? []) {
             fixed.add(f.fingerprint);
-        for (const f of report.rereview?.dismissed ?? [])
+            if (f.reviewer && !recorded.has(f.fingerprint))
+                recorded.set(f.fingerprint, f.reviewer);
+        }
+        for (const f of report.rereview?.dismissed ?? []) {
             dismissed.add(f.fingerprint);
+            if (f.reviewer && !recorded.has(f.fingerprint))
+                recorded.set(f.fingerprint, f.reviewer);
+        }
     }
     // A fingerprint can be dismissed in one review and gone in a later one:
     // the reviewer's decision stands.
     for (const fp of dismissed)
         fixed.delete(fp);
+    // The reviewer the earlier review recorded with the finding; reports from
+    // before it was recorded fall back to the first that reported the fingerprint.
+    const creditedTo = (fp) => recorded.get(fp) ?? reviewerOf.get(fp);
     for (const fp of fixed) {
-        const reviewer = reviewerOf.get(fp);
+        const reviewer = creditedTo(fp);
         if (reviewer)
             forReviewer(reviewer).fixed += 1;
     }
     for (const fp of dismissed) {
-        const reviewer = reviewerOf.get(fp);
+        const reviewer = creditedTo(fp);
         if (reviewer)
             forReviewer(reviewer).dismissed += 1;
     }
@@ -194,7 +181,7 @@ function rate(fixed, dismissed) {
 }
 const percent = (value) => (value === null ? "n/a" : `${Math.round(value * 100)}%`);
 const dollars = (value) => (value === null ? "n/a" : `$${value.toFixed(2)}`);
-export function renderMetrics(m) {
+function renderMetrics(m) {
     const lines = [
         `Runs: ${m.runs.total}${m.since ? ` since ${m.since}` : ""} (${m.runs.incomplete} incomplete, ${m.runs.unreadable} unreadable)`,
         `  by verdict: ${entries(m.runs.byVerdict)}`,

package/dist/commands/plugins.d.ts

@@ -0,0 +1,9 @@
+import type { Output } from "../io/output.js";
+import type { NpmRunner } from "../plugins/npm.js";
+export declare const PLUGINS_USAGE = "Usage: ocra plugins allow <name>@<version>\n       ocra plugins deny <name>\n       ocra plugins list\n\nYour ocra Cloud settings may name plugins; a review loads one only if this\nmachine allows it. allow shows the package and who published it, installs that\nexact version with install scripts off into a directory of your own, and\nrecords its integrity; deny removes it.\n";
+export interface PluginsDeps {
+    dir: string;
+    npm: NpmRunner;
+}
+export declare function pluginsCommand(argv: readonly string[], out: Output, deps: PluginsDeps): Promise<number>;
+//# sourceMappingURL=plugins.d.ts.map

package/dist/commands/plugins.js

@@ -0,0 +1,159 @@
+import { access, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { ConfigError } from "../config/cli-config.js";
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+import { UsageError } from "../io/usage-error.js";
+import { ensureDir, installedEntry, isExactVersion, isPackageName, readAllowed, writeAllowed, } from "../plugins/store.js";
+// `ocra plugins` (ADR-0027): the user's own decision, on each machine, to
+// let their ocra Cloud account load a third-party plugin, like adding a
+// dependency. The account names packages; only what is allowed here loads.
+export const PLUGINS_USAGE = `Usage: ocra plugins allow <name>@<version>
+       ocra plugins deny <name>
+       ocra plugins list
+
+Your ocra Cloud settings may name plugins; a review loads one only if this
+machine allows it. allow shows the package and who published it, installs that
+exact version with install scripts off into a directory of your own, and
+records its integrity; deny removes it.
+`;
+export async function pluginsCommand(argv, out, deps) {
+    const [action, target, ...extra] = argv;
+    if (action === "--help" || action === "-h" || action === "help") {
+        out.write(PLUGINS_USAGE);
+        return EXIT.ok;
+    }
+    if (extra.length > 0)
+        throw new UsageError(`Unexpected argument: ${extra[0]}`);
+    if (action === "list" && target === undefined)
+        return list(out, deps.dir);
+    if (action === "allow" && target !== undefined)
+        return allow(target, out, deps);
+    if (action === "deny" && target !== undefined)
+        return deny(target, out, deps);
+    throw new UsageError(action ? `Unknown or incomplete command: plugins ${action}` : "");
+}
+async function list(out, dir) {
+    const allowed = await readAllowed(dir);
+    if (allowed.length === 0) {
+        out.write("No plugins allowed. Allow one with: ocra plugins allow <name>@<version>\n");
+        return EXIT.ok;
+    }
+    for (const p of allowed)
+        out.write(`${p.name}@${p.version}  ${p.integrity}\n`);
+    out.write(`(installed in ${dir})\n`);
+    return EXIT.ok;
+}
+function parseSpec(spec) {
+    const at = spec.lastIndexOf("@");
+    const name = at > 0 ? spec.slice(0, at) : spec;
+    const version = at > 0 ? spec.slice(at + 1) : "";
+    if (!isPackageName(name))
+        throw new UsageError(`Not an npm package name: ${forTerminal(name)}`);
+    if (!isExactVersion(version)) {
+        throw new UsageError(`Name an exact version, such as ${name}@1.2.3: a range or tag could install something else later`);
+    }
+    return { name, version };
+}
+async function allow(spec, out, deps) {
+    const { name, version } = parseSpec(spec);
+    await ensureDir(deps.dir);
+    // npm installs into the nearest package.json; one of the directory's own
+    // keeps it from walking up to a project.
+    const manifest = join(deps.dir, "package.json");
+    if (!(await exists(manifest))) {
+        await writeFile(manifest, `${JSON.stringify({ private: true }, null, 2)}\n`, { mode: 0o600 });
+    }
+    const view = describe(await deps.npm(["view", `${name}@${version}`, "--json"], deps.dir));
+    if (view.name !== name || view.version !== version) {
+        throw new ConfigError(`npm did not resolve ${name}@${version} to that exact version`);
+    }
+    if (!view.integrity) {
+        throw new ConfigError(`npm view lists no integrity for ${name}@${version}; not allowed`);
+    }
+    out.write(forTerminal([
+        `Package:      ${view.name}@${view.version}`,
+        `Published by: ${view.publisher ?? "unknown"}`,
+        `Maintainers:  ${view.maintainers.join(", ") || "unknown"}`,
+        `Integrity:    ${view.integrity}`,
+        `Installing into ${deps.dir} with install scripts off`,
+        "",
+    ].join("\n")));
+    await deps.npm([
+        "install",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--save-exact",
+        "--prefix",
+        deps.dir,
+        `${name}@${version}`,
+    ], deps.dir);
+    const installed = await installedEntry(deps.dir, name);
+    if (installed?.version !== version || !installed.integrity) {
+        throw new ConfigError(`npm did not install ${name}@${version} into ${deps.dir}`);
+    }
+    if (view.integrity !== installed.integrity) {
+        throw new ConfigError(`${name}@${version} installed with another integrity than the registry lists; not allowed`);
+    }
+    const entry = { name, version, integrity: installed.integrity };
+    const allowed = (await readAllowed(deps.dir)).filter((p) => p.name !== name);
+    await writeAllowed(deps.dir, [...allowed, entry]);
+    out.write(`Allowed ${name}@${version}: your ocra Cloud settings can now load it here.\n`);
+    return EXIT.ok;
+}
+async function deny(name, out, deps) {
+    if (!isPackageName(name))
+        throw new UsageError(`Not an npm package name: ${forTerminal(name)}`);
+    const allowed = await readAllowed(deps.dir);
+    const kept = allowed.filter((p) => p.name !== name);
+    if (kept.length === allowed.length) {
+        out.write(`${name} was not allowed.\n`);
+        return EXIT.ok;
+    }
+    // The record is what loading checks; removing the files is housekeeping.
+    await writeAllowed(deps.dir, kept);
+    try {
+        await deps.npm(["uninstall", "--ignore-scripts", "--no-audit", "--no-fund", "--prefix", deps.dir, name], deps.dir);
+    }
+    catch {
+        await rm(join(deps.dir, "node_modules", name), { recursive: true, force: true });
+    }
+    out.write(`Denied ${name}: it no longer loads.\n`);
+    return EXIT.ok;
+}
+function describe(stdout) {
+    let data;
+    try {
+        data = JSON.parse(stdout);
+    }
+    catch {
+        throw new ConfigError("npm view did not answer with JSON");
+    }
+    if (Array.isArray(data))
+        data = data.length === 1 ? data[0] : undefined;
+    if (typeof data !== "object" || data === null) {
+        throw new ConfigError("npm view did not describe one version");
+    }
+    const v = data;
+    const person = (p) => typeof p === "string"
+        ? p
+        : typeof p === "object" && p !== null && typeof p.name === "string"
+            ? p.name
+            : undefined;
+    const integrity = v.dist?.integrity ?? v["dist.integrity"];
+    const publisher = person(v._npmUser);
+    return {
+        ...(typeof v.name === "string" ? { name: v.name } : {}),
+        ...(typeof v.version === "string" ? { version: v.version } : {}),
+        ...(publisher ? { publisher } : {}),
+        maintainers: (Array.isArray(v.maintainers) ? v.maintainers : [])
+            .map(person)
+            .filter((m) => m !== undefined),
+        ...(typeof integrity === "string" ? { integrity } : {}),
+    };
+}
+async function exists(path) {
+    return access(path).then(() => true, () => false);
+}
+//# sourceMappingURL=plugins.js.map

package/dist/{review → commands/review}/args.d.ts

@@ -1,20 +1,19 @@
-import { OcraError } from "@open-cr-agent/core";
 import type { LocalTarget } from "@open-cr-agent/vcs-local";
-export type OutputFormat = "text" | "json" | "sarif";
-export interface PullRequestTarget {
+type OutputFormat = "text" | "json" | "sarif";
+interface PullRequestArgs {
     number: number;
     repo?: string;
     publish: boolean;
 }
-export interface MergeRequestTarget {
+interface MergeRequestArgs {
     iid: number;
     project?: string;
     publish: boolean;
 }
 export interface ReviewArgs {
     target: LocalTarget;
-    pullRequest?: PullRequestTarget;
-    mergeRequest?: MergeRequestTarget;
+    pullRequest?: PullRequestArgs;
+    mergeRequest?: MergeRequestArgs;
     format: OutputFormat;
     output?: string;
     ignoreRepoConfig?: true;
@@ -29,9 +28,7 @@ export interface ReviewArgs {
     temperature?: number;
     seed?: number;
 }
-export declare class UsageError extends OcraError {
-    constructor(message: string);
-}
-export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  --no-upload        When signed in to ocra Cloud, do not send this review's\n                     counts (verdict, numbers of findings, files, tokens)\n  -h, --help         Show help\n";
+export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  --no-upload        When signed in to ocra Cloud, send nothing about this\n                     review: no counts, per-reviewer counts or findings\n  -h, --help         Show help\n";
 export declare function parseReviewArgs(argv: string[]): ReviewArgs | "help";
+export {};
 //# sourceMappingURL=args.d.ts.map

package/dist/{review → commands/review}/args.js

@@ -1,11 +1,6 @@
 import { parseArgs } from "node:util";
-import { OcraError } from "@open-cr-agent/core";
-export class UsageError extends OcraError {
-    constructor(message) {
-        super("INPUT_USAGE", message);
-        this.name = "UsageError";
-    }
-}
+import { errorMessage } from "@open-cr-agent/core";
+import { UsageError } from "../../io/usage-error.js";
 export const REVIEW_USAGE = `Usage: ocra review [options]
 
 Reviews uncommitted changes by default.
@@ -35,8 +30,8 @@ Options:
                      .ocra/config.json; it applies with --no-repo-config too
   --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted
                      code); models come from OCRA_MODEL_* variables or --config
-  --no-upload        When signed in to ocra Cloud, do not send this review's
-                     counts (verdict, numbers of findings, files, tokens)
+  --no-upload        When signed in to ocra Cloud, send nothing about this
+                     review: no counts, per-reviewer counts or findings
   -h, --help         Show help
 `;
 export function parseReviewArgs(argv) {
@@ -45,7 +40,7 @@ export function parseReviewArgs(argv) {
         parsed = parse(argv);
     }
     catch (error) {
-        throw new UsageError(error.message);
+        throw new UsageError(errorMessage(error));
     }
     const { values, positionals } = parsed;
     if (values.help)
@@ -56,9 +51,9 @@ export function parseReviewArgs(argv) {
     if (format !== "text" && format !== "json" && format !== "sarif") {
         throw new UsageError(`--format must be text, json or sarif, got ${format}`);
     }
-    const args = { target: target(values), format };
-    const pullRequest = pullRequestTarget(values);
-    const mergeRequest = mergeRequestTarget(values);
+    const args = { target: parseLocalTarget(values), format };
+    const pullRequest = parsePullRequest(values);
+    const mergeRequest = parseMergeRequest(values);
     if (pullRequest && mergeRequest)
         throw new UsageError("--pr cannot be combined with --mr");
     if (!pullRequest && !mergeRequest && values.publish) {
@@ -160,7 +155,7 @@ function parse(argv) {
         },
     });
 }
-function pullRequestTarget(values) {
+function parsePullRequest(values) {
     if (values.pr === undefined) {
         if (values.repo !== undefined)
             throw new UsageError("--repo requires --pr");
@@ -183,7 +178,7 @@ function pullRequestTarget(values) {
 }
 // A GitLab project is a numeric id or a full path, "group/sub/project".
 const PROJECT = /^(\d+|[\w.-]+(\/[\w.-]+)+)$/;
-function mergeRequestTarget(values) {
+function parseMergeRequest(values) {
     if (values.mr === undefined) {
         if (values.project !== undefined)
             throw new UsageError("--project requires --mr");
@@ -204,7 +199,7 @@ function mergeRequestTarget(values) {
         target.project = values.project;
     return target;
 }
-function target(values) {
+function parseLocalTarget(values) {
     if (values.commit !== undefined) {
         if (values.from !== undefined || values.to !== undefined) {
             throw new UsageError("--commit cannot be combined with --from or --to");

package/dist/commands/review/deliver.d.ts

@@ -0,0 +1,7 @@
+import type { ReviewArgs } from "./args.js";
+import type { ReviewDeps } from "./deps.js";
+import type { ExecutedRun } from "./execute-run.js";
+import type { ResolvedRun, ReviewIo } from "./resolve-run.js";
+export declare function writeReport(run: ResolvedRun, { report }: ExecutedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<void>;
+export declare function deliver(run: ResolvedRun, executed: ExecutedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<void>;
+//# sourceMappingURL=deliver.d.ts.map

package/dist/commands/review/deliver.js

@@ -0,0 +1,56 @@
+import { join, relative, resolve } from "node:path";
+import { sendToCloud } from "../../cloud/review.js";
+import { VERSION } from "../../version.js";
+import { renderJson, renderText } from "./render.js";
+import { renderSarif } from "./sarif.js";
+import { CHANGE_REQUEST } from "./target.js";
+// The report in the format asked for, to stdout or --output.
+export async function writeReport(run, { report }, args, io, deps) {
+    const sessionDir = relative(deps.cwd, join(run.session.dir, run.session.id)) || ".";
+    const rendered = args.format === "json"
+        ? renderJson(report)
+        : args.format === "sarif"
+            ? renderSarif(report, VERSION)
+            : renderText(report, sessionDir);
+    if (args.output === undefined) {
+        io.out.write(rendered);
+    }
+    else {
+        await deps.writeFile(resolve(deps.cwd, args.output), rendered);
+        io.err.write(`[ocra] Wrote ${args.output}\n`);
+    }
+    const hidden = report.remembered.filter((e) => e.source === "account").length;
+    if (hidden > 0)
+        io.err.write(`[ocra] ${hidden} finding(s) hidden by your ocra Cloud memory\n`);
+}
+// Publishes to the pull or merge request when asked, and uploads to ocra
+// Cloud when signed in.
+export async function deliver(run, executed, args, io, deps) {
+    const { target } = run;
+    if (target.publish && target.platform !== "local") {
+        const changeRequest = CHANGE_REQUEST[target.platform];
+        // Stopping halfway could post the inline comments without the summary
+        // that remembers them; a first Ctrl-C only warns.
+        const stopHolding = deps.onInterrupt?.(() => {
+            io.err.write(`[ocra] Publishing; Ctrl-C again quits now and may leave the ${changeRequest} half updated\n`);
+        });
+        try {
+            const published = await run.vcs.publish(executed.report);
+            for (const warning of published.warnings)
+                run.warn(warning);
+        }
+        finally {
+            stopHolding?.();
+        }
+        io.err.write(`[ocra] Published the review to the ${changeRequest}\n`);
+    }
+    if (executed.cloudReview && run.signedInCloud && !args.noUpload) {
+        await sendToCloud(executed.report, executed.cloudReview, run.signedInCloud, {
+            source: target.platform,
+            durationMs: deps.now() - executed.started,
+            err: io.err,
+            warn: run.warn,
+        });
+    }
+}
+//# sourceMappingURL=deliver.js.map

package/dist/commands/review/deps.d.ts

@@ -0,0 +1,18 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+import type { CloudDeps } from "../../cloud/deps.js";
+import type { NpmRunner } from "../../plugins/npm.js";
+import type { RuntimeLoaders } from "./runtimes.js";
+export interface ReviewDeps {
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    builtinPlugins: readonly OcraPlugin[];
+    runtimes: RuntimeLoaders;
+    writeFile(path: string, content: string): Promise<void>;
+    now(): number;
+    heartbeatMs: number;
+    fetch?: typeof fetch;
+    cloud?: CloudDeps;
+    npm?: NpmRunner;
+    onInterrupt?(handler: () => void): () => void;
+}
+//# sourceMappingURL=deps.d.ts.map

package/dist/commands/review/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/commands/review/execute-run.d.ts

@@ -0,0 +1,13 @@
+import { type ReviewReport } from "@open-cr-agent/core";
+import { type CloudReview } from "../../cloud/review.js";
+import type { ReviewArgs } from "./args.js";
+import type { ReviewDeps } from "./deps.js";
+import type { ResolvedRun, ReviewIo } from "./resolve-run.js";
+export interface ExecutedRun {
+    report: ReviewReport;
+    interrupted: boolean;
+    cloudReview?: CloudReview;
+    started: number;
+}
+export declare function executeRun(run: ResolvedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<ExecutedRun>;
+//# sourceMappingURL=execute-run.d.ts.map