@open-cr-agent/cli 0.4.0 → 0.6.0

package/dist/internal.d.ts

@@ -0,0 +1,6 @@
+export type { ReviewDeps } from "./commands/review/deps.js";
+export { type CliPlanOutput, cliPlanOutputSchema, planJsonSchema, } from "./commands/review/plan-schema.js";
+export { configJsonSchema } from "./config/schema.js";
+export type { Output } from "./io/output.js";
+export { run } from "./run.js";
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.js

@@ -0,0 +1,7 @@
+// "@open-cr-agent/cli/internal": what ocra's own packages share beyond the
+// public API (index.ts), such as the command with its dependencies
+// injected. Not a contract: any release may change or remove any of it.
+export { cliPlanOutputSchema, planJsonSchema, } from "./commands/review/plan-schema.js";
+export { configJsonSchema } from "./config/schema.js";
+export { run } from "./run.js";
+//# sourceMappingURL=internal.js.map

package/dist/io/exit.d.ts

@@ -0,0 +1,9 @@
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly blocking: 1;
+    readonly notSignedIn: 1;
+    readonly error: 2;
+    readonly incomplete: 3;
+    readonly interrupted: 130;
+};
+//# sourceMappingURL=exit.d.ts.map

package/dist/io/exit.js

@@ -0,0 +1,12 @@
+// Exit codes are a contract (docs/manual, "Exit codes"): every command
+// returns one of these, never a bare number.
+export const EXIT = {
+    ok: 0,
+    blocking: 1,
+    // ocra login, logout and whoami: no usable ocra Cloud session.
+    notSignedIn: 1,
+    error: 2,
+    incomplete: 3,
+    interrupted: 130,
+};
+//# sourceMappingURL=exit.js.map

package/dist/io/output.d.ts

@@ -0,0 +1,4 @@
+export interface Output {
+    write(chunk: string): unknown;
+}
+//# sourceMappingURL=output.d.ts.map

package/dist/io/output.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=output.js.map

package/dist/io/usage-error.d.ts

@@ -0,0 +1,5 @@
+import { OcraError } from "@open-cr-agent/core";
+export declare class UsageError extends OcraError {
+    constructor(message: string);
+}
+//# sourceMappingURL=usage-error.d.ts.map

package/dist/io/usage-error.js

@@ -0,0 +1,8 @@
+import { OcraError } from "@open-cr-agent/core";
+export class UsageError extends OcraError {
+    constructor(message) {
+        super("INPUT_USAGE", message);
+        this.name = "UsageError";
+    }
+}
+//# sourceMappingURL=usage-error.js.map

package/dist/main.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { run } from "./run.js";
-process.exitCode = await run(process.argv.slice(2), process.stdout, process.stderr);
+import { run } from "./index.js";
+process.exitCode = await run(process.argv.slice(2));
 //# sourceMappingURL=main.js.map

package/dist/plugins/account.d.ts

@@ -0,0 +1,23 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+export interface AccountPlugins {
+    plugins: string[];
+    pluginSettings: Record<string, unknown>;
+}
+export declare function parseAccountPlugins(body: unknown, warn: (message: string) => void): AccountPlugins;
+/**
+ * The account's plugins this review loads, and their settings. Only where a
+ * repository's plugins could load (allowed: never for pull or merge requests,
+ * never with --no-repo-config); a package the configuration already lists
+ * loads as the configuration's, and a plugin whose name is taken is skipped.
+ */
+export declare function loadAccountPlugins(account: AccountPlugins, options: {
+    allowed: boolean;
+    configured: readonly string[];
+    taken: readonly OcraPlugin[];
+    dir: string;
+    warn: (message: string) => void;
+}): Promise<{
+    plugins: OcraPlugin[];
+    settings: Record<string, unknown>;
+}>;
+//# sourceMappingURL=account.d.ts.map

package/dist/plugins/account.js

@@ -0,0 +1,54 @@
+import { loadAllowedPlugins } from "./load.js";
+import { isPackageName } from "./store.js";
+const MAX_PLUGINS = 50;
+export function parseAccountPlugins(body, warn) {
+    const settings = record(record(body).settings);
+    const listed = Array.isArray(settings.plugins) ? settings.plugins : [];
+    const plugins = [
+        ...new Set(listed.filter((p) => typeof p === "string" && isPackageName(p))),
+    ].slice(0, MAX_PLUGINS);
+    const refused = listed.filter((p) => typeof p !== "string" || !isPackageName(p));
+    if (refused.length > 0 || (settings.plugins !== undefined && !Array.isArray(settings.plugins))) {
+        warn(`ignoring plugins in your ocra Cloud settings that are not npm package names: ${refused.map((p) => JSON.stringify(p)).join(", ") || JSON.stringify(settings.plugins)}`);
+    }
+    if (listed.length > MAX_PLUGINS) {
+        warn(`your ocra Cloud settings name more than ${MAX_PLUGINS} plugins; the rest are ignored`);
+    }
+    return { plugins, pluginSettings: record(settings.pluginSettings) };
+}
+/**
+ * The account's plugins this review loads, and their settings. Only where a
+ * repository's plugins could load (allowed: never for pull or merge requests,
+ * never with --no-repo-config); a package the configuration already lists
+ * loads as the configuration's, and a plugin whose name is taken is skipped.
+ */
+export async function loadAccountPlugins(account, options) {
+    const names = account.plugins.filter((name) => !options.configured.includes(name));
+    if (names.length === 0)
+        return { plugins: [], settings: {} };
+    if (!options.allowed) {
+        options.warn(`plugins from your ocra Cloud settings do not load for pull or merge requests or with --no-repo-config: ${names.join(", ")}`);
+        return { plugins: [], settings: {} };
+    }
+    const taken = new Set(options.taken.map((p) => p.name));
+    const plugins = [];
+    const settings = {};
+    for (const { name, plugin } of await loadAllowedPlugins(names, options.dir, options.warn)) {
+        if (taken.has(plugin.name)) {
+            options.warn(`skipping plugin ${name} from your ocra Cloud settings: a plugin named "${plugin.name}" is already loaded`);
+            continue;
+        }
+        taken.add(plugin.name);
+        plugins.push(plugin);
+        if (Object.hasOwn(account.pluginSettings, name)) {
+            settings[plugin.name] = account.pluginSettings[name];
+        }
+    }
+    return { plugins, settings };
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
+//# sourceMappingURL=account.js.map

package/dist/plugins/load.d.ts

@@ -0,0 +1,13 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+export declare function loadExternalPlugins(specifiers: readonly string[], root: string): Promise<OcraPlugin[]>;
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export declare function loadAllowedPlugins(names: readonly string[], dir: string, warn: (message: string) => void): Promise<{
+    name: string;
+    plugin: OcraPlugin;
+}[]>;
+//# sourceMappingURL=load.d.ts.map

package/dist/plugins/load.js

@@ -0,0 +1,78 @@
+import { realpath } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { isAbsolute, join, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { errorMessage } from "@open-cr-agent/core";
+import { ConfigError } from "../config/cli-config.js";
+import { installedEntry, readAllowed } from "./store.js";
+// Plugins listed in the repository config execute code, so they are resolved
+// only from the repository's own dependencies or relative paths inside it.
+export async function loadExternalPlugins(specifiers, root) {
+    const plugins = [];
+    for (const specifier of specifiers) {
+        const module = await import(pathToFileURL(resolvePlugin(specifier, root)).href);
+        const plugin = module.default ?? module.plugin;
+        if (!isPlugin(plugin)) {
+            throw new ConfigError(`Plugin "${specifier}" must export an ocra plugin as default or "plugin"`);
+        }
+        plugins.push(plugin);
+    }
+    return plugins;
+}
+function resolvePlugin(specifier, root) {
+    if (specifier.startsWith(".") || isAbsolute(specifier))
+        return resolve(root, specifier);
+    try {
+        return createRequire(join(root, "package.json")).resolve(specifier);
+    }
+    catch {
+        throw new ConfigError(`Cannot find plugin "${specifier}" from ${root}; install it as a dependency`);
+    }
+}
+function isPlugin(value) {
+    return (typeof value === "object" && value !== null && typeof value.name === "string");
+}
+/**
+ * The plugins an ocra Cloud account names that this machine allowed: each
+ * from the allowed directory alone, at the version and integrity recorded
+ * when it was allowed. Anything else is skipped with a warning; an account
+ * plugin never fails the review.
+ */
+export async function loadAllowedPlugins(names, dir, warn) {
+    const allowed = new Map((await readAllowed(dir)).map((p) => [p.name, p]));
+    const missing = names.filter((name) => !allowed.has(name));
+    if (missing.length > 0) {
+        warn(`your ocra Cloud settings name plugins this machine has not allowed, so they do not load: ${missing.join(", ")}; allow each with ocra plugins allow <name>@<version>`);
+    }
+    const loaded = [];
+    for (const name of names) {
+        const record = allowed.get(name);
+        if (!record)
+            continue;
+        try {
+            const installed = await installedEntry(dir, name);
+            if (installed?.version !== record.version || installed.integrity !== record.integrity) {
+                throw new Error(`it is not the ${record.version} allowed here; run ocra plugins allow ${name}@<version> again`);
+            }
+            const module = await import(pathToFileURL(await allowedEntry(dir, name)).href);
+            const plugin = module.default ?? module.plugin;
+            if (!isPlugin(plugin))
+                throw new Error('it exports no ocra plugin as default or "plugin"');
+            loaded.push({ name, plugin });
+        }
+        catch (error) {
+            warn(`skipping plugin ${name} from your ocra Cloud settings: ${errorMessage(error)}`);
+        }
+    }
+    return loaded;
+}
+// Node's resolution walks up past the directory to any node_modules above
+// it; the entry must be inside the allowed package itself.
+async function allowedEntry(dir, name) {
+    const entry = await realpath(createRequire(join(dir, "package.json")).resolve(name));
+    const root = await realpath(join(dir, "node_modules", name));
+    if (!entry.startsWith(`${root}${sep}`))
+        throw new Error(`it resolves outside ${dir}`);
+    return entry;
+}
+//# sourceMappingURL=load.js.map

package/dist/plugins/npm.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runs npm with these arguments in `cwd`, never through a shell; resolves
+ * with its standard output. Every call runs in the plugin directory, so the
+ * npm configuration of whatever project ocra was started in does not apply.
+ */
+export type NpmRunner = (args: readonly string[], cwd: string) => Promise<string>;
+export declare function defaultNpm(env?: NodeJS.ProcessEnv): NpmRunner;
+//# sourceMappingURL=npm.d.ts.map

package/dist/plugins/npm.js

@@ -0,0 +1,24 @@
+import { execFile } from "node:child_process";
+import { dirname, join } from "node:path";
+import { ConfigError } from "../config/cli-config.js";
+import { forTerminal } from "../io/terminal.js";
+// npm on Windows is npm.cmd, which execFile cannot run without a shell; run
+// the npm that ships with this Node directly instead.
+export function defaultNpm(env = process.env) {
+    const [file, prefix] = process.platform === "win32"
+        ? [
+            process.execPath,
+            [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")],
+        ]
+        : ["npm", []];
+    return (args, cwd) => new Promise((resolve, reject) => {
+        execFile(file, [...prefix, ...args], { cwd, env, timeout: 5 * 60_000, maxBuffer: 16 * 1024 * 1024, shell: false }, (error, stdout, stderr) => {
+            if (error) {
+                reject(new ConfigError(`npm ${args[0]} failed: ${forTerminal(String(stderr).trim().split("\n").slice(-3).join(" ") || error.message)}`));
+            }
+            else
+                resolve(String(stdout));
+        });
+    });
+}
+//# sourceMappingURL=npm.js.map

package/dist/plugins/store.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+export declare function isPackageName(name: string): boolean;
+export declare function isExactVersion(version: string): boolean;
+declare const allowedSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    integrity: z.ZodString;
+}, z.core.$strict>;
+export type AllowedPlugin = z.infer<typeof allowedSchema>;
+export declare function pluginsDir(env: Readonly<Record<string, string | undefined>>): string;
+export declare function readAllowed(dir: string): Promise<AllowedPlugin[]>;
+export declare function writeAllowed(dir: string, plugins: readonly AllowedPlugin[]): Promise<void>;
+export declare function ensureDir(dir: string): Promise<void>;
+/** What npm's lockfile in the directory says it installed for a package. */
+export declare function installedEntry(dir: string, name: string): Promise<{
+    version?: string;
+    integrity?: string;
+} | undefined>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/plugins/store.js

@@ -0,0 +1,85 @@
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { isNotFound } from "@open-cr-agent/core/internal";
+import { z } from "zod";
+import { ConfigError } from "../config/cli-config.js";
+import { ocraConfigDir } from "../config/user-dir.js";
+// The plugins this machine allows its ocra Cloud account to name (ADR-0027):
+// installed by `ocra plugins allow` into a directory of the user's own, never
+// the reviewed checkout, and recorded with the integrity npm installed.
+// npm's package-name rules, less a leading "-" or "." that npm could read as
+// an option or a path; at most 214 characters.
+const PACKAGE_NAME = /^(?:@[a-z0-9~][a-z0-9._~-]*\/)?[a-z0-9~][a-z0-9._~-]*$/;
+// An exact version: no range, tag or URL.
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function isPackageName(name) {
+    return name.length <= 214 && PACKAGE_NAME.test(name);
+}
+export function isExactVersion(version) {
+    return version.length <= 256 && EXACT_VERSION.test(version);
+}
+const allowedSchema = z
+    .object({
+    name: z.string().refine(isPackageName),
+    version: z.string().refine(isExactVersion),
+    integrity: z.string().min(1),
+})
+    .strict();
+const fileSchema = z.object({ plugins: z.array(allowedSchema) }).strict();
+export function pluginsDir(env) {
+    return join(ocraConfigDir(env), "plugins");
+}
+export async function readAllowed(dir) {
+    let text;
+    try {
+        text = await readFile(join(dir, "plugins.json"), "utf8");
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return [];
+        throw error;
+    }
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        data = undefined;
+    }
+    const parsed = fileSchema.safeParse(data);
+    if (!parsed.success) {
+        throw new ConfigError(`${join(dir, "plugins.json")} is invalid; allow the plugins again or remove it`);
+    }
+    return parsed.data.plugins;
+}
+export async function writeAllowed(dir, plugins) {
+    await ensureDir(dir);
+    const path = join(dir, "plugins.json");
+    const sorted = [...plugins].sort((a, b) => (a.name < b.name ? -1 : 1));
+    await writeFile(path, `${JSON.stringify({ plugins: sorted }, null, 2)}\n`, { mode: 0o600 });
+    // writeFile keeps the mode of a file that already exists.
+    await chmod(path, 0o600);
+}
+export async function ensureDir(dir) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+}
+/** What npm's lockfile in the directory says it installed for a package. */
+export async function installedEntry(dir, name) {
+    let lock;
+    try {
+        lock = JSON.parse(await readFile(join(dir, "package-lock.json"), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    const entry = lock.packages?.[`node_modules/${name}`];
+    if (typeof entry !== "object" || entry === null)
+        return undefined;
+    const { version, integrity } = entry;
+    return {
+        ...(typeof version === "string" ? { version } : {}),
+        ...(typeof integrity === "string" ? { integrity } : {}),
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/repository-id.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `https://host/owner/repo` for a remote in URL form (`https://`,
+ * `ssh://`, `git://`) or scp form (`user@host:owner/repo`), without user,
+ * password, port, trailing `/` or `.git`, case-folded; undefined for a
+ * local path.
+ */
+export declare function normaliseRemote(url: string): string | undefined;
+/** The repository behind a pull or merge request's web page, such as https://host/o/r/pull/7. */
+export declare function repositoryOfWebUrl(url: string): string | undefined;
+/** The repository behind origin; its address as written when it is a path, the root without one. */
+export declare function originRepository(root: string): Promise<string>;
+//# sourceMappingURL=repository-id.d.ts.map

package/dist/repository-id.js

@@ -0,0 +1,72 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+// What a repository is called before it is salted and hashed for ocra Cloud
+// (ADR-0028): `https://host/owner/repo`, the same for every way of writing
+// its address, so a laptop cloning over SSH and CI cloning over HTTPS group
+// their reviews and match the account's memory. It is the https form
+// because 0.5.0 and earlier hashed the remote URL as written: an HTTPS
+// clone, the common case and CI's, keeps its hash across the upgrade.
+const run = promisify(execFile);
+// Hosts that serve SSH for another host's repositories (port 443 fallbacks).
+const SSH_ALIASES = {
+    "ssh.github.com": "github.com",
+    "altssh.gitlab.com": "gitlab.com",
+};
+/**
+ * `https://host/owner/repo` for a remote in URL form (`https://`,
+ * `ssh://`, `git://`) or scp form (`user@host:owner/repo`), without user,
+ * password, port, trailing `/` or `.git`, case-folded; undefined for a
+ * local path.
+ */
+export function normaliseRemote(url) {
+    const parsed = hostAndPath(url.trim());
+    if (!parsed)
+        return undefined;
+    const host = parsed.host.toLowerCase();
+    const path = parsed.path
+        .replace(/^\/+|\/+$/g, "")
+        .replace(/\.git$/i, "")
+        .replace(/\/+$/, "");
+    if (!host || !path)
+        return undefined;
+    return `https://${SSH_ALIASES[host] ?? host}/${path}`.toLowerCase();
+}
+/** The repository behind a pull or merge request's web page, such as https://host/o/r/pull/7. */
+export function repositoryOfWebUrl(url) {
+    const page = /^(.+?)\/(?:-\/)?(?:pull|merge_requests)\/\d+\/?$/.exec(url.trim());
+    return page?.[1] ? normaliseRemote(page[1]) : undefined;
+}
+/** The repository behind origin; its address as written when it is a path, the root without one. */
+export async function originRepository(root) {
+    let url;
+    try {
+        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], {
+            timeout: 10_000,
+        });
+        url = stdout.trim();
+    }
+    catch {
+        return root;
+    }
+    return normaliseRemote(url) ?? url.toLowerCase();
+}
+function hostAndPath(url) {
+    if (/^[a-z][\w+.-]*:\/\//i.test(url)) {
+        try {
+            const parsed = new URL(url);
+            if (parsed.protocol === "file:")
+                return undefined;
+            return { host: parsed.hostname, path: decodeURIComponent(parsed.pathname) };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // scp form; a Windows path such as C:\repo or C:/repo, whose "host" is
+    // one letter, is not one.
+    const scp = /^(?:[^@\s/]+@)?([^:/\s\\]+):(.+)$/.exec(url);
+    if (!scp?.[1] || !scp[2] || scp[1].length === 1)
+        return undefined;
+    return { host: scp[1], path: scp[2] };
+}
+//# sourceMappingURL=repository-id.js.map

package/dist/run.d.ts

@@ -1,5 +1,5 @@
-import { type ReviewDeps } from "./review/command.js";
-import type { Output } from "./review/progress.js";
+import type { ReviewDeps } from "./commands/review/deps.js";
+import type { Output } from "./io/output.js";
 export declare function defaultDeps(): ReviewDeps;
 export declare function run(argv: string[], out: Output, err: Output, deps?: ReviewDeps): Promise<number>;
 //# sourceMappingURL=run.d.ts.map

package/dist/run.js

@@ -1,14 +1,19 @@
 import { writeFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
-import { isOcraError } from "@open-cr-agent/core";
-import { errorMessage } from "@open-cr-agent/core/internal";
-import { cloudCommand, defaultCloudDeps, LOGIN_USAGE } from "./cloud.js";
-import { memoryCommand } from "./memory.js";
-import { metricsCommand } from "./metrics.js";
-import { parseReviewArgs, REVIEW_USAGE, UsageError } from "./review/args.js";
-import { BUILTIN_PLUGINS, EXIT, reviewCommand } from "./review/command.js";
-import { BUILTIN_RUNTIMES } from "./review/runtimes.js";
-import { forTerminal } from "./review/terminal.js";
+import { errorMessage, isOcraError } from "@open-cr-agent/core";
+import { defaultCloudDeps } from "./cloud/deps.js";
+import { LOGIN_USAGE, loginCommand } from "./commands/login.js";
+import { memoryCommand } from "./commands/memory.js";
+import { metricsCommand } from "./commands/metrics.js";
+import { PLUGINS_USAGE, pluginsCommand } from "./commands/plugins.js";
+import { parseReviewArgs, REVIEW_USAGE } from "./commands/review/args.js";
+import { BUILTIN_RUNTIMES } from "./commands/review/runtimes.js";
+import { BUILTIN_PLUGINS, reviewCommand } from "./commands/review.js";
+import { EXIT } from "./io/exit.js";
+import { forTerminal } from "./io/terminal.js";
+import { UsageError } from "./io/usage-error.js";
+import { defaultNpm } from "./plugins/npm.js";
+import { pluginsDir } from "./plugins/store.js";
 import { VERSION } from "./version.js";
 const USAGE = `Usage: ocra <command> [options]
 
@@ -16,6 +21,7 @@ Commands:
   review      Review code changes (run "ocra review --help" for options)
   memory      Remember findings the team accepts (run "ocra memory --help")
   metrics     Counts over past reviews: runs, cost, findings, per reviewer (run "ocra metrics --help")
+  plugins     Allow plugins your ocra Cloud settings name on this machine (run "ocra plugins --help")
   login       Sign in to ocra Cloud (in development; run "ocra login --help")
   logout      Sign out of ocra Cloud
   whoami      Show the ocra Cloud account
@@ -66,9 +72,25 @@ export async function run(argv, out, err, deps = defaultDeps()) {
             return EXIT.error;
         }
     }
+    if (command === "plugins") {
+        try {
+            return await pluginsCommand(rest, out, {
+                dir: pluginsDir(deps.env),
+                npm: deps.npm ?? defaultNpm(),
+            });
+        }
+        catch (error) {
+            if (error instanceof UsageError) {
+                err.write(`${error.message ? `${error.message}\n\n` : ""}${PLUGINS_USAGE}`);
+            }
+            else
+                err.write(failure(error));
+            return EXIT.error;
+        }
+    }
     if (command === "login" || command === "logout" || command === "whoami") {
         try {
-            return await cloudCommand(command, rest, out, err, defaultCloudDeps(deps.env));
+            return await loginCommand(command, rest, out, err, defaultCloudDeps(deps.env));
         }
         catch (error) {
             if (error instanceof UsageError)

package/dist/session/store.d.ts

@@ -0,0 +1,9 @@
+import type { ReportOutput } from "@open-cr-agent/core";
+export declare const SESSIONS_DIR = ".ocra/sessions";
+export declare function sessionsDir(root: string): string;
+export declare function reportPath(sessionDir: string): string;
+/** The session ids in a sessions directory, oldest first; none when it does not exist. */
+export declare function listSessions(dir: string): Promise<string[]>;
+export declare function sessionStart(id: string): Date | undefined;
+export declare function readSessionReport(sessionDir: string): Promise<ReportOutput | undefined>;
+//# sourceMappingURL=store.d.ts.map

package/dist/session/store.js

@@ -0,0 +1,31 @@
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { REPORT_FILE, readReport } from "@open-cr-agent/core/internal";
+// Where a repository keeps its review sessions: one directory per run, named
+// by the run id, written by core's session log (sessionJsonlPlugin).
+export const SESSIONS_DIR = ".ocra/sessions";
+export function sessionsDir(root) {
+    return join(root, SESSIONS_DIR);
+}
+export function reportPath(sessionDir) {
+    return join(sessionDir, REPORT_FILE);
+}
+/** The session ids in a sessions directory, oldest first; none when it does not exist. */
+export async function listSessions(dir) {
+    return (await readdir(dir).catch(() => [])).filter((n) => !n.startsWith(".")).sort();
+}
+// A session directory is named by its run id, whose first part is the start
+// time (newRunId in core).
+export function sessionStart(id) {
+    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z/.exec(id);
+    if (!m)
+        return undefined;
+    const [, y, mo, d, h, mi, s] = m;
+    return new Date(`${y}-${mo}-${d}T${h}:${mi}:${s}Z`);
+}
+// A session's version 1 report; undefined when it is missing, unreadable or
+// of another version, which `ocra metrics` counts as unreadable.
+export async function readSessionReport(sessionDir) {
+    return readReport(reportPath(sessionDir)).catch(() => undefined);
+}
+//# sourceMappingURL=store.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-cr-agent/cli",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "ocra: open-source multi-agent code review for local changes and GitHub pull requests",
   "keywords": [
     "code-review",
@@ -27,6 +27,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./internal": {
+      "@open-cr-agent/source": "./src/internal.ts",
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {
@@ -37,17 +42,22 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@open-cr-agent/core": "0.4.0",
-    "@open-cr-agent/runtime-direct": "0.4.0",
-    "@open-cr-agent/vcs-github": "0.4.0",
-    "@open-cr-agent/vcs-gitlab": "0.4.0",
-    "@open-cr-agent/vcs-local": "0.4.0",
+    "@open-cr-agent/cloud-contract": "0.6.0",
+    "@open-cr-agent/core": "0.6.0",
+    "@open-cr-agent/runtime-direct": "0.6.0",
+    "@open-cr-agent/vcs-github": "0.6.0",
+    "@open-cr-agent/vcs-gitlab": "0.6.0",
+    "@open-cr-agent/vcs-local": "0.6.0",
+    "@open-cr-agent/vcs-platform": "0.6.0",
     "zod": "^4.6.5"
   },
   "optionalDependencies": {
-    "@open-cr-agent/runtime-opencode": "0.4.0"
+    "@open-cr-agent/runtime-opencode": "0.6.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@open-cr-agent/test-support": "0.0.0"
   }
 }