@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/review/command.js

@@ -1,293 +0,0 @@
-import { join, relative, resolve } from "node:path";
-import { agentsMdReviewerPlugin, correctnessReviewerPlugin, coverageGaps, docsReviewerPlugin, performanceReviewerPlugin, review, securityReviewerPlugin, sessionJsonlPlugin, startPlugins, } from "@open-cr-agent/core";
-import { defaultSelectionPolicy, newRunId, previewReview, toPlanOutput, } from "@open-cr-agent/core/internal";
-import { githubPlugin } from "@open-cr-agent/vcs-github";
-import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
-import { localGitPlugin } from "@open-cr-agent/vcs-local";
-import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
-import { pluginsDir } from "../plugin-store.js";
-import { VERSION } from "../version.js";
-import { accountPlugins } from "./account-plugins.js";
-import { withCloudProviders } from "./cloud-providers.js";
-import { prepareCloudReview, sendToCloud } from "./cloud-review.js";
-import { fetchAccountSettings, layerAccountSettings } from "./cloud-settings.js";
-import { cloudEnabled } from "./cloud-upload.js";
-import { agentChains, ConfigError } from "./config.js";
-import { renderPlan } from "./plan-render.js";
-import { ProgressPrinter } from "./progress.js";
-import { configHash, requestedSampling } from "./provenance.js";
-import { renderJson, renderText, safeJson } from "./render.js";
-import { renderSarif } from "./sarif.js";
-import { loadSarifLogs } from "./sarif-input.js";
-import { effectiveSettings, renderSettings } from "./settings-sources.js";
-import { localTarget, mergeRequestTarget, pullRequestTarget } from "./target.js";
-import { forTerminal } from "./terminal.js";
-export const SESSIONS_DIR = ".ocra/sessions";
-export const EXIT = { ok: 0, blocking: 1, error: 2, incomplete: 3, interrupted: 130 };
-export const BUILTIN_PLUGINS = [
-    localGitPlugin,
-    githubPlugin,
-    gitlabPlugin,
-    correctnessReviewerPlugin,
-    securityReviewerPlugin,
-    performanceReviewerPlugin,
-    docsReviewerPlugin,
-    agentsMdReviewerPlugin,
-    sessionJsonlPlugin,
-];
-export async function reviewCommand(args, io, deps) {
-    const root = await findRepositoryRoot(deps.cwd);
-    const warn = (message) => io.err.write(`[ocra] Warning: ${forTerminal(message)}\n`);
-    const ignoreRepoConfig = args.ignoreRepoConfig === true;
-    const configFile = args.configFile ? resolve(deps.cwd, args.configFile) : undefined;
-    const localArgs = configFile ? { ...args, configFile } : args;
-    const target = args.pullRequest
-        ? await pullRequestTarget(args.pullRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
-        : args.mergeRequest
-            ? await mergeRequestTarget(args.mergeRequest, deps.cwd, root, deps.env, warn, deps.fetch, ignoreRepoConfig, configFile)
-            : await localTarget(localArgs, deps.cwd, root, deps.env, warn, deps.fetch);
-    // The account's settings fill what the repository leaves out (ADR-0027);
-    // unreachable, they cost a warning, so a plan still works offline.
-    const cloudDeps = deps.cloud;
-    const signedIn = cloudDeps !== undefined && (await cloudEnabled(cloudDeps));
-    let config = target.config;
-    let filled = [];
-    let fromAccount = { plugins: [], pluginSettings: {} };
-    if (cloudDeps && signedIn) {
-        const account = await fetchAccountSettings(cloudDeps, warn);
-        if (account?.settings) {
-            ({ config, filled } = layerAccountSettings(config, account.settings));
-            // The account's default for --ultra; there is no --no-ultra to refuse it.
-            if (account.settings.ultra === true && !args.ultra)
-                filled.push("ultra");
-            if (filled.length > 0) {
-                io.err.write(`[ocra] From your ocra Cloud settings: ${filled.join(", ")}\n`);
-            }
-        }
-        if (account)
-            fromAccount = account.plugins;
-    }
-    const ultra = args.ultra === true || filled.includes("ultra");
-    const session = { dir: join(root, SESSIONS_DIR), id: newRunId() };
-    // A plan calls no model, writes no session log and imports no runtime: it
-    // works without the optional runtime-opencode.
-    const builtins = args.plan
-        ? deps.builtinPlugins.filter((p) => p.name !== sessionJsonlPlugin.name)
-        : [...deps.builtinPlugins, ...(await builtinRuntime(deps.runtimes, config.runtime))];
-    const account = await accountPlugins(fromAccount, {
-        allowed: target.accountPlugins,
-        configured: config.plugins,
-        taken: [...builtins, ...target.plugins],
-        dir: pluginsDir(deps.env),
-        warn,
-    });
-    // The repository's own settings win; a repository plugin's come from it alone.
-    const pluginSettings = { ...account.settings, ...config.pluginSettings };
-    const registry = await startPlugins([...builtins, ...target.plugins, ...account.plugins], {
-        settings: args.plan
-            ? pluginSettings
-            : { ...pluginSettings, [sessionJsonlPlugin.name]: session },
-        env: deps.env,
-        warn,
-    });
-    const vcs = target.createVcs(registry);
-    const rules = [
-        ...registry.rules.map((rule) => ({ ...rule, source: "plugin" })),
-        ...config.rules,
-    ];
-    const overrides = reviewerOverrides(config, args, registry.reviewers.map((r) => r.id));
-    if (args.plan) {
-        const preview = await previewReview({
-            vcs,
-            reviewers: registry.reviewers,
-            reviewerOverrides: overrides,
-            effort: config.effort,
-            roles: config.roles,
-            models: config.models,
-            rules,
-            selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
-            ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
-            ...(ultra ? { ultra: true } : {}),
-            ...(config.maxTasks !== undefined ? { maxTasks: config.maxTasks } : {}),
-        });
-        const settings = effectiveSettings(target.config, config, filled);
-        const rendered = args.format === "json"
-            ? `${safeJson({ ...toPlanOutput(preview), settings, ...accountOf(config) })}\n`
-            : renderPlan(preview) + renderSettings(settings, config.accountSettings);
-        if (args.output === undefined)
-            io.out.write(rendered);
-        else
-            await deps.writeFile(resolve(deps.cwd, args.output), rendered);
-        return EXIT.ok;
-    }
-    const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
-    // The repository's hash and the account's memory for it (ADR-0028).
-    const cloudReview = cloudDeps && signedIn ? await prepareCloudReview(root, cloudDeps, warn) : undefined;
-    const sampling = requestedSampling(config, args);
-    const models = config.models;
-    const agentModels = agentChains({ reviewers: overrides, roles: config.roles });
-    const cloud = await withCloudProviders([...Object.values(models), ...Object.values(agentModels)], config.providers, deps.env, cloudDeps, warn);
-    const runtime = registry.createRuntime(config.runtime, {
-        models,
-        ...(Object.keys(agentModels).length > 0 ? { agentModels } : {}),
-        env: cloud.env,
-        providers: cloud.providers,
-        ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
-    });
-    const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
-    const interrupt = new AbortController();
-    const stopListening = deps.onInterrupt?.(() => {
-        io.err.write("[ocra] Interrupted: stopping and writing a partial report (Ctrl-C again quits now)\n");
-        interrupt.abort();
-    });
-    let report;
-    const started = deps.now();
-    try {
-        report = await review({
-            runId: session.id,
-            signal: interrupt.signal,
-            ...runOptions(config),
-            models,
-            reviewerOverrides: overrides,
-            provenance: {
-                ocraVersion: VERSION,
-                configHash: configHash(config, ultra ? { ...args, ultra: true } : args),
-                sampling,
-                ...accountOf(config),
-            },
-            ...(args.maxCostUsd !== undefined ? { maxCostUsd: args.maxCostUsd } : {}),
-            ...(ultra ? { ultra: true } : {}),
-            ...(args.full ? { fullReview: true } : {}),
-            ...(sarif.length > 0 ? { sarif } : {}),
-            ...(target.readTrusted ? { readTrusted: target.readTrusted } : {}),
-            vcs,
-            runtime,
-            reviewers: registry.reviewers,
-            rules,
-            ...(cloudReview?.memory.length ? { accountMemory: cloudReview.memory } : {}),
-            onEvent: (event) => {
-                registry.emit(event);
-                progress.onEvent(event);
-            },
-        });
-    }
-    finally {
-        stopListening?.();
-        progress.stop();
-        await runtime.dispose?.();
-    }
-    const sessionDir = relative(deps.cwd, join(session.dir, session.id)) || ".";
-    const rendered = args.format === "json"
-        ? renderJson(report)
-        : args.format === "sarif"
-            ? renderSarif(report, VERSION)
-            : renderText(report, sessionDir);
-    if (args.output === undefined) {
-        io.out.write(rendered);
-    }
-    else {
-        await deps.writeFile(resolve(deps.cwd, args.output), rendered);
-        io.err.write(`[ocra] Wrote ${args.output}\n`);
-    }
-    const hidden = report.remembered.filter((e) => e.source === "account").length;
-    if (hidden > 0)
-        io.err.write(`[ocra] ${hidden} finding(s) hidden by your ocra Cloud memory\n`);
-    if (interrupt.signal.aborted)
-        return EXIT.interrupted;
-    if (target.publish) {
-        // Stopping halfway could post the inline comments without the summary
-        // that remembers them; a first Ctrl-C only warns.
-        const stopHolding = deps.onInterrupt?.(() => {
-            io.err.write("[ocra] Publishing; Ctrl-C again quits now and may leave the pull request half updated\n");
-        });
-        try {
-            const published = await vcs.publish(report);
-            for (const warning of published.warnings)
-                warn(warning);
-        }
-        finally {
-            stopHolding?.();
-        }
-        io.err.write(`[ocra] Published the review to the ${target.publishesTo ?? "change request"}\n`);
-    }
-    if (cloudReview && cloudDeps && !args.noUpload) {
-        await sendToCloud(report, cloudReview, cloudDeps, {
-            source: args.pullRequest ? "github" : args.mergeRequest ? "gitlab" : "local",
-            durationMs: deps.now() - started,
-            err: io.err,
-            warn,
-        });
-    }
-    return exitCode(report, io.err);
-}
-function accountOf(config) {
-    return config.accountSettings ? { accountSettings: config.accountSettings } : {};
-}
-// A runtime not built in comes from a plugin of the configuration.
-async function builtinRuntime(runtimes, name) {
-    const load = Object.hasOwn(runtimes, name) ? runtimes[name] : undefined;
-    return load ? [await load()] : [];
-}
-function runOptions(config) {
-    const options = {
-        selection: { ...defaultSelectionPolicy, include: config.include, exclude: config.exclude },
-        effort: config.effort,
-        roles: config.roles,
-    };
-    if (config.concurrency !== undefined)
-        options.concurrency = config.concurrency;
-    if (config.taskTimeoutMinutes !== undefined)
-        options.taskTimeoutMs = config.taskTimeoutMinutes * 60_000;
-    if (config.verify !== undefined)
-        options.verify = config.verify;
-    if (config.judge !== undefined)
-        options.judge = config.judge;
-    if (config.maxCostUsd !== undefined)
-        options.maxCostUsd = config.maxCostUsd;
-    if (config.maxTasks !== undefined)
-        options.maxTasks = config.maxTasks;
-    if (config.runTimeoutMinutes !== undefined)
-        options.runTimeoutMs = config.runTimeoutMinutes * 60_000;
-    return options;
-}
-// --reviewers narrows the run to the named reviewers on top of the config.
-function reviewerOverrides(config, args, registered) {
-    if (args.reviewers === undefined)
-        return config.reviewers;
-    const unknown = args.reviewers.filter((id) => !registered.includes(id));
-    if (unknown.length > 0) {
-        throw new ConfigError(`Unknown reviewer(s): ${unknown.join(", ")} (available: ${registered.join(", ")})`);
-    }
-    const overrides = { ...config.reviewers };
-    for (const id of registered) {
-        if (!args.reviewers.includes(id))
-            overrides[id] = { ...overrides[id], enabled: false };
-    }
-    return overrides;
-}
-function exitCode(report, err) {
-    if (report.tasks.length > 0 && report.tasks.every((t) => t.status !== "completed")) {
-        err.write("[ocra] No review task completed; see the errors above.\n");
-        return EXIT.error;
-    }
-    // Incomplete comes first, even over a blocking verdict: the action lets
-    // exit 1 pass unless fail-on-concerns is set, and a review that missed
-    // files or could not check a critical finding must never pass.
-    const { notReviewed } = coverageGaps(report);
-    if (notReviewed > 0) {
-        err.write(`[ocra] ${notReviewed} selected file(s) were not reviewed; the review is incomplete.\n`);
-        return EXIT.incomplete;
-    }
-    if (report.unverifiedCriticals > 0) {
-        err.write(`[ocra] ${report.unverifiedCriticals} critical finding(s) could not be verified; the review is incomplete.\n`);
-        return EXIT.incomplete;
-    }
-    if (report.verdict !== "significant_concerns")
-        return EXIT.ok;
-    const override = report.changeRequest.override;
-    if (!override)
-        return EXIT.blocking;
-    err.write(`[ocra] The blocking verdict was overridden by ${forTerminal(override.by)}: ${forTerminal(override.reason)}\n`);
-    return EXIT.ok;
-}
-//# sourceMappingURL=command.js.map

package/dist/review/config.js

@@ -1,304 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { OcraError, } from "@open-cr-agent/core";
-import { AGENT_ROLES, EFFORT_LEVELS, RISK_TIERS } from "@open-cr-agent/core/internal";
-import { z } from "zod";
-import { fetchRemoteConfig, mergeConfig } from "./remote-config.js";
-export const CONFIG_PATH = ".ocra/config.json";
-// How much a model reasons before answering (ADR-0025); unset leaves the
-// provider's default.
-const effort = z.enum(EFFORT_LEVELS);
-const modelChain = z
-    .union([z.string().min(1), z.array(z.string().min(1)).min(1)])
-    .transform((value) => (typeof value === "string" ? [value] : value));
-// Where review code is sent: over https, or plain http only to this machine.
-// OpenCode replaces {env:NAME} and {file:path} anywhere in its configuration,
-// so an address with braces could carry a variable or a file (the checkout's
-// .git/config holds its token) to the endpoint.
-const endpoint = z
-    .url()
-    .refine((value) => {
-    const url = new URL(value);
-    if (url.protocol === "https:")
-        return true;
-    const host = url.hostname.replace(/^\[|\]$/g, "");
-    return (url.protocol === "http:" &&
-        (host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host)));
-}, "must be an https URL, or http on this machine (localhost, 127.0.0.1, ::1)")
-    .refine((value) => !/[{}]/.test(value), "must not contain { or }");
-// The platforms' and clouds' credentials never go to a model endpoint; the
-// same prefixes are never passed to the runtime by prefix (server-env.ts).
-const PLATFORM_TOKENS = /^(GITHUB_|GH_|GITLAB_|CI_|ACTIONS_|RUNNER_|AWS_|AZURE_|NPM_|SSH_|OCRA_)/;
-const price = z.number().min(0).max(10_000);
-const providerSchema = z
-    .object({
-    type: z.literal("openai-compatible"),
-    baseUrl: endpoint,
-    apiKeyEnv: z
-        .string()
-        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be an environment variable name")
-        .refine((name) => !PLATFORM_TOKENS.test(name), "must not name a platform or cloud credential")
-        .optional(),
-    // Prices in US dollars per million tokens; 0 means unpriced.
-    models: z
-        .record(z.string().regex(/^[\w./:@-]{1,200}$/), z.object({ input: price, output: price, cachedInput: price.optional() }).strict())
-        .refine((models) => Object.keys(models).length > 0, "must list at least one model"),
-    // How the endpoint takes a reasoning effort: "openai" sends
-    // reasoning_effort (the default), "openrouter" sends reasoning.effort.
-    effort: z.enum(["openai", "openrouter"]).optional(),
-})
-    .strict();
-// The runtimes ocra ships; a plugin may register another name, so the
-// schema lists these for editors and still accepts any other string.
-const BUILTIN_RUNTIMES = ["opencode", "direct"];
-export const DEFAULT_RUNTIME = "opencode";
-export const configSchema = z
-    .object({
-    $schema: z.string().optional(),
-    models: z
-        .object({ top: modelChain, standard: modelChain, light: modelChain })
-        .partial()
-        .strict()
-        .default({}),
-    effort: z
-        .object({ top: effort, standard: effort, light: effort })
-        .partial()
-        .strict()
-        .default({}),
-    concurrency: z.number().int().min(1).max(32).optional(),
-    taskTimeoutMinutes: z.number().positive().optional(),
-    runTimeoutMinutes: z.number().positive().optional(),
-    verify: z.boolean().optional(),
-    judge: z.boolean().optional(),
-    maxCostUsd: z.number().positive().optional(),
-    maxTasks: z.number().int().min(1).max(1_000).optional(),
-    // Unset: each provider's default. A seed makes sampling repeatable only
-    // where the provider supports it.
-    sampling: z
-        .object({
-        temperature: z.number().min(0).max(2),
-        seed: z
-            .number()
-            .int()
-            .min(0)
-            .max(2 ** 31 - 1),
-    })
-        .partial()
-        .strict()
-        .optional(),
-    github: z
-        .object({ requestChanges: z.boolean(), botLogin: z.string().min(1) })
-        .partial()
-        .strict()
-        .default({}),
-    include: z.array(z.string().min(1)).default([]),
-    exclude: z.array(z.string().min(1)).default([]),
-    // Unset means "opencode"; loadConfig fills it in and records whether the
-    // file chose, so account defaults (ADR-0025) apply only where it did not.
-    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).optional(),
-    plugins: z.array(z.string().min(1)).default([]),
-    reviewers: z
-        .record(z.string(), z
-        .object({
-        enabled: z.boolean(),
-        minTier: z.enum(RISK_TIERS),
-        // The reviewer's own chain, for its review tasks and plan call.
-        models: modelChain,
-        effort,
-    })
-        .partial()
-        .strict())
-        .default({}),
-    roles: z
-        .partialRecord(z.enum(AGENT_ROLES), z.object({ models: modelChain, effort }).partial().strict())
-        .default({}),
-    pluginSettings: z.record(z.string(), z.unknown()).default({}),
-    providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
-    extends: z.string().min(1).optional(),
-})
-    .strict();
-export const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
-// JSON Schema (draft 2020-12) of .ocra/config.json, for editors: what a
-// file may say, so defaults are optional and model chains take either form.
-export function configJsonSchema() {
-    const generated = z.toJSONSchema(configSchema, { target: "draft-2020-12", io: "input" });
-    const { $schema, ...rest } = generated;
-    return {
-        $schema,
-        $id: CONFIG_SCHEMA_ID,
-        title: "ocra configuration",
-        description: "The .ocra/config.json file of a repository, or a file passed with --config. Unknown keys are rejected.",
-        ...rest,
-    };
-}
-const MODEL_ENV = {
-    top: "OCRA_MODEL_TOP",
-    standard: "OCRA_MODEL_STANDARD",
-    light: "OCRA_MODEL_LIGHT",
-};
-const EFFORT_ENV = {
-    top: "OCRA_EFFORT_TOP",
-    standard: "OCRA_EFFORT_STANDARD",
-    light: "OCRA_EFFORT_LIGHT",
-};
-export class ConfigError extends OcraError {
-    constructor(message, options) {
-        super("CONFIG_INVALID", message, options);
-        this.name = "ConfigError";
-    }
-}
-// Without the repository's file, only defaults and environment variables
-// apply: that file can name plugins, and plugins run code.
-export async function loadConfig(root, env, options = { repository: true }) {
-    const read = options.read ?? ((path) => readConfigFromDisk(root, path));
-    const { config: parsed, rules } = options.file
-        ? await readConfigFile(ownFile(options.file), options, options.file)
-        : options.repository
-            ? await readConfigFile(read, options, CONFIG_PATH)
-            : { config: configSchema.parse({}), rules: [] };
-    const models = {};
-    for (const [tier, chain] of Object.entries(parsed.models)) {
-        if (chain)
-            models[tier] = chain;
-    }
-    for (const [tier, name] of Object.entries(MODEL_ENV)) {
-        const chain = (env[name] ?? "")
-            .split(",")
-            .map((m) => m.trim())
-            .filter((m) => m !== "");
-        if (chain.length > 0)
-            models[tier] = chain;
-    }
-    const efforts = {
-        ...parsed.effort,
-    };
-    for (const [tier, name] of Object.entries(EFFORT_ENV)) {
-        const value = env[name]?.trim();
-        if (!value)
-            continue;
-        const level = effort.safeParse(value);
-        if (!level.success) {
-            throw new ConfigError(`${name} must be one of ${EFFORT_LEVELS.join(", ")}`);
-        }
-        efforts[tier] = level.data;
-    }
-    for (const model of unpriced(parsed.providers, [
-        ...Object.values(models),
-        ...Object.values(agentChains(parsed)),
-    ])) {
-        options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
-    }
-    return {
-        ...parsed,
-        runtime: parsed.runtime ?? DEFAULT_RUNTIME,
-        runtimeSet: parsed.runtime !== undefined,
-        models,
-        effort: efforts,
-        providers: toProviders(parsed.providers),
-        rules: rules.map((rule) => ({ ...rule, source: "shared" })),
-    };
-}
-function toProviders(declared) {
-    return Object.fromEntries(Object.entries(declared).map(([id, p]) => [
-        id,
-        {
-            baseUrl: p.baseUrl,
-            ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}),
-            ...(p.effort ? { effort: p.effort } : {}),
-            models: Object.fromEntries(Object.entries(p.models).map(([model, price]) => [
-                model,
-                {
-                    input: price.input,
-                    output: price.output,
-                    ...(price.cachedInput === undefined ? {} : { cachedInput: price.cachedInput }),
-                },
-            ])),
-        },
-    ]));
-}
-// The reviewers' and roles' own chains, by agent id (ADR-0025); a disabled
-// reviewer's is left out, since it makes no call.
-export function agentChains(config) {
-    const chains = {};
-    for (const [id, setting] of Object.entries(config.reviewers)) {
-        if (setting.models && setting.enabled !== false)
-            chains[id] = setting.models;
-    }
-    for (const [role, setting] of Object.entries(config.roles)) {
-        if (setting?.models)
-            chains[role] = setting.models;
-    }
-    return chains;
-}
-// Models of declared providers, named in a chain, priced at 0 per token.
-function unpriced(providers, chains) {
-    const named = new Set(chains.flatMap((chain) => chain ?? []));
-    return [...named].filter((model) => {
-        const slash = model.indexOf("/");
-        const price = providers[model.slice(0, slash)]?.models[model.slice(slash + 1)];
-        return price !== undefined && price.input === 0 && price.output === 0;
-    });
-}
-// The user's own checkout, read like any local file (links followed): unlike
-// the review's reads, which never follow links (vcs-local), this is trusted
-// configuration, and --no-repo-config skips it for code that is not.
-function ownFile(file) {
-    return async () => {
-        try {
-            return await readFile(file, "utf8");
-        }
-        catch (error) {
-            throw new ConfigError(`cannot read ${file}: ${error.message}`, { cause: error });
-        }
-    };
-}
-async function readConfigFromDisk(root, path) {
-    try {
-        return await readFile(join(root, path), "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return undefined;
-        throw error;
-    }
-}
-async function readConfigFile(read, options, label) {
-    const text = await read(CONFIG_PATH);
-    if (text === undefined)
-        return { config: configSchema.parse({}), rules: [] };
-    let data;
-    try {
-        data = JSON.parse(text);
-    }
-    catch (error) {
-        throw new ConfigError(`${label} is not valid JSON: ${error.message}`, {
-            cause: error,
-        });
-    }
-    const local = configSchema.safeParse(data);
-    if (!local.success)
-        throw new ConfigError(`${label} is invalid: ${z.prettifyError(local.error)}`);
-    if (!local.data.extends)
-        return { config: local.data, rules: [] };
-    // A shared configuration that cannot be loaded costs its defaults, not the
-    // review: the repository's own settings still apply.
-    let remote;
-    try {
-        remote = await fetchRemoteConfig(local.data.extends, options.fetch);
-    }
-    catch (error) {
-        // Its limits are lost with it; say so rather than run silently unbounded.
-        const limits = local.data.maxCostUsd === undefined
-            ? "; none of its settings apply, including any spend or task limit"
-            : "; none of its settings apply";
-        options.warn?.(`could not load extends ${local.data.extends}: ${error.message}${limits}`);
-        return { config: local.data, rules: [] };
-    }
-    const merged = configSchema.safeParse(mergeConfig(remote, data));
-    if (!merged.success) {
-        options.warn?.(`ignoring extends ${local.data.extends}: its settings are invalid (${z.prettifyError(merged.error)})`);
-        return { config: local.data, rules: [] };
-    }
-    return { config: merged.data, rules: remote.rules ?? [] };
-}
-//# sourceMappingURL=config.js.map

package/dist/review/sarif.d.ts

@@ -1,4 +0,0 @@
-import { type ReviewReport } from "@open-cr-agent/core";
-export declare function renderSarif(report: ReviewReport, version: string): string;
-export declare function plainText(text: string): string;
-//# sourceMappingURL=sarif.d.ts.map

package/dist/review/settings-sources.d.ts

@@ -1,11 +0,0 @@
-import type { CliConfig } from "./config.js";
-export type SettingSource = "file" | "account" | "file+account" | "default";
-export interface EffectiveSetting {
-    key: string;
-    value?: unknown;
-    source: SettingSource;
-}
-/** file: the configuration before the account's settings; effective: after; filled: what they filled. */
-export declare function effectiveSettings(file: CliConfig, effective: CliConfig, filled: readonly string[]): EffectiveSetting[];
-export declare function renderSettings(settings: readonly EffectiveSetting[], account: CliConfig["accountSettings"]): string;
-//# sourceMappingURL=settings-sources.d.ts.map

package/dist/review/settings-sources.js

@@ -1,58 +0,0 @@
-import { ACCOUNT_SCALARS } from "./cloud-settings.js";
-import { forTerminal } from "./terminal.js";
-const TIERS = ["top", "standard", "light"];
-/** file: the configuration before the account's settings; effective: after; filled: what they filled. */
-export function effectiveSettings(file, effective, filled) {
-    const settings = [];
-    const add = (key, value, fromFile) => {
-        const fromAccount = filled.includes(key);
-        const source = fromFile && fromAccount
-            ? "file+account"
-            : fromAccount
-                ? "account"
-                : fromFile
-                    ? "file"
-                    : "default";
-        settings.push(source === "default" ? { key, source } : { key, value, source });
-    };
-    add("runtime", effective.runtime, file.runtimeSet);
-    for (const tier of TIERS) {
-        add(`models.${tier}`, effective.models[tier], file.models[tier] !== undefined);
-    }
-    for (const tier of TIERS) {
-        add(`effort.${tier}`, effective.effort[tier], file.effort[tier] !== undefined);
-    }
-    for (const [id, entry] of Object.entries(effective.reviewers)) {
-        add(`reviewers.${id}`, entry, file.reviewers[id] !== undefined);
-    }
-    for (const [role, entry] of Object.entries(effective.roles)) {
-        add(`roles.${role}`, entry, file.roles[role] !== undefined);
-    }
-    for (const key of ACCOUNT_SCALARS)
-        add(key, effective[key], file[key] !== undefined);
-    add("include", effective.include, file.include.length > 0);
-    add("exclude", effective.exclude, file.exclude.length > 0);
-    add("rules", effective.rules.map(({ path, source }) => ({ path, source })), file.rules.length > 0);
-    // A flag rather than a key: listed only when the account turned it on.
-    if (filled.includes("ultra"))
-        settings.push({ key: "ultra", value: true, source: "account" });
-    return settings;
-}
-export function renderSettings(settings, account) {
-    const lines = [
-        "",
-        account
-            ? `Settings (under your ocra Cloud settings, version ${account.version ?? "none"}):`
-            : "Settings:",
-    ];
-    const set = settings.filter((s) => s.source !== "default");
-    const width = Math.max(0, ...set.map((s) => s.key.length));
-    for (const s of set) {
-        lines.push(`  ${s.key.padEnd(width)}  ${JSON.stringify(s.value)}  (${s.source})`);
-    }
-    const defaults = settings.filter((s) => s.source === "default").map((s) => s.key);
-    if (defaults.length > 0)
-        lines.push(`  default: ${defaults.join(", ")}`);
-    return forTerminal(`${lines.join("\n")}\n`);
-}
-//# sourceMappingURL=settings-sources.js.map