@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/{review/cloud-findings.js → cloud/findings.js}

@@ -1,31 +1,9 @@
-export const MAX_FINDINGS = 200;
-export const MAX_FIELD = 4_096;
-export const MAX_TOTAL_BYTES = 262_144;
-// The same patterns as the server's (ocra-cloud src/redact.ts); the two
-// evolve together so the web never shows what this pass would have hidden.
-const PATTERNS = [
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g,
-    /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g,
-    /\b(ghp|gho|ghs|ghu|ghr)_[A-Za-z0-9]{20,}\b/g,
-    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
-    /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
-    /\bsk-(ant-|or-|proj-)?[A-Za-z0-9_-]{20,}\b/g,
-    /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g,
-    /\bAIza[0-9A-Za-z_-]{35}\b/g,
-    /\bnpm_[A-Za-z0-9]{36}\b/g,
-];
-// A long run mixing lower and upper case and digits: a likely key. A hex
-// digest (one case) and a path (has a slash) are left alone.
-const LONG_RUN = /\b[A-Za-z0-9+/_-]{32,}={0,2}/g;
-const looksRandom = (s) => /[a-z]/.test(s) && /[A-Z]/.test(s) && /\d/.test(s) && !s.includes("/");
-export const REDACTED = "[redacted]";
-export function redact(text) {
-    let out = text;
-    for (const pattern of PATTERNS)
-        out = out.replace(pattern, REDACTED);
-    out = out.replace(LONG_RUN, (m) => (looksRandom(m) ? REDACTED : m));
-    return { text: out, redacted: out !== text };
-}
+import { MAX_FIELD, MAX_FINDINGS, MAX_TOTAL_BYTES, redact, } from "@open-cr-agent/cloud-contract";
+// The findings a review sends ocra Cloud when the account shares them
+// (ADR-0028, 2): what the web needs to show the review, after the contract's
+// redaction pass and within its bounds. The server redacts and bounds again;
+// this pass keeps a secret from leaving the machine at all. It catches
+// patterns, not every secret.
 /** The report's findings as uploaded, redacted and bounded; `left` counts those not sent. */
 export function sharedFindings(report) {
     const findings = [];
@@ -57,9 +35,9 @@ function share(f) {
         fingerprint: f.fingerprint,
         reviewer: f.reviewer,
         severity: f.severity,
-        category: f.category,
+        category: text(f.category),
         verification: f.verification ?? "unchecked",
-        file: f.file,
+        file: text(f.file),
         lineStart: f.lineRange?.start ?? null,
         lineEnd: f.lineRange?.end ?? null,
         title: text(f.title),
@@ -75,6 +53,6 @@ function share(f) {
 }
 // Bytes as sent, escapes included, so the body stays under the server's limit.
 function textBytes(f) {
-    return [f.title, f.body, f.suggestion ?? "", f.code].reduce((sum, s) => sum + Buffer.byteLength(JSON.stringify(s)), 0);
+    return [f.title, f.body, f.suggestion ?? "", f.code ?? ""].reduce((sum, s) => sum + Buffer.byteLength(JSON.stringify(s)), 0);
 }
-//# sourceMappingURL=cloud-findings.js.map
+//# sourceMappingURL=findings.js.map

package/dist/cloud/gateway-token.d.ts

@@ -0,0 +1,18 @@
+import type { Credentials } from "./credentials.js";
+import type { CloudDeps } from "./deps.js";
+export declare const RENEW_BEFORE_MS: number;
+export declare class GatewayToken {
+    private timer;
+    private stopped;
+    private failing;
+    private credentials;
+    private readonly deps;
+    private readonly warn;
+    constructor(credentials: Credentials, deps: CloudDeps, warn: (message: string) => void);
+    get value(): string;
+    start(): void;
+    stop(): void;
+    private schedule;
+    private renew;
+}
+//# sourceMappingURL=gateway-token.d.ts.map

package/dist/cloud/gateway-token.js

@@ -0,0 +1,63 @@
+import { MAX_TIMER_MS } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+// The access token a run's models use at the ocra Cloud gateway lives an
+// hour; a run may last longer. While the run lasts, the token is renewed a
+// few minutes before it expires, for a runtime that reads its key at each
+// call (the direct runtime does).
+export const RENEW_BEFORE_MS = 5 * 60_000;
+const RETRY_MS = 60_000;
+export class GatewayToken {
+    timer;
+    stopped = false;
+    failing = false;
+    credentials;
+    deps;
+    warn;
+    constructor(credentials, deps, warn) {
+        this.credentials = credentials;
+        this.deps = deps;
+        this.warn = warn;
+    }
+    get value() {
+        return this.credentials.access_token;
+    }
+    start() {
+        this.schedule(this.credentials.expires_at - RENEW_BEFORE_MS - this.deps.now());
+    }
+    stop() {
+        this.stopped = true;
+        clearTimeout(this.timer);
+    }
+    schedule(delayMs) {
+        if (this.stopped)
+            return;
+        this.timer = setTimeout(() => void this.renew(), Math.min(Math.max(delayMs, 0), MAX_TIMER_MS));
+        this.timer.unref?.();
+    }
+    async renew() {
+        let reason;
+        try {
+            // Asking for more than the token has left renews it.
+            const session = await new CloudClient(this.deps).session(2 * RENEW_BEFORE_MS);
+            if (this.stopped)
+                return;
+            if (session.kind === "ok") {
+                this.credentials = session.credentials;
+                this.failing = false;
+                this.start();
+                return;
+            }
+            reason = session.kind === "signed-out" ? "you signed out" : sessionLostReason(session);
+        }
+        catch (error) {
+            reason = error instanceof Error ? error.message : "error";
+        }
+        if (!this.failing) {
+            this.warn(`could not renew the ocra Cloud token (${reason}); model calls through ocra Cloud fail once it expires`);
+            this.failing = true;
+        }
+        if (this.deps.now() < this.credentials.expires_at)
+            this.schedule(RETRY_MS);
+    }
+}
+//# sourceMappingURL=gateway-token.js.map

package/dist/cloud/memory.d.ts

@@ -0,0 +1,8 @@
+import type { MemoryEntry } from "@open-cr-agent/core";
+import type { CloudDeps } from "./deps.js";
+/** The account's entries for the repository; [] and a warning when they cannot be read. */
+export declare function fetchAccountMemory(deps: CloudDeps, repoHash: string, warn: (message: string) => void): Promise<MemoryEntry[]>;
+/** Whether the account remembers any finding, for any repository; false when that cannot be read. */
+export declare function accountHasMemory(deps: CloudDeps): Promise<boolean>;
+export declare function parseAccountMemory(list: readonly unknown[], warn: (message: string) => void): MemoryEntry[];
+//# sourceMappingURL=memory.d.ts.map

package/dist/cloud/memory.js

@@ -0,0 +1,68 @@
+import { MAX_MEMORY_PER_REPO } from "@open-cr-agent/cloud-contract";
+import { errorMessage } from "@open-cr-agent/core";
+import { memoryEntrySchema } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+// The findings the account remembers for one repository (ADR-0028, 4), set
+// from the web. A review applies them with .ocra/memory.json's.
+/** The account's entries for the repository; [] and a warning when they cannot be read. */
+export async function fetchAccountMemory(deps, repoHash, warn) {
+    const cannotRead = (reason) => {
+        warn(`could not read your ocra Cloud memory (${reason}); the review applies the repository's alone`);
+        return [];
+    };
+    let answer;
+    try {
+        answer = await new CloudClient(deps).memory(repoHash);
+    }
+    catch (error) {
+        return cannotRead(errorMessage(error));
+    }
+    switch (answer.kind) {
+        case "ok":
+            return parseAccountMemory(answer.value, warn);
+        case "signed-out":
+            return [];
+        case "status":
+            // A server without account memory has none to apply.
+            return answer.status === 404 ? [] : cannotRead(`HTTP ${answer.status}`);
+        case "malformed":
+            warn("ignoring your ocra Cloud memory: the server's answer has no entries");
+            return [];
+        default:
+            return cannotRead(sessionLostReason(answer));
+    }
+}
+/** Whether the account remembers any finding, for any repository; false when that cannot be read. */
+export async function accountHasMemory(deps) {
+    try {
+        const answer = await new CloudClient(deps).memory();
+        return answer.kind === "ok" && answer.value.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function parseAccountMemory(list, warn) {
+    const entries = [];
+    let refused = 0;
+    // The server keeps no more per repository; more is not an answer to trust.
+    for (const raw of list.slice(0, MAX_MEMORY_PER_REPO)) {
+        const r = (typeof raw === "object" && raw !== null ? raw : {});
+        const parsed = memoryEntrySchema.safeParse({
+            fingerprint: r.fingerprint,
+            file: r.file,
+            title: r.title,
+            reason: r.reason,
+            ...(typeof r.createdAt === "string" ? { added: r.createdAt.slice(0, 10) } : {}),
+        });
+        if (parsed.success)
+            entries.push(parsed.data);
+        else
+            refused += 1;
+    }
+    if (refused > 0) {
+        warn(`ignoring ${refused} ocra Cloud memory entr${refused > 1 ? "ies" : "y"} this version of ocra cannot read`);
+    }
+    return entries;
+}
+//# sourceMappingURL=memory.js.map

package/dist/cloud/private-file.d.ts

@@ -0,0 +1,8 @@
+/** Writes the file atomically, readable only by this user. */
+export declare function writePrivateFile(path: string, text: string): Promise<void>;
+/**
+ * Writes the file atomically unless it exists: false when another writer
+ * made it first, whose content then stands.
+ */
+export declare function createPrivateFile(path: string, text: string): Promise<boolean>;
+//# sourceMappingURL=private-file.d.ts.map

package/dist/cloud/private-file.js

@@ -0,0 +1,46 @@
+import { randomBytes } from "node:crypto";
+import { link, mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { errnoCode } from "@open-cr-agent/core/internal";
+// Files only this user may read (the ocra Cloud session, the salts), written
+// so that no reader, another ocra process included, ever sees one half
+// written: the text goes to a temporary file in the same directory, created
+// 0600, which then replaces the file in one rename.
+/** Writes the file atomically, readable only by this user. */
+export async function writePrivateFile(path, text) {
+    const temp = await writeTemp(path, text);
+    try {
+        await rename(temp, path);
+    }
+    catch (error) {
+        await rm(temp, { force: true });
+        throw error;
+    }
+}
+/**
+ * Writes the file atomically unless it exists: false when another writer
+ * made it first, whose content then stands.
+ */
+export async function createPrivateFile(path, text) {
+    const temp = await writeTemp(path, text);
+    try {
+        await link(temp, path);
+        return true;
+    }
+    catch (error) {
+        if (errnoCode(error) === "EEXIST")
+            return false;
+        throw error;
+    }
+    finally {
+        await rm(temp, { force: true });
+    }
+}
+async function writeTemp(path, text) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString("hex")}.tmp`);
+    // "wx": a fresh file, so the mode applies; never one that already exists.
+    await writeFile(temp, text, { mode: 0o600, flag: "wx" });
+    return temp;
+}
+//# sourceMappingURL=private-file.js.map

package/dist/{review/cloud-providers.d.ts → cloud/providers.d.ts}

@@ -1,12 +1,18 @@
 import type { CustomProvider } from "@open-cr-agent/core";
-import { type CloudDeps } from "../cloud.js";
-export declare const CLOUD_PREFIX = "ocra-";
+import type { CloudDeps } from "./deps.js";
 /** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
 export declare const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
-type Env = Readonly<Record<string, string | undefined>>;
-export declare function withCloudProviders(chains: readonly (readonly string[] | undefined)[], providers: Readonly<Record<string, CustomProvider>>, env: Env, deps: CloudDeps | undefined, warn: (message: string) => void): Promise<{
+/** The run the models serve: how long it may last, and whether its runtime reads a key at each call. */
+export type CloudRun = {
+    timeoutMs: number;
+    keyReadPerCall: boolean;
+};
+export type CloudProviders = {
     providers: Record<string, CustomProvider>;
     env: Env;
-}>;
+    stop(): void;
+};
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function withCloudProviders(chains: readonly (readonly string[] | undefined)[], providers: Readonly<Record<string, CustomProvider>>, env: Env, deps: CloudDeps | undefined, warn: (message: string) => void, run?: CloudRun): Promise<CloudProviders>;
 export {};
-//# sourceMappingURL=cloud-providers.d.ts.map
+//# sourceMappingURL=providers.d.ts.map

package/dist/cloud/providers.js

@@ -0,0 +1,132 @@
+import { CLOUD_PREFIX, EFFORT_STYLES, GATEWAY_PATH, isCloudModel, } from "@open-cr-agent/cloud-contract";
+import { errorMessage, OcraError } from "@open-cr-agent/core";
+import { REVIEW_DEFAULTS } from "@open-cr-agent/core/internal";
+import { CloudClient, sessionLostReason } from "./client.js";
+import { GatewayToken } from "./gateway-token.js";
+// Models named ocra-<provider>/<model> go through the ocra Cloud gateway with
+// the key stored there for <provider> (ADR-0024). Each such provider becomes
+// an OpenAI-compatible endpoint declared for this run, authorized by the
+// signed-in session's access token. Without such a model nothing here reads
+// the session or touches the network.
+/** Where the access token travels to the runtime; never a user's variable (OCRA_ is refused in config). */
+export const CLOUD_TOKEN_ENV = "OCRA_CLOUD_ACCESS_TOKEN";
+// A review runs 25 minutes at most by default; start it with a token that
+// outlives that, and ask for one that outlives a longer run.
+const MIN_TOKEN_MS = 35 * 60_000;
+const TOKEN_MARGIN_MS = 10 * 60_000;
+// chains: every chain of the run, the tiers' and the agents' own.
+export async function withCloudProviders(chains, providers, env, deps, warn, run = { timeoutMs: REVIEW_DEFAULTS.runTimeoutMs, keyReadPerCall: false }) {
+    const wanted = new Map();
+    const dropped = [];
+    for (const model of chains.flatMap((chain) => chain ?? [])) {
+        const slash = model.indexOf("/");
+        const id = model.slice(0, slash);
+        if (slash < 0 || !id.startsWith(CLOUD_PREFIX) || providers[id])
+            continue;
+        if (!isCloudModel(model)) {
+            dropped.push(JSON.stringify(model));
+            continue;
+        }
+        const set = wanted.get(id) ?? new Set();
+        set.add(model.slice(slash + 1));
+        wanted.set(id, set);
+    }
+    if (dropped.length > 0) {
+        warn(`ignoring ${dropped.join(", ")}: an ocra Cloud model is ${CLOUD_PREFIX}<provider>/<model>, with a provider of lowercase letters, digits and - and a model of letters, digits and ./:@_-`);
+    }
+    if (wanted.size === 0)
+        return { providers: { ...providers }, env, stop: () => { } };
+    const names = [...wanted.keys()].join(", ");
+    if (env.OCRA_CLOUD === "off") {
+        throw new OcraError("CONFIG_INVALID", `Models name ocra Cloud (${names}) but OCRA_CLOUD=off`);
+    }
+    const client = deps ? new CloudClient(deps) : undefined;
+    // A runtime that reads the key once needs a token that outlives the run;
+    // one that reads it at each call gets it renewed during the run.
+    const needed = run.timeoutMs + TOKEN_MARGIN_MS;
+    const minValidity = run.keyReadPerCall ? MIN_TOKEN_MS : Math.max(MIN_TOKEN_MS, needed);
+    const state = client ? await client.session(minValidity) : { kind: "signed-out" };
+    if (!client || !deps || state.kind === "signed-out") {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): sign in with ocra login`);
+    }
+    if (state.kind === "revoked") {
+        throw new OcraError("CONFIG_CREDENTIALS_MISSING", `Models name ocra Cloud (${names}): ${sessionLostReason(state)}`);
+    }
+    const unreachable = (reason) => new OcraError("RUNTIME_START_FAILED", `Models name ocra Cloud (${names}) but ocra Cloud could not be reached (${reason})`);
+    if (state.kind === "unreachable")
+        throw unreachable(state.reason);
+    const session = state.credentials;
+    let answer;
+    try {
+        answer = await client.providers(session.server);
+    }
+    catch (error) {
+        throw unreachable(errorMessage(error));
+    }
+    if (answer.kind === "status" && (answer.status >= 500 || answer.status === 429)) {
+        throw unreachable(`HTTP ${answer.status}`);
+    }
+    if (answer.kind === "malformed") {
+        throw new OcraError("RUNTIME_START_FAILED", "ocra Cloud's answer for its providers is not a list of providers");
+    }
+    if (answer.kind !== "ok") {
+        throw new OcraError("RUNTIME_START_FAILED", `ocra Cloud answered ${answer.status} for its providers`);
+    }
+    const listed = answer.value;
+    const declared = { ...providers };
+    for (const [id, modelIds] of wanted) {
+        const name = id.slice(CLOUD_PREFIX.length);
+        const entry = listed.find((p) => p.name === name);
+        const paths = entry?.paths ?? [];
+        const valid = paths.filter((path) => typeof path === "string" && GATEWAY_PATH.test(path));
+        if (valid.length < paths.length) {
+            warn(`ignoring ${paths.length - valid.length} gateway path(s) ocra Cloud listed for "${name}" that are not plain paths`);
+        }
+        const chat = valid.find((path) => path.endsWith("/chat/completions"));
+        if (!chat) {
+            throw new OcraError("CONFIG_INVALID", `ocra Cloud has no OpenAI-compatible chat endpoint for "${name}" (named by ${id})`);
+        }
+        declared[id] = {
+            baseUrl: `${session.server}/api/gateway/${name}${chat.slice(0, -"/chat/completions".length)}`,
+            apiKeyEnv: CLOUD_TOKEN_ENV,
+            models: Object.fromEntries([...modelIds].map((m) => [m, { input: 0, output: 0 }])),
+            ...effortStyleOf(entry?.effort, name, warn),
+        };
+    }
+    warn(`${names}: models through ocra Cloud are not priced, so reported cost and --max-cost-usd do not count them`);
+    if (!run.keyReadPerCall) {
+        const left = session.expires_at - deps.now();
+        if (left < needed) {
+            warn(`this run may last ${minutes(run.timeoutMs)} minutes, but its runtime reads the ocra Cloud token once and the token lasts ${minutes(left)}: model calls through ocra Cloud fail after that (use "runtime": "direct", which renews it, or a shorter runTimeoutMinutes)`);
+        }
+        return {
+            providers: declared,
+            env: { ...env, [CLOUD_TOKEN_ENV]: session.access_token },
+            stop: () => { },
+        };
+    }
+    const token = new GatewayToken(session, deps, warn);
+    token.start();
+    // The token is read at each call, so a renewed one is used from then on.
+    const live = Object.defineProperty({ ...env }, CLOUD_TOKEN_ENV, {
+        get: () => token.value,
+        enumerable: true,
+    });
+    return { providers: declared, env: live, stop: () => token.stop() };
+}
+function minutes(ms) {
+    return Math.floor(ms / 60_000);
+}
+// How the gateway's provider takes a reasoning effort, as ocra Cloud lists
+// it; unlisted, the runtime's default (OpenAI's reasoning_effort). A style
+// this version of ocra does not know is refused rather than guessed.
+function effortStyleOf(style, name, warn) {
+    if (style === undefined)
+        return {};
+    const known = EFFORT_STYLES.find((s) => s === style);
+    if (known)
+        return { effort: known };
+    warn(`ignoring the effort style ocra Cloud listed for "${name}", which this version of ocra does not know; efforts go as OpenAI's reasoning_effort`);
+    return {};
+}
+//# sourceMappingURL=providers.js.map

package/dist/cloud/review.d.ts

@@ -0,0 +1,28 @@
+import type { ReviewSource } from "@open-cr-agent/cloud-contract";
+import type { MemoryEntry, ReviewReport } from "@open-cr-agent/core";
+import type { Output } from "../io/output.js";
+import { type CloudSessionLost } from "./client.js";
+import type { CloudDeps } from "./deps.js";
+export type CloudReview = {
+    repoHash: string;
+    shareFindings: boolean;
+    memory: MemoryEntry[];
+};
+/** What a review loses when ocra Cloud cannot be used for it, said once. */
+export declare function sessionLostWarning(lost: Exclude<CloudSessionLost, {
+    kind: "signed-out";
+}>): string;
+/**
+ * Undefined when the saved session is gone; a failure to reach ocra Cloud is
+ * one warning. The repository is the pull or merge request's when given,
+ * else origin's.
+ */
+export declare function prepareCloudReview(root: string, deps: CloudDeps, warn: (message: string) => void, repository?: string): Promise<CloudReview | undefined>;
+/** Sends the counts, and the findings when the account shares them. */
+export declare function sendToCloud(report: ReviewReport, cloud: CloudReview, deps: CloudDeps, run: {
+    source: ReviewSource;
+    durationMs: number;
+    err: Output;
+    warn: (message: string) => void;
+}): Promise<void>;
+//# sourceMappingURL=review.d.ts.map

package/dist/cloud/review.js

@@ -0,0 +1,76 @@
+import { originRepository } from "../repository-id.js";
+import { readAccountSalt, saveAccountSalt } from "./account-salt.js";
+import { CloudClient, sessionLostReason } from "./client.js";
+import { sharedFindings } from "./findings.js";
+import { accountHasMemory, fetchAccountMemory } from "./memory.js";
+import { repoHash, uploadOf, uploadReview } from "./upload.js";
+/** What a review loses when ocra Cloud cannot be used for it, said once. */
+export function sessionLostWarning(lost) {
+    const cause = lost.kind === "revoked"
+        ? sessionLostReason(lost)
+        : `could not reach ocra Cloud (${lost.reason})`;
+    return `${cause}; this review runs without your account's rules, limits (maxCostUsd included), models and memory, and uploads nothing`;
+}
+/**
+ * Undefined when the saved session is gone; a failure to reach ocra Cloud is
+ * one warning. The repository is the pull or merge request's when given,
+ * else origin's.
+ */
+export async function prepareCloudReview(root, deps, warn, repository) {
+    const id = repository ?? (await originRepository(root));
+    let salt;
+    try {
+        const answer = await new CloudClient(deps).accountSalt();
+        if (answer.kind === "signed-out")
+            return undefined;
+        if (answer.kind === "status")
+            throw new Error(`HTTP ${answer.status}`);
+        if (answer.kind === "malformed")
+            throw new Error("the answer is not a salt");
+        if (answer.kind !== "ok")
+            throw new Error(sessionLostReason(answer));
+        salt = answer.value;
+    }
+    catch (error) {
+        // The salt kept from the last answer, else this machine's, still groups
+        // the counts. Whether the account still shares findings is unknown, so
+        // none is sent and the account's memory is not applied.
+        warn(`could not read your ocra Cloud account (${error instanceof Error ? error.message : "error"}); this review sends no findings and applies no account memory`);
+        const kept = await readAccountSalt(deps.credentialsPath);
+        return {
+            repoHash: await repoHash(id, deps.credentialsPath, kept),
+            shareFindings: false,
+            memory: [],
+        };
+    }
+    await saveAccountSalt(deps.credentialsPath, salt);
+    const hash = await repoHash(id, deps.credentialsPath, salt ?? undefined);
+    if (salt === null) {
+        // Memory is keyed by the account's hash, which only a sharing account has.
+        if (await accountHasMemory(deps)) {
+            warn("your ocra Cloud account remembers findings, but applies them only while it shares findings (Settings in ocra Cloud); this review applies the repository's memory alone");
+        }
+        return { repoHash: hash, shareFindings: false, memory: [] };
+    }
+    return {
+        repoHash: hash,
+        shareFindings: true,
+        memory: await fetchAccountMemory(deps, hash, warn),
+    };
+}
+/** Sends the counts, and the findings when the account shares them. */
+export async function sendToCloud(report, cloud, deps, run) {
+    const upload = uploadOf(report, run.source, cloud.repoHash, run.durationMs);
+    const shared = cloud.shareFindings ? sharedFindings(report) : undefined;
+    const sent = await uploadReview(upload, deps, run.warn, shared?.findings);
+    if (!sent)
+        return;
+    if (sent.findings > 0) {
+        const left = shared?.left ? ` (${shared.left} left out by the size limit)` : "";
+        run.err.write(`[ocra] Sent this review's counts and ${sent.findings} finding(s) to ocra Cloud${left} (--no-upload to skip)\n`);
+    }
+    else {
+        run.err.write("[ocra] Sent this review's counts to ocra Cloud (--no-upload to skip)\n");
+    }
+}
+//# sourceMappingURL=review.js.map

package/dist/cloud/settings.d.ts

@@ -0,0 +1,22 @@
+import type { SettingsLayer } from "../config/settings.js";
+import { type AccountPlugins } from "../plugins/account.js";
+import { type AccountSettings } from "./account-settings.js";
+import { type CloudSessionLost } from "./client.js";
+import type { CloudDeps } from "./deps.js";
+export type AccountRead = {
+    kind: "read";
+    settings?: AccountSettings;
+    plugins: AccountPlugins;
+} | CloudSessionLost;
+/**
+ * The account's settings. A server that cannot be reached, or a session
+ * that ended, is answered for the caller to say once what the run loses;
+ * an answer that cannot be used is a warning here and no settings.
+ */
+export declare function fetchAccountSettings(deps: CloudDeps, warn: (message: string) => void): Promise<AccountRead>;
+/**
+ * The account's settings as the layer under the configuration: they fill
+ * what it leaves out, and add to its include, exclude and rules.
+ */
+export declare function accountLayer(account: AccountSettings): SettingsLayer;
+//# sourceMappingURL=settings.d.ts.map

package/dist/cloud/settings.js

@@ -0,0 +1,64 @@
+import { errorMessage } from "@open-cr-agent/core";
+import { parseAccountPlugins } from "../plugins/account.js";
+import { parseAccountSettings } from "./account-settings.js";
+import { CloudClient } from "./client.js";
+const NO_PLUGINS = { plugins: [], pluginSettings: {} };
+/**
+ * The account's settings. A server that cannot be reached, or a session
+ * that ended, is answered for the caller to say once what the run loses;
+ * an answer that cannot be used is a warning here and no settings.
+ */
+export async function fetchAccountSettings(deps, warn) {
+    let answer;
+    try {
+        answer = await new CloudClient(deps).preferences();
+    }
+    catch (error) {
+        return { kind: "unreachable", reason: errorMessage(error) };
+    }
+    if (answer.kind === "status") {
+        // A server without account settings has none to apply.
+        if (answer.status === 404)
+            return { kind: "read", plugins: NO_PLUGINS };
+        if (answer.status >= 500 || answer.status === 429) {
+            return { kind: "unreachable", reason: `HTTP ${answer.status}` };
+        }
+        warn(`could not read your ocra Cloud settings (HTTP ${answer.status}); the review uses the repository's`);
+        return { kind: "read", plugins: NO_PLUGINS };
+    }
+    if (answer.kind === "malformed") {
+        warn("ignoring your ocra Cloud settings: the server's answer is not an object");
+        return { kind: "read", plugins: NO_PLUGINS };
+    }
+    if (answer.kind !== "ok")
+        return answer;
+    const body = answer.value;
+    const { settings, warnings } = parseAccountSettings(body);
+    for (const warning of warnings)
+        warn(warning);
+    return {
+        kind: "read",
+        ...(settings ? { settings } : {}),
+        plugins: parseAccountPlugins(body, warn),
+    };
+}
+/**
+ * The account's settings as the layer under the configuration: they fill
+ * what it leaves out, and add to its include, exclude and rules.
+ */
+export function accountLayer(account) {
+    const { version: _, rules, ultra, ...settings } = account;
+    return {
+        source: "account",
+        under: true,
+        settings: {
+            ...settings,
+            ...(rules
+                ? { rules: rules.map((rule) => ({ ...rule, source: "account" })) }
+                : {}),
+            // The account's default for --ultra; there is no --no-ultra to refuse it.
+            ...(ultra === true ? { ultra } : {}),
+        },
+    };
+}
+//# sourceMappingURL=settings.js.map

package/dist/cloud/upload.d.ts

@@ -0,0 +1,20 @@
+import type { ReviewSource, ReviewUpload, SharedFinding } from "@open-cr-agent/cloud-contract";
+import { type ReviewReport } from "@open-cr-agent/core";
+import type { CloudDeps } from "./deps.js";
+export declare function uploadOf(report: ReviewReport, source: ReviewSource, repoHash: string, durationMs: number): ReviewUpload;
+/**
+ * The hash of a repository named as `https://host/owner/repo`
+ * (repository-id.ts), salted with the account's salt when given, else this machine's.
+ */
+export declare function repoHash(repository: string, credentialsPath: string, accountSalt?: string): Promise<string>;
+/** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
+export declare function cloudEnabled(deps: CloudDeps, warn: (message: string) => void): Promise<boolean>;
+/**
+ * Sends the counts, and the findings when given; answers how many findings
+ * the server kept, or undefined when it took nothing. A failure is a
+ * warning, never a failed review.
+ */
+export declare function uploadReview(upload: ReviewUpload, deps: CloudDeps, warn: (message: string) => void, findings?: readonly SharedFinding[]): Promise<{
+    findings: number;
+} | undefined>;
+//# sourceMappingURL=upload.d.ts.map