@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/{review/cloud-upload.js → cloud/upload.js}

@@ -1,20 +1,20 @@
-import { execFile } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { promisify } from "node:util";
-import { coverageGaps, } from "@open-cr-agent/core";
+import { coverageGaps } from "@open-cr-agent/core";
 import { verificationSchema } from "@open-cr-agent/core/internal";
-import { cloudSession, readCredentials } from "../cloud.js";
 import { VERSION } from "../version.js";
+import { CloudClient, CloudError, sessionLostReason } from "./client.js";
+import { readCredentials } from "./credentials.js";
+import { createPrivateFile, writePrivateFile } from "./private-file.js";
 // After a review, a signed-in CLI sends ocra Cloud its counts (ADR-0024):
 // the verdict, how many findings of each severity, files and tasks, tokens
 // and time. A path, a title, a finding's text or code go only when the
-// account shares findings (ADR-0028, cloud-findings.ts). The repository is
-// a salted hash, so the server can group reviews of one repository without
-// learning which it is: the salt stays on this machine, or is the account's
-// while it shares findings, so the hash matches on all its machines.
-const run = promisify(execFile);
+// account shares findings (ADR-0028, findings.ts). The repository is
+// a salted hash of its `https://host/owner/repo` (repository-id.ts), so
+// the server can group reviews of one repository without learning which
+// it is: the salt stays on this machine, or is the account's while it
+// shares findings, so the hash matches on all its machines.
 export function uploadOf(report, source, repoHash, durationMs) {
     const severity = (s) => report.findings.filter((f) => f.severity === s).length;
     const gaps = coverageGaps(report);
@@ -24,7 +24,9 @@ export function uploadOf(report, source, repoHash, durationMs) {
         source,
         tier: report.tier,
         verdict: report.verdict,
-        complete: gaps.notReviewed === 0,
+        // As the exit code reads it: a review that missed files or could not
+        // verify a critical finding is incomplete.
+        complete: gaps.notReviewed === 0 && report.unverifiedCriticals === 0,
         findings: {
             critical: severity("critical"),
             warning: severity("warning"),
@@ -36,7 +38,7 @@ export function uploadOf(report, source, repoHash, durationMs) {
         },
         tasks: {
             completed: report.tasks.filter((t) => t.status === "completed").length,
-            failed: report.tasks.filter((t) => t.status === "failed").length,
+            failed: report.tasks.filter((t) => t.status === "failed" || t.status === "timed_out").length,
         },
         usage: {
             inputTokens: report.usage.inputTokens,
@@ -50,8 +52,9 @@ export function uploadOf(report, source, repoHash, durationMs) {
 }
 // Counted as `ocra metrics` counts one report: a failed or timed-out task is
 // failed, a finding without a verification is unchecked, a dismissal outranks
-// a fix, and a fixed or dismissed finding is attributed to the reviewer of a
-// finding with its fingerprint in this report, or to none.
+// a fix, and a fixed or dismissed finding is attributed to the reviewer the
+// earlier review recorded for it, else to the reviewer of a finding with its
+// fingerprint in this report, else to none.
 function perReviewer(report) {
     const reviewers = new Map();
     const of = (id) => {
@@ -84,64 +87,65 @@ function perReviewer(report) {
         if (!reviewerOf.has(finding.fingerprint))
             reviewerOf.set(finding.fingerprint, finding.reviewer);
     }
-    const dismissed = new Set((report.rereview?.dismissed ?? []).map((f) => f.fingerprint));
-    const fixed = new Set((report.rereview?.fixed ?? []).map((f) => f.fingerprint).filter((fp) => !dismissed.has(fp)));
-    for (const fp of fixed) {
-        const reviewer = reviewerOf.get(fp);
+    const outcomeReviewer = (f) => f.reviewer ?? reviewerOf.get(f.fingerprint);
+    const dismissed = new Map((report.rereview?.dismissed ?? []).map((f) => [f.fingerprint, outcomeReviewer(f)]));
+    const fixed = new Map((report.rereview?.fixed ?? [])
+        .filter((f) => !dismissed.has(f.fingerprint))
+        .map((f) => [f.fingerprint, outcomeReviewer(f)]));
+    for (const reviewer of fixed.values())
         if (reviewer)
             of(reviewer).fixed += 1;
-    }
-    for (const fp of dismissed) {
-        const reviewer = reviewerOf.get(fp);
+    for (const reviewer of dismissed.values())
         if (reviewer)
             of(reviewer).dismissed += 1;
-    }
     return {
         reviewers: Object.fromEntries([...reviewers].sort(([a], [b]) => a.localeCompare(b))),
         verification,
         outcomes: { fixed: fixed.size, dismissed: dismissed.size },
     };
 }
-/** The repository's origin without credentials, or its root path when it has none. */
-async function repositoryId(root) {
-    try {
-        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], {
-            timeout: 10_000,
-        });
-        const url = stdout.trim();
-        return url
-            .replace(/^[a-z+]+:\/\/[^@/]*@/i, (m) => m.slice(0, m.indexOf("//") + 2))
-            .replace(/\.git$/, "")
-            .toLowerCase();
-    }
-    catch {
-        return root;
-    }
-}
 /** This machine's random salt, kept beside the credentials, made on first use. */
 async function machineSalt(credentialsPath) {
     const path = join(dirname(credentialsPath), "upload-salt");
-    try {
-        const existing = (await readFile(path, "utf8")).trim();
-        if (/^[0-9a-f]{64}$/.test(existing))
+    const existing = await readSalt(path);
+    if (existing !== "unreadable") {
+        if (existing)
             return existing;
+        // Two first reviews at once agree on the salt the first of them made.
+        const fresh = randomBytes(32).toString("hex");
+        if (await createPrivateFile(path, `${fresh}\n`))
+            return fresh;
+        const made = await readSalt(path);
+        if (made && made !== "unreadable")
+            return made;
     }
-    catch { }
     const fresh = randomBytes(32).toString("hex");
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${fresh}\n`, { mode: 0o600 });
+    await writePrivateFile(path, `${fresh}\n`);
     return fresh;
 }
-/** The repository's hash, salted with the account's salt when given, else this machine's. */
-export async function repoHash(root, credentialsPath, accountSalt) {
+async function readSalt(path) {
+    let text;
+    try {
+        text = await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const salt = text.trim();
+    return /^[0-9a-f]{64}$/.test(salt) ? salt : "unreadable";
+}
+/**
+ * The hash of a repository named as `https://host/owner/repo`
+ * (repository-id.ts), salted with the account's salt when given, else this machine's.
+ */
+export async function repoHash(repository, credentialsPath, accountSalt) {
     const salt = accountSalt ?? (await machineSalt(credentialsPath));
-    return createHash("sha256")
-        .update(`${salt}:${await repositoryId(root)}`)
-        .digest("hex");
+    return createHash("sha256").update(`${salt}:${repository}`).digest("hex");
 }
 /** Whether this run talks to ocra Cloud at all: signed in, not turned off. */
-export async function cloudEnabled(deps) {
-    return (deps.env.OCRA_CLOUD !== "off" && (await readCredentials(deps.credentialsPath)) !== undefined);
+export async function cloudEnabled(deps, warn) {
+    return (deps.env.OCRA_CLOUD !== "off" &&
+        (await readCredentials(deps.credentialsPath, warn)) !== undefined);
 }
 /**
  * Sends the counts, and the findings when given; answers how many findings
@@ -150,31 +154,30 @@ export async function cloudEnabled(deps) {
  */
 export async function uploadReview(upload, deps, warn, findings) {
     try {
-        const session = await cloudSession(deps);
-        if (!session)
+        const answer = await new CloudClient(deps).uploadReview(
+        // The counts stay in `findings`; the shared list goes in `findingList`.
+        findings ? { ...upload, findingList: findings } : upload);
+        if (answer.kind === "signed-out")
+            return undefined;
+        if (answer.kind === "status") {
+            warn(`ocra Cloud did not take the review's counts (HTTP ${answer.status})`);
             return undefined;
-        const res = await deps.fetch(`${session.server}/api/reviews`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${session.access_token}`,
-                "user-agent": `ocra/${VERSION}`,
-            },
-            // The counts stay in `findings`; the shared list goes in `findingList`.
-            body: JSON.stringify(findings ? { ...upload, findingList: findings } : upload),
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (!res.ok) {
-            warn(`ocra Cloud did not take the review's counts (HTTP ${res.status})`);
+        }
+        if (answer.kind !== "ok") {
+            warn(`could not send the review's counts to ocra Cloud: ${sessionLostReason(answer)}`);
             return undefined;
         }
-        const answer = (await res.json().catch(() => ({})));
-        const kept = answer.findings;
-        return { findings: typeof kept === "number" && Number.isInteger(kept) && kept > 0 ? kept : 0 };
+        return answer.value;
     }
     catch (error) {
-        warn(`could not send the review's counts to ocra Cloud: ${error instanceof Error ? error.name : "error"}`);
+        warn(`could not send the review's counts to ocra Cloud: ${failureName(error)}`);
         return undefined;
     }
 }
-//# sourceMappingURL=cloud-upload.js.map
+// The warning names the error, not its message; for a call that could not be
+// sent, the cause's name (TypeError for a network failure).
+function failureName(error) {
+    const cause = error instanceof CloudError && error.cause instanceof Error ? error.cause : error;
+    return cause instanceof Error ? cause.name : "error";
+}
+//# sourceMappingURL=upload.js.map

package/dist/commands/login.d.ts

@@ -0,0 +1,5 @@
+import { type CloudDeps } from "../cloud/deps.js";
+import type { Output } from "../io/output.js";
+export declare const LOGIN_USAGE: string;
+export declare function loginCommand(command: "login" | "logout" | "whoami", argv: string[], out: Output, err: Output, deps: CloudDeps): Promise<number>;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.js

@@ -0,0 +1,164 @@
+import { rm } from "node:fs/promises";
+import { parseArgs } from "node:util";
+import { errorMessage } from "@open-cr-agent/core";
+import { saveAccountSalt } from "../cloud/account-salt.js";
+import { signInPage } from "../cloud/browser.js";
+import { CloudClient } from "../cloud/client.js";
+import { credentialsHint, loadCredentials, writeCredentials, } from "../cloud/credentials.js";
+import { cloudUrl, DEFAULT_CLOUD_URL } from "../cloud/deps.js";
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+// ocra Cloud sign-in (ADR-0024): `ocra login` runs the OAuth device flow
+// (RFC 8628) against ocra Cloud, `ocra whoami` shows the account, and
+// `ocra logout` ends the session. Nothing here runs unless one of these
+// commands is used: a self-hosted user never sees a login prompt.
+export const LOGIN_USAGE = `Usage: ocra login [--no-browser]
+       ocra logout
+       ocra whoami
+
+Sign in to ocra Cloud with GitHub, so reviews can use the model keys stored
+there. ocra login shows a code, opens the browser to confirm it, and saves the
+session to ${credentialsHint()} (readable only by you).
+
+Environment:
+  OCRA_CLOUD=off   Disable ocra Cloud: these commands refuse to run
+  OCRA_CLOUD_URL   Another ocra Cloud server (default ${DEFAULT_CLOUD_URL})
+`;
+export async function loginCommand(command, argv, out, err, deps) {
+    const { values } = parseArgs({
+        args: argv,
+        strict: true,
+        options: { "no-browser": { type: "boolean" }, help: { type: "boolean", short: "h" } },
+    });
+    if (values.help) {
+        out.write(LOGIN_USAGE);
+        return EXIT.ok;
+    }
+    if (deps.env.OCRA_CLOUD === "off") {
+        err.write("ocra Cloud is off (OCRA_CLOUD=off).\n");
+        return EXIT.error;
+    }
+    if (command === "whoami")
+        return whoami(out, err, deps);
+    if (command === "logout")
+        return logout(out, deps);
+    return login(out, err, deps, !values["no-browser"]);
+}
+async function whoami(out, err, deps) {
+    const client = new CloudClient(deps);
+    const session = await client.session();
+    if (session.kind === "signed-out") {
+        err.write("Not signed in. Run ocra login.\n");
+        return EXIT.notSignedIn;
+    }
+    if (session.kind === "unreachable") {
+        err.write(forTerminal(`ocra Cloud could not be reached (${session.reason}).\n`));
+        return EXIT.error;
+    }
+    const me = session.kind === "ok"
+        ? await client.account(session.credentials.server, session.credentials.access_token)
+        : undefined;
+    if (session.kind !== "ok" || !me) {
+        err.write("Your ocra Cloud session ended. Run ocra login.\n");
+        return EXIT.notSignedIn;
+    }
+    out.write(forTerminal(`${me.login} on ${session.credentials.server}\n`));
+    return EXIT.ok;
+}
+async function logout(out, deps) {
+    const saved = await loadCredentials(deps.credentialsPath);
+    if (saved && saved !== "unreadable") {
+        // Ends the session on the server too; the local file goes either way.
+        const client = new CloudClient(deps);
+        const session = await client.session().catch(() => undefined);
+        if (session?.kind === "ok")
+            await client.endSession(session.credentials).catch(() => { });
+    }
+    await rm(deps.credentialsPath, { force: true });
+    await saveAccountSalt(deps.credentialsPath, null);
+    out.write(saved === "unreadable"
+        ? "Removed the saved session, which could not be read.\n"
+        : saved
+            ? "Signed out.\n"
+            : "Not signed in.\n");
+    return EXIT.ok;
+}
+async function login(out, err, deps, browser) {
+    const server = cloudUrl(deps.env);
+    const client = new CloudClient(deps);
+    const start = await client.startLogin(server);
+    if (start.kind === "refused") {
+        err.write(`ocra Cloud did not start a login (HTTP ${start.status}). Try again in a minute.\n`);
+        return EXIT.error;
+    }
+    const { code } = start;
+    out.write(forTerminal(`Confirm this code in your browser: ${code.user_code}\n` +
+        `  ${code.verification_uri_complete}\n` +
+        `(or open ${code.verification_uri} and type it)\n\nWaiting for approval...\n`));
+    if (browser) {
+        const page = signInPage(code.verification_uri_complete, server);
+        if (page)
+            deps.openBrowser(page);
+        else
+            err.write(`ocra opens only pages on ${server}; open the address above yourself.\n`);
+    }
+    let interval = (code.interval ?? 5) * 1000;
+    const deadline = deps.now() + (code.expires_in ?? 600) * 1000;
+    while (deps.now() < deadline) {
+        await deps.sleep(interval);
+        let t;
+        try {
+            t = await client.pollLogin(server, code.device_code);
+        }
+        catch (error) {
+            // A dropped connection is retried on the next tick.
+            err.write(forTerminal(`(${errorMessage(error)}; retrying)\n`));
+            continue;
+        }
+        if (t.status === 200 && t.access_token && t.refresh_token && t.expires_in) {
+            // The tokens are issued: they are saved even when the login cannot be read.
+            let login;
+            let unknown = "";
+            try {
+                login = (await client.account(server, t.access_token))?.login;
+            }
+            catch (error) {
+                unknown = errorMessage(error);
+            }
+            const credentials = {
+                server,
+                login: login ?? "",
+                access_token: t.access_token,
+                refresh_token: t.refresh_token,
+                expires_at: deps.now() + t.expires_in * 1000,
+            };
+            await writeCredentials(deps.credentialsPath, credentials);
+            // Best effort: each signed-in review asks again.
+            await client
+                .accountSalt()
+                .then((salt) => salt.kind === "ok" ? saveAccountSalt(deps.credentialsPath, salt.value) : undefined)
+                .catch(() => { });
+            out.write(forTerminal(login
+                ? `Signed in as ${login}.\n`
+                : `Signed in; the login is unknown${unknown ? ` (${unknown})` : ""}: ocra whoami asks again.\n`));
+            return EXIT.ok;
+        }
+        if (t.error === "authorization_pending")
+            continue;
+        if (t.error === "slow_down") {
+            interval = typeof t.interval === "number" ? t.interval * 1000 : interval + 5000;
+            continue;
+        }
+        if (t.error === "access_denied") {
+            err.write("Login denied in the browser.\n");
+            return EXIT.notSignedIn;
+        }
+        if (t.error === "expired_token")
+            break;
+        err.write(forTerminal(`Login failed: ${t.error ?? `HTTP ${t.status}`}\n`));
+        return EXIT.error;
+    }
+    err.write("The code expired before it was confirmed. Run ocra login again.\n");
+    return EXIT.notSignedIn;
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/memory.d.ts

@@ -0,0 +1,3 @@
+import type { Output } from "../io/output.js";
+export declare function memoryCommand(argv: string[], out: Output, cwd: string, now?: Date): Promise<number>;
+//# sourceMappingURL=memory.d.ts.map

package/dist/{memory.js → commands/memory.js}

@@ -1,13 +1,14 @@
 import { constants, existsSync } from "node:fs";
-import { lstat, mkdir, open, readdir, readFile } from "node:fs/promises";
+import { lstat, mkdir, open, readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { MEMORY_PATH, parseMemory, serializeMemory } from "@open-cr-agent/core/internal";
+import { isNotFound, MEMORY_PATH, parseMemory, readReport, serializeMemory, } from "@open-cr-agent/core/internal";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
-import { UsageError } from "./review/args.js";
-import { SESSIONS_DIR } from "./review/command.js";
-import { forTerminal } from "./review/terminal.js";
-export const MEMORY_USAGE = `Usage: ocra memory <command>
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+import { UsageError } from "../io/usage-error.js";
+import { listSessions, reportPath, SESSIONS_DIR, sessionsDir } from "../session/store.js";
+const MEMORY_USAGE = `Usage: ocra memory <command>
 
 Remember findings the team accepts, so ocra stops reporting them.
 Entries live in ${MEMORY_PATH}; commit it to share them.
@@ -31,7 +32,7 @@ export async function memoryCommand(argv, out, cwd, now = new Date()) {
     const [command, id] = positionals;
     if (values.help || command === undefined) {
         out.write(MEMORY_USAGE);
-        return 0;
+        return EXIT.ok;
     }
     const root = await findRepositoryRoot(cwd);
     const memory = await readMemory(root);
@@ -41,7 +42,7 @@ export async function memoryCommand(argv, out, cwd, now = new Date()) {
         for (const e of memory) {
             out.write(forTerminal(`${e.fingerprint.slice(0, 8)}  ${e.file}  ${e.title}\n    ${e.reason}\n`));
         }
-        return 0;
+        return EXIT.ok;
     }
     if (command !== "add")
         throw new UsageError(`Unknown memory command: ${command}`);
@@ -50,10 +51,10 @@ export async function memoryCommand(argv, out, cwd, now = new Date()) {
     if (!values.reason?.trim())
         throw new UsageError("ocra memory add needs --reason");
     const report = values.session ? resolve(cwd, values.session) : await newestSession(root);
-    const finding = await findFinding(join(report, "report.json"), id);
+    const finding = await findFinding(reportPath(report), id);
     if (memory.some((e) => e.fingerprint === finding.fingerprint)) {
         out.write(`Already remembered: ${forTerminal(finding.title)}\n`);
-        return 0;
+        return EXIT.ok;
     }
     const entry = {
         fingerprint: finding.fingerprint,
@@ -64,7 +65,7 @@ export async function memoryCommand(argv, out, cwd, now = new Date()) {
     };
     await writeRepositoryFile(root, MEMORY_PATH, serializeMemory([...memory, entry]));
     out.write(forTerminal(`Remembered ${finding.fingerprint.slice(0, 8)}: ${finding.title}\nCommit ${MEMORY_PATH} to share it.\n`));
-    return 0;
+    return EXIT.ok;
 }
 // The repository may be someone else's clone: a planted symlink at
 // .ocra/memory.json, or at .ocra, must not make ocra write elsewhere.
@@ -89,26 +90,26 @@ async function readMemory(root) {
         return parseMemory(await readFile(join(root, MEMORY_PATH), "utf8"));
     }
     catch (error) {
-        if (error.code === "ENOENT")
+        if (isNotFound(error))
             return [];
         throw error;
     }
 }
 async function newestSession(root) {
-    const dir = join(root, SESSIONS_DIR);
-    const sessions = (await readdir(dir).catch(() => [])).filter((n) => !n.startsWith(".")).sort();
+    const dir = sessionsDir(root);
     // An interrupted run leaves a session without a report.
-    for (const name of sessions.reverse()) {
-        if (existsSync(join(dir, name, "report.json")))
+    for (const name of (await listSessions(dir)).reverse()) {
+        if (existsSync(reportPath(join(dir, name))))
             return join(dir, name);
     }
     throw new UsageError(`No finished review in ${SESSIONS_DIR}; run ocra review first`);
 }
 async function findFinding(reportPath, id) {
-    const report = JSON.parse(await readFile(reportPath, "utf8"));
-    const matches = (report.findings ?? []).filter((f) => f.fingerprint.startsWith(id));
-    if (matches.length === 1)
-        return matches[0];
+    const report = await readReport(reportPath);
+    const matches = report.findings.filter((f) => f.fingerprint.startsWith(id));
+    const [only] = matches;
+    if (only && matches.length === 1)
+        return only;
     throw new UsageError(matches.length === 0
         ? `No finding ${id} in ${reportPath}`
         : `${id} matches ${matches.length} findings; use more characters`);

package/dist/commands/metrics.d.ts

@@ -0,0 +1,45 @@
+import type { Severity, Verification } from "@open-cr-agent/core";
+import type { Output } from "../io/output.js";
+declare const METRICS_VERSION = 1;
+interface ReviewerMetrics {
+    tasks: number;
+    failedTasks: number;
+    findings: number;
+    costUsd: number;
+    fixed: number;
+    dismissed: number;
+    acceptanceRate: number | null;
+}
+export interface Metrics {
+    version: typeof METRICS_VERSION;
+    sessionsDir: string;
+    since?: string;
+    runs: {
+        total: number;
+        byVerdict: Record<string, number>;
+        incomplete: number;
+        unreadable: number;
+    };
+    cost: {
+        usd: number;
+        inputTokens: number;
+        outputTokens: number;
+        usdPerRun: number | null;
+    };
+    findings: {
+        reported: number;
+        unique: number;
+        bySeverity: Record<Severity, number>;
+        byVerification: Record<Verification, number>;
+    };
+    outcomes: {
+        fixed: number;
+        dismissed: number;
+        acceptanceRate: number | null;
+    };
+    reviewers: Record<string, ReviewerMetrics>;
+}
+export declare function metricsCommand(argv: string[], out: Output, cwd: string): Promise<number>;
+export declare function collectMetrics(dir: string, since?: Date): Promise<Metrics>;
+export {};
+//# sourceMappingURL=metrics.d.ts.map