@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/{metrics.js → commands/metrics.js}

@@ -1,13 +1,12 @@
-import { readdir, readFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { reportOutputSchema, } from "@open-cr-agent/core";
 import { findRepositoryRoot } from "@open-cr-agent/vcs-local/internal";
-import { UsageError } from "./review/args.js";
-import { SESSIONS_DIR } from "./review/command.js";
-import { forTerminal } from "./review/terminal.js";
-export const METRICS_VERSION = 1;
-export const METRICS_USAGE = `Usage: ocra metrics [options]
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+import { UsageError } from "../io/usage-error.js";
+import { listSessions, readSessionReport, SESSIONS_DIR, sessionStart, sessionsDir, } from "../session/store.js";
+const METRICS_VERSION = 1;
+const METRICS_USAGE = `Usage: ocra metrics [options]
 
 Counts over the finished reviews in ${SESSIONS_DIR}: runs, cost, findings,
 what reviewers later fixed or dismissed, per reviewer. Reads each session's
@@ -33,18 +32,18 @@ export async function metricsCommand(argv, out, cwd) {
     });
     if (values.help) {
         out.write(METRICS_USAGE);
-        return 0;
+        return EXIT.ok;
     }
     const format = values.format ?? "text";
     if (format !== "text" && format !== "json")
         throw new UsageError("--format must be text or json");
     const since = values.since === undefined ? undefined : parseSince(values.since);
-    const sessionsDir = values.sessions
+    const dir = values.sessions
         ? resolve(cwd, values.sessions)
-        : join(await findRepositoryRoot(cwd), SESSIONS_DIR);
-    const metrics = await collectMetrics(sessionsDir, since);
+        : sessionsDir(await findRepositoryRoot(cwd));
+    const metrics = await collectMetrics(dir, since);
     out.write(format === "json" ? `${JSON.stringify(metrics, null, 2)}\n` : renderMetrics(metrics));
-    return 0;
+    return EXIT.ok;
 }
 function parseSince(text) {
     const date = new Date(text);
@@ -52,55 +51,34 @@ function parseSince(text) {
         throw new UsageError(`--since needs an ISO 8601 date, not "${text}"`);
     return date;
 }
-// A session directory is named by its run id, whose first part is the start
-// time (newRunId in core); that is what --since compares against.
-export function sessionStart(id) {
-    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z/.exec(id);
-    if (!m)
-        return undefined;
-    const [, y, mo, d, h, mi, s] = m;
-    return new Date(`${y}-${mo}-${d}T${h}:${mi}:${s}Z`);
-}
-export async function collectMetrics(sessionsDir, since) {
-    const names = (await readdir(sessionsDir).catch(() => []))
-        .filter((n) => !n.startsWith("."))
-        .filter((n) => {
+export async function collectMetrics(dir, since) {
+    // --since compares the start time in each session's id.
+    const names = (await listSessions(dir)).filter((n) => {
         const start = sessionStart(n);
         return since === undefined || (start !== undefined && start >= since);
-    })
-        .sort();
+    });
     const reports = [];
     let unreadable = 0;
     for (const name of names) {
-        const report = await readReport(join(sessionsDir, name, "report.json"));
+        const report = await readSessionReport(join(dir, name));
         if (report)
             reports.push(report);
         else
             unreadable += 1;
     }
     return aggregate(reports, {
-        sessionsDir,
+        sessionsDir: dir,
         unreadable,
         ...(since ? { since: since.toISOString() } : {}),
     });
 }
-async function readReport(path) {
-    let data;
-    try {
-        data = JSON.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        return undefined;
-    }
-    const parsed = reportOutputSchema.safeParse(data);
-    return parsed.success ? parsed.data : undefined;
-}
 function aggregate(reports, meta) {
     const byVerdict = {};
     const bySeverity = { critical: 0, warning: 0, suggestion: 0 };
     const byVerification = { confirmed: 0, uncertain: 0, unchecked: 0 };
     const reviewers = new Map();
     const reviewerOf = new Map();
+    const recorded = new Map();
     const unique = new Set();
     const fixed = new Set();
     const dismissed = new Set();
@@ -148,22 +126,31 @@ function aggregate(reports, meta) {
             if (!reviewerOf.has(finding.fingerprint))
                 reviewerOf.set(finding.fingerprint, finding.reviewer);
         }
-        for (const f of report.rereview?.fixed ?? [])
+        for (const f of report.rereview?.fixed ?? []) {
             fixed.add(f.fingerprint);
-        for (const f of report.rereview?.dismissed ?? [])
+            if (f.reviewer && !recorded.has(f.fingerprint))
+                recorded.set(f.fingerprint, f.reviewer);
+        }
+        for (const f of report.rereview?.dismissed ?? []) {
             dismissed.add(f.fingerprint);
+            if (f.reviewer && !recorded.has(f.fingerprint))
+                recorded.set(f.fingerprint, f.reviewer);
+        }
     }
     // A fingerprint can be dismissed in one review and gone in a later one:
     // the reviewer's decision stands.
     for (const fp of dismissed)
         fixed.delete(fp);
+    // The reviewer the earlier review recorded with the finding; reports from
+    // before it was recorded fall back to the first that reported the fingerprint.
+    const creditedTo = (fp) => recorded.get(fp) ?? reviewerOf.get(fp);
     for (const fp of fixed) {
-        const reviewer = reviewerOf.get(fp);
+        const reviewer = creditedTo(fp);
         if (reviewer)
             forReviewer(reviewer).fixed += 1;
     }
     for (const fp of dismissed) {
-        const reviewer = reviewerOf.get(fp);
+        const reviewer = creditedTo(fp);
         if (reviewer)
             forReviewer(reviewer).dismissed += 1;
     }
@@ -194,7 +181,7 @@ function rate(fixed, dismissed) {
 }
 const percent = (value) => (value === null ? "n/a" : `${Math.round(value * 100)}%`);
 const dollars = (value) => (value === null ? "n/a" : `$${value.toFixed(2)}`);
-export function renderMetrics(m) {
+function renderMetrics(m) {
     const lines = [
         `Runs: ${m.runs.total}${m.since ? ` since ${m.since}` : ""} (${m.runs.incomplete} incomplete, ${m.runs.unreadable} unreadable)`,
         `  by verdict: ${entries(m.runs.byVerdict)}`,

package/dist/{plugins-command.d.ts → commands/plugins.d.ts}

@@ -1,15 +1,9 @@
-import type { Output } from "./review/progress.js";
+import type { Output } from "../io/output.js";
+import type { NpmRunner } from "../plugins/npm.js";
 export declare const PLUGINS_USAGE = "Usage: ocra plugins allow <name>@<version>\n       ocra plugins deny <name>\n       ocra plugins list\n\nYour ocra Cloud settings may name plugins; a review loads one only if this\nmachine allows it. allow shows the package and who published it, installs that\nexact version with install scripts off into a directory of your own, and\nrecords its integrity; deny removes it.\n";
-/** Runs npm with these arguments, never through a shell; resolves with its standard output. */
-export type NpmRunner = (args: readonly string[]) => Promise<string>;
 export interface PluginsDeps {
     dir: string;
     npm: NpmRunner;
 }
 export declare function pluginsCommand(argv: readonly string[], out: Output, deps: PluginsDeps): Promise<number>;
-export declare function parseSpec(spec: string): {
-    name: string;
-    version: string;
-};
-export declare function defaultNpm(env?: NodeJS.ProcessEnv): NpmRunner;
-//# sourceMappingURL=plugins-command.d.ts.map
+//# sourceMappingURL=plugins.d.ts.map

package/dist/{plugins-command.js → commands/plugins.js}

@@ -1,10 +1,10 @@
-import { execFile } from "node:child_process";
 import { access, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { ensureDir, installedEntry, isExactVersion, isPackageName, readAllowed, writeAllowed, } from "./plugin-store.js";
-import { UsageError } from "./review/args.js";
-import { ConfigError } from "./review/config.js";
-import { forTerminal } from "./review/terminal.js";
+import { join } from "node:path";
+import { ConfigError } from "../config/cli-config.js";
+import { EXIT } from "../io/exit.js";
+import { forTerminal } from "../io/terminal.js";
+import { UsageError } from "../io/usage-error.js";
+import { ensureDir, installedEntry, isExactVersion, isPackageName, readAllowed, writeAllowed, } from "../plugins/store.js";
 // `ocra plugins` (ADR-0027): the user's own decision, on each machine, to
 // let their ocra Cloud account load a third-party plugin, like adding a
 // dependency. The account names packages; only what is allowed here loads.
@@ -21,7 +21,7 @@ export async function pluginsCommand(argv, out, deps) {
     const [action, target, ...extra] = argv;
     if (action === "--help" || action === "-h" || action === "help") {
         out.write(PLUGINS_USAGE);
-        return 0;
+        return EXIT.ok;
     }
     if (extra.length > 0)
         throw new UsageError(`Unexpected argument: ${extra[0]}`);
@@ -37,14 +37,14 @@ async function list(out, dir) {
     const allowed = await readAllowed(dir);
     if (allowed.length === 0) {
         out.write("No plugins allowed. Allow one with: ocra plugins allow <name>@<version>\n");
-        return 0;
+        return EXIT.ok;
     }
     for (const p of allowed)
         out.write(`${p.name}@${p.version}  ${p.integrity}\n`);
     out.write(`(installed in ${dir})\n`);
-    return 0;
+    return EXIT.ok;
 }
-export function parseSpec(spec) {
+function parseSpec(spec) {
     const at = spec.lastIndexOf("@");
     const name = at > 0 ? spec.slice(0, at) : spec;
     const version = at > 0 ? spec.slice(at + 1) : "";
@@ -57,25 +57,28 @@ export function parseSpec(spec) {
 }
 async function allow(spec, out, deps) {
     const { name, version } = parseSpec(spec);
-    const view = describe(await deps.npm(["view", `${name}@${version}`, "--json"]));
+    await ensureDir(deps.dir);
+    // npm installs into the nearest package.json; one of the directory's own
+    // keeps it from walking up to a project.
+    const manifest = join(deps.dir, "package.json");
+    if (!(await exists(manifest))) {
+        await writeFile(manifest, `${JSON.stringify({ private: true }, null, 2)}\n`, { mode: 0o600 });
+    }
+    const view = describe(await deps.npm(["view", `${name}@${version}`, "--json"], deps.dir));
     if (view.name !== name || view.version !== version) {
         throw new ConfigError(`npm did not resolve ${name}@${version} to that exact version`);
     }
+    if (!view.integrity) {
+        throw new ConfigError(`npm view lists no integrity for ${name}@${version}; not allowed`);
+    }
     out.write(forTerminal([
         `Package:      ${view.name}@${view.version}`,
         `Published by: ${view.publisher ?? "unknown"}`,
         `Maintainers:  ${view.maintainers.join(", ") || "unknown"}`,
-        `Integrity:    ${view.integrity ?? "unknown"}`,
+        `Integrity:    ${view.integrity}`,
         `Installing into ${deps.dir} with install scripts off`,
         "",
     ].join("\n")));
-    await ensureDir(deps.dir);
-    // npm installs into the nearest package.json; one of the directory's own
-    // keeps it from walking up to a project.
-    const manifest = join(deps.dir, "package.json");
-    if (!(await exists(manifest))) {
-        await writeFile(manifest, `${JSON.stringify({ private: true }, null, 2)}\n`, { mode: 0o600 });
-    }
     await deps.npm([
         "install",
         "--ignore-scripts",
@@ -85,19 +88,19 @@ async function allow(spec, out, deps) {
         "--prefix",
         deps.dir,
         `${name}@${version}`,
-    ]);
+    ], deps.dir);
     const installed = await installedEntry(deps.dir, name);
     if (installed?.version !== version || !installed.integrity) {
         throw new ConfigError(`npm did not install ${name}@${version} into ${deps.dir}`);
     }
-    if (view.integrity && view.integrity !== installed.integrity) {
+    if (view.integrity !== installed.integrity) {
         throw new ConfigError(`${name}@${version} installed with another integrity than the registry lists; not allowed`);
     }
     const entry = { name, version, integrity: installed.integrity };
     const allowed = (await readAllowed(deps.dir)).filter((p) => p.name !== name);
     await writeAllowed(deps.dir, [...allowed, entry]);
     out.write(`Allowed ${name}@${version}: your ocra Cloud settings can now load it here.\n`);
-    return 0;
+    return EXIT.ok;
 }
 async function deny(name, out, deps) {
     if (!isPackageName(name))
@@ -106,26 +109,18 @@ async function deny(name, out, deps) {
     const kept = allowed.filter((p) => p.name !== name);
     if (kept.length === allowed.length) {
         out.write(`${name} was not allowed.\n`);
-        return 0;
+        return EXIT.ok;
     }
     // The record is what loading checks; removing the files is housekeeping.
     await writeAllowed(deps.dir, kept);
     try {
-        await deps.npm([
-            "uninstall",
-            "--ignore-scripts",
-            "--no-audit",
-            "--no-fund",
-            "--prefix",
-            deps.dir,
-            name,
-        ]);
+        await deps.npm(["uninstall", "--ignore-scripts", "--no-audit", "--no-fund", "--prefix", deps.dir, name], deps.dir);
     }
     catch {
         await rm(join(deps.dir, "node_modules", name), { recursive: true, force: true });
     }
     out.write(`Denied ${name}: it no longer loads.\n`);
-    return 0;
+    return EXIT.ok;
 }
 function describe(stdout) {
     let data;
@@ -161,23 +156,4 @@ function describe(stdout) {
 async function exists(path) {
     return access(path).then(() => true, () => false);
 }
-// npm on Windows is npm.cmd, which execFile cannot run without a shell; run
-// the npm that ships with this Node directly instead.
-export function defaultNpm(env = process.env) {
-    const [file, prefix] = process.platform === "win32"
-        ? [
-            process.execPath,
-            [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")],
-        ]
-        : ["npm", []];
-    return (args) => new Promise((resolve, reject) => {
-        execFile(file, [...prefix, ...args], { env, timeout: 5 * 60_000, maxBuffer: 16 * 1024 * 1024, shell: false }, (error, stdout, stderr) => {
-            if (error) {
-                reject(new ConfigError(`npm ${args[0]} failed: ${forTerminal(String(stderr).trim().split("\n").slice(-3).join(" ") || error.message)}`));
-            }
-            else
-                resolve(String(stdout));
-        });
-    });
-}
-//# sourceMappingURL=plugins-command.js.map
+//# sourceMappingURL=plugins.js.map

package/dist/{review → commands/review}/args.d.ts

@@ -1,20 +1,19 @@
-import { OcraError } from "@open-cr-agent/core";
 import type { LocalTarget } from "@open-cr-agent/vcs-local";
-export type OutputFormat = "text" | "json" | "sarif";
-export interface PullRequestTarget {
+type OutputFormat = "text" | "json" | "sarif";
+interface PullRequestArgs {
     number: number;
     repo?: string;
     publish: boolean;
 }
-export interface MergeRequestTarget {
+interface MergeRequestArgs {
     iid: number;
     project?: string;
     publish: boolean;
 }
 export interface ReviewArgs {
     target: LocalTarget;
-    pullRequest?: PullRequestTarget;
-    mergeRequest?: MergeRequestTarget;
+    pullRequest?: PullRequestArgs;
+    mergeRequest?: MergeRequestArgs;
     format: OutputFormat;
     output?: string;
     ignoreRepoConfig?: true;
@@ -29,9 +28,7 @@ export interface ReviewArgs {
     temperature?: number;
     seed?: number;
 }
-export declare class UsageError extends OcraError {
-    constructor(message: string);
-}
-export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  --no-upload        When signed in to ocra Cloud, do not send this review's\n                     counts (verdict, numbers of findings, files, tokens)\n  -h, --help         Show help\n";
+export declare const REVIEW_USAGE = "Usage: ocra review [options]\n\nReviews uncommitted changes by default.\n\nOptions:\n  --from <ref>       Review changes on --to since it diverged from <ref>\n  --to <ref>         End of the range (default: HEAD)\n  --commit <sha>     Review a single commit\n  --pr <number>      Review a GitHub pull request (needs GITHUB_TOKEN)\n  --repo <owner/name>  Repository of --pr (default: GITHUB_REPOSITORY or origin)\n  --mr <iid>         Review a GitLab merge request (needs GITLAB_TOKEN)\n  --project <id|path>  Project of --mr (default: CI_PROJECT_ID or origin)\n  --publish          With --pr or --mr: post the review to it\n  --full             With --pr or --mr: review every file, not only what\n                     changed since the previous review\n  --format <format>  text (default), json, or sarif (SARIF 2.1.0; not with --plan)\n  --output <file>    Write the result to a file instead of stdout\n  --reviewers <ids>  Run only these reviewers (comma-separated)\n  --max-cost-usd <n> Spend limit: reviews use 80%, verification and judging the rest\n  --import-sarif <file>  Add the results of a SARIF 2.1.0 log (Semgrep, CodeQL, \u2026)\n                     that fall on the change; repeatable; not with --plan\n  --plan             Show files, bundles, review tasks and prompt sizes; call no model\n  --ultra            Favor recall: all reviewers at every tier, two samples each (about 2x cost)\n  --temperature <n>  Sampling temperature, 0 to 2 (default: the provider's, or sampling in config)\n  --seed <n>         Sampling seed, where the runtime and provider support one\n  --config <file>    Read this configuration file instead of the repository's\n                     .ocra/config.json; it applies with --no-repo-config too\n  --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted\n                     code); models come from OCRA_MODEL_* variables or --config\n  --no-upload        When signed in to ocra Cloud, send nothing about this\n                     review: no counts, per-reviewer counts or findings\n  -h, --help         Show help\n";
 export declare function parseReviewArgs(argv: string[]): ReviewArgs | "help";
+export {};
 //# sourceMappingURL=args.d.ts.map

package/dist/{review → commands/review}/args.js

@@ -1,11 +1,6 @@
 import { parseArgs } from "node:util";
-import { OcraError } from "@open-cr-agent/core";
-export class UsageError extends OcraError {
-    constructor(message) {
-        super("INPUT_USAGE", message);
-        this.name = "UsageError";
-    }
-}
+import { errorMessage } from "@open-cr-agent/core";
+import { UsageError } from "../../io/usage-error.js";
 export const REVIEW_USAGE = `Usage: ocra review [options]
 
 Reviews uncommitted changes by default.
@@ -35,8 +30,8 @@ Options:
                      .ocra/config.json; it applies with --no-repo-config too
   --no-repo-config   Ignore .ocra/config.json and its plugins (for untrusted
                      code); models come from OCRA_MODEL_* variables or --config
-  --no-upload        When signed in to ocra Cloud, do not send this review's
-                     counts (verdict, numbers of findings, files, tokens)
+  --no-upload        When signed in to ocra Cloud, send nothing about this
+                     review: no counts, per-reviewer counts or findings
   -h, --help         Show help
 `;
 export function parseReviewArgs(argv) {
@@ -45,7 +40,7 @@ export function parseReviewArgs(argv) {
         parsed = parse(argv);
     }
     catch (error) {
-        throw new UsageError(error.message);
+        throw new UsageError(errorMessage(error));
     }
     const { values, positionals } = parsed;
     if (values.help)
@@ -56,9 +51,9 @@ export function parseReviewArgs(argv) {
     if (format !== "text" && format !== "json" && format !== "sarif") {
         throw new UsageError(`--format must be text, json or sarif, got ${format}`);
     }
-    const args = { target: target(values), format };
-    const pullRequest = pullRequestTarget(values);
-    const mergeRequest = mergeRequestTarget(values);
+    const args = { target: parseLocalTarget(values), format };
+    const pullRequest = parsePullRequest(values);
+    const mergeRequest = parseMergeRequest(values);
     if (pullRequest && mergeRequest)
         throw new UsageError("--pr cannot be combined with --mr");
     if (!pullRequest && !mergeRequest && values.publish) {
@@ -160,7 +155,7 @@ function parse(argv) {
         },
     });
 }
-function pullRequestTarget(values) {
+function parsePullRequest(values) {
     if (values.pr === undefined) {
         if (values.repo !== undefined)
             throw new UsageError("--repo requires --pr");
@@ -183,7 +178,7 @@ function pullRequestTarget(values) {
 }
 // A GitLab project is a numeric id or a full path, "group/sub/project".
 const PROJECT = /^(\d+|[\w.-]+(\/[\w.-]+)+)$/;
-function mergeRequestTarget(values) {
+function parseMergeRequest(values) {
     if (values.mr === undefined) {
         if (values.project !== undefined)
             throw new UsageError("--project requires --mr");
@@ -204,7 +199,7 @@ function mergeRequestTarget(values) {
         target.project = values.project;
     return target;
 }
-function target(values) {
+function parseLocalTarget(values) {
     if (values.commit !== undefined) {
         if (values.from !== undefined || values.to !== undefined) {
             throw new UsageError("--commit cannot be combined with --from or --to");

package/dist/commands/review/deliver.d.ts

@@ -0,0 +1,7 @@
+import type { ReviewArgs } from "./args.js";
+import type { ReviewDeps } from "./deps.js";
+import type { ExecutedRun } from "./execute-run.js";
+import type { ResolvedRun, ReviewIo } from "./resolve-run.js";
+export declare function writeReport(run: ResolvedRun, { report }: ExecutedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<void>;
+export declare function deliver(run: ResolvedRun, executed: ExecutedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<void>;
+//# sourceMappingURL=deliver.d.ts.map

package/dist/commands/review/deliver.js

@@ -0,0 +1,56 @@
+import { join, relative, resolve } from "node:path";
+import { sendToCloud } from "../../cloud/review.js";
+import { VERSION } from "../../version.js";
+import { renderJson, renderText } from "./render.js";
+import { renderSarif } from "./sarif.js";
+import { CHANGE_REQUEST } from "./target.js";
+// The report in the format asked for, to stdout or --output.
+export async function writeReport(run, { report }, args, io, deps) {
+    const sessionDir = relative(deps.cwd, join(run.session.dir, run.session.id)) || ".";
+    const rendered = args.format === "json"
+        ? renderJson(report)
+        : args.format === "sarif"
+            ? renderSarif(report, VERSION)
+            : renderText(report, sessionDir);
+    if (args.output === undefined) {
+        io.out.write(rendered);
+    }
+    else {
+        await deps.writeFile(resolve(deps.cwd, args.output), rendered);
+        io.err.write(`[ocra] Wrote ${args.output}\n`);
+    }
+    const hidden = report.remembered.filter((e) => e.source === "account").length;
+    if (hidden > 0)
+        io.err.write(`[ocra] ${hidden} finding(s) hidden by your ocra Cloud memory\n`);
+}
+// Publishes to the pull or merge request when asked, and uploads to ocra
+// Cloud when signed in.
+export async function deliver(run, executed, args, io, deps) {
+    const { target } = run;
+    if (target.publish && target.platform !== "local") {
+        const changeRequest = CHANGE_REQUEST[target.platform];
+        // Stopping halfway could post the inline comments without the summary
+        // that remembers them; a first Ctrl-C only warns.
+        const stopHolding = deps.onInterrupt?.(() => {
+            io.err.write(`[ocra] Publishing; Ctrl-C again quits now and may leave the ${changeRequest} half updated\n`);
+        });
+        try {
+            const published = await run.vcs.publish(executed.report);
+            for (const warning of published.warnings)
+                run.warn(warning);
+        }
+        finally {
+            stopHolding?.();
+        }
+        io.err.write(`[ocra] Published the review to the ${changeRequest}\n`);
+    }
+    if (executed.cloudReview && run.signedInCloud && !args.noUpload) {
+        await sendToCloud(executed.report, executed.cloudReview, run.signedInCloud, {
+            source: target.platform,
+            durationMs: deps.now() - executed.started,
+            err: io.err,
+            warn: run.warn,
+        });
+    }
+}
+//# sourceMappingURL=deliver.js.map

package/dist/commands/review/deps.d.ts

@@ -0,0 +1,18 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+import type { CloudDeps } from "../../cloud/deps.js";
+import type { NpmRunner } from "../../plugins/npm.js";
+import type { RuntimeLoaders } from "./runtimes.js";
+export interface ReviewDeps {
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    builtinPlugins: readonly OcraPlugin[];
+    runtimes: RuntimeLoaders;
+    writeFile(path: string, content: string): Promise<void>;
+    now(): number;
+    heartbeatMs: number;
+    fetch?: typeof fetch;
+    cloud?: CloudDeps;
+    npm?: NpmRunner;
+    onInterrupt?(handler: () => void): () => void;
+}
+//# sourceMappingURL=deps.d.ts.map

package/dist/commands/review/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/commands/review/execute-run.d.ts

@@ -0,0 +1,13 @@
+import { type ReviewReport } from "@open-cr-agent/core";
+import { type CloudReview } from "../../cloud/review.js";
+import type { ReviewArgs } from "./args.js";
+import type { ReviewDeps } from "./deps.js";
+import type { ResolvedRun, ReviewIo } from "./resolve-run.js";
+export interface ExecutedRun {
+    report: ReviewReport;
+    interrupted: boolean;
+    cloudReview?: CloudReview;
+    started: number;
+}
+export declare function executeRun(run: ResolvedRun, args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<ExecutedRun>;
+//# sourceMappingURL=execute-run.d.ts.map

package/dist/commands/review/execute-run.js

@@ -0,0 +1,97 @@
+import { review, } from "@open-cr-agent/core";
+import { REVIEW_DEFAULTS } from "@open-cr-agent/core/internal";
+import { withCloudProviders } from "../../cloud/providers.js";
+import { prepareCloudReview } from "../../cloud/review.js";
+import { agentChains } from "../../config/cli-config.js";
+import { VERSION } from "../../version.js";
+import { ProgressPrinter } from "./progress.js";
+import { configHash, requestedSampling } from "./provenance.js";
+import { configuredOptions } from "./review-options.js";
+import { loadSarifLogs } from "./sarif-input.js";
+import { accountOf } from "./settings-sources.js";
+export async function executeRun(run, args, io, deps) {
+    const sarif = await loadSarifLogs(args.importSarif ?? [], deps.cwd);
+    const cloudReview = run.signedInCloud
+        ? await prepareCloudReview(run.root, run.signedInCloud, run.warn, run.target.repository)
+        : undefined;
+    const sampling = requestedSampling(run.config, args);
+    const { runtime, stopCloud } = await startRuntime(run, deps, sampling);
+    const progress = new ProgressPrinter(io.err, { heartbeatMs: deps.heartbeatMs, now: deps.now });
+    const interrupt = new AbortController();
+    const stopListening = deps.onInterrupt?.(() => {
+        io.err.write("[ocra] Interrupted: stopping and writing a partial report (Ctrl-C again quits now)\n");
+        interrupt.abort();
+    });
+    const started = deps.now();
+    try {
+        const report = await review({
+            ...prepareReview(run, args, sampling, sarif, cloudReview),
+            signal: interrupt.signal,
+            vcs: run.vcs,
+            runtime,
+            onEvent: (event) => {
+                run.registry.emit(event);
+                progress.onEvent(event);
+            },
+        });
+        return {
+            report,
+            interrupted: interrupt.signal.aborted,
+            ...(cloudReview ? { cloudReview } : {}),
+            started,
+        };
+    }
+    finally {
+        stopListening?.();
+        progress.stop();
+        stopCloud();
+        await runtime.dispose?.();
+    }
+}
+// The runtime the configuration names, with ocra Cloud's providers when signed in.
+async function startRuntime(run, deps, sampling) {
+    const { config } = run;
+    const models = config.models;
+    const agentModels = agentChains({ reviewers: run.overrides, roles: config.roles });
+    const cloud = await withCloudProviders([...Object.values(models), ...Object.values(agentModels)], config.providers, deps.env, 
+    // Even when the session was lost: an ocra- model then fails with why.
+    deps.cloud, run.warn, {
+        timeoutMs: config.runTimeoutMinutes
+            ? config.runTimeoutMinutes * 60_000
+            : REVIEW_DEFAULTS.runTimeoutMs,
+        // The direct runtime reads a provider's key at each call (DirectRuntime.target).
+        keyReadPerCall: config.runtime === "direct",
+    });
+    try {
+        const runtime = run.registry.createRuntime(config.runtime, {
+            models,
+            ...(Object.keys(agentModels).length > 0 ? { agentModels } : {}),
+            env: cloud.env,
+            providers: cloud.providers,
+            ...(Object.keys(sampling).length > 0 ? { sampling } : {}),
+        });
+        return { runtime, stopCloud: () => cloud.stop() };
+    }
+    catch (error) {
+        cloud.stop();
+        throw error;
+    }
+}
+function prepareReview(run, args, sampling, sarif, cloudReview) {
+    const { config, ultra, accountSettings } = run;
+    return {
+        ...configuredOptions(run, args),
+        identity: {
+            runId: run.session.id,
+            provenance: {
+                ocraVersion: VERSION,
+                configHash: configHash(config, ultra ? { ...args, ultra: true } : args, accountSettings),
+                sampling,
+                ...accountOf(accountSettings),
+            },
+        },
+        ...(sarif.length > 0 ? { sarif } : {}),
+        ...(cloudReview?.memory.length ? { accountMemory: cloudReview.memory } : {}),
+    };
+}
+//# sourceMappingURL=execute-run.js.map

package/dist/commands/review/exit-code.d.ts

@@ -0,0 +1,4 @@
+import { type ReviewReport } from "@open-cr-agent/core";
+import type { Output } from "../../io/output.js";
+export declare function exitCode(report: ReviewReport, err: Output): number;
+//# sourceMappingURL=exit-code.d.ts.map