@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/commands/review/sarif.d.ts

@@ -0,0 +1,96 @@
+import { type ReviewReport } from "@open-cr-agent/core";
+type SarifLevel = "error" | "warning" | "note";
+interface SarifMessage {
+    text: string;
+}
+interface SarifResult {
+    ruleId: string;
+    ruleIndex: number;
+    level: SarifLevel;
+    message: SarifMessage;
+    locations: {
+        physicalLocation: {
+            artifactLocation: ArtifactLocation;
+            region?: {
+                startLine: number;
+                endLine: number;
+            };
+        };
+    }[];
+    partialFingerprints: Record<string, string>;
+    baselineState?: "new" | "unchanged";
+    fixes?: SarifFix[];
+    properties: Record<string, unknown>;
+}
+interface SarifRegion {
+    startLine: number;
+    startColumn?: number;
+    endLine: number;
+    endColumn?: number;
+}
+interface SarifFix {
+    description: SarifMessage;
+    artifactChanges: {
+        artifactLocation: ArtifactLocation;
+        replacements: {
+            deletedRegion: SarifRegion;
+            insertedContent: {
+                text: string;
+            };
+        }[];
+    }[];
+}
+interface ArtifactLocation {
+    uri: string;
+    uriBaseId: "%SRCROOT%";
+}
+export declare function renderSarif(report: ReviewReport, version: string): string;
+export declare function sarifLog(report: ReviewReport, version: string): {
+    $schema: string;
+    version: string;
+    runs: {
+        automationDetails: {
+            id: string;
+        };
+        tool: {
+            driver: {
+                name: string;
+                informationUri: string;
+                version: string;
+                semanticVersion: string;
+                rules: {
+                    id: string;
+                    name: string;
+                    shortDescription: {
+                        text: string;
+                    };
+                    properties: {
+                        tags: string[];
+                    };
+                }[];
+            };
+        };
+        invocations: {
+            executionSuccessful: boolean;
+            toolExecutionNotifications: {
+                level: string;
+                message: {
+                    text: string;
+                };
+            }[];
+        }[];
+        results: SarifResult[];
+        properties: {
+            verdict: "approved" | "approved_with_comments" | "minor_issues" | "significant_concerns";
+            tier: "full" | "lite" | "trivial";
+            baseSha: string;
+            headSha: string;
+            notReviewed: string[];
+            unverifiedCriticals: number;
+            costUsd: number;
+        };
+    }[];
+};
+export declare function plainText(text: string): string;
+export {};
+//# sourceMappingURL=sarif.d.ts.map

package/dist/{review → commands/review}/sarif.js

@@ -12,6 +12,9 @@ const LEVEL = {
     suggestion: "note",
 };
 export function renderSarif(report, version) {
+    return `${serializeOutput(sarifLog(report, version))}\n`;
+}
+export function sarifLog(report, version) {
     const open = [
         ...(report.rereview?.unchanged ?? []),
         ...(report.rereview?.notReproduced ?? []),
@@ -83,7 +86,7 @@ export function renderSarif(report, version) {
             },
         ],
     };
-    return `${serializeOutput(log)}\n`;
+    return log;
 }
 // Open findings an earlier review reported, carried over under their own
 // rule: their reviewer category is not recorded in the review state.
@@ -98,6 +101,7 @@ function fromFinding(f, index) {
         message: { text: plainText(text) },
         locations: [location(f.file, f.lineRange)],
         partialFingerprints: { "ocra/v1": f.fingerprint },
+        ...(f.fix ? { fixes: [fix(f.file, f.fix)] } : {}),
         properties: {
             reviewer: f.reviewer,
             severity: f.severity,
@@ -125,16 +129,34 @@ function fromPrior(f, index) {
 function location(file, lines) {
     return {
         physicalLocation: {
-            // Each segment percent-encoded: a path may hold "#", "?" or spaces,
-            // which a URI would read as a fragment, a query or an error.
-            artifactLocation: {
-                uri: file.split("/").map(encodeURIComponent).join("/"),
-                uriBaseId: "%SRCROOT%",
-            },
+            artifactLocation: artifactLocation(file),
             ...(lines ? { region: { startLine: lines.start, endLine: lines.end } } : {}),
         },
     };
 }
+// Each segment percent-encoded: a path may hold "#", "?" or spaces, which a
+// URI would read as a fragment, a query or an error.
+function artifactLocation(file) {
+    return { uri: file.split("/").map(encodeURIComponent).join("/"), uriBaseId: "%SRCROOT%" };
+}
+// The inserted text is code and goes in as written: it is content to apply,
+// not a message a viewer renders. A region without columns ends before the
+// last line's newline (SARIF 3.30), which a replacement keeps; a deletion
+// runs to the start of the next line instead, so no empty line is left.
+function fix(file, f) {
+    const deletedRegion = f.replacement === ""
+        ? { startLine: f.startLine, startColumn: 1, endLine: f.endLine + 1, endColumn: 1 }
+        : { startLine: f.startLine, endLine: f.endLine };
+    return {
+        description: { text: "Replace the lines with the suggested code" },
+        artifactChanges: [
+            {
+                artifactLocation: artifactLocation(file),
+                replacements: [{ deletedRegion, insertedContent: { text: f.replacement } }],
+            },
+        ],
+    };
+}
 // SARIF viewers turn "[text](target)" in a message into a link (SARIF
 // 3.11.6), and some turn bare web addresses into links too. Text from a
 // reviewed change or a model must do neither: every backslash and bracket is

package/dist/commands/review/settings-sources.d.ts

@@ -0,0 +1,17 @@
+import type { ListedSetting } from "../../config/settings.js";
+export interface EffectiveSetting {
+    key: string;
+    value?: unknown;
+    source: string;
+}
+export interface AccountVersion {
+    version: string | null;
+}
+export declare function effectiveSettings(listed: readonly ListedSetting[]): EffectiveSetting[];
+/** The settings the account set, alone or with other layers. */
+export declare function filledByAccount(listed: readonly ListedSetting[]): string[];
+export declare function renderSettings(settings: readonly EffectiveSetting[], account: AccountVersion | undefined): string;
+export declare function accountOf(account: AccountVersion | undefined): {
+    accountSettings?: AccountVersion;
+};
+//# sourceMappingURL=settings-sources.d.ts.map

package/dist/commands/review/settings-sources.js

@@ -0,0 +1,30 @@
+import { forTerminal } from "../../io/terminal.js";
+export function effectiveSettings(listed) {
+    return listed.map(({ key, value, sources }) => sources.length === 0 ? { key, source: "default" } : { key, value, source: sources.join("+") });
+}
+/** The settings the account set, alone or with other layers. */
+export function filledByAccount(listed) {
+    return listed.filter((s) => s.sources.includes("account")).map((s) => s.key);
+}
+export function renderSettings(settings, account) {
+    const lines = [
+        "",
+        account
+            ? `Settings (under your ocra Cloud settings, version ${account.version ?? "none"}):`
+            : "Settings:",
+    ];
+    const set = settings.filter((s) => s.source !== "default");
+    const width = Math.max(0, ...set.map((s) => s.key.length));
+    for (const s of set) {
+        lines.push(`  ${s.key.padEnd(width)}  ${JSON.stringify(s.value)}  (${s.source})`);
+    }
+    const defaults = settings.filter((s) => s.source === "default").map((s) => s.key);
+    if (defaults.length > 0)
+        lines.push(`  default: ${defaults.join(", ")}`);
+    return forTerminal(`${lines.join("\n")}\n`);
+}
+// The account's settings version, for the plan and the provenance.
+export function accountOf(account) {
+    return account ? { accountSettings: account } : {};
+}
+//# sourceMappingURL=settings-sources.js.map

package/dist/commands/review/target.d.ts

@@ -0,0 +1,38 @@
+import type { OcraPlugin, PluginRegistry, VcsAdapter } from "@open-cr-agent/core";
+import type { LocalCode, PlatformTarget, ResolveTargetOptions } from "@open-cr-agent/vcs-platform";
+import { type CliConfig } from "../../config/cli-config.js";
+import type { SettingsLayer } from "../../config/settings.js";
+import type { ReviewArgs } from "./args.js";
+type FoundChangeRequest = Omit<PlatformTarget<unknown>, "createVcs"> & {
+    createVcs(registry: PluginRegistry, local: LocalCode, config: CliConfig): VcsAdapter;
+};
+type FindChangeRequest = (options: ResolveTargetOptions) => Promise<FoundChangeRequest>;
+declare const PLATFORMS: {
+    github: FindChangeRequest;
+    gitlab: FindChangeRequest;
+};
+type Platform = "local" | keyof typeof PLATFORMS;
+export declare const CHANGE_REQUEST: {
+    readonly github: "pull request";
+    readonly gitlab: "merge request";
+};
+export interface ReviewTarget {
+    platform: Platform;
+    layers: SettingsLayer[];
+    plugins: OcraPlugin[];
+    accountPlugins: boolean;
+    createVcs(registry: PluginRegistry): VcsAdapter;
+    readTrusted?: (path: string) => Promise<string | undefined>;
+    publish: boolean;
+    repository?: string;
+}
+export interface TargetOptions {
+    cwd: string;
+    root: string;
+    env: Readonly<Record<string, string | undefined>>;
+    warn: (message: string) => void;
+    fetch?: typeof fetch;
+}
+export declare function resolveReviewTarget(args: ReviewArgs, options: TargetOptions): Promise<ReviewTarget>;
+export {};
+//# sourceMappingURL=target.d.ts.map

package/dist/commands/review/target.js

@@ -0,0 +1,126 @@
+import { dirname, resolve } from "node:path";
+import { resolveGitHubTarget } from "@open-cr-agent/vcs-github";
+import { resolveGitLabTarget } from "@open-cr-agent/vcs-gitlab";
+import { ensureCommits, filesChangedSince, LocalGitAdapter, } from "@open-cr-agent/vcs-local/internal";
+import { loadConfigLayers } from "../../config/cli-config.js";
+import { loadExternalPlugins } from "../../plugins/load.js";
+import { repositoryOfWebUrl } from "../../repository-id.js";
+function platform(resolveTarget, settings) {
+    return async (options) => {
+        const target = await resolveTarget(options);
+        return {
+            ...target,
+            createVcs: (registry, local, config) => target.createVcs(registry, local, settings(config)),
+        };
+    };
+}
+// The code review platforms ocra publishes to.
+const PLATFORMS = {
+    github: platform(resolveGitHubTarget, (config) => config.github),
+    gitlab: platform(resolveGitLabTarget, () => ({})),
+};
+// What a review published to a platform lands on, as the output names it.
+export const CHANGE_REQUEST = {
+    github: "pull request",
+    gitlab: "merge request",
+};
+export async function resolveReviewTarget(args, options) {
+    const inputs = {
+        ...options,
+        ignoreRepoConfig: args.ignoreRepoConfig === true,
+        ...(args.configFile ? { configFile: resolve(options.cwd, args.configFile) } : {}),
+    };
+    const change = changeRequestOf(args);
+    return change ? changeRequestTarget(change, inputs) : localTarget(args, inputs);
+}
+function changeRequestOf(args) {
+    const pr = args.pullRequest;
+    if (pr) {
+        const ref = { number: pr.number, ...(pr.repo ? { repository: pr.repo } : {}) };
+        return { platform: "github", ref, publish: pr.publish };
+    }
+    const mr = args.mergeRequest;
+    if (mr) {
+        const ref = { number: mr.iid, ...(mr.project ? { repository: mr.project } : {}) };
+        return { platform: "gitlab", ref, publish: mr.publish };
+    }
+    return undefined;
+}
+async function localTarget(args, inputs) {
+    const { cwd, root, configFile, ignoreRepoConfig } = inputs;
+    const { config, layers } = await loadConfigLayers(root, inputs.env, {
+        repository: !ignoreRepoConfig,
+        ...(configFile ? { file: configFile } : {}),
+        warn: inputs.warn,
+        ...(inputs.fetch ? { fetch: inputs.fetch } : {}),
+    });
+    return {
+        platform: "local",
+        layers,
+        // Plugins named by the user's own file are resolved from where it is.
+        plugins: await loadExternalPlugins(config.plugins, configFile ? dirname(configFile) : root),
+        accountPlugins: !ignoreRepoConfig,
+        createVcs: (registry) => registry.createVcs("local", { cwd, target: args.target }),
+        ...(ignoreRepoConfig ? { readTrusted: untrustedTreeReader(args, cwd) } : {}),
+        publish: false,
+    };
+}
+// --no-repo-config is for code you do not trust, so the files that steer a
+// review (.ocra/memory.json can silence findings, rules and AGENTS.md shape
+// the prompts) are not taken from it either: from the base of a range, which
+// you chose, and otherwise not at all.
+function untrustedTreeReader(args, cwd) {
+    if (args.target.mode !== "range")
+        return async () => undefined;
+    const base = new LocalGitAdapter({ cwd, target: { mode: "commit", commit: args.target.from } });
+    return (path) => base.readFile(path);
+}
+// The change request's own files are untrusted: configuration, guidelines
+// and rules come from its base commit, and repository plugins never load.
+async function changeRequestTarget(change, inputs) {
+    const { cwd, root, configFile, warn } = inputs;
+    const found = await PLATFORMS[change.platform]({
+        ref: change.ref,
+        env: inputs.env,
+        origin: () => originUrl(root),
+        warn,
+        ...(inputs.fetch ? { fetch: inputs.fetch } : {}),
+    });
+    await ensureCommits(root, [found.baseSha, found.headSha], found.headRefs);
+    const base = new LocalGitAdapter({ cwd, target: { mode: "commit", commit: found.baseSha } });
+    const readTrusted = (path) => base.readFile(path);
+    const { config, layers } = await loadConfigLayers(root, inputs.env, {
+        repository: !inputs.ignoreRepoConfig,
+        read: readTrusted,
+        ...(configFile ? { file: configFile } : {}),
+        warn,
+        ...(inputs.fetch ? { fetch: inputs.fetch } : {}),
+    });
+    if (config.plugins.length > 0) {
+        warn(`plugins in the configuration are not loaded for ${CHANGE_REQUEST[change.platform]}s`);
+    }
+    const local = {
+        code: new LocalGitAdapter({
+            cwd,
+            target: { mode: "range", from: found.baseSha, to: found.headSha },
+        }),
+        history: { filesChangedSince: (from, to) => filesChangedSince(root, from, to) },
+    };
+    const repository = repositoryOfWebUrl(found.webUrl);
+    return {
+        platform: change.platform,
+        layers,
+        plugins: [],
+        accountPlugins: false,
+        createVcs: (registry) => found.createVcs(registry, local, config),
+        readTrusted,
+        publish: change.publish,
+        ...(repository ? { repository } : {}),
+    };
+}
+function originUrl(root) {
+    return new LocalGitAdapter({ cwd: root, target: { mode: "workspace" } })
+        .remoteUrl("origin")
+        .catch(() => undefined);
+}
+//# sourceMappingURL=target.js.map

package/dist/commands/review.d.ts

@@ -0,0 +1,7 @@
+import { type OcraPlugin } from "@open-cr-agent/core";
+import type { ReviewArgs } from "./review/args.js";
+import type { ReviewDeps } from "./review/deps.js";
+import { type ReviewIo } from "./review/resolve-run.js";
+export declare const BUILTIN_PLUGINS: readonly OcraPlugin[];
+export declare function reviewCommand(args: ReviewArgs, io: ReviewIo, deps: ReviewDeps): Promise<number>;
+//# sourceMappingURL=review.d.ts.map

package/dist/commands/review.js

@@ -0,0 +1,34 @@
+import { agentsMdReviewerPlugin, correctnessReviewerPlugin, docsReviewerPlugin, performanceReviewerPlugin, securityReviewerPlugin, sessionJsonlPlugin, } from "@open-cr-agent/core";
+import { githubPlugin } from "@open-cr-agent/vcs-github";
+import { gitlabPlugin } from "@open-cr-agent/vcs-gitlab";
+import { localGitPlugin } from "@open-cr-agent/vcs-local";
+import { EXIT } from "../io/exit.js";
+import { deliver, writeReport } from "./review/deliver.js";
+import { executeRun } from "./review/execute-run.js";
+import { exitCode } from "./review/exit-code.js";
+import { planRun } from "./review/plan-run.js";
+import { resolveRun } from "./review/resolve-run.js";
+export const BUILTIN_PLUGINS = [
+    localGitPlugin,
+    githubPlugin,
+    gitlabPlugin,
+    correctnessReviewerPlugin,
+    securityReviewerPlugin,
+    performanceReviewerPlugin,
+    docsReviewerPlugin,
+    agentsMdReviewerPlugin,
+    sessionJsonlPlugin,
+];
+// resolveRun → plan | execute → write → deliver (publish, upload) → exit code.
+export async function reviewCommand(args, io, deps) {
+    const run = await resolveRun(args, io, deps);
+    if (args.plan)
+        return planRun(run, args, io, deps);
+    const executed = await executeRun(run, args, io, deps);
+    await writeReport(run, executed, args, io, deps);
+    if (executed.interrupted)
+        return EXIT.interrupted;
+    await deliver(run, executed, args, io, deps);
+    return exitCode(executed.report, io.err);
+}
+//# sourceMappingURL=review.js.map

package/dist/config/cli-config.d.ts

@@ -0,0 +1,41 @@
+import { type CustomProvider, type ModelChains, OcraError, type ReviewerOverrides, type RoleSettings, type SourcedRule, type TierEfforts } from "@open-cr-agent/core";
+import { z } from "zod";
+import { type configSchema } from "./schema.js";
+import { type ListedSetting, type SettingSources, type SettingsLayer } from "./settings.js";
+export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers" | "runtime"> & {
+    runtime: string;
+    models: ModelChains;
+    effort: TierEfforts;
+    providers: Record<string, CustomProvider>;
+    rules: SourcedRule[];
+};
+export interface ResolvedConfig {
+    config: CliConfig;
+    sources: SettingSources;
+    ultra: boolean;
+    listed: ListedSetting[];
+}
+export interface LoadOptions {
+    repository: boolean;
+    read?: (path: string) => Promise<string | undefined>;
+    file?: string;
+    fetch?: typeof fetch;
+    warn?: (message: string) => void;
+}
+export declare class ConfigError extends OcraError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare function loadConfig(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<CliConfig>;
+/** The configuration's layers, and what they resolve to on their own. */
+export declare function loadConfigLayers(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<{
+    config: CliConfig;
+    layers: SettingsLayer[];
+}>;
+export declare function resolveConfig(layers: readonly SettingsLayer[]): ResolvedConfig;
+export declare function agentChains(config: {
+    reviewers: ReviewerOverrides;
+    roles: RoleSettings;
+}): Record<string, readonly string[]>;
+//# sourceMappingURL=cli-config.d.ts.map

package/dist/config/cli-config.js

@@ -0,0 +1,199 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { EFFORT_LEVELS, errorMessage, MODEL_TIERS, OcraError, } from "@open-cr-agent/core";
+import { isNotFound } from "@open-cr-agent/core/internal";
+import { z } from "zod";
+import { fetchRemoteConfig } from "./remote.js";
+import { DEFAULT_RUNTIME, effort } from "./schema.js";
+import { layerSchema, listSettings, resolveSettings, } from "./settings.js";
+const CONFIG_PATH = ".ocra/config.json";
+// OCRA_MODEL_TOP, OCRA_EFFORT_STANDARD and so on.
+const tierEnv = (prefix) => Object.fromEntries(MODEL_TIERS.map((tier) => [tier, `${prefix}_${tier.toUpperCase()}`]));
+const MODEL_ENV = tierEnv("OCRA_MODEL");
+const EFFORT_ENV = tierEnv("OCRA_EFFORT");
+export class ConfigError extends OcraError {
+    constructor(message, options) {
+        super("CONFIG_INVALID", message, options);
+        this.name = "ConfigError";
+    }
+}
+// Without the repository's file, only defaults and environment variables
+// apply: that file can name plugins, and plugins run code.
+export async function loadConfig(root, env, options = { repository: true }) {
+    return (await loadConfigLayers(root, env, options)).config;
+}
+/** The configuration's layers, and what they resolve to on their own. */
+export async function loadConfigLayers(root, env, options = { repository: true }) {
+    const layers = await configLayers(root, env, options);
+    const { config } = resolveConfig(layers);
+    for (const model of unpriced(config.providers, [
+        ...Object.values(config.models),
+        ...Object.values(agentChains(config)),
+    ])) {
+        options.warn?.(`${model} has a price of 0: reported cost and --max-cost-usd do not count its tokens`);
+    }
+    return { config, layers };
+}
+export function resolveConfig(layers) {
+    const { settings, sources } = resolveSettings(layers);
+    const { ultra, providers, ...rest } = settings;
+    return {
+        config: {
+            ...rest,
+            runtime: settings.runtime ?? DEFAULT_RUNTIME,
+            models: defined(settings.models),
+            effort: defined(settings.effort),
+            providers: toProviders(providers),
+        },
+        sources,
+        ultra,
+        listed: listSettings(settings, sources),
+    };
+}
+function defined(map) {
+    return Object.fromEntries(Object.entries(map).filter(([, value]) => value !== undefined));
+}
+// The configuration's layers, earliest first: a shared configuration it
+// extends, the file, and OCRA_MODEL_<TIER> and OCRA_EFFORT_<TIER> on top.
+async function configLayers(root, env, options) {
+    const read = options.read ?? ((path) => readConfigFromDisk(root, path));
+    const files = options.file
+        ? await fileLayers(ownFile(options.file), options, options.file)
+        : options.repository
+            ? await fileLayers(read, options, CONFIG_PATH)
+            : [];
+    return [...files, envLayer(env)];
+}
+function envLayer(env) {
+    const models = {};
+    const efforts = {};
+    for (const tier of MODEL_TIERS) {
+        const chain = (env[MODEL_ENV[tier]] ?? "")
+            .split(",")
+            .map((m) => m.trim())
+            .filter((m) => m !== "");
+        if (chain.length > 0)
+            models[tier] = chain;
+    }
+    for (const tier of MODEL_TIERS) {
+        const name = EFFORT_ENV[tier];
+        const value = env[name]?.trim();
+        if (!value)
+            continue;
+        const level = effort.safeParse(value);
+        if (!level.success) {
+            throw new ConfigError(`${name} must be one of ${EFFORT_LEVELS.join(", ")}`);
+        }
+        efforts[tier] = level.data;
+    }
+    return { source: "env", settings: { models, effort: efforts } };
+}
+function toProviders(declared) {
+    return Object.fromEntries(Object.entries(declared).map(([id, p]) => [
+        id,
+        {
+            baseUrl: p.baseUrl,
+            ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}),
+            ...(p.effort ? { effort: p.effort } : {}),
+            models: Object.fromEntries(Object.entries(p.models).map(([model, price]) => [
+                model,
+                {
+                    input: price.input,
+                    output: price.output,
+                    ...(price.cachedInput === undefined ? {} : { cachedInput: price.cachedInput }),
+                },
+            ])),
+        },
+    ]));
+}
+// The reviewers' and roles' own chains, by agent id (ADR-0025); a disabled
+// reviewer's is left out, since it makes no call.
+export function agentChains(config) {
+    const chains = {};
+    for (const [id, setting] of Object.entries(config.reviewers)) {
+        if (setting.models && setting.enabled !== false)
+            chains[id] = setting.models;
+    }
+    for (const [role, setting] of Object.entries(config.roles)) {
+        if (setting?.models)
+            chains[role] = setting.models;
+    }
+    return chains;
+}
+// Models of declared providers, named in a chain, priced at 0 per token.
+function unpriced(providers, chains) {
+    const named = new Set(chains.flatMap((chain) => chain ?? []));
+    return [...named].filter((model) => {
+        const slash = model.indexOf("/");
+        const price = providers[model.slice(0, slash)]?.models[model.slice(slash + 1)];
+        return price !== undefined && price.input === 0 && price.output === 0;
+    });
+}
+// The user's own checkout, read like any local file (links followed): unlike
+// the review's reads, which never follow links (vcs-local), this is trusted
+// configuration, and --no-repo-config skips it for code that is not.
+function ownFile(file) {
+    return async () => {
+        try {
+            return await readFile(file, "utf8");
+        }
+        catch (error) {
+            throw new ConfigError(`cannot read ${file}: ${errorMessage(error)}`, { cause: error });
+        }
+    };
+}
+async function readConfigFromDisk(root, path) {
+    try {
+        return await readFile(join(root, path), "utf8");
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return undefined;
+        throw error;
+    }
+}
+// The file, and the shared configuration it extends under it.
+async function fileLayers(read, options, label) {
+    const text = await read(CONFIG_PATH);
+    if (text === undefined)
+        return [];
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch (error) {
+        throw new ConfigError(`${label} is not valid JSON: ${errorMessage(error)}`, {
+            cause: error,
+        });
+    }
+    const local = layerSchema.safeParse(data);
+    if (!local.success)
+        throw new ConfigError(`${label} is invalid: ${z.prettifyError(local.error)}`);
+    const file = { source: "file", settings: local.data };
+    const shared = local.data.extends;
+    if (!shared)
+        return [file];
+    // A shared configuration that cannot be loaded costs its defaults, not the
+    // review: the repository's own settings still apply.
+    let remote;
+    try {
+        remote = await fetchRemoteConfig(shared, options.fetch);
+    }
+    catch (error) {
+        // Its limits are lost with it; say so rather than run silently unbounded.
+        const limits = local.data.maxCostUsd === undefined
+            ? "; none of its settings apply, including any spend or task limit"
+            : "; none of its settings apply";
+        options.warn?.(`could not load extends ${shared}: ${errorMessage(error)}${limits}`);
+        return [file];
+    }
+    const { rules = [], ...rest } = remote;
+    const settings = layerSchema.safeParse(rest);
+    if (!settings.success) {
+        options.warn?.(`ignoring extends ${shared}: its settings are invalid (${z.prettifyError(settings.error)})`);
+        return [file];
+    }
+    const sourced = rules.map((rule) => ({ ...rule, source: "shared" }));
+    return [{ source: "shared", settings: { ...settings.data, rules: sourced } }, file];
+}
+//# sourceMappingURL=cli-config.js.map

package/dist/{review/remote-config.d.ts → config/remote.d.ts}

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const remoteConfigSchema: z.ZodObject<{
+declare const remoteConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     models: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
         light: "light";
@@ -31,5 +31,5 @@ export declare const remoteConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type RemoteConfig = z.infer<typeof remoteConfigSchema>;
 export declare function fetchRemoteConfig(spec: string, fetchImpl?: typeof fetch): Promise<RemoteConfig>;
-export declare function mergeConfig(remote: RemoteConfig, local: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=remote-config.d.ts.map
+export {};
+//# sourceMappingURL=remote.d.ts.map