@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/{review/remote-config.js → config/remote.js}

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { OcraError } from "@open-cr-agent/core";
+import { MODEL_TIERS, OcraError } from "@open-cr-agent/core";
 import { repoRuleSchema } from "@open-cr-agent/core/internal";
 import { z } from "zod";
 const MAX_BYTES = 256 * 1024;
@@ -7,11 +7,11 @@ const TIMEOUT_MS = 10_000;
 // What a shared configuration may set: settings, rules and model providers
 // (a company gateway, for example), never plugins or a runtime, because it
 // is fetched from outside the repository.
-export const remoteConfigSchema = z
+const remoteConfigSchema = z
     .object({
     $schema: z.string().optional(),
-    models: z.record(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
-    effort: z.partialRecord(z.enum(["top", "standard", "light"]), z.unknown()).optional(),
+    models: z.record(z.enum(MODEL_TIERS), z.unknown()).optional(),
+    effort: z.partialRecord(z.enum(MODEL_TIERS), z.unknown()).optional(),
     concurrency: z.unknown().optional(),
     taskTimeoutMinutes: z.unknown().optional(),
     runTimeoutMinutes: z.unknown().optional(),
@@ -81,22 +81,4 @@ async function readLimited(response, limit, name) {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
-// The repository's own values win; lists and maps are combined.
-export function mergeConfig(remote, local) {
-    const { rules: _rules, ...settings } = remote;
-    const merged = { ...settings, ...local };
-    for (const key of ["models", "effort", "reviewers", "roles", "github", "providers"]) {
-        const a = settings[key];
-        const b = local[key];
-        if (a !== undefined || b !== undefined)
-            merged[key] = { ...(a ?? {}), ...(b ?? {}) };
-    }
-    for (const key of ["include", "exclude"]) {
-        const a = settings[key] ?? [];
-        const b = local[key] ?? [];
-        if (a.length + b.length > 0)
-            merged[key] = [...a, ...b];
-    }
-    return merged;
-}
-//# sourceMappingURL=remote-config.js.map
+//# sourceMappingURL=remote.js.map

package/dist/{review/config.d.ts → config/schema.d.ts}

@@ -1,6 +1,11 @@
-import { type CustomProvider, type ModelChains, OcraError, type ReviewerOverrides, type RoleSettings, type SourcedRule, type TierEfforts } from "@open-cr-agent/core";
 import { z } from "zod";
-export declare const CONFIG_PATH = ".ocra/config.json";
+export declare const effort: z.ZodEnum<{
+    high: "high";
+    low: "low";
+    medium: "medium";
+    minimal: "minimal";
+    none: "none";
+}>;
 export declare const DEFAULT_RUNTIME = "opencode";
 export declare const configSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
@@ -103,32 +108,4 @@ export declare const configSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
 export declare function configJsonSchema(): Record<string, unknown>;
-export type CliConfig = Omit<z.infer<typeof configSchema>, "models" | "effort" | "providers" | "runtime"> & {
-    runtime: string;
-    runtimeSet: boolean;
-    models: ModelChains;
-    effort: TierEfforts;
-    providers: Record<string, CustomProvider>;
-    rules: SourcedRule[];
-    accountSettings?: {
-        version: string | null;
-    };
-};
-export interface LoadOptions {
-    repository: boolean;
-    read?: (path: string) => Promise<string | undefined>;
-    file?: string;
-    fetch?: typeof fetch;
-    warn?: (message: string) => void;
-}
-export declare class ConfigError extends OcraError {
-    constructor(message: string, options?: {
-        cause?: unknown;
-    });
-}
-export declare function loadConfig(root: string, env: Readonly<Record<string, string | undefined>>, options?: LoadOptions): Promise<CliConfig>;
-export declare function agentChains(config: {
-    reviewers: ReviewerOverrides;
-    roles: RoleSettings;
-}): Record<string, readonly string[]>;
-//# sourceMappingURL=config.d.ts.map
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.js

@@ -0,0 +1,138 @@
+import { EFFORT_LEVELS } from "@open-cr-agent/core";
+import { AGENT_ROLES, MAX_TIMER_MS, RISK_TIERS } from "@open-cr-agent/core/internal";
+import { z } from "zod";
+// What .ocra/config.json may say. Every layer of settings (settings.ts) is
+// checked against it.
+// How much a model reasons before answering (ADR-0025); unset leaves the
+// provider's default.
+export const effort = z.enum(EFFORT_LEVELS);
+// The longest timeout a timer keeps, about 24.8 days; a longer one would fire at once.
+const timeoutMinutes = z
+    .number()
+    .positive()
+    .max(Math.floor(MAX_TIMER_MS / 60_000))
+    .optional();
+const modelChain = z
+    .union([z.string().min(1), z.array(z.string().min(1)).min(1)])
+    .transform((value) => (typeof value === "string" ? [value] : value));
+// Where review code is sent: over https, or plain http only to this machine.
+// OpenCode replaces {env:NAME} and {file:path} anywhere in its configuration,
+// so an address with braces could carry a variable or a file (the checkout's
+// .git/config holds its token) to the endpoint.
+const endpoint = z
+    .url()
+    .refine((value) => {
+    const url = new URL(value);
+    if (url.protocol === "https:")
+        return true;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    return (url.protocol === "http:" &&
+        (host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host)));
+}, "must be an https URL, or http on this machine (localhost, 127.0.0.1, ::1)")
+    .refine((value) => !/[{}]/.test(value), "must not contain { or }");
+// The platforms' and clouds' credentials never go to a model endpoint; the
+// same prefixes are never passed to the runtime by prefix (server-env.ts).
+const PLATFORM_TOKENS = /^(GITHUB_|GH_|GITLAB_|CI_|ACTIONS_|RUNNER_|AWS_|AZURE_|NPM_|SSH_|OCRA_)/;
+const price = z.number().min(0).max(10_000);
+const providerSchema = z
+    .object({
+    type: z.literal("openai-compatible"),
+    baseUrl: endpoint,
+    apiKeyEnv: z
+        .string()
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be an environment variable name")
+        .refine((name) => !PLATFORM_TOKENS.test(name), "must not name a platform or cloud credential")
+        .optional(),
+    // Prices in US dollars per million tokens; 0 means unpriced.
+    models: z
+        .record(z.string().regex(/^[\w./:@-]{1,200}$/), z.object({ input: price, output: price, cachedInput: price.optional() }).strict())
+        .refine((models) => Object.keys(models).length > 0, "must list at least one model"),
+    // How the endpoint takes a reasoning effort: "openai" sends
+    // reasoning_effort (the default), "openrouter" sends reasoning.effort.
+    effort: z.enum(["openai", "openrouter"]).optional(),
+})
+    .strict();
+// The runtimes ocra ships; a plugin may register another name, so the
+// schema lists these for editors and still accepts any other string.
+const BUILTIN_RUNTIMES = ["opencode", "direct"];
+export const DEFAULT_RUNTIME = "opencode";
+export const configSchema = z
+    .object({
+    $schema: z.string().optional(),
+    models: z
+        .object({ top: modelChain, standard: modelChain, light: modelChain })
+        .partial()
+        .strict()
+        .default({}),
+    effort: z
+        .object({ top: effort, standard: effort, light: effort })
+        .partial()
+        .strict()
+        .default({}),
+    concurrency: z.number().int().min(1).max(32).optional(),
+    taskTimeoutMinutes: timeoutMinutes,
+    runTimeoutMinutes: timeoutMinutes,
+    verify: z.boolean().optional(),
+    judge: z.boolean().optional(),
+    maxCostUsd: z.number().positive().optional(),
+    maxTasks: z.number().int().min(1).max(1_000).optional(),
+    // Unset: each provider's default. A seed makes sampling repeatable only
+    // where the provider supports it.
+    sampling: z
+        .object({
+        temperature: z.number().min(0).max(2),
+        seed: z
+            .number()
+            .int()
+            .min(0)
+            .max(2 ** 31 - 1),
+    })
+        .partial()
+        .strict()
+        .optional(),
+    github: z
+        .object({ requestChanges: z.boolean(), botLogin: z.string().min(1) })
+        .partial()
+        .strict()
+        .default({}),
+    include: z.array(z.string().min(1)).default([]),
+    exclude: z.array(z.string().min(1)).default([]),
+    // Unset means "opencode"; loadConfig fills it in and records whether the
+    // file chose, so account defaults (ADR-0025) apply only where it did not.
+    runtime: z.enum(BUILTIN_RUNTIMES).or(z.string().min(1)).optional(),
+    plugins: z.array(z.string().min(1)).default([]),
+    reviewers: z
+        .record(z.string(), z
+        .object({
+        enabled: z.boolean(),
+        minTier: z.enum(RISK_TIERS),
+        // The reviewer's own chain, for its review tasks and plan call.
+        models: modelChain,
+        effort,
+    })
+        .partial()
+        .strict())
+        .default({}),
+    roles: z
+        .partialRecord(z.enum(AGENT_ROLES), z.object({ models: modelChain, effort }).partial().strict())
+        .default({}),
+    pluginSettings: z.record(z.string(), z.unknown()).default({}),
+    providers: z.record(z.string().regex(/^[a-z][a-z0-9-]{0,39}$/), providerSchema).default({}),
+    extends: z.string().min(1).optional(),
+})
+    .strict();
+export const CONFIG_SCHEMA_ID = "https://ocra.majincheng.com/schema/config.v1.json";
+// JSON Schema (draft 2020-12) of .ocra/config.json, for editors: what a
+// file may say, so defaults are optional and model chains take either form.
+export function configJsonSchema() {
+    const generated = z.toJSONSchema(configSchema, { target: "draft-2020-12", io: "input" });
+    const { $schema, ...rest } = generated;
+    return {
+        $schema,
+        $id: CONFIG_SCHEMA_ID,
+        title: "ocra configuration",
+        description: "The .ocra/config.json file of a repository, or a file passed with --config. Unknown keys are rejected.",
+        ...rest,
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/config/settings.d.ts

@@ -0,0 +1,37 @@
+import { type SourcedRule } from "@open-cr-agent/core";
+import { z } from "zod";
+import { configSchema } from "./schema.js";
+type FileSettings = z.output<typeof configSchema>;
+export type Settings = FileSettings & {
+    rules: SourcedRule[];
+    ultra: boolean;
+};
+type SettingSource = "shared" | "file" | "env" | "account" | "flag";
+export type LayerSettings = {
+    [K in keyof Settings]?: Settings[K];
+};
+export interface SettingsLayer {
+    source: SettingSource;
+    settings: LayerSettings;
+    under?: boolean;
+}
+export type SettingSources = Record<string, SettingSource[]>;
+export declare const layerSchema: z.ZodType<Omit<LayerSettings, "rules" | "ultra">>;
+/** The layers, earliest first, over ocra's defaults, and where each setting came from. */
+export declare function resolveSettings(layers: readonly SettingsLayer[]): {
+    settings: Settings;
+    sources: SettingSources;
+};
+export interface ListedSetting {
+    key: string;
+    value?: unknown;
+    sources: SettingSource[];
+}
+/**
+ * The settings --plan lists, in its order, with their sources. A setting
+ * only a command-line flag set is the flag's, not a setting, and is left
+ * out.
+ */
+export declare function listSettings(settings: Settings, sources: SettingSources): ListedSetting[];
+export {};
+//# sourceMappingURL=settings.d.ts.map

package/dist/config/settings.js

@@ -0,0 +1,133 @@
+import { isDeepStrictEqual } from "node:util";
+import { MODEL_TIERS, OcraError } from "@open-cr-agent/core";
+import { z } from "zod";
+import { configSchema } from "./schema.js";
+const ALL = ["shared", "file", "env", "account"];
+const NOT_ENV = ["shared", "file", "account"];
+const ALWAYS = { list: "always" };
+// How each setting merges, which layers may set it, and how --plan lists
+// it, in --plan's order. A shared configuration is fetched from outside the
+// repository, so it never names plugins or a runtime; the account never
+// moves code or keys (providers, extends) or decides whose comments are
+// trusted (github). The layers' parsers refuse these with a warning; here
+// they are a broken invariant.
+const MERGE = {
+    runtime: { merge: "replace", from: ["file", "account"], plan: ALWAYS },
+    models: { merge: "entries", from: ALL, plan: { list: "always", entries: MODEL_TIERS } },
+    effort: { merge: "entries", from: ALL, plan: { list: "always", entries: MODEL_TIERS } },
+    reviewers: { merge: "entries", from: NOT_ENV, plan: { list: "set" } },
+    roles: { merge: "entries", from: NOT_ENV, plan: { list: "set" } },
+    concurrency: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    taskTimeoutMinutes: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    runTimeoutMinutes: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    maxCostUsd: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    maxTasks: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    verify: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    judge: { merge: "replace", from: NOT_ENV, plan: ALWAYS },
+    sampling: { merge: "replace", from: ["file", "account"], plan: ALWAYS },
+    include: { merge: "concat", from: NOT_ENV, plan: ALWAYS },
+    exclude: { merge: "concat", from: NOT_ENV, plan: ALWAYS },
+    rules: {
+        merge: "concat",
+        from: ["shared", "account"],
+        // Where each rule applies and whose it is; the rule's text can be long.
+        plan: {
+            list: "always",
+            show: (rules) => rules.map(({ path, source }) => ({ path, source })),
+        },
+    },
+    ultra: { merge: "replace", from: ["account", "flag"], plan: { list: "set" } },
+    $schema: { merge: "replace", from: ["shared", "file"] },
+    github: { merge: "entries", from: ["shared", "file"] },
+    plugins: { merge: "replace", from: ["file"] },
+    pluginSettings: { merge: "replace", from: ["file"] },
+    providers: { merge: "entries", from: ["shared", "file"] },
+    extends: { merge: "replace", from: ["file"] },
+};
+// The configuration file's schema without its defaults, so a layer holds
+// only what it sets; unknown keys are refused as in the file.
+export const layerSchema = z
+    .object(Object.fromEntries(Object.entries(configSchema.shape).map(([key, schema]) => [
+    key,
+    (schema instanceof z.ZodDefault ? schema.unwrap() : schema).optional(),
+])))
+    .strict();
+/** The layers, earliest first, over ocra's defaults, and where each setting came from. */
+export function resolveSettings(layers) {
+    const merged = { ...configSchema.parse({}), rules: [], ultra: false };
+    const sources = {};
+    const record = (name, source) => {
+        const from = sources[name] ?? [];
+        if (!from.includes(source))
+            sources[name] = [...from, source];
+    };
+    for (const { source, settings, under = false } of layers) {
+        for (const [key, value] of Object.entries(settings)) {
+            if (value === undefined)
+                continue;
+            const rule = MERGE[key];
+            if (!rule.from.includes(source)) {
+                throw new OcraError("INTERNAL", `the ${source} settings may not set ${key}`);
+            }
+            if (rule.merge === "replace") {
+                if (under && sources[key])
+                    continue;
+                merged[key] = value;
+                sources[key] = [source];
+            }
+            else if (rule.merge === "entries") {
+                const entries = { ...merged[key] };
+                for (const [entry, setting] of Object.entries(value)) {
+                    const name = `${key}.${entry}`;
+                    if (setting === undefined || (under && sources[name]))
+                        continue;
+                    entries[entry] = setting;
+                    sources[name] = [source];
+                }
+                merged[key] = entries;
+            }
+            else {
+                const current = merged[key];
+                const added = under
+                    ? value.filter((v) => !current.some((c) => isDeepStrictEqual(c, v)))
+                    : value;
+                if (added.length === 0)
+                    continue;
+                merged[key] = [...current, ...added];
+                record(key, source);
+            }
+        }
+    }
+    return { settings: merged, sources };
+}
+/**
+ * The settings --plan lists, in its order, with their sources. A setting
+ * only a command-line flag set is the flag's, not a setting, and is left
+ * out.
+ */
+export function listSettings(settings, sources) {
+    const listed = [];
+    for (const [key, rule] of Object.entries(MERGE)) {
+        const plan = rule.plan;
+        if (!plan)
+            continue;
+        const value = settings[key];
+        const add = (name, shown, always) => {
+            const from = (sources[name] ?? []).filter((source) => source !== "flag");
+            if (from.length === 0 && !always)
+                return;
+            listed.push(from.length === 0 ? { key: name, sources: [] } : { key: name, value: shown, sources: from });
+        };
+        if (rule.merge === "entries") {
+            const map = value;
+            for (const entry of plan.entries ?? Object.keys(map)) {
+                add(`${key}.${entry}`, map[entry], plan.list === "always");
+            }
+        }
+        else {
+            add(key, plan.show ? plan.show(value) : value, plan.list === "always");
+        }
+    }
+    return listed;
+}
+//# sourceMappingURL=settings.js.map

package/dist/config/user-dir.d.ts

@@ -0,0 +1,3 @@
+/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
+export declare function ocraConfigDir(env: Readonly<Record<string, string | undefined>>): string;
+//# sourceMappingURL=user-dir.d.ts.map

package/dist/config/user-dir.js

@@ -0,0 +1,10 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
+export function ocraConfigDir(env) {
+    const base = process.platform === "win32"
+        ? (env.APPDATA ?? join(homedir(), "AppData", "Roaming"))
+        : (env.XDG_CONFIG_HOME ?? join(homedir(), ".config"));
+    return join(base, "ocra");
+}
+//# sourceMappingURL=user-dir.js.map

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export { run } from "./run.js";
+export declare function run(argv: readonly string[]): Promise<number>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,2 +1,11 @@
-export { run } from "./run.js";
+// The public API of @open-cr-agent/cli, a contract under the 0.x rule
+// (manual: Embedding, Stability); etc/cli.api.md records it. What the
+// other workspace packages need beyond this comes from
+// "@open-cr-agent/cli/internal", which is not a contract.
+import { defaultDeps, run as runWith } from "./run.js";
+// The `ocra` command with its arguments (no node or script path), writing
+// to stdout and stderr; resolves to the exit code.
+export function run(argv) {
+    return runWith([...argv], process.stdout, process.stderr, defaultDeps());
+}
 //# sourceMappingURL=index.js.map

package/dist/internal.d.ts

@@ -0,0 +1,6 @@
+export type { ReviewDeps } from "./commands/review/deps.js";
+export { type CliPlanOutput, cliPlanOutputSchema, planJsonSchema, } from "./commands/review/plan-schema.js";
+export { configJsonSchema } from "./config/schema.js";
+export type { Output } from "./io/output.js";
+export { run } from "./run.js";
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.js

@@ -0,0 +1,7 @@
+// "@open-cr-agent/cli/internal": what ocra's own packages share beyond the
+// public API (index.ts), such as the command with its dependencies
+// injected. Not a contract: any release may change or remove any of it.
+export { cliPlanOutputSchema, planJsonSchema, } from "./commands/review/plan-schema.js";
+export { configJsonSchema } from "./config/schema.js";
+export { run } from "./run.js";
+//# sourceMappingURL=internal.js.map

package/dist/io/exit.d.ts

@@ -0,0 +1,9 @@
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly blocking: 1;
+    readonly notSignedIn: 1;
+    readonly error: 2;
+    readonly incomplete: 3;
+    readonly interrupted: 130;
+};
+//# sourceMappingURL=exit.d.ts.map

package/dist/io/exit.js

@@ -0,0 +1,12 @@
+// Exit codes are a contract (docs/manual, "Exit codes"): every command
+// returns one of these, never a bare number.
+export const EXIT = {
+    ok: 0,
+    blocking: 1,
+    // ocra login, logout and whoami: no usable ocra Cloud session.
+    notSignedIn: 1,
+    error: 2,
+    incomplete: 3,
+    interrupted: 130,
+};
+//# sourceMappingURL=exit.js.map

package/dist/io/output.d.ts

@@ -0,0 +1,4 @@
+export interface Output {
+    write(chunk: string): unknown;
+}
+//# sourceMappingURL=output.d.ts.map

package/dist/io/output.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=output.js.map

package/dist/io/usage-error.d.ts

@@ -0,0 +1,5 @@
+import { OcraError } from "@open-cr-agent/core";
+export declare class UsageError extends OcraError {
+    constructor(message: string);
+}
+//# sourceMappingURL=usage-error.d.ts.map

package/dist/io/usage-error.js

@@ -0,0 +1,8 @@
+import { OcraError } from "@open-cr-agent/core";
+export class UsageError extends OcraError {
+    constructor(message) {
+        super("INPUT_USAGE", message);
+        this.name = "UsageError";
+    }
+}
+//# sourceMappingURL=usage-error.js.map

package/dist/main.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { run } from "./run.js";
-process.exitCode = await run(process.argv.slice(2), process.stdout, process.stderr);
+import { run } from "./index.js";
+process.exitCode = await run(process.argv.slice(2));
 //# sourceMappingURL=main.js.map

package/dist/{review/account-plugins.d.ts → plugins/account.d.ts}

@@ -10,7 +10,7 @@ export declare function parseAccountPlugins(body: unknown, warn: (message: strin
  * never with --no-repo-config); a package the configuration already lists
  * loads as the configuration's, and a plugin whose name is taken is skipped.
  */
-export declare function accountPlugins(account: AccountPlugins, options: {
+export declare function loadAccountPlugins(account: AccountPlugins, options: {
     allowed: boolean;
     configured: readonly string[];
     taken: readonly OcraPlugin[];
@@ -20,4 +20,4 @@ export declare function accountPlugins(account: AccountPlugins, options: {
     plugins: OcraPlugin[];
     settings: Record<string, unknown>;
 }>;
-//# sourceMappingURL=account-plugins.d.ts.map
+//# sourceMappingURL=account.d.ts.map

package/dist/{review/account-plugins.js → plugins/account.js}

@@ -1,5 +1,5 @@
-import { isPackageName } from "../plugin-store.js";
-import { loadAccountPlugins } from "./plugins.js";
+import { loadAllowedPlugins } from "./load.js";
+import { isPackageName } from "./store.js";
 const MAX_PLUGINS = 50;
 export function parseAccountPlugins(body, warn) {
     const settings = record(record(body).settings);
@@ -22,7 +22,7 @@ export function parseAccountPlugins(body, warn) {
  * never with --no-repo-config); a package the configuration already lists
  * loads as the configuration's, and a plugin whose name is taken is skipped.
  */
-export async function accountPlugins(account, options) {
+export async function loadAccountPlugins(account, options) {
     const names = account.plugins.filter((name) => !options.configured.includes(name));
     if (names.length === 0)
         return { plugins: [], settings: {} };
@@ -33,15 +33,15 @@ export async function accountPlugins(account, options) {
     const taken = new Set(options.taken.map((p) => p.name));
     const plugins = [];
     const settings = {};
-    for (const { name, plugin } of await loadAccountPlugins(names, options.dir, options.warn)) {
+    for (const { name, plugin } of await loadAllowedPlugins(names, options.dir, options.warn)) {
         if (taken.has(plugin.name)) {
             options.warn(`skipping plugin ${name} from your ocra Cloud settings: a plugin named "${plugin.name}" is already loaded`);
             continue;
         }
         taken.add(plugin.name);
         plugins.push(plugin);
-        if (Object.hasOwn(account.pluginSettings, plugin.name)) {
-            settings[plugin.name] = account.pluginSettings[plugin.name];
+        if (Object.hasOwn(account.pluginSettings, name)) {
+            settings[plugin.name] = account.pluginSettings[name];
         }
     }
     return { plugins, settings };
@@ -51,4 +51,4 @@ function record(value) {
         ? value
         : {};
 }
-//# sourceMappingURL=account-plugins.js.map
+//# sourceMappingURL=account.js.map

package/dist/{review/plugins.d.ts → plugins/load.d.ts}

@@ -6,8 +6,8 @@ export declare function loadExternalPlugins(specifiers: readonly string[], root:
  * when it was allowed. Anything else is skipped with a warning; an account
  * plugin never fails the review.
  */
-export declare function loadAccountPlugins(names: readonly string[], dir: string, warn: (message: string) => void): Promise<{
+export declare function loadAllowedPlugins(names: readonly string[], dir: string, warn: (message: string) => void): Promise<{
     name: string;
     plugin: OcraPlugin;
 }[]>;
-//# sourceMappingURL=plugins.d.ts.map
+//# sourceMappingURL=load.d.ts.map

package/dist/{review/plugins.js → plugins/load.js}

@@ -2,8 +2,9 @@ import { realpath } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { isAbsolute, join, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
-import { installedEntry, readAllowed } from "../plugin-store.js";
-import { ConfigError } from "./config.js";
+import { errorMessage } from "@open-cr-agent/core";
+import { ConfigError } from "../config/cli-config.js";
+import { installedEntry, readAllowed } from "./store.js";
 // Plugins listed in the repository config execute code, so they are resolved
 // only from the repository's own dependencies or relative paths inside it.
 export async function loadExternalPlugins(specifiers, root) {
@@ -37,7 +38,7 @@ function isPlugin(value) {
  * when it was allowed. Anything else is skipped with a warning; an account
  * plugin never fails the review.
  */
-export async function loadAccountPlugins(names, dir, warn) {
+export async function loadAllowedPlugins(names, dir, warn) {
     const allowed = new Map((await readAllowed(dir)).map((p) => [p.name, p]));
     const missing = names.filter((name) => !allowed.has(name));
     if (missing.length > 0) {
@@ -60,7 +61,7 @@ export async function loadAccountPlugins(names, dir, warn) {
             loaded.push({ name, plugin });
         }
         catch (error) {
-            warn(`skipping plugin ${name} from your ocra Cloud settings: ${error.message}`);
+            warn(`skipping plugin ${name} from your ocra Cloud settings: ${errorMessage(error)}`);
         }
     }
     return loaded;
@@ -74,4 +75,4 @@ async function allowedEntry(dir, name) {
         throw new Error(`it resolves outside ${dir}`);
     return entry;
 }
-//# sourceMappingURL=plugins.js.map
+//# sourceMappingURL=load.js.map

package/dist/plugins/npm.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runs npm with these arguments in `cwd`, never through a shell; resolves
+ * with its standard output. Every call runs in the plugin directory, so the
+ * npm configuration of whatever project ocra was started in does not apply.
+ */
+export type NpmRunner = (args: readonly string[], cwd: string) => Promise<string>;
+export declare function defaultNpm(env?: NodeJS.ProcessEnv): NpmRunner;
+//# sourceMappingURL=npm.d.ts.map

package/dist/plugins/npm.js

@@ -0,0 +1,24 @@
+import { execFile } from "node:child_process";
+import { dirname, join } from "node:path";
+import { ConfigError } from "../config/cli-config.js";
+import { forTerminal } from "../io/terminal.js";
+// npm on Windows is npm.cmd, which execFile cannot run without a shell; run
+// the npm that ships with this Node directly instead.
+export function defaultNpm(env = process.env) {
+    const [file, prefix] = process.platform === "win32"
+        ? [
+            process.execPath,
+            [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")],
+        ]
+        : ["npm", []];
+    return (args, cwd) => new Promise((resolve, reject) => {
+        execFile(file, [...prefix, ...args], { cwd, env, timeout: 5 * 60_000, maxBuffer: 16 * 1024 * 1024, shell: false }, (error, stdout, stderr) => {
+            if (error) {
+                reject(new ConfigError(`npm ${args[0]} failed: ${forTerminal(String(stderr).trim().split("\n").slice(-3).join(" ") || error.message)}`));
+            }
+            else
+                resolve(String(stdout));
+        });
+    });
+}
+//# sourceMappingURL=npm.js.map