@open-cr-agent/cli 0.5.0 → 0.6.0

package/dist/{plugin-store.d.ts → plugins/store.d.ts}

@@ -17,4 +17,4 @@ export declare function installedEntry(dir: string, name: string): Promise<{
     integrity?: string;
 } | undefined>;
 export {};
-//# sourceMappingURL=plugin-store.d.ts.map
+//# sourceMappingURL=store.d.ts.map

package/dist/{plugin-store.js → plugins/store.js}

@@ -1,8 +1,9 @@
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { isNotFound } from "@open-cr-agent/core/internal";
 import { z } from "zod";
-import { ocraConfigDir } from "./cloud.js";
-import { ConfigError } from "./review/config.js";
+import { ConfigError } from "../config/cli-config.js";
+import { ocraConfigDir } from "../config/user-dir.js";
 // The plugins this machine allows its ocra Cloud account to name (ADR-0027):
 // installed by `ocra plugins allow` into a directory of the user's own, never
 // the reviewed checkout, and recorded with the integrity npm installed.
@@ -34,7 +35,7 @@ export async function readAllowed(dir) {
         text = await readFile(join(dir, "plugins.json"), "utf8");
     }
     catch (error) {
-        if (error.code === "ENOENT")
+        if (isNotFound(error))
             return [];
         throw error;
     }
@@ -81,4 +82,4 @@ export async function installedEntry(dir, name) {
         ...(typeof integrity === "string" ? { integrity } : {}),
     };
 }
-//# sourceMappingURL=plugin-store.js.map
+//# sourceMappingURL=store.js.map

package/dist/repository-id.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `https://host/owner/repo` for a remote in URL form (`https://`,
+ * `ssh://`, `git://`) or scp form (`user@host:owner/repo`), without user,
+ * password, port, trailing `/` or `.git`, case-folded; undefined for a
+ * local path.
+ */
+export declare function normaliseRemote(url: string): string | undefined;
+/** The repository behind a pull or merge request's web page, such as https://host/o/r/pull/7. */
+export declare function repositoryOfWebUrl(url: string): string | undefined;
+/** The repository behind origin; its address as written when it is a path, the root without one. */
+export declare function originRepository(root: string): Promise<string>;
+//# sourceMappingURL=repository-id.d.ts.map

package/dist/repository-id.js

@@ -0,0 +1,72 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+// What a repository is called before it is salted and hashed for ocra Cloud
+// (ADR-0028): `https://host/owner/repo`, the same for every way of writing
+// its address, so a laptop cloning over SSH and CI cloning over HTTPS group
+// their reviews and match the account's memory. It is the https form
+// because 0.5.0 and earlier hashed the remote URL as written: an HTTPS
+// clone, the common case and CI's, keeps its hash across the upgrade.
+const run = promisify(execFile);
+// Hosts that serve SSH for another host's repositories (port 443 fallbacks).
+const SSH_ALIASES = {
+    "ssh.github.com": "github.com",
+    "altssh.gitlab.com": "gitlab.com",
+};
+/**
+ * `https://host/owner/repo` for a remote in URL form (`https://`,
+ * `ssh://`, `git://`) or scp form (`user@host:owner/repo`), without user,
+ * password, port, trailing `/` or `.git`, case-folded; undefined for a
+ * local path.
+ */
+export function normaliseRemote(url) {
+    const parsed = hostAndPath(url.trim());
+    if (!parsed)
+        return undefined;
+    const host = parsed.host.toLowerCase();
+    const path = parsed.path
+        .replace(/^\/+|\/+$/g, "")
+        .replace(/\.git$/i, "")
+        .replace(/\/+$/, "");
+    if (!host || !path)
+        return undefined;
+    return `https://${SSH_ALIASES[host] ?? host}/${path}`.toLowerCase();
+}
+/** The repository behind a pull or merge request's web page, such as https://host/o/r/pull/7. */
+export function repositoryOfWebUrl(url) {
+    const page = /^(.+?)\/(?:-\/)?(?:pull|merge_requests)\/\d+\/?$/.exec(url.trim());
+    return page?.[1] ? normaliseRemote(page[1]) : undefined;
+}
+/** The repository behind origin; its address as written when it is a path, the root without one. */
+export async function originRepository(root) {
+    let url;
+    try {
+        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], {
+            timeout: 10_000,
+        });
+        url = stdout.trim();
+    }
+    catch {
+        return root;
+    }
+    return normaliseRemote(url) ?? url.toLowerCase();
+}
+function hostAndPath(url) {
+    if (/^[a-z][\w+.-]*:\/\//i.test(url)) {
+        try {
+            const parsed = new URL(url);
+            if (parsed.protocol === "file:")
+                return undefined;
+            return { host: parsed.hostname, path: decodeURIComponent(parsed.pathname) };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // scp form; a Windows path such as C:\repo or C:/repo, whose "host" is
+    // one letter, is not one.
+    const scp = /^(?:[^@\s/]+@)?([^:/\s\\]+):(.+)$/.exec(url);
+    if (!scp?.[1] || !scp[2] || scp[1].length === 1)
+        return undefined;
+    return { host: scp[1], path: scp[2] };
+}
+//# sourceMappingURL=repository-id.js.map

package/dist/run.d.ts

@@ -1,5 +1,5 @@
-import { type ReviewDeps } from "./review/command.js";
-import type { Output } from "./review/progress.js";
+import type { ReviewDeps } from "./commands/review/deps.js";
+import type { Output } from "./io/output.js";
 export declare function defaultDeps(): ReviewDeps;
 export declare function run(argv: string[], out: Output, err: Output, deps?: ReviewDeps): Promise<number>;
 //# sourceMappingURL=run.d.ts.map

package/dist/run.js

@@ -1,16 +1,19 @@
 import { writeFile } from "node:fs/promises";
 import { parseArgs } from "node:util";
-import { isOcraError } from "@open-cr-agent/core";
-import { errorMessage } from "@open-cr-agent/core/internal";
-import { cloudCommand, defaultCloudDeps, LOGIN_USAGE } from "./cloud.js";
-import { memoryCommand } from "./memory.js";
-import { metricsCommand } from "./metrics.js";
-import { pluginsDir } from "./plugin-store.js";
-import { defaultNpm, PLUGINS_USAGE, pluginsCommand } from "./plugins-command.js";
-import { parseReviewArgs, REVIEW_USAGE, UsageError } from "./review/args.js";
-import { BUILTIN_PLUGINS, EXIT, reviewCommand } from "./review/command.js";
-import { BUILTIN_RUNTIMES } from "./review/runtimes.js";
-import { forTerminal } from "./review/terminal.js";
+import { errorMessage, isOcraError } from "@open-cr-agent/core";
+import { defaultCloudDeps } from "./cloud/deps.js";
+import { LOGIN_USAGE, loginCommand } from "./commands/login.js";
+import { memoryCommand } from "./commands/memory.js";
+import { metricsCommand } from "./commands/metrics.js";
+import { PLUGINS_USAGE, pluginsCommand } from "./commands/plugins.js";
+import { parseReviewArgs, REVIEW_USAGE } from "./commands/review/args.js";
+import { BUILTIN_RUNTIMES } from "./commands/review/runtimes.js";
+import { BUILTIN_PLUGINS, reviewCommand } from "./commands/review.js";
+import { EXIT } from "./io/exit.js";
+import { forTerminal } from "./io/terminal.js";
+import { UsageError } from "./io/usage-error.js";
+import { defaultNpm } from "./plugins/npm.js";
+import { pluginsDir } from "./plugins/store.js";
 import { VERSION } from "./version.js";
 const USAGE = `Usage: ocra <command> [options]
 
@@ -87,7 +90,7 @@ export async function run(argv, out, err, deps = defaultDeps()) {
     }
     if (command === "login" || command === "logout" || command === "whoami") {
         try {
-            return await cloudCommand(command, rest, out, err, defaultCloudDeps(deps.env));
+            return await loginCommand(command, rest, out, err, defaultCloudDeps(deps.env));
         }
         catch (error) {
             if (error instanceof UsageError)

package/dist/session/store.d.ts

@@ -0,0 +1,9 @@
+import type { ReportOutput } from "@open-cr-agent/core";
+export declare const SESSIONS_DIR = ".ocra/sessions";
+export declare function sessionsDir(root: string): string;
+export declare function reportPath(sessionDir: string): string;
+/** The session ids in a sessions directory, oldest first; none when it does not exist. */
+export declare function listSessions(dir: string): Promise<string[]>;
+export declare function sessionStart(id: string): Date | undefined;
+export declare function readSessionReport(sessionDir: string): Promise<ReportOutput | undefined>;
+//# sourceMappingURL=store.d.ts.map

package/dist/session/store.js

@@ -0,0 +1,31 @@
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { REPORT_FILE, readReport } from "@open-cr-agent/core/internal";
+// Where a repository keeps its review sessions: one directory per run, named
+// by the run id, written by core's session log (sessionJsonlPlugin).
+export const SESSIONS_DIR = ".ocra/sessions";
+export function sessionsDir(root) {
+    return join(root, SESSIONS_DIR);
+}
+export function reportPath(sessionDir) {
+    return join(sessionDir, REPORT_FILE);
+}
+/** The session ids in a sessions directory, oldest first; none when it does not exist. */
+export async function listSessions(dir) {
+    return (await readdir(dir).catch(() => [])).filter((n) => !n.startsWith(".")).sort();
+}
+// A session directory is named by its run id, whose first part is the start
+// time (newRunId in core).
+export function sessionStart(id) {
+    const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z/.exec(id);
+    if (!m)
+        return undefined;
+    const [, y, mo, d, h, mi, s] = m;
+    return new Date(`${y}-${mo}-${d}T${h}:${mi}:${s}Z`);
+}
+// A session's version 1 report; undefined when it is missing, unreadable or
+// of another version, which `ocra metrics` counts as unreadable.
+export async function readSessionReport(sessionDir) {
+    return readReport(reportPath(sessionDir)).catch(() => undefined);
+}
+//# sourceMappingURL=store.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-cr-agent/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "ocra: open-source multi-agent code review for local changes and GitHub pull requests",
   "keywords": [
     "code-review",
@@ -27,6 +27,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./internal": {
+      "@open-cr-agent/source": "./src/internal.ts",
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {
@@ -37,17 +42,22 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@open-cr-agent/core": "0.5.0",
-    "@open-cr-agent/runtime-direct": "0.5.0",
-    "@open-cr-agent/vcs-github": "0.5.0",
-    "@open-cr-agent/vcs-gitlab": "0.5.0",
-    "@open-cr-agent/vcs-local": "0.5.0",
+    "@open-cr-agent/cloud-contract": "0.6.0",
+    "@open-cr-agent/core": "0.6.0",
+    "@open-cr-agent/runtime-direct": "0.6.0",
+    "@open-cr-agent/vcs-github": "0.6.0",
+    "@open-cr-agent/vcs-gitlab": "0.6.0",
+    "@open-cr-agent/vcs-local": "0.6.0",
+    "@open-cr-agent/vcs-platform": "0.6.0",
     "zod": "^4.6.5"
   },
   "optionalDependencies": {
-    "@open-cr-agent/runtime-opencode": "0.5.0"
+    "@open-cr-agent/runtime-opencode": "0.6.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@open-cr-agent/test-support": "0.0.0"
   }
 }

package/dist/account-salt.d.ts

@@ -1,7 +0,0 @@
-import type { CloudDeps } from "./cloud.js";
-export declare function accountSaltPath(credentialsPath: string): string;
-/** The account's salt, or null; throws when the server cannot be asked. */
-export declare function fetchAccountSalt(deps: Pick<CloudDeps, "fetch">, server: string, token: string): Promise<string | null>;
-/** Keeps the salt beside the credentials (0600), or removes it when the account has none. */
-export declare function saveAccountSalt(credentialsPath: string, salt: string | null): Promise<void>;
-//# sourceMappingURL=account-salt.d.ts.map

package/dist/account-salt.js

@@ -1,43 +0,0 @@
-import { chmod, mkdir, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { VERSION } from "./version.js";
-// The account's repository-hash salt (ADR-0028, 4). The server answers one
-// only while the account shares findings, so that a repository hashes alike
-// on every machine of the account; null means the per-machine salt stays.
-// It is kept beside the credentials, readable only by this user, and
-// refreshed at login and by each signed-in review.
-const SALT = /^[0-9a-f]{64}$/;
-export function accountSaltPath(credentialsPath) {
-    return join(dirname(credentialsPath), "account-salt");
-}
-/** The account's salt, or null; throws when the server cannot be asked. */
-export async function fetchAccountSalt(deps, server, token) {
-    const res = await deps.fetch(`${server}/api/account/salt`, {
-        headers: { authorization: `Bearer ${token}`, "user-agent": `ocra/${VERSION}` },
-        signal: AbortSignal.timeout(15_000),
-    });
-    // A server without account salts shares no findings.
-    if (res.status === 404)
-        return null;
-    if (!res.ok)
-        throw new Error(`HTTP ${res.status}`);
-    const body = (await res.json());
-    if (body.salt === null)
-        return null;
-    if (typeof body.salt === "string" && SALT.test(body.salt))
-        return body.salt;
-    throw new Error("the answer is not a salt");
-}
-/** Keeps the salt beside the credentials (0600), or removes it when the account has none. */
-export async function saveAccountSalt(credentialsPath, salt) {
-    const path = accountSaltPath(credentialsPath);
-    if (salt === null) {
-        await rm(path, { force: true });
-        return;
-    }
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${salt}\n`, { mode: 0o600 });
-    // writeFile keeps the mode of a file that already exists.
-    await chmod(path, 0o600);
-}
-//# sourceMappingURL=account-salt.js.map

package/dist/cloud.d.ts

@@ -1,34 +0,0 @@
-import type { Output } from "./review/progress.js";
-/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
-export declare const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
-export declare const LOGIN_USAGE: string;
-export type Credentials = {
-    server: string;
-    login: string;
-    access_token: string;
-    refresh_token: string;
-    /** Epoch milliseconds when the access token expires. */
-    expires_at: number;
-};
-export type CloudDeps = {
-    env: Readonly<Record<string, string | undefined>>;
-    fetch: typeof fetch;
-    now: () => number;
-    sleep: (ms: number) => Promise<void>;
-    openBrowser: (url: string) => void;
-    credentialsPath: string;
-    clientName: string;
-};
-export declare function defaultCloudDeps(env?: CloudDeps["env"]): CloudDeps;
-export declare function credentialsPath(env: CloudDeps["env"]): string;
-/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
-export declare function ocraConfigDir(env: CloudDeps["env"]): string;
-export declare function readCredentials(path: string): Promise<Credentials | undefined>;
-/**
- * The saved session with a live access token, refreshed (and saved) when
- * it has expired or is about to; undefined when not signed in or the
- * session was revoked.
- */
-export declare function cloudSession(deps: CloudDeps, minValidityMs?: number): Promise<Credentials | undefined>;
-export declare function cloudCommand(command: "login" | "logout" | "whoami", argv: string[], out: Output, err: Output, deps: CloudDeps): Promise<number>;
-//# sourceMappingURL=cloud.d.ts.map

package/dist/cloud.js

@@ -1,272 +0,0 @@
-import { spawn } from "node:child_process";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { homedir, hostname } from "node:os";
-import { dirname, join } from "node:path";
-import { parseArgs } from "node:util";
-import { errorMessage } from "@open-cr-agent/core/internal";
-import { fetchAccountSalt, saveAccountSalt } from "./account-salt.js";
-import { UsageError } from "./review/args.js";
-import { forTerminal } from "./review/terminal.js";
-import { VERSION } from "./version.js";
-// ocra Cloud sign-in (ADR-0024): `ocra login` runs the OAuth device flow
-// (RFC 8628) against ocra Cloud, `ocra whoami` shows the account, and
-// `ocra logout` ends the session. Nothing here runs unless one of these
-// commands is used: a self-hosted user never sees a login prompt.
-/** ocra Cloud's address; OCRA_CLOUD_URL names another server. */
-export const DEFAULT_CLOUD_URL = "https://app.ocracloud.com";
-export const LOGIN_USAGE = `Usage: ocra login [--no-browser]
-       ocra logout
-       ocra whoami
-
-Sign in to ocra Cloud with GitHub, so reviews can use the model keys stored
-there. ocra login shows a code, opens the browser to confirm it, and saves the
-session to ${credentialsHint()} (readable only by you).
-
-Environment:
-  OCRA_CLOUD=off   Disable ocra Cloud: these commands refuse to run
-  OCRA_CLOUD_URL   Another ocra Cloud server (default ${DEFAULT_CLOUD_URL})
-`;
-export function defaultCloudDeps(env = process.env) {
-    return {
-        env,
-        fetch: globalThis.fetch,
-        now: Date.now,
-        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-        openBrowser,
-        credentialsPath: credentialsPath(env),
-        clientName: `${hostname()} (ocra ${VERSION})`,
-    };
-}
-function credentialsHint() {
-    return process.platform === "win32"
-        ? "%APPDATA%\\ocra\\credentials.json"
-        : "~/.config/ocra/credentials.json";
-}
-export function credentialsPath(env) {
-    return join(ocraConfigDir(env), "credentials.json");
-}
-/** ~/.config/ocra ($XDG_CONFIG_HOME/ocra), or %APPDATA%\ocra on Windows: this machine's own. */
-export function ocraConfigDir(env) {
-    const base = process.platform === "win32"
-        ? (env.APPDATA ?? join(homedir(), "AppData", "Roaming"))
-        : (env.XDG_CONFIG_HOME ?? join(homedir(), ".config"));
-    return join(base, "ocra");
-}
-function cloudUrl(env) {
-    const named = env.OCRA_CLOUD_URL || DEFAULT_CLOUD_URL;
-    let url;
-    try {
-        url = new URL(named);
-    }
-    catch {
-        throw new UsageError(`OCRA_CLOUD_URL is not a URL: ${named}`);
-    }
-    if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
-        throw new UsageError(`OCRA_CLOUD_URL must use https: ${url}`);
-    }
-    return url.origin;
-}
-function openBrowser(url) {
-    const [cmd, args] = process.platform === "darwin"
-        ? ["open", [url]]
-        : process.platform === "win32"
-            ? ["cmd", ["/c", "start", "", url]]
-            : ["xdg-open", [url]];
-    try {
-        const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-        child.on("error", () => { });
-        child.unref();
-    }
-    catch {
-        // The URL is printed as well; a missing opener is not an error.
-    }
-}
-export async function readCredentials(path) {
-    let text;
-    try {
-        text = await readFile(path, "utf8");
-    }
-    catch {
-        return undefined;
-    }
-    const c = JSON.parse(text);
-    if (!c.server || !c.access_token || !c.refresh_token || typeof c.expires_at !== "number") {
-        return undefined;
-    }
-    return c;
-}
-async function writeCredentials(path, c) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${JSON.stringify(c, null, 2)}\n`, { mode: 0o600 });
-    // writeFile keeps the mode of a file that already exists.
-    await chmod(path, 0o600);
-}
-async function postJson(deps, url, body, token) {
-    const res = await deps.fetch(url, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            "user-agent": `ocra/${VERSION}`,
-            ...(token ? { authorization: `Bearer ${token}` } : {}),
-        },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(30_000),
-    });
-    return {
-        status: res.status,
-        body: (await res.json().catch(() => ({}))),
-    };
-}
-async function fetchMe(deps, server, token) {
-    const res = await deps.fetch(`${server}/api/me`, {
-        headers: { authorization: `Bearer ${token}`, "user-agent": `ocra/${VERSION}` },
-        signal: AbortSignal.timeout(30_000),
-    });
-    if (res.status === 401)
-        return undefined;
-    if (!res.ok)
-        throw new Error(`ocra Cloud answered ${res.status}`);
-    return (await res.json());
-}
-/**
- * The saved session with a live access token, refreshed (and saved) when
- * it has expired or is about to; undefined when not signed in or the
- * session was revoked.
- */
-export async function cloudSession(deps, minValidityMs = 60_000) {
-    const saved = await readCredentials(deps.credentialsPath);
-    if (!saved)
-        return undefined;
-    if (saved.expires_at - deps.now() > minValidityMs)
-        return saved;
-    const { status, body } = await postJson(deps, `${saved.server}/api/device/refresh`, {
-        refresh_token: saved.refresh_token,
-    });
-    const t = body;
-    if (status !== 200 || !t.access_token || !t.refresh_token || !t.expires_in)
-        return undefined;
-    const next = {
-        ...saved,
-        access_token: t.access_token,
-        refresh_token: t.refresh_token,
-        expires_at: deps.now() + t.expires_in * 1000,
-    };
-    await writeCredentials(deps.credentialsPath, next);
-    return next;
-}
-export async function cloudCommand(command, argv, out, err, deps) {
-    const { values } = parseArgs({
-        args: argv,
-        strict: true,
-        options: { "no-browser": { type: "boolean" }, help: { type: "boolean", short: "h" } },
-    });
-    if (values.help) {
-        out.write(LOGIN_USAGE);
-        return 0;
-    }
-    if (deps.env.OCRA_CLOUD === "off") {
-        err.write("ocra Cloud is off (OCRA_CLOUD=off).\n");
-        return 2;
-    }
-    if (command === "whoami")
-        return whoami(out, err, deps);
-    if (command === "logout")
-        return logout(out, deps);
-    return login(out, err, deps, !values["no-browser"]);
-}
-async function whoami(out, err, deps) {
-    const session = await cloudSession(deps);
-    if (!session) {
-        err.write("Not signed in. Run ocra login.\n");
-        return 1;
-    }
-    const me = await fetchMe(deps, session.server, session.access_token);
-    if (!me) {
-        err.write("The saved session was revoked. Run ocra login.\n");
-        return 1;
-    }
-    out.write(forTerminal(`${me.login} on ${session.server}\n`));
-    return 0;
-}
-async function logout(out, deps) {
-    const saved = await readCredentials(deps.credentialsPath);
-    if (saved) {
-        // Ends the session on the server too; the local file goes either way.
-        const session = await cloudSession(deps).catch(() => undefined);
-        if (session) {
-            await postJson(deps, `${session.server}/api/auth/logout`, {}, session.access_token).catch(() => { });
-        }
-    }
-    await rm(deps.credentialsPath, { force: true });
-    await saveAccountSalt(deps.credentialsPath, null);
-    out.write(saved ? "Signed out.\n" : "Not signed in.\n");
-    return 0;
-}
-async function login(out, err, deps, browser) {
-    const server = cloudUrl(deps.env);
-    const start = await postJson(deps, `${server}/api/device/code`, { client_name: deps.clientName });
-    const code = start.body;
-    if (start.status !== 200 ||
-        !code.device_code ||
-        !code.user_code ||
-        !code.verification_uri_complete) {
-        err.write(`ocra Cloud did not start a login (HTTP ${start.status}). Try again in a minute.\n`);
-        return 2;
-    }
-    out.write(forTerminal(`Confirm this code in your browser: ${code.user_code}\n` +
-        `  ${code.verification_uri_complete}\n` +
-        `(or open ${code.verification_uri} and type it)\n\nWaiting for approval...\n`));
-    if (browser)
-        deps.openBrowser(code.verification_uri_complete);
-    let interval = (code.interval ?? 5) * 1000;
-    const deadline = deps.now() + (code.expires_in ?? 600) * 1000;
-    while (deps.now() < deadline) {
-        await deps.sleep(interval);
-        let answer;
-        try {
-            answer = await postJson(deps, `${server}/api/device/token`, {
-                device_code: code.device_code,
-            });
-        }
-        catch (error) {
-            // A dropped connection is retried on the next tick.
-            err.write(forTerminal(`(${errorMessage(error)}; retrying)\n`));
-            continue;
-        }
-        const t = answer.body;
-        if (answer.status === 200 && t.access_token && t.refresh_token && t.expires_in) {
-            const me = await fetchMe(deps, server, t.access_token);
-            const credentials = {
-                server,
-                login: me?.login ?? "",
-                access_token: t.access_token,
-                refresh_token: t.refresh_token,
-                expires_at: deps.now() + t.expires_in * 1000,
-            };
-            await writeCredentials(deps.credentialsPath, credentials);
-            // Best effort: each signed-in review asks again.
-            await fetchAccountSalt(deps, server, t.access_token)
-                .then((salt) => saveAccountSalt(deps.credentialsPath, salt))
-                .catch(() => { });
-            out.write(forTerminal(`Signed in as ${credentials.login}.\n`));
-            return 0;
-        }
-        if (t.error === "authorization_pending")
-            continue;
-        if (t.error === "slow_down") {
-            interval = typeof t.interval === "number" ? t.interval * 1000 : interval + 5000;
-            continue;
-        }
-        if (t.error === "access_denied") {
-            err.write("Login denied in the browser.\n");
-            return 1;
-        }
-        if (t.error === "expired_token")
-            break;
-        err.write(forTerminal(`Login failed: ${t.error ?? `HTTP ${answer.status}`}\n`));
-        return 2;
-    }
-    err.write("The code expired before it was confirmed. Run ocra login again.\n");
-    return 1;
-}
-//# sourceMappingURL=cloud.js.map

package/dist/memory.d.ts

@@ -1,4 +0,0 @@
-import type { Output } from "./review/progress.js";
-export declare const MEMORY_USAGE = "Usage: ocra memory <command>\n\nRemember findings the team accepts, so ocra stops reporting them.\nEntries live in .ocra/memory.json; commit it to share them.\n\nCommands:\n  list                              Show remembered findings\n  add <id> --reason <text>          Remember a finding from the last review\n      [--session <dir>]             (default: the newest session in .ocra/sessions)\n";
-export declare function memoryCommand(argv: string[], out: Output, cwd: string, now?: Date): Promise<number>;
-//# sourceMappingURL=memory.d.ts.map