@open-cr-agent/runtime-opencode 0.1.1 → 0.2.0

package/dist/binary.d.ts

@@ -5,6 +5,7 @@ export interface Host {
     musl: boolean;
     baseline: boolean;
 }
-export declare function resolveOpencodeBinary(env: Env): string;
+export declare function resolveOpencodeBinary(env: Env, opencodePackage?: string): string;
+export declare function isNativeExecutable(path: string): boolean;
 export declare function binaryVariants(host: Host): string[];
 //# sourceMappingURL=binary.d.ts.map

package/dist/binary.js

@@ -1,17 +1,21 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 const PLATFORMS = { darwin: "darwin", linux: "linux", win32: "windows" };
 // Resolved from opencode-ai's platform packages directly, because newer npm
-// versions block the postinstall script that would otherwise place it.
-export function resolveOpencodeBinary(env) {
+// versions block the postinstall script that would otherwise place it. An
+// install without optional dependencies has no platform package, but where
+// that script ran, it downloaded the binary into opencode-ai's own bin/.
+export function resolveOpencodeBinary(env, opencodePackage = createRequire(import.meta.url).resolve("opencode-ai/package.json")) {
     const override = env.OCRA_OPENCODE_BIN;
+    // OpenCode runs in a directory of its own, where a relative path would
+    // not resolve; a bare name is still looked up in PATH.
     if (override)
-        return override;
+        return /[\\/]/.test(override) ? resolve(override) : override;
     const platform = PLATFORMS[process.platform] ?? process.platform;
     const executable = platform === "windows" ? "opencode.exe" : "opencode";
-    const fromOpencode = createRequire(createRequire(import.meta.url).resolve("opencode-ai/package.json"));
+    const fromOpencode = createRequire(opencodePackage);
     for (const variant of binaryVariants(currentHost(platform))) {
         try {
             const pkg = fromOpencode.resolve(`opencode-${platform}-${process.arch}${variant}/package.json`);
@@ -21,7 +25,34 @@ export function resolveOpencodeBinary(env) {
         }
         catch { }
     }
-    throw new Error(`No OpenCode binary for ${platform}-${process.arch}; set OCRA_OPENCODE_BIN`);
+    // The script names the binary opencode.exe on every platform.
+    const placed = join(dirname(opencodePackage), "bin", "opencode.exe");
+    if (isNativeExecutable(placed))
+        return placed;
+    throw new Error(`No OpenCode binary for ${platform}-${process.arch}: install without --omit=optional, or set OCRA_OPENCODE_BIN`);
+}
+// Until the install script replaces it, opencode-ai's bin/opencode.exe is a
+// shell script that only prints an error, so the file must be a real
+// executable: ELF, Mach-O (either byte order, or universal) or Windows PE.
+export function isNativeExecutable(path) {
+    let fd;
+    try {
+        fd = openSync(path, "r");
+        const head = Buffer.alloc(4);
+        if (readSync(fd, head, 0, 4, 0) < 4)
+            return false;
+        const magic = head.readUInt32BE(0);
+        return (magic === 0x7f454c46 ||
+            [0xfeedface, 0xfeedfacf, 0xcefaedfe, 0xcffaedfe, 0xcafebabe].includes(magic) ||
+            head.subarray(0, 2).toString("latin1") === "MZ");
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
 }
 // The builds to try, best first. npm installs every build whose os and cpu
 // match, and the glibc builds declare no libc, so musl Linux has both kinds;

package/dist/failback.d.ts

@@ -1,4 +1,4 @@
-import { type AgentEvent, type ModelTier } from "@open-cr-agent/core";
+import { type AgentEvent, type ModelTier, type Usage } from "@open-cr-agent/core";
 import type { ModelHealth } from "./models.js";
 import type { SessionOutcome } from "./session-outcome.js";
 export interface FailbackOptions {
@@ -7,8 +7,17 @@ export interface FailbackOptions {
     chain: readonly string[];
     health: ModelHealth;
     signal: AbortSignal;
-    attempt(model: string): Promise<SessionOutcome>;
+    attempt(model: string, onUsage: (spent: Usage) => void): Promise<SessionOutcome>;
 }
 export declare function withFailback(options: FailbackOptions): AsyncGenerator<AgentEvent>;
+export declare class LiveUsage {
+    private seen;
+    private given;
+    private wake;
+    observe(spent: Usage): void;
+    changed(): Promise<void>;
+    take(): Usage;
+    rest(total: Usage): Usage;
+}
 export declare function toolSummary(toolCalls: readonly string[]): string;
 //# sourceMappingURL=failback.d.ts.map

package/dist/failback.js

@@ -1,4 +1,4 @@
-import { REVIEW_TOOLS } from "@open-cr-agent/core";
+import { emptyUsage, REVIEW_TOOLS, } from "@open-cr-agent/core";
 import { sleep } from "./quota.js";
 // Findings from a failed attempt are still emitted: the pipeline deduplicates
 // by fingerprint, so a retry on the next model cannot double-report them.
@@ -21,8 +21,16 @@ export async function* withFailback(options) {
                     return;
             }
             yield { type: "progress", taskId, message: `reviewing with ${model}` };
-            const outcome = await options.attempt(model);
-            yield { type: "usage", taskId, ...outcome.usage };
+            // Spend is reported while the attempt runs, so a run's spend limit
+            // can stop it; the finished attempt's total settles the rest.
+            const live = new LiveUsage();
+            const running = options.attempt(model, (spent) => live.observe(spent));
+            const finished = running.then(() => false, () => false);
+            while (await Promise.race([finished, live.changed().then(() => true)])) {
+                yield { type: "usage", taskId, ...live.take() };
+            }
+            const outcome = await running;
+            yield { type: "usage", taskId, ...live.rest(outcome.usage) };
             yield { type: "progress", taskId, message: attemptSummary(model, outcome) };
             for (const finding of outcome.findings)
                 yield { type: "finding", taskId, finding };
@@ -59,6 +67,56 @@ export async function* withFailback(options) {
         retryable: true,
     };
 }
+// Hands out what an attempt has spent in increments, each what grew since the
+// last one; `rest` settles the finished attempt's total, so the increments
+// add up to it and nothing is counted twice.
+export class LiveUsage {
+    seen = emptyUsage();
+    given = emptyUsage();
+    wake;
+    observe(spent) {
+        this.seen = larger(this.seen, spent);
+        if (ahead(this.seen, this.given)) {
+            this.wake?.();
+            this.wake = undefined;
+        }
+    }
+    // Resolves once more has been seen than handed out.
+    changed() {
+        if (ahead(this.seen, this.given))
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            this.wake = resolve;
+        });
+    }
+    take() {
+        const increment = beyond(this.seen, this.given);
+        this.given = this.seen;
+        return increment;
+    }
+    rest(total) {
+        const settled = larger(total, this.given);
+        const increment = beyond(settled, this.given);
+        this.given = settled;
+        return increment;
+    }
+}
+const FIELDS = [
+    "inputTokens",
+    "outputTokens",
+    "reasoningTokens",
+    "cachedTokens",
+    "costUsd",
+];
+function larger(a, b) {
+    return Object.fromEntries(FIELDS.map((f) => [f, Math.max(a[f], b[f])]));
+}
+function beyond(a, b) {
+    return Object.fromEntries(FIELDS.map((f) => [f, Math.max(0, a[f] - b[f])]));
+}
+function ahead(a, b) {
+    return FIELDS.some((f) => a[f] > b[f]);
+}
 // Which tools an attempt spent its steps on, and whether it finished: a
 // review that never called task_done was cut off, usually by the step cap.
 function attemptSummary(model, outcome) {

package/dist/opencode-server.d.ts

@@ -6,6 +6,7 @@ export interface OpencodeServer {
 }
 export interface StartOptions {
     binary: string;
+    cwd: string;
     env: Record<string, string>;
     config: unknown;
     startupTimeoutMs?: number;

package/dist/opencode-server.js

@@ -6,6 +6,7 @@ export async function startOpencodeServer(options) {
     const port = await freePort();
     const password = randomBytes(24).toString("hex");
     const child = spawn(options.binary, ["serve", "--hostname=127.0.0.1", `--port=${port}`], {
+        cwd: options.cwd,
         env: {
             ...options.env,
             OPENCODE_CONFIG_CONTENT: JSON.stringify(options.config),

package/dist/runtime.d.ts

@@ -1,4 +1,4 @@
-import { type AgentEvent, type AgentRuntime, type AgentTaskSpec, type CompletionRequest, type CompletionResult, type RuntimeOptions } from "@open-cr-agent/core";
+import { type AgentEvent, type AgentRuntime, type AgentTaskSpec, type CompletionRequest, type CompletionResult, type CustomProvider, type RuntimeOptions } from "@open-cr-agent/core";
 import { type ToolServer } from "./tool-server.js";
 export declare const MCP_SERVER = "ocra";
 export declare const MAX_AGENT_STEPS = 30;
@@ -27,9 +27,29 @@ export declare class OpenCodeRuntime implements AgentRuntime {
     private start;
     private launch;
 }
-export declare function openCodeConfig(tools: Pick<ToolServer, "url" | "headers">, helperTools: Record<string, boolean>): {
+export declare function openCodeConfig(tools: Pick<ToolServer, "url" | "headers">, helperTools: Record<string, boolean>, custom?: Readonly<Record<string, CustomProvider>>): {
     share: string;
     autoupdate: boolean;
+    provider?: {
+        [k: string]: {
+            npm: string;
+            name: string;
+            options: {
+                baseURL: string;
+                apiKey?: string;
+            };
+            models: {
+                [k: string]: {
+                    name: string;
+                    cost: {
+                        input: number;
+                        output: number;
+                        cache_read?: number;
+                    };
+                };
+            };
+        };
+    };
     mcp: {
         ocra: {
             type: string;

package/dist/runtime.js

@@ -92,7 +92,7 @@ export class OpenCodeRuntime {
             chain,
             health: this.health,
             signal,
-            attempt: (model) => this.prompt(infra, {
+            attempt: (model, onUsage) => this.prompt(infra, {
                 title: `ocra ${spec.taskId}`,
                 agent: REVIEW_AGENT,
                 model,
@@ -100,7 +100,7 @@ export class OpenCodeRuntime {
                 user: spec.userPrompt,
                 tools: DISABLED_BUILTINS,
                 resume: REVIEW_RESUME,
-            }, signal),
+            }, signal, onUsage),
         });
     }
     async complete(request, signal) {
@@ -154,15 +154,16 @@ export class OpenCodeRuntime {
         await Promise.allSettled([infra.server.close(), infra.tools.close(), infra.dispatcher.close()]);
         await rm(infra.root, { recursive: true, force: true });
     }
-    prompt(infra, input, signal) {
-        return promptSession(infra.client.session, input, `${MCP_SERVER}_${REVIEW_TOOLS.reportFinding}`, signal);
+    prompt(infra, input, signal, onUsage) {
+        return promptSession(infra.client.session, input, `${MCP_SERVER}_${REVIEW_TOOLS.reportFinding}`, signal, onUsage ? { onUsage } : {});
     }
     start() {
         this.infra ??= this.launch();
         return this.infra;
     }
     async launch() {
-        const missing = missingCredentials(this.options.env, providersOf(this.options.models));
+        const custom = this.options.providers ?? {};
+        const missing = missingCredentials(this.options.env, providersOf(this.options.models), custom);
         if (missing.length > 0)
             throw new Error(missing.join("; "));
         const root = await mkdtemp(join(tmpdir(), "ocra-opencode-"));
@@ -178,8 +179,9 @@ export class OpenCodeRuntime {
         try {
             const server = await startOpencodeServer({
                 binary: this.options.binary ?? resolveOpencodeBinary(this.options.env),
-                env: serverEnv(this.options.env, dirs, providersOf(this.options.models)),
-                config: openCodeConfig(tools, this.helperTools),
+                cwd: workspace,
+                env: serverEnv(this.options.env, dirs, providersOf(this.options.models), custom),
+                config: openCodeConfig(tools, this.helperTools, custom),
             });
             started = server;
             const dispatcher = createUntimedDispatcher();
@@ -205,11 +207,12 @@ export class OpenCodeRuntime {
         }
     }
 }
-export function openCodeConfig(tools, helperTools) {
+export function openCodeConfig(tools, helperTools, custom = {}) {
     const permission = { edit: "deny", bash: "deny", webfetch: "deny", skill: "deny" };
     return {
         share: "disabled",
         autoupdate: false,
+        ...(Object.keys(custom).length > 0 ? { provider: providerConfig(custom) } : {}),
         mcp: {
             [MCP_SERVER]: {
                 type: "remote",
@@ -237,6 +240,35 @@ export function openCodeConfig(tools, helperTools) {
         },
     };
 }
+// OpenCode's form of a provider declared in configuration. OpenCode bundles
+// the OpenAI-compatible client, so nothing is installed to reach it
+// (docs/spikes/0002). The key stays in the environment: OpenCode reads
+// {env:NAME} itself, and the configuration, which OpenCode may log, never
+// holds it. Prices are per million tokens, as OpenCode's catalog has them.
+function providerConfig(custom) {
+    return Object.fromEntries(Object.entries(custom).map(([id, provider]) => [
+        id,
+        {
+            npm: "@ai-sdk/openai-compatible",
+            name: id,
+            options: {
+                baseURL: provider.baseUrl,
+                ...(provider.apiKeyEnv ? { apiKey: `{env:${provider.apiKeyEnv}}` } : {}),
+            },
+            models: Object.fromEntries(Object.entries(provider.models).map(([model, price]) => [
+                model,
+                {
+                    name: model,
+                    cost: {
+                        input: price.input,
+                        output: price.output,
+                        ...(price.cachedInput === undefined ? {} : { cache_read: price.cachedInput }),
+                    },
+                },
+            ])),
+        },
+    ]));
+}
 function providersOf(models) {
     return Object.values(models).flatMap((chain) => (chain ?? []).map((m) => parseModel(m).providerID));
 }

package/dist/server-env.d.ts

@@ -1,10 +1,12 @@
-import type { Env } from "@open-cr-agent/core";
+import type { CustomProvider, Env } from "@open-cr-agent/core";
 export interface IsolatedDirs {
     config: string;
     data: string;
     state: string;
 }
-export declare function missingCredentials(base: Env, providers: readonly string[]): string[];
+type CustomProviders = Readonly<Record<string, CustomProvider>>;
+export declare function missingCredentials(base: Env, providers: readonly string[], custom?: CustomProviders): string[];
 export declare const EXTRA_ENV_VARIABLE = "OCRA_RUNTIME_ENV";
-export declare function serverEnv(base: Env, dirs: IsolatedDirs, providers: readonly string[]): Record<string, string>;
+export declare function serverEnv(base: Env, dirs: IsolatedDirs, providers: readonly string[], custom?: CustomProviders): Record<string, string>;
+export {};
 //# sourceMappingURL=server-env.d.ts.map

package/dist/server-env.js

@@ -73,8 +73,13 @@ const REQUIRED_KEYS = {
     xai: ["XAI_API_KEY"],
     azure: ["AZURE_API_KEY"],
 };
-export function missingCredentials(base, providers) {
+export function missingCredentials(base, providers, custom = {}) {
     return [...new Set(providers)].flatMap((provider) => {
+        const declared = custom[provider];
+        if (declared) {
+            const name = declared.apiKeyEnv;
+            return name && !base[name] ? [`No API key for provider "${provider}": set ${name}`] : [];
+        }
         const names = REQUIRED_KEYS[provider];
         if (!names || names.some((name) => base[name]))
             return [];
@@ -84,14 +89,28 @@ export function missingCredentials(base, providers) {
 const GOOGLE_KEY = "GOOGLE_GENERATIVE_AI_API_KEY";
 const GOOGLE_KEY_ALIASES = ["GEMINI_API_KEY", "GOOGLE_API_KEY"];
 export const EXTRA_ENV_VARIABLE = "OCRA_RUNTIME_ENV";
-// A model chain naming a provider such as "github" or "aws" must not carry
-// the CI's or the cloud's credentials across by prefix; name them in
+// OpenCode installs its plugin package from npm into every config directory
+// when it starts, and the SDK of a provider it does not bundle when a model
+// first uses it; no flag turns either off. ocra loads no OpenCode plugins and
+// supports only bundled providers, so both installs get the discard port on
+// this machine as their registry, and no retries: they fail at once, no code
+// is fetched at review time and no .npmrc token is sent (docs/spikes/0002).
+const NPM_SETTINGS = {
+    npm_config_registry: "http://127.0.0.1:9/",
+    NPM_CONFIG_REGISTRY: "http://127.0.0.1:9/",
+    npm_config_fetch_retries: "0",
+};
+// A model chain naming a provider such as "github", "gitlab" or "aws" must
+// not carry the CI's or the cloud's credentials across by prefix (GitLab CI
+// puts CI_JOB_TOKEN and CI_REGISTRY_PASSWORD in every job); name them in
 // OCRA_RUNTIME_ENV when they are really meant for a provider.
 const NEVER_BY_PREFIX = [
     "GITHUB_",
     "GH_",
     "ACTIONS_",
     "RUNNER_",
+    "GITLAB_",
+    "CI_",
     "AWS_",
     "AZURE_",
     "NPM_",
@@ -99,9 +118,10 @@ const NEVER_BY_PREFIX = [
     "OCRA_",
 ];
 // The child sees only what it needs: system basics, the credentials of the
-// providers in the configured model chains, and names listed in
+// providers in the configured model chains (for a provider declared in
+// configuration, only the variable it names), and names listed in
 // OCRA_RUNTIME_ENV. Other secrets in the user's shell never reach it.
-export function serverEnv(base, dirs, providers) {
+export function serverEnv(base, dirs, providers, custom = {}) {
     const env = {};
     const copy = (name) => {
         const value = base[name];
@@ -114,6 +134,12 @@ export function serverEnv(base, dirs, providers) {
         if (name.startsWith("LC_"))
             copy(name);
     for (const provider of new Set(providers)) {
+        const declared = custom[provider];
+        if (declared) {
+            if (declared.apiKeyEnv)
+                copy(declared.apiKeyEnv);
+            continue;
+        }
         const known = PROVIDER_VARIABLES[provider];
         if (known) {
             for (const name of known)
@@ -132,13 +158,14 @@ export function serverEnv(base, dirs, providers) {
         if (name.trim() !== "")
             copy(name.trim());
     }
-    if (providers.includes("google") && !env[GOOGLE_KEY]) {
+    if (providers.includes("google") && !custom.google && !env[GOOGLE_KEY]) {
         const alias = GOOGLE_KEY_ALIASES.map((name) => base[name]).find((value) => value);
         if (alias)
             env[GOOGLE_KEY] = alias;
     }
     for (const flag of ISOLATION_FLAGS)
         env[flag] = "1";
+    Object.assign(env, NPM_SETTINGS);
     env.OPENCODE_CONFIG_DIR = dirs.config;
     env.XDG_CONFIG_HOME = dirs.config;
     env.XDG_DATA_HOME = dirs.data;

package/dist/session-outcome.d.ts

@@ -45,4 +45,5 @@ export interface SessionOutcome {
     };
 }
 export declare function summarizeSession(messages: readonly SessionMessage[], reportTool: string): SessionOutcome;
+export declare function sessionUsage(messages: readonly SessionMessage[]): Usage;
 //# sourceMappingURL=session-outcome.d.ts.map

package/dist/session-outcome.js

@@ -14,13 +14,7 @@ export function summarizeSession(messages, reportTool) {
             .flatMap((m) => m.parts.filter((p) => p.type === "text").map((p) => p.text ?? ""))
             .join("\n")
             .trim(),
-        usage: {
-            inputTokens: sum(assistant, (m) => m.info.tokens?.input),
-            outputTokens: sum(assistant, (m) => m.info.tokens?.output),
-            reasoningTokens: sum(assistant, (m) => m.info.tokens?.reasoning),
-            cachedTokens: sum(assistant, (m) => m.info.tokens?.cache?.read),
-            costUsd: sum(assistant, (m) => m.info.cost),
-        },
+        usage: sessionUsage(messages),
     };
     const errors = assistant.flatMap((m) => (m.info.error ? [m.info.error] : []));
     const last = errors.at(-1);
@@ -36,6 +30,18 @@ export function summarizeSession(messages, reportTool) {
     }
     return outcome;
 }
+// Every finished step carries its tokens and cost, so this grows while the
+// session runs.
+export function sessionUsage(messages) {
+    const assistant = messages.filter((m) => m.info.role === "assistant");
+    return {
+        inputTokens: sum(assistant, (m) => m.info.tokens?.input),
+        outputTokens: sum(assistant, (m) => m.info.tokens?.output),
+        reasoningTokens: sum(assistant, (m) => m.info.tokens?.reasoning),
+        cachedTokens: sum(assistant, (m) => m.info.tokens?.cache?.read),
+        costUsd: sum(assistant, (m) => m.info.cost),
+    };
+}
 function isAuthError(error) {
     return (error.name === "ProviderAuthError" ||
         AUTH_STATUS.has(error.data?.statusCode ?? 0) ||

package/dist/session-prompt.d.ts

@@ -1,11 +1,13 @@
+import { type Usage } from "@open-cr-agent/core";
 import type { OpencodeClient } from "@opencode-ai/sdk/v2";
 import { type SessionMessage, type SessionOutcome } from "./session-outcome.js";
 export declare const HARVEST_TIMEOUT_MS = 5000;
 export declare const INACTIVITY_MS: number;
-export declare const ACTIVITY_POLL_MS = 30000;
+export declare const ACTIVITY_POLL_MS = 10000;
 export interface ActivityOptions {
     inactivityMs?: number;
     pollMs?: number;
+    onUsage?: (spent: Usage) => void;
 }
 export interface PromptInput {
     title: string;

package/dist/session-prompt.js

@@ -1,6 +1,6 @@
 import { emptyUsage, errorMessage } from "@open-cr-agent/core";
 import { parseModel } from "./models.js";
-import { summarizeSession } from "./session-outcome.js";
+import { sessionUsage, summarizeSession, } from "./session-outcome.js";
 // A session that was cut off has still spent tokens and may have reported
 // findings; this bounds the one extra request that collects them.
 export const HARVEST_TIMEOUT_MS = 5_000;
@@ -10,7 +10,10 @@ export const HARVEST_TIMEOUT_MS = 5_000;
 // stopped and the task moves to the next model instead of waiting for its
 // full timeout. Generous, so a slow step that is still writing survives.
 export const INACTIVITY_MS = 5 * 60_000;
-export const ACTIVITY_POLL_MS = 30_000;
+// Each poll also reports what the session has spent, and a run's spend limit
+// stops running tasks on those reports: this bounds how far past the limit a
+// task can get before it is stopped.
+export const ACTIVITY_POLL_MS = 10_000;
 // About one review attempt in twelve on Gemini ended after a step or two
 // with no text, no done tool and steps to spare (2026-09-28), and the task
 // counted as completed with its files unread. Continuing the same session
@@ -110,13 +113,22 @@ function watchActivity(session, sessionID, options) {
     let last = "";
     let changedAt = Date.now();
     let polling = false;
+    let reported = emptyUsage();
     const timer = setInterval(async () => {
         if (polling)
             return;
         polling = true;
         try {
             const messages = await session.messages({ sessionID }, { signal: AbortSignal.timeout(HARVEST_TIMEOUT_MS) });
-            const now = activitySignature((messages.data ?? []));
+            const list = (messages.data ?? []);
+            if (options.onUsage) {
+                const spent = sessionUsage(list);
+                if (spent.costUsd > reported.costUsd || spent.inputTokens > reported.inputTokens) {
+                    reported = spent;
+                    options.onUsage(spent);
+                }
+            }
+            const now = activitySignature(list);
             if (now !== last) {
                 last = now;
                 changedAt = Date.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-cr-agent/runtime-opencode",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "OpenCode-based agent runtime for Open-CR-Agent",
   "keywords": [
     "code-review",
@@ -31,7 +31,7 @@
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "@open-cr-agent/core": "0.1.1",
+    "@open-cr-agent/core": "0.2.0",
     "@opencode-ai/sdk": "1.18.32",
     "opencode-ai": "1.18.32",
     "undici": "^8.11.2",