@open-cr-agent/vcs-platform 0.1.2

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,3 @@
+# @open-cr-agent/vcs-platform
+
+What the code review platform adapters of [Open-CR-Agent](https://github.com/jma49/Open-CR-Agent), the multi-agent code reviewer, share: the summary comment and the review state it carries, the text of inline comments, and the rules for who may override, dismiss or answer ocra. Most users want [`@open-cr-agent/cli`](https://www.npmjs.com/package/@open-cr-agent/cli), which provides the `ocra` command and installs this package; see the [manual](https://ocra.majincheng.com). All `@open-cr-agent` packages are released together at one version. Apache-2.0.

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./platform.js";
+export * from "./render.js";
+export * from "./retry.js";
+export * from "./review.js";
+export * from "./state.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from "./platform.js";
+export * from "./render.js";
+export * from "./retry.js";
+export * from "./review.js";
+export * from "./state.js";
+//# sourceMappingURL=index.js.map

package/dist/platform.d.ts

@@ -0,0 +1,53 @@
+import type { Finding, ReviewReport } from "@open-cr-agent/core";
+import type { PlatformText } from "./render.js";
+export interface ReviewPlatform {
+    readonly text: PlatformText;
+    bot(): Promise<Bot>;
+    changeRequest(): Promise<PlatformChangeRequest>;
+    comments(): Promise<PlatformComment[]>;
+    editor(comment: PlatformComment): Promise<string | undefined>;
+    canWrite(login: string): Promise<boolean>;
+    threads(): Promise<PlatformThread[]>;
+    publishFindings(report: ReviewReport, fresh: readonly InlineFinding[]): Promise<PublishedFindings>;
+    writeSummary(existing: PlatformComment | undefined, body: string): Promise<void>;
+    resolveThread(id: string): Promise<void>;
+}
+export interface Bot {
+    login: string;
+    is(login: string): boolean;
+}
+export interface PlatformChangeRequest {
+    id: string;
+    title: string;
+    description: string;
+    baseSha: string;
+    headSha: string;
+    author?: string;
+}
+export interface PlatformComment {
+    id: string;
+    author?: string;
+    body: string;
+}
+export interface PlatformThread {
+    id: string;
+    resolved: boolean;
+    resolvedBy?: string;
+    comments: {
+        author: string;
+        body: string;
+        editor?: string;
+    }[];
+}
+export interface InlineFinding {
+    finding: Finding & {
+        lineRange: NonNullable<Finding["lineRange"]>;
+    };
+    body: string;
+}
+export interface PublishedFindings {
+    posted: string[];
+    warnings: string[];
+    finish?: () => Promise<string[]>;
+}
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=platform.js.map

package/dist/render.d.ts

@@ -0,0 +1,19 @@
+import { type Finding, type ReviewReport } from "@open-cr-agent/core";
+import { type ReviewState } from "./state.js";
+export interface PlatformText {
+    changeRequest: string;
+    authority: string;
+}
+export declare function safeMarkdown(text: string): string;
+export declare function codeSpan(text: string): string;
+export declare const FINDING_MARKER: RegExp;
+export declare function inlineBody(f: Finding): string;
+export interface SummaryInput {
+    report: ReviewReport;
+    commented: ReadonlySet<string>;
+    state: ReviewState;
+    text: PlatformText;
+    unattributed?: number;
+}
+export declare function renderSummary({ report, commented, state, text, unattributed, }: SummaryInput): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.js

@@ -0,0 +1,201 @@
+import { coverageGaps, } from "@open-cr-agent/core";
+import { SUMMARY_MARKER, writeState } from "./state.js";
+// GitHub rejects comments over 65,536 characters; GitLab takes 1,000,000,
+// but a summary that long is no use to anyone.
+const MAX_SUMMARY_CHARS = 65_000;
+const ICON = { critical: "🔴", warning: "🟠", suggestion: "🔵" };
+const VERIFICATION = {
+    confirmed: "verified",
+    uncertain: "unverified (verifier unsure)",
+    unchecked: "not verified",
+};
+// A run that reviewed nothing has no verdict to announce, and one that missed
+// files or could not verify a critical finding says so next to its verdict.
+function headline(report) {
+    const { notReviewed, nothingReviewed } = coverageGaps(report);
+    if (nothingReviewed)
+        return "⏸️ Not reviewed";
+    const incomplete = notReviewed > 0 || report.unverifiedCriticals > 0;
+    const overridden = report.verdict === "significant_concerns" && report.changeRequest.override
+        ? " · overridden"
+        : "";
+    return `${VERDICT[report.verdict]}${overridden}${incomplete ? " · incomplete" : ""}`;
+}
+// Who overrode a blocking verdict, or how someone entitled to can.
+function overrideNote(report, text) {
+    if (report.verdict !== "significant_concerns")
+        return [];
+    const override = report.changeRequest.override;
+    if (override) {
+        return [
+            "",
+            `**Overridden** by @\u200b${safeMarkdown(override.by)} for ${codeSpan(report.changeRequest.headSha.slice(0, 7))}: ${safeMarkdown(override.reason)}`,
+        ];
+    }
+    return [
+        "",
+        `Someone with ${text.authority} other than the author can let this commit pass by commenting \`/ocra override ${report.changeRequest.headSha} <reason>\`.`,
+    ];
+}
+function spendLimitNote(report) {
+    const limit = report.spendLimit;
+    if (!limit)
+        return "";
+    return ` of a $${limit.usd} limit${limit.reached ? ", reached" : ""}`;
+}
+function verification(f) {
+    return VERIFICATION[f.verification ?? "unchecked"];
+}
+const VERDICT = {
+    approved: "✅ Approved",
+    approved_with_comments: "💬 Approved with comments",
+    minor_issues: "⚠️ Minor issues",
+    significant_concerns: "🛑 Significant concerns",
+};
+// Model text is untrusted: it may not close our markup, mention people,
+// pull in images, spell one of ocra's commands (`/ocra …`, which would count
+// if ocra posted as a person with write access), start a line with a slash
+// (GitLab runs a line such as `/merge` or `/approve` in a comment as a quick
+// action, with the rights of the token that posted it), or become a link at
+// all. A pull request can plant an address for a reviewer to repeat (the
+// adversarial probe saw one), and a bot comment lends it credibility.
+// Character references get a zero-width space after their `&` and stay as
+// typed, since both platforms look for mentions after decoding them
+// (`&#64;all`); unlike `&amp;`, it keeps `&lt;` quoted in code readable.
+// Every `@` gets one too, which no mention survives (GitLab usernames may
+// start with `_` or `.`), nor an email address. Inline links lose their `](`,
+// and every `]:` is escaped, so no link reference definition (`[1]: https://…`)
+// can form, at line start or inside a blockquote or list item, and no
+// reference-style link (`[x][1]`, `[x][]`, `[1]`) has anything to resolve to.
+// Addresses of every scheme get a zero-width space after the colon (GitLab
+// links `smb://` and `vscode://` too), and `www.` one before its dot, so they
+// read the same and stay text.
+const CHARACTER_REFERENCE = /&(?=#\d{1,7};|#[xX][\da-fA-F]{1,6};|[A-Za-z][A-Za-z\d]{1,31};)/g;
+export function safeMarkdown(text) {
+    return text
+        .replace(CHARACTER_REFERENCE, "&\u200b")
+        .replaceAll("<!--", "&lt;!--")
+        .replace(/<\/?[a-zA-Z][^>]*>/g, (tag) => tag.replaceAll("<", "&lt;"))
+        .replaceAll("@", "@\u200b")
+        .replace(/!\[/g, "!\u200b[")
+        .replace(/\/(?=ocra)/gi, "/\u200b")
+        .replace(/^([ \t]*)\//gm, "$1\u200b/")
+        .replace(/:(?=\/\/)/g, ":\u200b")
+        .replace(/\bwww(?=\.)/gi, "www\u200b")
+        .replaceAll("](", "]\\(")
+        .replaceAll("]:", "]\\:");
+}
+// File paths come from the diff, so the author controls them: a backtick or
+// newline must not end the code span and let markup through, and angle
+// brackets must not form ocra's HTML-comment markers in the raw body.
+export function codeSpan(text) {
+    const safe = text
+        .replaceAll("`", "\u02cb")
+        .replace(/[\r\n]+/g, " ")
+        .replaceAll("<", "\u2039")
+        .replaceAll(">", "\u203a");
+    return `\`${safe}\``;
+}
+function location(f) {
+    if (!f.lineRange)
+        return codeSpan(f.file);
+    const { start, end } = f.lineRange;
+    return codeSpan(`${f.file}:${start === end ? start : `${start}-${end}`}`);
+}
+export const FINDING_MARKER = /<!-- ocra:finding ([0-9a-f]{16}) -->/;
+export function inlineBody(f) {
+    const parts = [
+        `<!-- ocra:finding ${f.fingerprint} -->`,
+        `${ICON[f.severity]} **${safeMarkdown(f.title)}** · ${f.severity} · ${verification(f)} · ${f.reviewer}${f.lowConfidence ? " · low confidence" : ""}`,
+        "",
+        safeMarkdown(f.body),
+    ];
+    if (f.suggestion)
+        parts.push("", `**Suggestion:** ${safeMarkdown(f.suggestion)}`);
+    return parts.join("\n");
+}
+export function renderSummary({ report, commented, state, text, unattributed = 0, }) {
+    const counts = ["critical", "warning", "suggestion"]
+        .map((s) => `${report.findings.filter((f) => f.severity === s).length} ${s}`)
+        .join(", ");
+    const lines = [
+        SUMMARY_MARKER,
+        `## ocra review · ${headline(report)}`,
+        "",
+        safeMarkdown(report.summary),
+        ...overrideNote(report, text),
+        "",
+        `**${report.findings.length} finding(s)** (${counts}) · risk tier \`${report.tier}\``,
+    ];
+    if (report.scope?.mode === "incremental") {
+        lines.push("", `Reviewed only what changed since ${codeSpan(report.scope.since.slice(0, 7))}.`);
+    }
+    else if (report.scope) {
+        lines.push("", `Reviewed every file again: ${safeMarkdown(report.scope.reason)}.`);
+    }
+    // Only true while no confirmed critical blocks, and low-confidence
+    // findings do not count at all.
+    const unverified = report.verdict === "significant_concerns"
+        ? 0
+        : report.findings.filter((f) => f.severity === "critical" && f.verification !== "confirmed" && !f.lowConfidence).length;
+    if (unverified > 0) {
+        lines.push("", `${unverified} critical finding(s) are not verified, so they cap the verdict at minor issues.`);
+    }
+    if (report.unverifiedCriticals > 0) {
+        lines.push("", `**Incomplete:** verification failed or ran out of budget for ${report.unverifiedCriticals} critical finding(s); check them yourself.`);
+    }
+    const { notReviewed } = coverageGaps(report);
+    if (notReviewed > 0) {
+        const limit = report.spendLimit?.reached
+            ? `; the spend limit of $${report.spendLimit.usd} was reached`
+            : "";
+        lines.push("", `**Incomplete:** ${notReviewed} selected file(s) were not reviewed${limit}. They are listed under Coverage and cost, and the next review of this ${text.changeRequest} includes them.`);
+    }
+    if (unattributed > 0) {
+        lines.push("", `${unattributed} resolved thread(s) of ocra's did not dismiss their finding: nothing says who resolved them, as when a push resolves outdated threads. To dismiss a finding, answer its thread with \`/ocra dismiss\` or "won't fix".`);
+    }
+    const inSummary = report.findings.filter((f) => !commented.has(f.fingerprint));
+    if (inSummary.length > 0) {
+        lines.push("", "### Findings outside the diff");
+        for (const f of inSummary) {
+            lines.push(`- ${ICON[f.severity]} ${location(f)} **${safeMarkdown(f.title)}** _(${verification(f)}${f.lowConfidence ? ", low confidence" : ""})_: ${safeMarkdown(f.body).replaceAll("\n", " ")}`);
+        }
+    }
+    if (report.remembered.length > 0) {
+        lines.push("", `${report.remembered.length} finding(s) matched \`.ocra/memory.json\` and are not repeated.`);
+    }
+    const rereview = report.rereview;
+    if (rereview && rereview.fixed.length > 0) {
+        lines.push("", "### Fixed since the last review");
+        for (const f of rereview.fixed)
+            lines.push(`- ~~${safeMarkdown(f.title)}~~ ${codeSpan(f.file)}`);
+    }
+    if (rereview && rereview.notReproduced.length > 0) {
+        lines.push("", "### Not reported this time, code unchanged", "", "Still open and counted in the verdict until the code changes or a reviewer dismisses them.", "");
+        for (const f of rereview.notReproduced)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    if (rereview && rereview.unchanged.length > 0) {
+        lines.push("", "### Still open in unchanged files", "", "Reported earlier in files not changed since; they count in the verdict.", "");
+        for (const f of rereview.unchanged)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    if (rereview && rereview.dismissed.length > 0) {
+        lines.push("", "### Dismissed by reviewers");
+        for (const f of rereview.dismissed)
+            lines.push(`- ${safeMarkdown(f.title)} ${codeSpan(f.file)}`);
+    }
+    if (rereview && rereview.notRechecked.length > 0) {
+        lines.push("", "### Not re-checked this time", "", "Their files were not reviewed in this run; they stay open and count in the verdict.", "");
+        for (const f of rereview.notRechecked)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    const failed = report.coverage.filter((c) => c.status === "failed" || c.status === "unreviewed");
+    const { costUsd, inputTokens, outputTokens } = report.usage;
+    lines.push("", "_The verdict is advice from language models that read the change itself, and can be swayed by text in it. Do not use it as a security gate._", "", "<details><summary>Coverage and cost</summary>", "", `${report.coverage.filter((c) => c.status === "reviewed").length} reviewed · ${report.coverage.filter((c) => c.status === "unchanged").length} unchanged since the last review · ${failed.length} not reviewed · ${report.coverage.filter((c) => c.status === "excluded").length} excluded · ${inputTokens} in / ${outputTokens} out tokens · $${costUsd.toFixed(4)}${spendLimitNote(report)}`, ...failed.map((c) => `- not reviewed: ${codeSpan(c.path)}`), "", "</details>");
+    const markdown = lines.join("\n");
+    const footer = `\n\n${writeState(state)}`;
+    const room = MAX_SUMMARY_CHARS - footer.length;
+    return ((markdown.length > room ? `${markdown.slice(0, room - 40)}\n\n…(truncated)` : markdown) + footer);
+}
+//# sourceMappingURL=render.js.map

package/dist/retry.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_ATTEMPTS = 3;
+export interface RetryDecision {
+    retry: boolean;
+    waitMs: number;
+}
+export declare function retryDecision(method: string, idempotent: boolean, outcome: {
+    status: number;
+    headers: Headers;
+    body: string;
+} | "network_error", attempt: number, now?: number): RetryDecision;
+//# sourceMappingURL=retry.d.ts.map

package/dist/retry.js

@@ -0,0 +1,40 @@
+// Platforms answer bursts with a rate limit (429 on both; GitHub also a 403
+// "secondary rate limit") and have short 5xx outages. One such answer during
+// publish used to throw away a paid review, so requests are retried a
+// bounded number of times.
+export const MAX_ATTEMPTS = 3;
+const MAX_WAIT_MS = 60_000;
+// A request the platform refused without acting on it (rate limits) can
+// always be repeated. A 5xx or a lost connection may have happened after the
+// platform acted, so only requests that are safe to repeat retry then: POST
+// would post the same comment or review twice.
+export function retryDecision(method, idempotent, outcome, attempt, now = Date.now()) {
+    const stop = { retry: false, waitMs: 0 };
+    if (attempt >= MAX_ATTEMPTS)
+        return stop;
+    const backoff = 1_000 * 2 ** (attempt - 1);
+    const safe = idempotent || method === "GET";
+    if (outcome === "network_error")
+        return safe ? { retry: true, waitMs: backoff } : stop;
+    const { status, headers, body } = outcome;
+    const rateLimited = status === 429 ||
+        (status === 403 &&
+            (headers.get("x-ratelimit-remaining") === "0" || /secondary rate limit/i.test(body)));
+    if (rateLimited)
+        return { retry: true, waitMs: rateLimitWait(headers, now) ?? backoff };
+    if (safe && status >= 500)
+        return { retry: true, waitMs: backoff };
+    return stop;
+}
+function rateLimitWait(headers, now) {
+    const after = Number(headers.get("retry-after"));
+    if (Number.isFinite(after) && after > 0)
+        return Math.min(after * 1_000, MAX_WAIT_MS);
+    // GitHub's header, then GitLab's; both carry epoch seconds.
+    const reset = Number(headers.get("x-ratelimit-reset") ?? headers.get("ratelimit-reset"));
+    if (Number.isFinite(reset) && reset > 0) {
+        return Math.min(Math.max(reset * 1_000 - now, 0), MAX_WAIT_MS);
+    }
+    return undefined;
+}
+//# sourceMappingURL=retry.js.map

package/dist/review.d.ts

@@ -0,0 +1,50 @@
+import { type ChangeRequest, type CodeMatch, type FileDiff, type PriorReview, type ReviewReport, type VcsAdapter } from "@open-cr-agent/core";
+import type { ReviewPlatform } from "./platform.js";
+export type CodeSource = Pick<VcsAdapter, "getDiff" | "readFile" | "searchCode">;
+export interface History {
+    filesChangedSince(from: string, to: string): Promise<{
+        files: string[];
+    } | {
+        reason: string;
+    }>;
+}
+export interface PlatformReviewOptions {
+    name: string;
+    platform: ReviewPlatform;
+    code: CodeSource;
+    history?: History;
+}
+export declare function declinesFinding(reply: string): boolean;
+export declare class PlatformReview implements VcsAdapter {
+    private readonly options;
+    readonly name: string;
+    private readonly platform;
+    private readonly memo;
+    private readonly writers;
+    constructor(options: PlatformReviewOptions);
+    getChangeRequest(): Promise<ChangeRequest>;
+    private override;
+    private unedited;
+    private canWrite;
+    getDiff(): Promise<FileDiff[]>;
+    readFile(path: string): Promise<string | undefined>;
+    searchCode(literal: string): Promise<CodeMatch[]>;
+    getPriorReview(): Promise<PriorReview | undefined>;
+    private priorState;
+    private changesSince;
+    private repliesByPeople;
+    publish(report: ReviewReport): Promise<{
+        warnings: string[];
+    }>;
+    private ownThreads;
+    private unattributedResolutions;
+    private resolveFixedThreads;
+    private lastEditor;
+    private summaryComment;
+    private bot;
+    private changeRequest;
+    private comments;
+    private threads;
+    private once;
+}
+//# sourceMappingURL=review.d.ts.map

package/dist/review.js

@@ -0,0 +1,368 @@
+import { errorMessage, } from "@open-cr-agent/core";
+import { FINDING_MARKER, inlineBody, renderSummary } from "./render.js";
+import { lostProgress, readState, SUMMARY_MARKER } from "./state.js";
+const OVERRIDE = /^\/ocra override ([0-9a-fA-F]{40}(?:[0-9a-fA-F]{24})?)\s+(\S.*)$/m;
+const MAX_OVERRIDE_REASON = 300;
+const MAX_REPLIES = 3;
+const MAX_REPLY_CHARS = 1_000;
+const DECLINE = /^(won['’]?t fix|wontfix|will not fix|by design|false positive|not a bug|working as intended|intended behaviou?r)(?=$|[\s.,;:!—–-])/i;
+const COMMAND = /^\/ocra dismiss\b/im;
+// A dismissal takes a clear decline: an explicit `/ocra dismiss`, or a reply
+// that opens with a decline and does not ask. Words anywhere else in a reply
+// ("this is not intended", "is this by design?", "acknowledged, will fix")
+// do not dismiss, since a dismissed finding leaves the verdict. Disagreement
+// ("I disagree") keeps the finding reported.
+export function declinesFinding(reply) {
+    if (COMMAND.test(reply))
+        return true;
+    const opening = reply
+        .trim()
+        .split(/(?<=[.!?])\s|\n/)[0]
+        ?.trim() ?? "";
+    return DECLINE.test(opening) && !opening.endsWith("?");
+}
+// The review conversation on a code review platform, the same on every one:
+// which earlier state and which comments count, who may override or dismiss,
+// and what gets posted. The platform only maps its API (ReviewPlatform).
+export class PlatformReview {
+    options;
+    name;
+    platform;
+    memo = new Map();
+    writers = new Map();
+    constructor(options) {
+        this.options = options;
+        this.name = options.name;
+        this.platform = options.platform;
+    }
+    async getChangeRequest() {
+        const cr = await this.changeRequest();
+        const override = await this.override(cr);
+        return {
+            id: cr.id,
+            title: cr.title,
+            description: cr.description,
+            baseSha: cr.baseSha,
+            headSha: cr.headSha,
+            ...(override ? { override } : {}),
+        };
+    }
+    // "Break glass": `/ocra override <commit> <reason>` from someone with
+    // write access other than the author lets a blocking verdict pass for that
+    // commit only, so a later push with new problems needs a new decision. The
+    // author can never overrule the review of their own change. Comments are
+    // best effort: without them there is simply no override.
+    async override(cr) {
+        const comments = await this.comments().catch(() => []);
+        const bot = await this.bot();
+        let found;
+        for (const c of comments) {
+            const login = c.author;
+            const match = OVERRIDE.exec(c.body);
+            if (!match || !login || login === cr.author || bot.is(login))
+                continue;
+            // ocra's own summary is never a command, whichever account posted it.
+            if (c.body.includes(SUMMARY_MARKER))
+                continue;
+            const [, commit = "", reason = ""] = match;
+            // The full commit id: a short prefix can be matched by a new commit.
+            if (commit.toLowerCase() !== cr.headSha)
+                continue;
+            if (!(await this.unedited(c, login)) || !(await this.canWrite(login)))
+                continue;
+            found = { by: login, reason: reason.trim().slice(0, MAX_OVERRIDE_REASON) };
+        }
+        return found;
+    }
+    // Anyone with write access can edit anyone's comment, and the platform
+    // keeps showing the original author: a command counts only when nobody
+    // else edited it. Unknown means no.
+    async unedited(comment, login) {
+        try {
+            const editor = await this.platform.editor(comment);
+            return editor === undefined || editor === login;
+        }
+        catch {
+            return false;
+        }
+    }
+    // Write access from the platform, memoized per login; a failed lookup
+    // means no.
+    canWrite(login) {
+        let known = this.writers.get(login);
+        if (!known) {
+            known = this.platform.canWrite(login).catch(() => false);
+            this.writers.set(login, known);
+        }
+        return known;
+    }
+    getDiff() {
+        return this.options.code.getDiff();
+    }
+    readFile(path) {
+        return this.options.code.readFile(path);
+    }
+    searchCode(literal) {
+        return this.options.code.searchCode(literal);
+    }
+    async getPriorReview() {
+        const prior = await this.priorState();
+        if ("untrusted" in prior)
+            return { findings: [], fullReviewReason: prior.untrusted };
+        const { state } = prior;
+        if (!state)
+            return undefined;
+        const { dismissed, replies } = await this.repliesByPeople(state.findings);
+        return {
+            findings: state.findings.map((f) => dismissed.has(f.fingerprint) ? { ...f, dismissed: true } : f),
+            ...(await this.changesSince(state)),
+            ...(state.tier ? { tier: state.tier } : {}),
+            ...(Object.keys(replies).length > 0 ? { replies } : {}),
+        };
+    }
+    // Anyone with write access can edit the summary comment, including a
+    // change request's author. Every part of the state is then suspect: a head
+    // skips their next changes, a `commented` flag hides a finding from both
+    // the inline comments and the summary. So the state counts only when ocra
+    // was the last to edit the comment; otherwise the run starts over.
+    priorState() {
+        return this.once("prior", async () => {
+            const comment = await this.summaryComment();
+            const state = comment ? readState(comment.body) : undefined;
+            if (!comment || !state)
+                return {};
+            const editor = await this.lastEditor(comment);
+            if (editor === undefined) {
+                return { untrusted: "could not check who last edited the previous review's summary" };
+            }
+            if (!(await this.bot()).is(editor)) {
+                return { untrusted: "the previous review's summary was edited by someone else" };
+            }
+            return { state };
+        });
+    }
+    async changesSince(state) {
+        const { history } = this.options;
+        if (!state.head)
+            return { fullReviewReason: "the previous review did not record its commit" };
+        if (!history)
+            return { fullReviewReason: "no repository history to compare with" };
+        const head = (await this.changeRequest()).headSha;
+        const changed = await history.filesChangedSince(state.head, head);
+        if ("reason" in changed)
+            return { fullReviewReason: changed.reason };
+        return {
+            changedSince: {
+                head: state.head,
+                files: [...new Set([...changed.files, ...(state.pending ?? [])])],
+            },
+        };
+    }
+    // A thread of ocra's that a reviewer resolved, or answered with a clear
+    // "won't fix", dismisses its finding. A reviewer is someone with write
+    // access other than the change request's author, in a comment nobody else
+    // edited: otherwise the author could resolve or argue a finding away. Any
+    // other reply from a reviewer dismisses nothing, but the judge weighs it
+    // when the finding comes back (and cannot drop a confirmed critical for
+    // it). Replies are collected for every thread of ocra's, not only tracked
+    // findings, so a finding a reply argued away does not return without it.
+    // Thread data is best effort: without it nothing is dismissed or replied.
+    async repliesByPeople(findings) {
+        const commented = new Set(findings.filter((f) => f.commented).map((f) => f.fingerprint));
+        const author = (await this.changeRequest()).author;
+        const bot = await this.bot();
+        const reviewer = async (login) => login !== undefined && login !== author && !bot.is(login) && (await this.canWrite(login));
+        const threads = await this.threads().catch(() => []);
+        const dismissed = new Set();
+        const replies = {};
+        for (const thread of threads) {
+            const fingerprint = findingOf(thread, bot);
+            if (!fingerprint)
+                continue;
+            const said = [];
+            let declined = false;
+            for (const r of thread.comments.slice(1)) {
+                const own = r.editor === undefined || r.editor === r.author;
+                if (!own || !(await reviewer(r.author)))
+                    continue;
+                if (declinesFinding(r.body))
+                    declined = true;
+                else if (r.body.trim() !== "")
+                    said.push(r.body.trim().slice(0, MAX_REPLY_CHARS));
+            }
+            if (commented.has(fingerprint)) {
+                const resolved = thread.resolved && (await reviewer(thread.resolvedBy));
+                if (resolved || declined) {
+                    dismissed.add(fingerprint);
+                    continue;
+                }
+            }
+            if (said.length > 0)
+                replies[fingerprint] = said.slice(-MAX_REPLIES);
+        }
+        return { dismissed, replies };
+    }
+    async publish(report) {
+        const previous = await this.summaryComment();
+        const prior = await this.priorState();
+        const trusted = "state" in prior ? prior.state : undefined;
+        const before = trusted?.findings ?? [];
+        const alreadyCommented = new Set([
+            ...before.filter((f) => f.commented).map((f) => f.fingerprint),
+            ...(trusted?.posted ?? []),
+            ...(await this.ownThreads()),
+        ]);
+        const fresh = report.findings.flatMap((f) => {
+            if (alreadyCommented.has(f.fingerprint) || !f.lineRange || !f.anchor.inDiff)
+                return [];
+            return [{ finding: { ...f, lineRange: f.lineRange }, body: inlineBody(f) }];
+        });
+        const published = await this.platform.publishFindings(report, fresh);
+        const commented = new Set([...alreadyCommented, ...published.posted]);
+        const current = new Set(report.findings.map((f) => f.fingerprint));
+        const rereview = report.rereview;
+        const quiet = [
+            ...(rereview?.notReproduced ?? []),
+            ...(rereview?.notRechecked ?? []),
+            ...(rereview?.unchanged ?? []),
+            ...(rereview?.dismissed ?? []),
+        ];
+        // Low-confidence findings (--ultra) are shown, not counted; stored as
+        // ordinary findings they would count on the next push.
+        const state = [
+            ...report.findings
+                .filter((f) => !f.lowConfidence)
+                .map((f) => ({
+                fingerprint: f.fingerprint,
+                title: f.title,
+                file: f.file,
+                severity: f.severity,
+                commented: commented.has(f.fingerprint),
+                ...(f.quote ? { quote: f.quote } : {}),
+                ...(f.verification ? { verification: f.verification } : {}),
+            })),
+            ...quiet.filter((f) => !current.has(f.fingerprint)),
+        ];
+        const pending = report.coverage
+            .filter((c) => c.status === "failed" || c.status === "unreviewed")
+            .map((c) => c.path);
+        const tracked = new Set(state.map((f) => f.fingerprint));
+        const untracked = [...commented].filter((fp) => !tracked.has(fp));
+        const unattributed = await this.unattributedResolutions(current);
+        const body = renderSummary({
+            report,
+            commented,
+            state: {
+                findings: state,
+                head: report.changeRequest.headSha,
+                pending,
+                tier: report.tier,
+                ...(untracked.length > 0 ? { posted: untracked } : {}),
+            },
+            text: this.platform.text,
+            unattributed,
+        });
+        await this.platform.writeSummary(previous, body);
+        const lost = lostProgress(body, pending.length);
+        return {
+            warnings: [
+                ...(lost ? [lost] : []),
+                ...published.warnings,
+                ...((await published.finish?.()) ?? []),
+                ...(await this.resolveFixedThreads(report)),
+            ],
+        };
+    }
+    // Findings ocra already commented on inline, from its own threads, so a
+    // run that stopped between posting them and writing the summary, or a
+    // summary whose state no longer counts, does not post them twice.
+    async ownThreads() {
+        const bot = await this.bot();
+        const threads = await this.threads().catch(() => []);
+        return threads.flatMap((thread) => findingOf(thread, bot) ?? []);
+    }
+    // Findings still reported whose thread was resolved without saying by
+    // whom: that resolution dismissed nothing, and the summary says why.
+    async unattributedResolutions(current) {
+        const bot = await this.bot();
+        const threads = await this.threads().catch(() => []);
+        return threads.filter((thread) => {
+            const fingerprint = findingOf(thread, bot);
+            return (thread.resolved &&
+                thread.resolvedBy === undefined &&
+                fingerprint !== undefined &&
+                current.has(fingerprint));
+        }).length;
+    }
+    // Resolving threads is a courtesy: the summary already lists what was
+    // fixed, so a failure here is a warning, not a failed publish.
+    async resolveFixedThreads(report) {
+        const fixed = new Set((report.rereview?.fixed ?? []).filter((f) => f.commented).map((f) => f.fingerprint));
+        if (fixed.size === 0)
+            return [];
+        try {
+            const bot = await this.bot();
+            for (const thread of await this.threads()) {
+                const fingerprint = findingOf(thread, bot);
+                if (thread.resolved || !fingerprint || !fixed.has(fingerprint))
+                    continue;
+                await this.platform.resolveThread(thread.id);
+            }
+            return [];
+        }
+        catch (error) {
+            return [`could not resolve the threads of fixed findings: ${errorMessage(error)}`];
+        }
+    }
+    // The account that last edited the comment (ocra itself when nobody did),
+    // or undefined when that cannot be told.
+    async lastEditor(comment) {
+        try {
+            return (await this.platform.editor(comment)) ?? (await this.bot()).login;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // The last summary ocra posted: by the account's exact login, never by a
+    // look-alike, since a comment counted as ocra's is trusted when unedited.
+    summaryComment() {
+        return this.once("summary", async () => {
+            const bot = await this.bot();
+            return (await this.comments()).findLast((c) => c.author === bot.login && c.body.includes(SUMMARY_MARKER));
+        });
+    }
+    bot() {
+        return this.once("bot", () => this.platform.bot());
+    }
+    changeRequest() {
+        return this.once("changeRequest", () => this.platform.changeRequest());
+    }
+    comments() {
+        return this.once("comments", () => this.platform.comments());
+    }
+    threads() {
+        return this.once("threads", () => this.platform.threads());
+    }
+    // Platform data is read once per run: a second read could see a comment
+    // posted in between and disagree with the first.
+    once(key, load) {
+        let value = this.memo.get(key);
+        if (!value) {
+            value = load();
+            this.memo.set(key, value);
+        }
+        return value;
+    }
+}
+// The finding a thread of ocra's is about: its first comment is ocra's, with
+// a marker, and nobody else edited it. An edited marker could point a
+// reviewer's resolution or reply at another finding, or hide one.
+function findingOf(thread, bot) {
+    const first = thread.comments[0];
+    const fingerprint = first && FINDING_MARKER.exec(first.body)?.[1];
+    if (!first || !fingerprint || !bot.is(first.author))
+        return undefined;
+    return first.editor === undefined || bot.is(first.editor) ? fingerprint : undefined;
+}
+//# sourceMappingURL=review.js.map

package/dist/state.d.ts

@@ -0,0 +1,15 @@
+import type { PriorFinding } from "@open-cr-agent/core";
+import { type RiskTier } from "@open-cr-agent/core";
+export declare const SUMMARY_MARKER = "<!-- ocra:review -->";
+export declare const MAX_WRITTEN_STATE_CHARS = 30000;
+export interface ReviewState {
+    findings: PriorFinding[];
+    head?: string;
+    pending?: string[];
+    posted?: string[];
+    tier?: RiskTier;
+}
+export declare function readState(body: string): ReviewState | undefined;
+export declare function writeState(state: ReviewState): string;
+export declare function lostProgress(body: string, pending: number): string | undefined;
+//# sourceMappingURL=state.d.ts.map

package/dist/state.js

@@ -0,0 +1,120 @@
+import { RISK_TIERS, severitySchema, verificationSchema } from "@open-cr-agent/core";
+import { z } from "zod";
+export const SUMMARY_MARKER = "<!-- ocra:review -->";
+// Only a state block that ends the comment counts: author-controlled text
+// (file paths, titles) is printed above it and must not be able to plant one.
+const STATE_PATTERN = /<!-- ocra:state v1 ([A-Za-z0-9+/=]+) -->\s*$/;
+const MAX_STATE_FINDINGS = 500;
+const MAX_STATE_CHARS = 60_000;
+// Written states stay well under what is read, so the summary text keeps room
+// in GitHub's 65,536-character comment limit.
+export const MAX_WRITTEN_STATE_CHARS = 30_000;
+const MAX_PENDING_FILES = 1_000;
+const MAX_POSTED = 1_000;
+const SHA = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const stateSchema = z.object({
+    findings: z
+        .array(z.object({
+        fingerprint: z.string().regex(/^[0-9a-f]{16}$/),
+        title: z.string().max(300),
+        file: z.string().max(1_000),
+        severity: severitySchema,
+        commented: z.boolean(),
+        quote: z
+            .object({
+            lines: z.number().int().positive().max(1_000),
+            hash: z.string().regex(/^[0-9a-f]{16}$/),
+        })
+            .optional(),
+        verification: verificationSchema.optional(),
+    }))
+        .max(MAX_STATE_FINDINGS),
+    head: z.string().regex(SHA).optional(),
+    pending: z.array(z.string().max(1_000)).max(MAX_PENDING_FILES).optional(),
+    posted: z
+        .array(z.string().regex(/^[0-9a-f]{16}$/))
+        .max(MAX_POSTED)
+        .optional(),
+    tier: z.enum(RISK_TIERS).optional(),
+});
+// The state lives in a comment anyone with write access can edit, so it is
+// validated and bounded, and the adapter ignores it when someone other than
+// ocra edited the comment. Dismissals are never stored: they are recomputed
+// from review threads on every run.
+export function readState(body) {
+    const encoded = STATE_PATTERN.exec(body)?.[1];
+    if (!encoded || encoded.length > MAX_STATE_CHARS)
+        return undefined;
+    try {
+        const parsed = stateSchema.safeParse(JSON.parse(Buffer.from(encoded, "base64").toString("utf8")));
+        if (!parsed.success)
+            return undefined;
+        const { head, pending, posted, tier } = parsed.data;
+        return {
+            findings: parsed.data.findings.map(({ quote, verification, ...finding }) => ({
+                ...finding,
+                ...(quote ? { quote } : {}),
+                ...(verification ? { verification } : {}),
+            })),
+            ...(head ? { head } : {}),
+            ...(pending ? { pending } : {}),
+            ...(posted?.length ? { posted } : {}),
+            ...(tier ? { tier } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function writeState(state) {
+    const kept = state.findings.slice(0, MAX_STATE_FINDINGS).map((f) => ({
+        fingerprint: f.fingerprint,
+        title: f.title.slice(0, 300),
+        file: f.file.slice(0, 1_000),
+        severity: f.severity,
+        commented: f.commented,
+        ...(f.quote ? { quote: f.quote } : {}),
+        ...(f.verification ? { verification: f.verification } : {}),
+    }));
+    // Without the full list of unfinished files the next run could skip one of
+    // them, so a list that does not fit drops the head and forces a full review.
+    const pending = state.pending ?? [];
+    const scope = state.head && pending.length <= MAX_PENDING_FILES
+        ? {
+            head: state.head,
+            ...(pending.length > 0 ? { pending: pending.map((p) => p.slice(0, 1_000)) } : {}),
+        }
+        : {};
+    // Too large a state first loses its scope (a full review next time), then
+    // findings from the end of the list (this run's come first, most severe
+    // first); a dropped finding's inline comment may be posted again.
+    const extras = {
+        ...(state.posted?.length ? { posted: state.posted.slice(-MAX_POSTED) } : {}),
+        ...(state.tier ? { tier: state.tier } : {}),
+    };
+    let encoded = encode(kept, { ...scope, ...extras });
+    if (encoded.length > MAX_WRITTEN_STATE_CHARS)
+        encoded = encode(kept, extras);
+    if (encoded.length > MAX_WRITTEN_STATE_CHARS)
+        encoded = encode(kept, {});
+    let count = kept.length;
+    while (encoded.length > MAX_WRITTEN_STATE_CHARS && count > 0) {
+        count = Math.floor(count * 0.8);
+        encoded = encode(kept.slice(0, count), {});
+    }
+    return `<!-- ocra:state v1 ${encoded} -->`;
+}
+// A state too large for the comment loses its head and unfinished files
+// (writeState), so the next review starts over instead of continuing; the
+// warning for that, or undefined when the state in `body` kept its head.
+export function lostProgress(body, pending) {
+    const kept = readState(body);
+    if (!kept || kept.head !== undefined)
+        return undefined;
+    const files = pending > 0 ? ` with its ${pending} unfinished file(s)` : "";
+    return `the review state did not fit in the summary comment${files}: the next review of this pull request reviews every file again`;
+}
+function encode(findings, scope) {
+    return Buffer.from(JSON.stringify({ findings, ...scope }), "utf8").toString("base64");
+}
+//# sourceMappingURL=state.js.map

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@open-cr-agent/vcs-platform",
+  "version": "0.1.2",
+  "description": "What Open-CR-Agent's code review platform adapters share: the review summary, its state, and who may command ocra",
+  "keywords": [
+    "code-review",
+    "pull-request",
+    "merge-request"
+  ],
+  "license": "Apache-2.0",
+  "homepage": "https://ocra.majincheng.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jma49/Open-CR-Agent.git",
+    "directory": "packages/vcs-platform"
+  },
+  "bugs": "https://github.com/jma49/Open-CR-Agent/issues",
+  "engines": {
+    "node": ">=22.19"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "dependencies": {
+    "@open-cr-agent/core": "0.1.2",
+    "zod": "^4.6.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}