can-i-merge 0.1.1 → 0.2.0

package/dist/cli/index.js

@@ -10,10 +10,14 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
+import { clearProviderConfig, loadProviderConfig, saveProviderConfig } from "../config/index.js";
 import { NoChangesError, runReview } from "../core/index.js";
 import { isGitRepository } from "../git/index.js";
 import { ProviderRegistry } from "../provider/index.js";
 import { ClaudeProvider } from "../provider-anthropic/index.js";
+import { NvidiaProvider } from "../provider-nvidia/index.js";
+import { OllamaProvider } from "../provider-ollama/index.js";
+import { OpenAIProvider } from "../provider-openai/index.js";
 import { isMergeReady, reportConsole, reportJson } from "../reporter/index.js";
 import { colors } from "../shared/colors.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -31,6 +35,12 @@ const STAGE_MESSAGES = {
     context: "Building Context...",
     reviewing: "Reviewing...",
 };
+const PROVIDER_ENV_VARS = {
+    claude: { apiKey: "ANTHROPIC_API_KEY", model: "ANTHROPIC_MODEL" },
+    openai: { apiKey: "OPENAI_API_KEY", model: "OPENAI_MODEL" },
+    nvidia: { apiKey: "NVIDIA_API_KEY", model: "NVIDIA_MODEL" },
+    ollama: { apiKey: "OLLAMA_API_KEY", model: "OLLAMA_MODEL" },
+};
 function isReviewLevel(value) {
     return REVIEW_LEVELS.includes(value);
 }
@@ -40,6 +50,9 @@ function isReviewType(value) {
 function buildProviderRegistry() {
     const registry = new ProviderRegistry();
     registry.register("claude", (config) => new ClaudeProvider(config));
+    registry.register("openai", (config) => new OpenAIProvider(config));
+    registry.register("nvidia", (config) => new NvidiaProvider(config));
+    registry.register("ollama", (config) => new OllamaProvider(config));
     return registry;
 }
 export async function main(argv = process.argv) {
@@ -49,13 +62,21 @@ export async function main(argv = process.argv) {
         .description("AI-powered Git Review Pipeline with Intelligent Context Building")
         .version(pkg.version)
         .option("--commit <ref>", "review a specific commit instead of the staged index")
-        .option("--provider <name>", "AI provider to use", "claude")
+        .option("--provider <name>", "AI provider to use: claude, openai, nvidia, or ollama", "claude")
+        .option("--api-key <key>", "API key for the selected provider (saved encrypted for future runs)")
+        .option("--model <model>", "model name for the selected provider (saved for future runs)")
+        .option("--forget-credentials", "remove stored credentials for the selected provider and exit", false)
         .option("--level <level>", "review level: fast, normal, or deep", "normal")
         .option("--type <type>", "review focus: general, security, performance, architecture, or style", "general")
         .option("--json", "output the review result as JSON", false)
         .option("--fix", "automatically apply suggested fixes (not yet supported)", false);
     program.parse(argv);
     const opts = program.opts();
+    if (opts.forgetCredentials) {
+        clearProviderConfig(opts.provider);
+        console.log(colors.green(`Removed stored credentials for provider "${opts.provider}".`));
+        return;
+    }
     if (opts.fix) {
         console.error(colors.yellow("--fix is not supported yet (see TOBE.md roadmap, Phase 4)."));
         process.exitCode = 2;
@@ -77,10 +98,20 @@ export async function main(argv = process.argv) {
         process.exitCode = 2;
         return;
     }
+    if (opts.apiKey !== undefined || opts.model !== undefined) {
+        saveProviderConfig(opts.provider, { apiKey: opts.apiKey, model: opts.model });
+        if (!opts.json) {
+            console.log(colors.dim(`Saved ${opts.provider} credentials to ~/.can-i-merge (encrypted).`));
+        }
+    }
+    const stored = loadProviderConfig(opts.provider);
+    const envVars = PROVIDER_ENV_VARS[opts.provider];
+    const apiKey = opts.apiKey ?? (envVars && process.env[envVars.apiKey]) ?? stored.apiKey;
+    const model = opts.model ?? (envVars && process.env[envVars.model]) ?? stored.model;
     const registry = buildProviderRegistry();
     let provider;
     try {
-        provider = registry.create(opts.provider);
+        provider = registry.create(opts.provider, { apiKey, model });
     }
     catch (err) {
         console.error(colors.red(err instanceof Error ? err.message : String(err)));

package/dist/config/credentialStore.js

@@ -0,0 +1,118 @@
+/**
+ * Local, encrypted credential store for provider API keys.
+ *
+ * CLI flags and env vars are per-invocation. This store lets a user pass
+ * --api-key/--model once and have it picked up automatically on every later
+ * run, without re-exporting an env var each time.
+ *
+ * The encryption key is a random 32-byte value generated on first use and
+ * kept in a file (key) separate from the ciphertext (credentials.json),
+ * both under the user's home directory with owner-only permissions. This
+ * guards against accidental exposure (e.g. a backup or sync tool scooping up
+ * one file but not the other) - it does not protect against an attacker who
+ * already has read access to the user's home directory, since the key lives
+ * on the same machine as the ciphertext.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+const CONFIG_DIR = path.join(homedir(), ".can-i-merge");
+const KEY_FILE = path.join(CONFIG_DIR, "key");
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+const ALGORITHM = "aes-256-gcm";
+function ensureConfigDir() {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function getOrCreateKey() {
+    ensureConfigDir();
+    if (existsSync(KEY_FILE)) {
+        return Buffer.from(readFileSync(KEY_FILE, "utf8"), "base64");
+    }
+    const key = randomBytes(32);
+    writeFileSync(KEY_FILE, key.toString("base64"), { mode: 0o600 });
+    return key;
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return {
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        data: data.toString("base64"),
+    };
+}
+function decrypt(value, key) {
+    const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(value.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(value.tag, "base64"));
+    const data = Buffer.concat([
+        decipher.update(Buffer.from(value.data, "base64")),
+        decipher.final(),
+    ]);
+    return data.toString("utf8");
+}
+function readCredentialsFile() {
+    if (!existsSync(CREDENTIALS_FILE)) {
+        return {};
+    }
+    try {
+        return JSON.parse(readFileSync(CREDENTIALS_FILE, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function writeCredentialsFile(contents) {
+    ensureConfigDir();
+    writeFileSync(CREDENTIALS_FILE, JSON.stringify(contents, null, 2), { mode: 0o600 });
+}
+/** Persist an API key and/or model for a provider, encrypting the API key at rest. */
+export function saveProviderConfig(provider, config) {
+    const file = readCredentialsFile();
+    const next = { ...file[provider] };
+    if (config.apiKey !== undefined) {
+        next.apiKey = encrypt(config.apiKey, getOrCreateKey());
+    }
+    if (config.model !== undefined) {
+        next.model = config.model;
+    }
+    file[provider] = next;
+    writeCredentialsFile(file);
+}
+/** Load a previously persisted API key/model for a provider, decrypting the API key. */
+export function loadProviderConfig(provider) {
+    const stored = readCredentialsFile()[provider];
+    if (!stored) {
+        return {};
+    }
+    const result = {};
+    if (stored.apiKey) {
+        try {
+            result.apiKey = decrypt(stored.apiKey, getOrCreateKey());
+        }
+        catch {
+            // Key file missing/rotated or ciphertext corrupted - treat as absent
+            // rather than crashing the CLI.
+        }
+    }
+    if (stored.model) {
+        result.model = stored.model;
+    }
+    return result;
+}
+/** Remove stored credentials for a provider (or all providers if omitted). */
+export function clearProviderConfig(provider) {
+    if (!existsSync(CREDENTIALS_FILE)) {
+        return;
+    }
+    if (!provider) {
+        unlinkSync(CREDENTIALS_FILE);
+        return;
+    }
+    const file = readCredentialsFile();
+    delete file[provider];
+    writeCredentialsFile(file);
+}

package/dist/config/index.js

@@ -0,0 +1,4 @@
+/**
+ * config package entry point. Re-exports the encrypted credential store.
+ */
+export * from "./credentialStore.js";

package/dist/provider-nvidia/index.js

@@ -0,0 +1 @@
+export * from "./nvidiaProvider.js";

package/dist/provider-nvidia/nvidiaProvider.js

@@ -0,0 +1,33 @@
+/**
+ * NVIDIA provider - talks to NVIDIA's OpenAI-chat-completions-compatible
+ * endpoint for NIM-hosted foundation models (e.g. Llama, Nemotron) at
+ * https://integrate.api.nvidia.com/v1. Delegates the actual request/response
+ * handling to the shared OpenAI-compatible reviewer.
+ */
+import { createOpenAICompatibleReviewer } from "../shared/openaiCompatibleProvider.js";
+export const DEFAULT_NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
+export class NvidiaProvider {
+    name = "nvidia";
+    delegate;
+    constructor(options = {}) {
+        const apiKey = options.apiKey ?? process.env.NVIDIA_API_KEY;
+        if (!apiKey) {
+            throw new Error("Missing NVIDIA API key. Set the NVIDIA_API_KEY environment variable, or pass { apiKey } when constructing NvidiaProvider.");
+        }
+        const model = options.model ?? process.env.NVIDIA_MODEL;
+        if (!model) {
+            throw new Error('Missing NVIDIA model. Set the NVIDIA_MODEL environment variable, or pass { model } when constructing NvidiaProvider (e.g. "meta/llama-3.1-70b-instruct" - see the model catalog at https://build.nvidia.com).');
+        }
+        const baseURL = options.baseURL ?? process.env.NVIDIA_BASE_URL ?? DEFAULT_NVIDIA_BASE_URL;
+        this.delegate = createOpenAICompatibleReviewer({
+            providerName: this.name,
+            apiKey,
+            model,
+            baseURL,
+            maxOutputTokens: options.maxOutputTokens,
+        });
+    }
+    async review(context) {
+        return this.delegate.review(context);
+    }
+}

package/dist/provider-ollama/index.js

@@ -0,0 +1,6 @@
+/**
+ * provider-ollama package entry point. Re-exports the Ollama provider.
+ * Does NOT register the provider into any registry - that wiring happens
+ * elsewhere (e.g. in the CLI or core composition root).
+ */
+export * from "./ollamaProvider.js";

package/dist/provider-ollama/ollamaProvider.js

@@ -0,0 +1,34 @@
+/**
+ * Ollama provider - talks to a local Ollama instance via its OpenAI
+ * chat-completions-compatible endpoint (http://localhost:11434/v1 by
+ * default). Delegates the actual request/response handling to
+ * createOpenAICompatibleReviewer.
+ */
+import { createOpenAICompatibleReviewer } from "../shared/openaiCompatibleProvider.js";
+export const DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434/v1";
+export class OllamaProvider {
+    name = "ollama";
+    delegate;
+    constructor(options = {}) {
+        // Ollama does not require a real API key for local use, but the OpenAI
+        // SDK requires some non-empty string - fall back to a placeholder.
+        const apiKey = options.apiKey ?? process.env.OLLAMA_API_KEY ?? "ollama";
+        const model = options.model ?? process.env.OLLAMA_MODEL;
+        if (!model) {
+            throw new Error('Missing Ollama model. Set the OLLAMA_MODEL environment variable, or pass { model } when ' +
+                'constructing OllamaProvider to the name of a model you have pulled locally (e.g. "ollama pull ' +
+                'llama3.1", then OLLAMA_MODEL=llama3.1). The model must support tool/function calling.');
+        }
+        const baseURL = options.baseURL ?? process.env.OLLAMA_BASE_URL ?? DEFAULT_OLLAMA_BASE_URL;
+        this.delegate = createOpenAICompatibleReviewer({
+            providerName: this.name,
+            apiKey,
+            model,
+            baseURL,
+            maxOutputTokens: options.maxOutputTokens,
+        });
+    }
+    async review(context) {
+        return this.delegate.review(context);
+    }
+}

package/dist/provider-openai/index.js

@@ -0,0 +1,6 @@
+/**
+ * provider-openai package entry point. Re-exports the OpenAI provider.
+ * Does NOT register the provider into any registry - that wiring happens
+ * elsewhere (e.g. in the CLI or core composition root).
+ */
+export * from "./openAIProvider.js";

package/dist/provider-openai/openAIProvider.js

@@ -0,0 +1,32 @@
+/**
+ * OpenAI provider - implements ReviewProvider by delegating to the shared
+ * OpenAI-compatible reviewer (createOpenAICompatibleReviewer), which speaks
+ * the OpenAI chat-completions wire format and forces structured output via
+ * a "submit_review" tool call.
+ */
+import { createOpenAICompatibleReviewer } from "../shared/openaiCompatibleProvider.js";
+export class OpenAIProvider {
+    name = "openai";
+    delegate;
+    constructor(options = {}) {
+        const apiKey = options.apiKey ?? process.env.OPENAI_API_KEY;
+        if (!apiKey) {
+            throw new Error("Missing OpenAI API key. Set the OPENAI_API_KEY environment variable, or pass { apiKey } when constructing OpenAIProvider.");
+        }
+        const model = options.model ?? process.env.OPENAI_MODEL;
+        if (!model) {
+            throw new Error('Missing OpenAI model. Set the OPENAI_MODEL environment variable, or pass { model } when constructing OpenAIProvider (e.g. "gpt-4.1").');
+        }
+        const baseURL = options.baseURL ?? process.env.OPENAI_BASE_URL;
+        this.delegate = createOpenAICompatibleReviewer({
+            providerName: this.name,
+            apiKey,
+            model,
+            baseURL,
+            maxOutputTokens: options.maxOutputTokens,
+        });
+    }
+    async review(context) {
+        return this.delegate.review(context);
+    }
+}

package/dist/shared/openaiCompatibleProvider.js

@@ -0,0 +1,125 @@
+/**
+ * Shared base for any ReviewProvider that speaks the OpenAI chat-completions
+ * wire format - OpenAI itself, and OpenAI-compatible endpoints (NVIDIA NIM,
+ * Ollama's /v1 API). Each concrete provider (provider-openai, provider-nvidia,
+ * provider-ollama) just supplies its own api key / model / base URL defaults
+ * and delegates review() to the reviewer this factory returns.
+ */
+import OpenAI from "openai";
+const SUBMIT_REVIEW_FUNCTION_NAME = "submit_review";
+function buildSubmitReviewTool() {
+    return {
+        type: "function",
+        function: {
+            name: SUBMIT_REVIEW_FUNCTION_NAME,
+            description: "Submit the code review findings: an overall summary plus a list of issues discovered in the diff.",
+            parameters: {
+                type: "object",
+                properties: {
+                    summary: {
+                        type: "string",
+                        description: "A concise, high-level summary of the overall review.",
+                    },
+                    issues: {
+                        type: "array",
+                        description: "The list of individual issues found while reviewing the diff.",
+                        items: {
+                            type: "object",
+                            properties: {
+                                severity: {
+                                    type: "string",
+                                    enum: ["critical", "high", "medium", "low"],
+                                    description: "How severe this issue is.",
+                                },
+                                category: {
+                                    type: "string",
+                                    enum: ["security", "performance", "architecture", "style", "bug"],
+                                    description: "The category this issue falls under.",
+                                },
+                                title: { type: "string", description: "A short, human-readable title for the issue." },
+                                description: { type: "string", description: "A detailed explanation of the issue." },
+                                file: { type: "string", description: "The path of the file this issue was found in." },
+                                line: { type: "number", description: "The line number in the file where this issue occurs." },
+                                suggestion: {
+                                    type: "string",
+                                    description: "A concrete suggestion for how to fix or address the issue.",
+                                },
+                                confidence: {
+                                    type: "number",
+                                    description: "A confidence score (0 to 1) that this issue is a real, valid finding.",
+                                },
+                            },
+                            required: [
+                                "severity",
+                                "category",
+                                "title",
+                                "description",
+                                "file",
+                                "line",
+                                "suggestion",
+                                "confidence",
+                            ],
+                        },
+                    },
+                },
+                required: ["summary", "issues"],
+            },
+        },
+    };
+}
+const submitReviewTool = buildSubmitReviewTool();
+/**
+ * Builds a ReviewProvider that talks to any OpenAI chat-completions-compatible
+ * endpoint, forcing structured output via a named tool call (mirrors how
+ * ClaudeProvider forces its submit_review tool use).
+ */
+export function createOpenAICompatibleReviewer(options) {
+    const client = new OpenAI({ apiKey: options.apiKey, baseURL: options.baseURL });
+    return {
+        name: options.providerName,
+        async review(context) {
+            if (!context.prompt) {
+                throw new Error("ReviewContext.prompt is not set - run the Prompt Builder (buildPrompt) before calling provider.review().");
+            }
+            const start = Date.now();
+            let response;
+            try {
+                response = await client.chat.completions.create({
+                    model: options.model,
+                    max_tokens: options.maxOutputTokens ?? 4096,
+                    messages: [
+                        { role: "system", content: context.prompt.system },
+                        { role: "user", content: context.prompt.user },
+                    ],
+                    tools: [submitReviewTool],
+                    tool_choice: { type: "function", function: { name: SUBMIT_REVIEW_FUNCTION_NAME } },
+                });
+            }
+            catch (err) {
+                throw new Error(`${options.providerName} API request failed: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+            }
+            const toolCall = response.choices[0]?.message?.tool_calls?.find((call) => call.type === "function" && call.function.name === SUBMIT_REVIEW_FUNCTION_NAME);
+            if (!toolCall) {
+                throw new Error(`${options.providerName} did not return a submit_review tool call. Make sure the selected ` +
+                    `model ("${options.model}") supports tool/function calling.`);
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(toolCall.function.arguments);
+            }
+            catch (err) {
+                throw new Error(`${options.providerName} returned malformed JSON for the submit_review tool call arguments.`, { cause: err });
+            }
+            const input = parsed;
+            return {
+                payload: {
+                    summary: input.summary ?? "",
+                    issues: input.issues ?? [],
+                },
+                provider: options.providerName,
+                model: options.model,
+                durationMs: Date.now() - start,
+            };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "can-i-merge",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "AI-powered Git Review Pipeline with Intelligent Context Building",
   "type": "module",
   "main": "dist/index.js",
@@ -32,7 +32,8 @@
   "license": "SEE LICENSE IN license",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.110.0",
-    "commander": "^15.0.0"
+    "commander": "^15.0.0",
+    "openai": "^6.45.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.0",