@0xcraft/powershot 1.1.2 → 1.1.4

package/dist/session.js

@@ -105,9 +105,13 @@ export class Session {
             verified: findings.filter((f) => f.class === 'verified').length,
             judged: findings.filter((f) => f.class === 'judged').length,
             state: verdict.state,
-            notLookedAt: verdict.notLookedAt,
+            notLookedAt: [...verdict.notLookedAt],
             coverage: verdict.coverage,
-            unavailableCoverage: verdict.unavailableCoverage,
+            verifyOnly: verdict.verifyOnly,
+            minSeverity: verdict.minSeverity,
+            filesReviewed: verdict.filesReviewed,
+            deterministicChecks: verdict.deterministicChecks,
+            scopeDetails: verdict.scopeDetails ? [...verdict.scopeDetails] : undefined,
         };
         this.save();
     }

package/dist/verifiers/foreign-reinvented.js

@@ -1,4 +1,5 @@
-import { finding, topLevelDeclarations } from './foreign-tokens.js';
+import { createReinventionScopeResolver, implementationFingerprint } from '#app/reinvention.js';
+import { finding, tokensFor, topLevelDeclarations } from './foreign-tokens.js';
 /** Names too common to mean anything across files, as in the TypeScript version. */
 const GENERIC = new Set([
     'render', 'handler', 'handle', 'create', 'update', 'remove', 'delete', 'insert',
@@ -14,6 +15,19 @@ const GENERIC = new Set([
  * repository this was the single largest source of noise.
  */
 const TESTISH = /(^|\/)(tests?|spec|__tests__)\/|(^|\/)(test_[^/]+|[^/]+_test|[^/]+\.(test|spec))\.[a-z]+$/;
+function normalized(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+function declarationIndex(root, pack) {
+    const index = new Map();
+    for (const [name, node] of topLevelDeclarations(root, pack)) {
+        const key = normalized(name);
+        const list = index.get(key) ?? [];
+        list.push({ name, node, fingerprint: implementationFingerprint(tokensFor(node, pack)) });
+        index.set(key, list);
+    }
+    return index;
+}
 export const foreignReinvented = {
     name: 'reinvented',
     needs: ['syntax'],
@@ -24,39 +38,71 @@ export const foreignReinvented = {
         // Keyed by language as well as name: a Ruby `charge` and a C++ `charge` are two
         // unrelated functions that happen to share a word, and calling that duplication
         // would be nonsense — nothing can be reused across the boundary anyway.
+        const scopeFor = createReinventionScopeResolver(g.root);
         const index = new Map();
+        const declarations = new Map();
         for (const file of g.foreign) {
-            if (TESTISH.test(file.path))
+            declarations.set(file.path, {
+                current: declarationIndex(file.tree.rootNode, file.pack),
+                base: file.beforeTree ? declarationIndex(file.beforeTree.rootNode, file.pack) : undefined,
+            });
+        }
+        for (const file of g.foreign) {
+            if (TESTISH.test(file.path) || !file.beforeTree)
                 continue;
-            for (const [name, decl] of topLevelDeclarations(file.tree.rootNode, file.pack)) {
-                const key = file.pack.name + '|' + name.toLowerCase().replace(/[^a-z0-9]/g, '');
-                const list = index.get(key) ?? [];
-                list.push({ file: file.path, line: decl.startPosition.row + 1 });
-                index.set(key, list);
+            const fileDeclarations = declarations.get(file.path);
+            for (const [nameKey, baseDeclarations] of fileDeclarations.base ?? []) {
+                for (const baseDeclaration of baseDeclarations) {
+                    const currentDeclaration = (fileDeclarations.current.get(nameKey) ?? []).find((declaration) => declaration.fingerprint === baseDeclaration.fingerprint);
+                    // The reusable declaration must both predate the change and remain available
+                    // at the reviewed head. A removed or rewritten helper is not a candidate.
+                    if (!currentDeclaration)
+                        continue;
+                    const key = file.pack.name + '|' + nameKey;
+                    const list = index.get(key) ?? [];
+                    list.push({
+                        file: file.path,
+                        line: currentDeclaration.node.startPosition.row + 1,
+                        fingerprint: baseDeclaration.fingerprint,
+                        scope: scopeFor(file.path),
+                    });
+                    index.set(key, list);
+                }
             }
         }
         for (const file of g.foreign) {
             if (TESTISH.test(file.path))
                 continue;
-            for (const [name, decl] of topLevelDeclarations(file.tree.rootNode, file.pack)) {
-                const line = decl.startPosition.row + 1;
-                if (!file.changed.added.has(line))
-                    continue;
-                if (name.length < 6 || GENERIC.has(name.toLowerCase()))
-                    continue;
-                const key = file.pack.name + '|' + name.toLowerCase().replace(/[^a-z0-9]/g, '');
-                const match = (index.get(key) ?? []).find((e) => e.file !== file.path);
-                // report the pair once, from the file that declares it later
-                if (!match || match.file < file.path)
-                    continue;
-                findings.push(finding(file, decl, {
-                    check: 'reinvented',
-                    severity: 'medium',
-                    confidence: 'firm',
-                    title: name + '() duplicates a declaration in ' + match.file,
-                    evidence: { oracle: file.pack.name + ' declarations', detail: 'already declared at ' + match.file + ':' + match.line },
-                    fix: 'Reuse the existing one instead of redeclaring it',
-                }));
+            const fileDeclarations = declarations.get(file.path);
+            for (const [nameKey, currentDeclarations] of fileDeclarations.current) {
+                for (const { name, node: decl, fingerprint } of currentDeclarations) {
+                    const line = decl.startPosition.row + 1;
+                    if (!file.changed.added.has(line))
+                        continue;
+                    if (name.length < 6 || GENERIC.has(name.toLowerCase()))
+                        continue;
+                    const existedHere = (fileDeclarations.base?.get(nameKey) ?? []).some((baseDeclaration) => baseDeclaration.fingerprint === fingerprint);
+                    if (existedHere)
+                        continue;
+                    const key = file.pack.name + '|' + nameKey;
+                    const scope = scopeFor(file.path);
+                    const match = (index.get(key) ?? []).find((candidate) => candidate.file !== file.path &&
+                        candidate.scope === scope &&
+                        candidate.fingerprint === fingerprint);
+                    if (!match)
+                        continue;
+                    findings.push(finding(file, decl, {
+                        check: 'reinvented',
+                        severity: 'medium',
+                        confidence: 'firm',
+                        title: name + ' repeats the implementation at ' + match.file,
+                        evidence: {
+                            oracle: file.pack.name + ' base declaration + token fingerprint',
+                            detail: 'token-identical implementation already present at ' + match.file + ':' + match.line,
+                        },
+                        fix: 'Consider reusing the existing declaration; if the separation is intentional, keep the boundary explicit',
+                    }));
+                }
             }
         }
         return findings;

package/dist/verifiers/foreign-tokens.js

@@ -68,8 +68,11 @@ export function finding(file, node, f) {
  */
 export function declaredName(decl, pack) {
     const field = decl.childForFieldName(pack.nodes.declarationName);
+    // tree-sitter-kotlin exposes the declaration identifier as a named child but
+    // assigns no field name to it. Keep the grammar field authoritative when one is
+    // present; otherwise the first identifier inside the declaration is its name.
     if (!field)
-        return undefined;
+        return nodesOfType(decl, pack.nodes.identifier)[0]?.text;
     if (field.childCount === 0)
         return field.text;
     // C and C++ wrap the name in a declarator; look inside that, never wider

package/dist/verifiers/reinvented.js

@@ -1,5 +1,6 @@
 import { SyntaxKind } from 'ts-morph';
 import { locate, normalizeName, relPath } from '#app/ground.js';
+import { createReinventionScopeResolver, typescriptImplementationFingerprint } from '#app/reinvention.js';
 /**
  * Names too generic to mean anything across files — two `render`s are usually
  * two different things, not a duplication.
@@ -15,8 +16,10 @@ function declaredNames(sf) {
     for (const fn of sf.getFunctions()) {
         const name = fn.getName();
         const id = fn.getNameNode();
-        if (name && id)
-            out.push({ name, line: fn.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span });
+        const fingerprint = typescriptImplementationFingerprint(fn);
+        if (name && id && fingerprint) {
+            out.push({ name, line: fn.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span, fingerprint });
+        }
     }
     for (const v of sf.getVariableDeclarations()) {
         const init = v.getInitializer();
@@ -24,7 +27,10 @@ function declaredNames(sf) {
             continue;
         if (init.isKind(SyntaxKind.ArrowFunction) || init.isKind(SyntaxKind.FunctionExpression)) {
             const id = v.getNameNode();
-            out.push({ name: v.getName(), line: v.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span });
+            const fingerprint = typescriptImplementationFingerprint(v);
+            if (fingerprint) {
+                out.push({ name: v.getName(), line: v.getStartLineNumber(), span: locate(sf, id.getStart(), id.getWidth()).span, fingerprint });
+            }
         }
     }
     return out;
@@ -35,19 +41,28 @@ export const reinvented = {
     needs: ['syntax'],
     run(g) {
         const findings = [];
-        for (const { sf, changed } of g.files) {
+        const scopeFor = createReinventionScopeResolver(g.root);
+        for (const { sf, changed, before } of g.files) {
             const file = relPath(sf, g.root);
+            const scope = scopeFor(file);
             // a fixture builder repeated across test files is a deliberate trade, and two
             // tests describing the same scenario naturally share a name
             if (TEST_FILE.test(file))
                 continue;
-            for (const { name, line, span } of declaredNames(sf)) {
+            const baseDeclarations = before ? declaredNames(before) : [];
+            for (const { name, line, span, fingerprint } of declaredNames(sf)) {
                 if (!changed.added.has(line))
                     continue;
                 if (name.length < 6 || GENERIC.has(name) || GENERIC.has(name.toLowerCase()))
                     continue;
-                const existing = (g.symbolIndex.get(normalizeName(name)) ?? []).filter((s) => s.file !== file);
-                const match = existing[0];
+                const existedHere = baseDeclarations.some((declaration) => normalizeName(declaration.name) === normalizeName(name) &&
+                    declaration.fingerprint === fingerprint);
+                if (existedHere)
+                    continue;
+                const match = (g.symbolIndex.get(normalizeName(name)) ?? []).find((symbol) => symbol.file !== file &&
+                    symbol.existedInBase &&
+                    symbol.scope === scope &&
+                    symbol.fingerprint === fingerprint);
                 if (!match)
                     continue;
                 findings.push({
@@ -59,12 +74,15 @@ export const reinvented = {
                     file,
                     line,
                     span,
-                    title: name + '() duplicates an existing export ' + match.file + ':' + match.name,
-                    evidence: { oracle: 'repo symbol index', detail: 'already exported from ' + match.file + ':' + match.line },
+                    title: name + '() repeats the implementation at ' + match.file + ':' + match.name,
+                    evidence: {
+                        oracle: 'base export + callable token fingerprint',
+                        detail: 'token-identical implementation already exported from ' + match.file + ':' + match.line,
+                    },
                     // Deliberately not an import statement: the correct specifier depends on the
                     // repo's module resolution, and a wrong one would be exactly the kind of
                     // confidently-wrong output this tool exists to catch.
-                    fix: 'Reuse ' + match.name + ' from ' + match.file + ' instead of redeclaring it',
+                    fix: 'Consider reusing ' + match.name + ' from ' + match.file + '; if the separation is intentional, keep the boundary explicit',
                 });
             }
         }

package/docs/architecture.md

@@ -59,13 +59,14 @@ engine. The engine does not depend on a workflow provider or terminal layout.
 |---|---|---|
 | `src/cli/` | Argument parsing, command dispatch, report publication, exit mapping | Review algorithms |
 | `src/review.ts` | One review run and its stage orchestration | CLI parsing or presentation |
-| `src/ground.ts` | Change-scoped TypeScript projects, parse trees, manifests, symbol index | Check selection |
+| `src/ground.ts` | Change-scoped TypeScript projects, parse trees, manifests, base-aware implementation index | Check selection |
 | `src/plan.ts` | File selection and per-file capability accounting | Finding generation |
 | `src/manifest.ts` | Completion state and the authoritative run record | Rendering |
 | `src/verifiers/` | Deterministic check implementations | Model calls |
 | `src/judges/` | Prompt data, bounded model loop, tool adapter | Git target selection |
 | `src/lang/` | Language-pack data, isolated parser workers, optional language oracles | Cross-run policy |
 | `src/report/` | Pure output adapters | Re-running or reinterpreting a review |
+| `src/github/` | GitHub REST transport and pull-request publication reconciliation | Review decisions or report rendering |
 | `src/bench.ts` | Historical and labelled evaluation | Production command dispatch |
 | `src/session.ts`, `src/cache.ts` | Reuse of completed judge work | Completion decisions |
 

package/docs/ci.md

@@ -41,6 +41,10 @@ name: PowerShot
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   pull-requests: write
@@ -77,6 +81,27 @@ and bounded batches, so all declared languages can coexist in one monorepo revie
 Set `upload-sarif: 'false'` and omit `security-events: write` when GitHub code scanning
 is unavailable or the workflow should not publish SARIF.
 
+`comment: 'true'` maintains one summary through a hidden marker scoped to the caller's
+workflow file and job. Reruns update only that exact `github-actions[bot]` comment, so
+another workflow or job using the same bot identity is left alone. Each candidate also
+records its pull-request head. A new head gets a new candidate, which means an old run
+never patches or retires the current head's comment. The first scoped run replaces the
+newest unmarked legacy `## PowerShot` summary from v1.1.2 or older without claiming the
+ambiguous legacy comment through `PATCH`.
+
+The comment leads with the verdict, effective severity threshold, review mode, and
+aggregate file/check counts. Portable gaps and files outside parser coverage stay
+visible under a collapsed coverage section without filling the timeline with paths.
+The generated `powershot.manifest.json` keeps the per-file accounting for workflows
+that want to persist it as an artifact.
+
+PowerShot checks the target head throughout reconciliation and removes its own
+just-created candidate if it observes a changed head. Simultaneous same-head runs
+relist and converge on one scoped candidate when they complete. Keep the example's
+`concurrency` block to reduce overlap and canceled stale work. GitHub's issue-comment
+REST API has no atomic create-if-absent operation, and cancellation cannot stop a REST
+request already in flight, so concurrency reduces but cannot eliminate that window.
+
 `inline-comments: 'true'` requires `pull-requests: write`. It publishes at most ten
 findings as one review. Only deterministic `verified` findings with `proven`
 confidence, severity `medium` or higher, and a GitHub-confirmed added line qualify.

package/examples/github-actions/action.yml

@@ -3,6 +3,10 @@ name: PowerShot
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   pull-requests: write

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xcraft/powershot",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Oracle-first code review for machine-written code, with deterministic verification and CI-ready reports.",
   "license": "Apache-2.0",
   "author": "aglumova <alina.glumova@gmail.com>",