@a9n-shoji/rvw 0.2.2 → 0.2.4

package/CHANGELOG.md

@@ -5,6 +5,32 @@
 
 ## [Unreleased]
 
+## [0.2.4] - 2026-08-24
+
+### Changed
+
+- `rvw-watch-comments`のinvestigate-and-reply専用taskで、同じPR／repositoryの後続batchもworker capacity内で
+  並列に調査・返信。保証できる場合は`max-in-flight=8`を目標とし、fix-and-pushを許可したtaskだけ従来の
+  writer排他を維持
+
+## [0.2.3] - 2026-08-21
+
+### Added
+
+- PR本文へ貼り付けたmodern GitHub user attachment画像を、public/private共通のlocalhost proxyで表示
+- repositoryのPNG、JPEG、GIF、WebP、AVIF、SVGをexact commit固定の全文表示とold/new Split表示で閲覧
+- 画像ファイルのadded、deleted、renamed、画像・非画像間の変更表示とfile-level comment
+
+### Fixed
+
+- 同じtask stateで`rvw-watch-comments`のwatch driverを複数起動できないようにし、二重監視と重複処理を防止
+
+### Security
+
+- GitHub attachment proxyを厳密な`https://github.com/user-attachments/assets/<uuid>`だけへ限定し、
+  同一origin request、GitHub CLIの既存認証、10 MiB上限、magic-byte判定、`nosniff`、SVG sandbox CSPを適用
+- arbitrary external image、legacy GitHub image host、unknown binary、HTML/JSON error responseは引き続き自動取得しない
+
 ## [0.2.2] - 2026-08-21
 
 ### Changed

package/README.md

@@ -118,8 +118,8 @@ rvw walkthrough publish --stdin --json
 構成されます。参照は意味のある複数行range、単行、またはfile全体を指せます。rvwは登録時にcommit、
 path、指定された行範囲を検証します。publishしてもbrowserは開かれず、
 active tabやscroll位置も変わりません。人間がviewerのWalkthroughを開き、必要なreferenceを選んだ
-時だけ、exact sourceがdocument tabへ開き、行指定があれば範囲全体が強調されます。`Cmd` / `Ctrl`を押しながら選べば
-操作元と反対のペインへ開きます。説明tabは残るため、
+時だけ、exact sourceがdocument tabへ開き、行指定があれば範囲全体が強調されます。通常clickは左ペイン、
+`Cmd` / `Ctrl`を押しながら選べば右ペインへ開きます。説明tabは残るため、
 複数のclaimと実装を任意の順序・任意のタイミングで往復できます。
 
 Walkthrough本文のinline referenceとMermaid node linkは維持しますが、同じ参照を横や下へ列挙する
@@ -199,7 +199,10 @@ PRは常にcode/GitHub read-onlyで調査します。同梱driverがcursor resum
 batchをclaimすると各threadへ`🔎 確認中です…`をAgent往復なしに即時返信し、
 完了時は同じreplyを最終結果へ編集します。Skill同梱のtask-state toolがrepository外のSQLiteへcursor、
 queue、retry、batch内のthread単位status post、自己返信抑制をtransactionalに保存します。同じthreadへ
-後から返信が追加された場合は新しいstatus postを返信するため、以前の回答は書き換えません。
+後から返信が追加された場合は新しいstatus postを返信するため、以前の回答は書き換えません。親taskは
+起動前にsubagent枠を予約し、driverはその枠数までだけbatchをclaimします。acknowledge済みbatchは大小や
+変更有無にかかわらず同じscheduling turnでfresh subagentへ委譲し、親taskは直接処理しません。lease解放後の
+同一PR follow-upと期限到達したretryはdriverがtask stateから自動的に再開します。
 調査結果、実装内容、test結果が具体的なcodeに基づく場合、Skillは最終replyからexact commitの有用な
 line rangeへ`rvw-ref:` linkを付け、reviewerが根拠へ直接移動できるようにします。
 

package/dist/cli.mjs

@@ -19759,12 +19759,15 @@ import path5 from "node:path";
 import { TextDecoder as TextDecoder2 } from "node:util";
 
 // src/shared/constants.ts
-var APP_VERSION = "0.2.2";
+var APP_VERSION = "0.2.4";
 var PROTOCOL_VERSION = 3;
 var VIEWER_ID_HEADER = "x-rvw-viewer-id";
 var GIT_OBJECT_ID_PATTERN = /^[0-9a-f]{40,64}$/i;
 var MAX_TEXT_DOCUMENT_BYTES = 1024 * 1024;
 var MAX_MARKDOWN_ASSET_BYTES = 5 * 1024 * 1024;
+var MAX_GITHUB_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+var MAX_GITHUB_ATTACHMENT_STDERR_BYTES = 64 * 1024;
+var GITHUB_ATTACHMENT_TIMEOUT_MS = 3e4;
 var MAX_COMMENT_BODY_BYTES = 64 * 1024;
 var MAX_AUTHOR_LABEL_CHARACTERS = 100;
 var MAX_IDEMPOTENCY_KEY_CHARACTERS = 200;
@@ -20414,6 +20417,101 @@ var GitClient = class {
   }
 };
 
+// src/shared/image-assets.ts
+var SUPPORTED_IMAGE_EXTENSIONS = [
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".avif",
+  ".svg"
+];
+var githubAttachmentPathPattern = /^\/user-attachments\/assets\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var utf8Fatal2 = new TextDecoder("utf-8", { fatal: true });
+function hasBytes(bytes, offset, expected) {
+  return expected.every((value, index2) => bytes[offset + index2] === value);
+}
+function ascii(bytes, offset, length) {
+  return String.fromCharCode(...bytes.subarray(offset, offset + length));
+}
+function uint16Le(bytes, offset) {
+  return (bytes[offset] ?? 0) | (bytes[offset + 1] ?? 0) << 8;
+}
+function uint32Be(bytes, offset) {
+  return (bytes[offset] ?? 0) * 16777216 + ((bytes[offset + 1] ?? 0) << 16) + ((bytes[offset + 2] ?? 0) << 8) + (bytes[offset + 3] ?? 0) >>> 0;
+}
+function uint32Le(bytes, offset) {
+  return (bytes[offset] ?? 0) + ((bytes[offset + 1] ?? 0) << 8) + ((bytes[offset + 2] ?? 0) << 16) + (bytes[offset + 3] ?? 0) * 16777216 >>> 0;
+}
+function isSvg(bytes) {
+  if (bytes.length === 0) return false;
+  let text3;
+  try {
+    text3 = utf8Fatal2.decode(bytes);
+  } catch {
+    return false;
+  }
+  const withoutBom = text3.charCodeAt(0) === 65279 ? text3.slice(1) : text3;
+  let candidate = withoutBom.trimStart();
+  const declaration = /^<\?xml(?:\s[^?]*)?\?>/iu.exec(candidate);
+  if (declaration) candidate = candidate.slice(declaration[0].length).trimStart();
+  while (candidate.startsWith("<!--")) {
+    const commentEnd = candidate.indexOf("-->");
+    if (commentEnd < 0) return false;
+    candidate = candidate.slice(commentEnd + 3).trimStart();
+  }
+  return /^<svg(?:\s|>)/iu.test(candidate);
+}
+function isSupportedImagePath(filePath) {
+  const normalized = filePath.toLowerCase();
+  return SUPPORTED_IMAGE_EXTENSIONS.some((extension2) => normalized.endsWith(extension2));
+}
+function canonicalGitHubAttachmentUrl(value) {
+  if (!value?.startsWith("https://github.com/")) return null;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.hostname !== "github.com" || parsed.username !== "" || parsed.password !== "" || parsed.port !== "" || parsed.search !== "" || parsed.hash !== "" || !githubAttachmentPathPattern.test(parsed.pathname)) {
+    return null;
+  }
+  return parsed.href;
+}
+function detectImageContentType(bytes) {
+  if (bytes.length >= 33 && hasBytes(bytes, 0, [137, 80, 78, 71, 13, 10, 26, 10]) && ascii(bytes, 12, 4) === "IHDR" && uint32Be(bytes, 16) > 0 && uint32Be(bytes, 20) > 0) {
+    return "image/png";
+  }
+  if (bytes.length >= 10 && hasBytes(bytes, 0, [255, 216, 255]) && hasBytes(bytes, bytes.length - 2, [255, 217])) {
+    return "image/jpeg";
+  }
+  const gifHeader = bytes.length >= 13 ? ascii(bytes, 0, 6) : "";
+  if ((gifHeader === "GIF87a" || gifHeader === "GIF89a") && uint16Le(bytes, 6) > 0 && uint16Le(bytes, 8) > 0) {
+    return "image/gif";
+  }
+  if (bytes.length >= 20 && ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 4) === "WEBP" && ["VP8 ", "VP8L", "VP8X"].includes(ascii(bytes, 12, 4)) && uint32Le(bytes, 4) >= 12 && uint32Le(bytes, 4) + 8 <= bytes.length) {
+    return "image/webp";
+  }
+  if (bytes.length >= 16 && ascii(bytes, 4, 4) === "ftyp") {
+    const boxSize = uint32Be(bytes, 0);
+    if (boxSize >= 16 && boxSize <= bytes.length) {
+      const brands = [ascii(bytes, 8, 4)];
+      for (let offset = 16; offset + 4 <= boxSize; offset += 4) {
+        brands.push(ascii(bytes, offset, 4));
+      }
+      if (brands.some((brand) => brand === "avif" || brand === "avis")) {
+        return "image/avif";
+      }
+    }
+  }
+  return isSvg(bytes) ? "image/svg+xml" : null;
+}
+function imageContentTypeHeader(contentType2) {
+  return contentType2 === "image/svg+xml" ? `${contentType2}; charset=utf-8` : contentType2;
+}
+
 // src/infrastructure/github/github-client.ts
 var ghPullRequestSchema = external_exports.object({
   author: external_exports.object({ login: external_exports.string().min(1) }).nullable(),
@@ -20439,6 +20537,10 @@ function parsePullRequestUrl(url2) {
   return { owner: match2[1], repository: match2[2], number: Number(match2[3]) };
 }
 var GitHubClient = class {
+  constructor(processRunner = runProcess) {
+    this.processRunner = processRunner;
+  }
+  processRunner;
   async doctor() {
     const version2 = await runText("gh", ["--version"]);
     const auth = await runProcess("gh", ["auth", "status", "--hostname", "github.com"], {
@@ -20523,6 +20625,31 @@ var GitHubClient = class {
       isDraft: parsed.data.isDraft
     };
   }
+  async getAttachment(absoluteUrl) {
+    const canonicalUrl = canonicalGitHubAttachmentUrl(absoluteUrl);
+    if (!canonicalUrl) {
+      throw new RvwError("INVALID_INPUT", "GitHub user attachment URL\u304C\u4E0D\u6B63\u3067\u3059\u3002");
+    }
+    try {
+      const result = await this.processRunner("gh", ["api", canonicalUrl], {
+        timeoutMs: GITHUB_ATTACHMENT_TIMEOUT_MS,
+        maxStdoutBytes: MAX_GITHUB_ATTACHMENT_BYTES,
+        maxStderrBytes: MAX_GITHUB_ATTACHMENT_STDERR_BYTES
+      });
+      return { content: result.stdout, byteLength: result.stdout.byteLength };
+    } catch (error51) {
+      if (error51 instanceof RvwError && error51.code === "PROCESS_OUTPUT_LIMIT" && error51.details?.stream === "stdout") {
+        throw new RvwError("FILE_TOO_LARGE", "GitHub attachment\u306F10 MiB\u4EE5\u4E0B\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002", {
+          status: 413
+        });
+      }
+      throw new RvwError(
+        "GITHUB_ERROR",
+        "GitHub attachment\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\u3002gh\u8A8D\u8A3C\u3068\u753B\u50CF\u306E\u95B2\u89A7\u6A29\u9650\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+        { status: 502 }
+      );
+    }
+  }
 };
 
 // src/application/rvw-service.ts
@@ -28398,6 +28525,21 @@ var RvwService = class {
     await this.assertCommitAvailable(pullRequest, sourceOid);
     return await this.git.readRepositoryAsset(pullRequest.localRepositoryPath, sourceOid, filePath);
   }
+  async getGitHubAttachment(pullRequestId, absoluteUrl) {
+    this.getPullRequest(pullRequestId);
+    const canonicalUrl = canonicalGitHubAttachmentUrl(absoluteUrl);
+    if (!canonicalUrl) {
+      throw new RvwError("INVALID_INPUT", "GitHub user attachment URL\u304C\u4E0D\u6B63\u3067\u3059\u3002");
+    }
+    const attachment = await this.github.getAttachment(canonicalUrl);
+    const contentType2 = detectImageContentType(attachment.content);
+    if (!contentType2) {
+      throw new RvwError("UNSUPPORTED_IMAGE", "GitHub attachment\u306F\u5BFE\u5FDC\u753B\u50CF\u5F62\u5F0F\u3067\u306F\u3042\u308A\u307E\u305B\u3093\u3002", {
+        status: 415
+      });
+    }
+    return { ...attachment, contentType: contentType2 };
+  }
   async getDiff(ref) {
     const [old, next] = await Promise.all([
       ref.old ? this.getDocument(ref.old) : Promise.resolve(null),
@@ -33257,17 +33399,25 @@ function parseBooleanQuery(value, name) {
   if (value === "true") return true;
   throw new RvwError("INVALID_INPUT", `${name} query\u306Ftrue\u307E\u305F\u306Ffalse\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002`);
 }
-function markdownAssetContentType(filePath) {
-  const extension2 = path8.extname(filePath).toLowerCase();
-  return {
-    ".avif": "image/avif",
-    ".gif": "image/gif",
-    ".jpeg": "image/jpeg",
-    ".jpg": "image/jpeg",
-    ".png": "image/png",
-    ".svg": "image/svg+xml; charset=utf-8",
-    ".webp": "image/webp"
-  }[extension2] ?? "application/octet-stream";
+function repositoryAssetContentType(filePath, content3) {
+  if (!isSupportedImagePath(filePath)) return null;
+  const contentType2 = detectImageContentType(content3);
+  if (!contentType2) {
+    throw new RvwError("UNSUPPORTED_IMAGE", "repository asset\u306F\u5BFE\u5FDC\u753B\u50CF\u5F62\u5F0F\u3067\u306F\u3042\u308A\u307E\u305B\u3093\u3002", {
+      status: 415
+    });
+  }
+  return contentType2;
+}
+function setImageResponseHeaders(setHeader, contentType2) {
+  setHeader("content-type", imageContentTypeHeader(contentType2));
+  setHeader("cache-control", "private, max-age=31536000, immutable");
+  setHeader("x-content-type-options", "nosniff");
+  setHeader("content-disposition", "inline");
+  setHeader("cross-origin-resource-policy", "same-origin");
+  if (contentType2 === "image/svg+xml") {
+    setHeader("content-security-policy", svgAssetContentSecurityPolicy);
+  }
 }
 function documentRefFromQuery(pullRequestId, query) {
   if (query.kind === "pull-request-markdown") {
@@ -33395,17 +33545,36 @@ function createApp(service, options) {
     const ref = documentRefFromQuery(context.req.param("id"), context.req.query());
     return context.json({ ok: true, document: await service.getDocument(ref) });
   });
-  app.get("/api/pull-requests/:id/markdown-asset", async (context) => {
+  app.on(["GET", "HEAD"], "/api/pull-requests/:id/markdown-asset", async (context) => {
     const sourceOid = oidQuery(context.req.query("sourceOid"), "sourceOid");
     const filePath = requiredQuery(context.req.query("path"), "path");
     const asset = await service.getRepositoryAsset(context.req.param("id"), sourceOid, filePath);
-    context.header("content-type", markdownAssetContentType(filePath));
-    context.header("cache-control", "private, max-age=31536000, immutable");
-    context.header("x-content-type-options", "nosniff");
-    if (path8.extname(filePath).toLowerCase() === ".svg") {
-      context.header("content-security-policy", svgAssetContentSecurityPolicy);
+    const contentType2 = repositoryAssetContentType(filePath, asset.content);
+    if (contentType2) {
+      setImageResponseHeaders((name, value) => context.header(name, value), contentType2);
+    } else {
+      context.header("content-type", "application/octet-stream");
+      context.header("cache-control", "private, max-age=31536000, immutable");
+      context.header("x-content-type-options", "nosniff");
+    }
+    return context.req.method === "HEAD" ? context.body(null) : context.body(Uint8Array.from(asset.content));
+  });
+  app.get("/api/pull-requests/:id/github-attachment", async (context) => {
+    const fetchSite = context.req.header("sec-fetch-site");
+    const origin = context.req.header("origin");
+    if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none" || origin !== void 0 && origin !== options.security.expectedOrigin) {
+      throw new RvwError(
+        "INVALID_ORIGIN",
+        "cross-origin attachment request\u306F\u8A31\u53EF\u3055\u308C\u3066\u3044\u307E\u305B\u3093\u3002",
+        {
+          status: 403
+        }
+      );
     }
-    return context.body(Uint8Array.from(asset.content));
+    const absoluteUrl = requiredQuery(context.req.query("url"), "url");
+    const attachment = await service.getGitHubAttachment(context.req.param("id"), absoluteUrl);
+    setImageResponseHeaders((name, value) => context.header(name, value), attachment.contentType);
+    return context.body(Uint8Array.from(attachment.content));
   });
   app.get("/api/pull-requests/:id/diff", async (context) => {
     const pullRequestId = context.req.param("id");