@agentsdance/codejury 0.1.1 → 0.1.2

package/bin/jury.js

@@ -56,7 +56,6 @@ Common flags
   --agents codex,grok      only these reviewers           (default: all installed)
   --judge codex            one agent that triages and fixes       (default: claude)
   --no-push                fix locally, do not push
-  --dry-run                exercise the pipeline, spawn nothing
 
 Other commands
 
@@ -95,7 +94,9 @@ review                           (drives itself; no operator between rounds)
   --web              open the console on this run          (stays up when it ends)
   --port <n>         console port, with --web              (default 3080)
   --no-push          commit fixes to the worktree without pushing
-  --dry-run          exercise the pipeline, spawn nothing
+  --dry-run          (internal) exercise the pipeline, spawn no agents. Always
+                     reports clean and triages nothing, so it says whether the
+                     plumbing runs and never whether the code is good.
 
 review-once flags
   --dir <path>       repo/worktree       (default: cwd if Git, otherwise ~/.jury)
@@ -106,7 +107,6 @@ review-once flags
   --round <n>        round number                            (default: next)
   --agents a,b       only these reviewers                    (default: all enabled)
   --max-rounds <n>   keep going until every reviewer approves, at most n (default 1)
-  --dry-run          do not spawn anything; exercise the pipeline
 
 web flags
   --dir <path>       run-state root       (default: cwd if Git, otherwise ~/.jury)
@@ -535,7 +535,7 @@ async function cmdAgent(argv) {
   values.push = values.push && !values["no-push"];
   const requestedWorktree = await commandDirectory(values.dir);
   const resolved = values.pr
-    ? await resolvePrCheckout(values.pr, { allowPush: values.push })
+    ? await resolvePrCheckout(values.pr, { allowPush: values.push, dir: requestedWorktree })
     : null;
   const worktree = resolved?.worktree ?? requestedWorktree;
   resolvedCheckoutCleanup = resolved?.cleanup ?? null;

package/lib/repository.js

@@ -5,8 +5,8 @@
 // PR's name. Keep this check independent of a hosting CLI so it also works for
 // self-hosted GitHub and GitLab instances.
 import { execFile } from "node:child_process";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 
@@ -117,27 +117,222 @@ function branchAtHead(stdout, sha) {
 
 class MergeRequestCheckoutError extends Error {}
 
+/**
+ * Fetch a merge request's head, falling back to numbered revision refs.
+ *
+ * Not every GitLab-compatible host publishes refs/merge-requests/<id>/head.
+ * Some expose the individual revisions instead, as
+ * refs/merge-requests/<id>/<id>/<revision>, where the highest revision is the
+ * current head. Returns the advertised sha when that fallback was used, so the
+ * caller can check the fetched commit against what the remote said: a request
+ * updated mid-fetch would otherwise be reviewed as though it were the head.
+ */
+async function fetchMergeRequestHead(exec, worktree, number) {
+  const options = { cwd: worktree };
+  try {
+    await exec("git", ["fetch", "origin", `refs/merge-requests/${number}/head`], options);
+    return null;
+  } catch (err) {
+    // Only a genuinely absent ref justifies looking elsewhere. An auth or
+    // transport failure keeps its own error, or every network problem would be
+    // reported as an unusual ref layout.
+    if (!/couldn't find remote ref/i.test(String(err.stderr ?? "") + String(err.message))) throw err;
+    const prefix = `refs/merge-requests/${number}/${number}/`;
+    const { stdout } = await exec("git", ["ls-remote", "--refs", "origin", `${prefix}*`], options);
+    const revisions = String(stdout).split("\n").flatMap((line) => {
+      const [sha, ref] = line.trim().split(/\s+/);
+      if (!/^[a-f\d]{40,64}$/i.test(sha ?? "") || !ref?.startsWith(prefix)) return [];
+      const revision = ref.slice(prefix.length);
+      // Numeric, so revision 10 sorts above revision 9 rather than beside 1.
+      return /^[1-9]\d*$/.test(revision) ? [{ sha, ref, revision: BigInt(revision) }] : [];
+    });
+    revisions.sort((a, b) => (a.revision > b.revision ? -1 : a.revision < b.revision ? 1 : 0));
+    if (!revisions.length) throw err; // no revisions either: the original error is the true one
+    const latest = revisions[0];
+    await exec("git", ["fetch", "--quiet", "origin", latest.ref], options);
+    return latest.sha;
+  }
+}
+
+/**
+ * Make origin/<trunk> resolvable in a clone taken from local disk. Best effort:
+ * offline the review may still fail, but it fails saying so rather than
+ * appearing to resolve and then diffing against a ref that is not there.
+ */
+async function ensureTrunkRef(worktree, trunk, { exec }) {
+  try {
+    await exec("git", ["rev-parse", "--verify", `refs/remotes/origin/${trunk}^{commit}`], { cwd: worktree });
+    return;
+  } catch { /* not present: try to bring it in */ }
+  try {
+    await exec("git", ["fetch", "--quiet", "origin",
+      `refs/heads/${trunk}:refs/remotes/origin/${trunk}`], { cwd: worktree });
+  } catch { /* offline: leave it, the review reports the real failure */ }
+}
+
+/**
+ * Whether a repository already contains a specific commit — and is the
+ * repository the request actually names. The identity check is not optional:
+ * an unrelated checkout holding the same commit would be reviewed under this
+ * request's name.
+ */
+async function hasCommit(dir, sha, { exec, target }) {
+  if (!dir || !sha || !await sameRepository(dir, target, { exec })) return false;
+  try {
+    await exec("git", ["-C", dir, "rev-parse", "--verify", `${sha}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The commit a merge request points at, if this machine already has it.
+ *
+ * The head ref is the fragile part of resolving a merge request: GitLab prunes
+ * refs/merge-requests/<id>/head once a request is merged or old, so fetching it
+ * fails for requests that are otherwise perfectly reviewable. A repository that
+ * already contains the commits does not need that ref at all — and reviewing a
+ * branch you already have is the common case, not the exception.
+ *
+ * Read-only by construction: this resolves a revision and never checks anything
+ * out, because `jury <url>` run from master must not move the caller's tree.
+ */
+/**
+ * Whether a directory is a checkout of the repository the URL names.
+ *
+ * The URL names one repository; a local checkout of a DIFFERENT one that
+ * happens to hold the same ref or commit would review unrelated code under this
+ * request's name. Every local shortcut passes through here first.
+ */
+async function sameRepository(dir, target, { exec }) {
+  if (!dir || !target) return false;
+  try {
+    const { stdout } = await exec("git", ["-C", dir, "remote", "-v"]);
+    return String(stdout).split("\n").some((line) => {
+      const url = line.split(/\s+/)[1];
+      return url && repositoryFromRemote(url)?.display === target.display;
+    });
+  } catch {
+    return false; // not a repository, or no remotes: nothing to match against
+  }
+}
+
+async function localHead(dir, target, number, { exec, namespace, branch = null }) {
+  if (!dir || !await sameRepository(dir, target, { exec })) return null;
+
+  // Only the numbered ref. FETCH_HEAD was also consulted here, and it is not
+  // evidence of anything: it holds whatever the last fetch left behind, which
+  // after `git fetch origin main` is main. That resolved the wrong commit under
+  // this request's name, and — since branchAtHead then matched main on the
+  // remote — could make main the push target of a review that never examined it.
+  try {
+    const { stdout } = await exec(
+      "git", ["-C", dir, "rev-parse", "--verify", `${namespace}/${number}/head^{commit}`],
+    );
+    if (stdout.trim()) return stdout.trim();
+  } catch { /* an ordinary clone has no numbered ref; try the branch below */ }
+
+  // The numbered ref is the exception, not the rule: a normal clone or a
+  // source-branch checkout has none of them, only branches. Requiring it made
+  // this path unreachable for exactly the people the error told to "check out
+  // the source branch and pass --dir" — advice that could not work.
+  if (!branch) return null;
+  for (const rev of [`refs/remotes/origin/${branch}`, `refs/heads/${branch}`]) {
+    try {
+      const { stdout } = await exec("git", ["-C", dir, "rev-parse", "--verify", `${rev}^{commit}`]);
+      if (stdout.trim()) return stdout.trim();
+    } catch { /* try the next candidate */ }
+  }
+  return null;
+}
+
 async function resolveMergeRequestCheckout(prUrl, target, number, {
-  allowPush, exec, makeTemp, remove,
+  allowPush, exec, makeTemp, remove, dir, home = homedir(),
 }) {
-  const worktree = await makeTemp(path.join(tmpdir(), `jury-mr-${number}-`));
+  // Where the clone lands when one is needed: the same ~/.jury the rest of the
+  // CLI already uses, rather than the system temp directory. The checkout is
+  // still removed when the review ends — this puts jury's working files under
+  // one predictable, inspectable root, and does not make them persist.
+  const worktree = await makeTemp(path.join(home, ".jury", "checkouts", `jury-mr-${number}-`));
+  let advertisedSha = null;
+  // Refresh the cached ref before trusting it. A ref fetched before the author
+  // pushed again names an obsolete head, and nothing about matching repository
+  // identity makes it current — a silent review of superseded code. When the
+  // refresh fails (offline, pruned) the cached ref is still better than nothing,
+  // which is the whole point of the local path.
+  if (dir && await sameRepository(dir, target, { exec })) {
+    try {
+      await exec("git", ["-C", dir, "fetch", "--quiet", "origin",
+        `refs/merge-requests/${number}/head:refs/merge-requests/${number}/head`, "--force"]);
+    } catch { /* keep whatever is cached */ }
+  }
+  const local = await localHead(dir, target, number, { exec, namespace: "refs/merge-requests" });
   try {
-    await exec("git", ["clone", "--quiet", "--no-checkout", cloneUrlForMergeRequest(prUrl, target.path), worktree]);
-    await exec("git", ["fetch", "--quiet", "origin", `refs/merge-requests/${number}/head`], { cwd: worktree });
-    await exec("git", ["checkout", "--quiet", "-b", `jury-mr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    if (local) {
+      // The commits are already here. Clone from disk rather than the network:
+      // no credentials, no head ref, and nothing the host may have pruned.
+      await exec("git", ["clone", "--quiet", "--no-checkout", dir, worktree]);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-mr-${number}`, local], { cwd: worktree });
+      // Cloning from disk points origin at a filesystem path. Left alone, the
+      // branch lookup below would read the local clone and pushTarget would
+      // push into it — a review that never reaches the real remote. Repoint
+      // origin at the repository the URL actually names.
+      await exec("git", ["remote", "set-url", "origin",
+        cloneUrlForMergeRequest(prUrl, target.path)], { cwd: worktree });
+    } else {
+      await exec("git", ["clone", "--quiet", "--no-checkout", cloneUrlForMergeRequest(prUrl, target.path), worktree]);
+      advertisedSha = await fetchMergeRequestHead(exec, worktree, number);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-mr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    }
 
     const { stdout: actualOut } = await exec("git", ["rev-parse", "HEAD"], { cwd: worktree });
     const sha = actualOut.trim();
-    const { stdout: trunkOut } = await exec(
-      "git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: worktree },
-    );
-    const trunk = trunkOut.trim().replace(/^origin\//, "");
-    if (!trunk) throw new MergeRequestCheckoutError(
+    if (advertisedSha && sha !== advertisedSha) {
+      throw new MergeRequestCheckoutError(
+        `merge request !${number} changed while it was being fetched; run the review again`,
+      );
+    }
+    // origin/HEAD comes from the clone SOURCE. Cloning the caller's repository
+    // copies whatever they had checked out, so a user sitting on the request's
+    // own source branch got that branch reported as trunk — and the review then
+    // diffed the branch against itself and saw nothing. Ask the real remote
+    // when the clone came from disk; fall back to the copied ref offline.
+    let trunk = "";
+    if (local) {
+      try {
+        const { stdout } = await exec("git", ["ls-remote", "--symref", "origin", "HEAD"], { cwd: worktree });
+        trunk = String(stdout).match(/^ref:\s+refs\/heads\/(\S+)\s+HEAD/m)?.[1] ?? "";
+      } catch { /* offline: fall through to the local ref */ }
+    }
+    if (!trunk && !local) {
+      // Only for a network clone, where origin/HEAD came from the host. In a
+      // clone taken from disk it was copied from whatever the caller had
+      // checked out — often this request's own source branch, which would make
+      // the review diff the branch against itself and report an empty change.
+      const { stdout: trunkOut } = await exec(
+        "git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: worktree },
+      );
+      trunk = trunkOut.trim().replace(/^origin\//, "");
+    }
+    // A network clone with no default branch is a broken repository, and saying
+    // so is right. A local clone that simply could not reach the host is not:
+    // the CLI applies its own --trunk after this returns, so failing here would
+    // refuse a run the user had already told where trunk is. Leave it empty and
+    // let that flag win; the CLI reports a missing trunk itself if there is none.
+    if (!trunk && !local) throw new MergeRequestCheckoutError(
       `merge request !${number} repository has no default branch`,
     );
 
-    const { stdout: headsOut } = await exec("git", ["ls-remote", "--heads", "origin"], { cwd: worktree });
-    const branch = branchAtHead(headsOut, sha);
+    // Only when a push target is actually needed. This ran unconditionally, so
+    // a --no-push review with every commit already on disk still failed the
+    // moment the network was unreachable — the one case the local path exists
+    // to serve.
+    let branch = null;
+    if (allowPush) {
+      const { stdout: headsOut } = await exec("git", ["ls-remote", "--heads", "origin"], { cwd: worktree });
+      branch = branchAtHead(headsOut, sha);
+    }
     if (allowPush && !branch) {
       throw new MergeRequestCheckoutError(
         `resolved merge request !${number}, but its source branch is not uniquely available on origin — ` +
@@ -157,9 +352,18 @@ async function resolveMergeRequestCheckout(prUrl, target, number, {
   } catch (err) {
     await remove(worktree);
     if (err instanceof MergeRequestCheckoutError) throw err;
+    // git's own words, not a guess. --quiet used to hide them and only the
+    // first line survived, so a pruned head ref — the usual cause — was
+    // reported as a probable authentication problem. Whatever git said is the
+    // one thing that distinguishes the cases.
+    const said = [err.stderr, err.message].map((t) => String(t ?? "").trim()).find(Boolean) ?? "";
+    const missingRef = /couldn't find remote ref|no matching remote head/i.test(said);
     throw new Error(
-      `could not resolve ${target.display} merge request !${number}: ${String(err.message).split("\n")[0]} — ` +
-      "check Git authentication and refs/merge-requests support, or check out the source branch and pass --dir",
+      `could not resolve ${target.display} merge request !${number}: ${said.split("\n")[0]} — ` +
+      (missingRef
+        ? `${target.host} has no refs/merge-requests/${number}/head; hosts prune it once a request ` +
+          "is merged or old. Check out the source branch and pass --dir."
+        : "check Git authentication and refs/merge-requests support, or check out the source branch and pass --dir"),
     );
   }
 }
@@ -185,15 +389,24 @@ function remoteForRepository(origin, repoPath) {
 export async function resolvePrCheckout(prUrl, {
   allowPush = true,
   exec = run,
-  makeTemp = mkdtemp,
+  // Creates the parent too: a checkout under ~/.jury has a directory that may
+  // not exist yet, and a caller that injects this must not need the real one.
+  makeTemp = async (prefix) => {
+    await mkdir(path.dirname(prefix), { recursive: true });
+    return mkdtemp(prefix);
+  },
   remove = (dir) => rm(dir, { recursive: true, force: true }),
+  // The caller's checkout, when it has one. Consulted before the network: a
+  // repository that already holds the request's commits needs no head ref.
+  dir = null,
+  home = homedir(),
 } = {}) {
   const target = repositoryFromPrUrl(prUrl);
   const number = githubNumber(prUrl);
   const mrNumber = mergeRequestNumber(prUrl);
   if (target && mrNumber) {
     return resolveMergeRequestCheckout(prUrl, target, mrNumber, {
-      allowPush, exec, makeTemp, remove,
+      allowPush, exec, makeTemp, remove, dir, home,
     });
   }
   if (!target || !number) {
@@ -229,11 +442,33 @@ export async function resolvePrCheckout(prUrl, {
     );
   }
 
-  const worktree = await makeTemp(path.join(tmpdir(), `jury-pr-${number}-`));
+  const worktree = await makeTemp(path.join(home, ".jury", "checkouts", `jury-pr-${number}-`));
+  // `gh` already gave the authoritative head oid, so that — not a cached ref —
+  // is what to look for locally. Consulting refs/pull/<id>/head first checked
+  // out whatever it pointed at when it was last fetched, which then failed the
+  // assertion below: a stale ref blocked a review whose real head was sitting
+  // in the same repository.
+  // `gh` gives both the oid and the branch name, so a plain checkout of the PR
+  // branch resolves here without any refs/pull ref existing.
+  const local = dir && await hasCommit(dir, details.headRefOid, { exec, target })
+    ? details.headRefOid
+    : await localHead(dir, target, number, {
+      exec, namespace: "refs/pull", branch: details.headRefName,
+    });
   try {
-    await exec("gh", ["repo", "clone", target.display, worktree, "--", "--quiet"]);
-    await exec("git", ["fetch", "--quiet", "origin", `refs/pull/${number}/head`], { cwd: worktree });
-    await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    if (local) {
+      await exec("git", ["clone", "--quiet", "--no-checkout", dir, worktree]);
+      await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, local], { cwd: worktree });
+      await exec("git", ["remote", "set-url", "origin", cloneUrlForMergeRequest(prUrl, target.path)],
+        { cwd: worktree });
+      // Same as the merge request path: a clone of a developer's checkout has
+      // their local branches, not origin/<base>, and every review prompt needs it.
+      await ensureTrunkRef(worktree, details.baseRefName, { exec });
+    } else {
+      await exec("gh", ["repo", "clone", target.display, worktree, "--", "--quiet"]);
+      await exec("git", ["fetch", "origin", `refs/pull/${number}/head`], { cwd: worktree });
+      await exec("git", ["checkout", "--quiet", "-b", `jury-pr-${number}`, "FETCH_HEAD"], { cwd: worktree });
+    }
 
     const { stdout: actual } = await exec("git", ["rev-parse", "HEAD"], { cwd: worktree });
     if (actual.trim() !== details.headRefOid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsdance/codejury",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Independent AI reviewers that iterate until your pull request is clean.",
   "keywords": [
     "code-review",