@deftai/directive-core 0.66.2 → 0.67.0

package/dist/pr-merge-readiness/compute.js

@@ -1,7 +1,9 @@
+import { buildCiSummaryLine, evaluateCiGate } from "./ci-gate.js";
 import { FALLBACK2_NOT_CLEAN_MSG, VIA_ERROR, VIA_FALLBACK1, VIA_FALLBACK2, VIA_PRIMARY, } from "./constants.js";
 import { evaluateGates, isMergeReady } from "./evaluate.js";
 import { fetchCheckRunsRest, fetchGreptileBodyRest, fetchGreptileCommentBody, fetchPrHeadSha, fetchPrHeadShaRest, resolveRepo, } from "./gh.js";
 import { emptyVerdict, parseGreptileBody } from "./parse.js";
+import { evaluateSlizardGate, isSlizardCheck } from "./slizard-gate.js";
 function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, error = null) {
     const verdict = parseGreptileBody(body);
     const failures = evaluateGates(prNumber, headSha, verdict);
@@ -16,7 +18,75 @@ function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, e
         error,
     };
 }
-function computePrimary(prNumber, repo, runGh) {
+/** Run the CI + SLizard gates off a single check-runs fetch (#2169 / #2189). */
+function evaluateCiAndSlizard(checkRuns, options) {
+    const slizardResult = evaluateSlizardGate(checkRuns, options);
+    // The SLizard check is scored by the structured gate, so exclude it from the
+    // generic CI required set to avoid double-counting the same run.
+    const slizardNames = checkRuns.filter((r) => isSlizardCheck(r.name)).map((r) => r.name);
+    const ciOptions = {
+        skipCi: options.skipCi,
+        ignoreCheckNames: [...(options.ignoreCheckNames ?? []), ...slizardNames],
+    };
+    const ciResult = evaluateCiGate(checkRuns, ciOptions);
+    return {
+        failures: [...ciResult.failures, ...slizardResult.failures],
+        ci: { ...ciResult.summary, summary_line: buildCiSummaryLine(ciResult.summary) },
+        slizard: { ...slizardResult.summary },
+    };
+}
+function applyCiGateForHead(repo, headSha, runGh, options) {
+    if (repo === null) {
+        return {
+            failures: [
+                "Could not resolve repo for required CI check-run gate. " +
+                    "Use --repo OWNER/REPO or run from a checked-out repository.",
+            ],
+            ci: {
+                ready_state: "blocked",
+                error: "repo unresolved for check-runs lookup",
+            },
+            slizard: {
+                ready_state: "skipped",
+                present: false,
+                summary_line: "SLizard review: skipped (repo unresolved for check-runs lookup)",
+            },
+        };
+    }
+    // When CI is skipped we do not fetch check-runs, so the SLizard gate cannot
+    // evaluate either; run both gates against an empty set to honor the overrides.
+    if (options.skipCi === true) {
+        const outcome = evaluateCiAndSlizard([], options);
+        outcome.ci.summary_line = "CI check-runs: skipped (--skip-ci)";
+        return { failures: outcome.failures, ci: outcome.ci, slizard: outcome.slizard };
+    }
+    const check = fetchCheckRunsRest(headSha, repo, runGh);
+    if (check.summary === null) {
+        return {
+            failures: [
+                "Required CI check-runs could not be fetched; fail closed by default (#2169). " +
+                    `Root cause: ${check.error}`,
+            ],
+            ci: {
+                ready_state: "blocked",
+                error: check.error,
+                checked_count: 0,
+                ignored_checks: [...(options.ignoreCheckNames ?? [])],
+                failed_required: [],
+                pending_required: [],
+                conclusions: [],
+            },
+            slizard: {
+                ready_state: "skipped",
+                present: false,
+                summary_line: `SLizard review: skipped (check-runs unavailable: ${check.error})`,
+            },
+        };
+    }
+    const outcome = evaluateCiAndSlizard(check.checkRuns, options);
+    return { failures: outcome.failures, ci: outcome.ci, slizard: outcome.slizard };
+}
+function computePrimary(prNumber, repo, runGh, options) {
     const partial = {};
     const headSha = fetchPrHeadSha(prNumber, repo, runGh);
     if (headSha === null) {
@@ -31,6 +101,14 @@ function computePrimary(prNumber, repo, runGh) {
     }
     const verdict = parseGreptileBody(body);
     const failures = evaluateGates(prNumber, headSha, verdict);
+    const partialData = {};
+    if (failures.length === 0) {
+        const resolved = resolveRepo(repo, runGh);
+        const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
+        failures.push(...ci.failures);
+        partialData.ci = ci.ci;
+        partialData.slizard = ci.slizard;
+    }
     return {
         result: {
             prNumber,
@@ -39,13 +117,13 @@ function computePrimary(prNumber, repo, runGh) {
             verdict,
             failures,
             via: VIA_PRIMARY,
-            partialData: {},
+            partialData,
             error: null,
         },
         partial,
     };
 }
-function computeFallback1(prNumber, repo, primaryPartial, runGh) {
+function computeFallback1(prNumber, repo, primaryPartial, runGh, options) {
     const partial = { ...primaryPartial };
     const resolved = resolveRepo(repo, runGh);
     if (resolved.repo === null) {
@@ -75,6 +153,12 @@ function computeFallback1(prNumber, repo, primaryPartial, runGh) {
             partialData[key] = value;
         }
     }
+    if (failures.length === 0) {
+        const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
+        failures.push(...ci.failures);
+        partialData.ci = ci.ci;
+        partialData.slizard = ci.slizard;
+    }
     return {
         result: {
             prNumber,
@@ -191,12 +275,12 @@ function errorResult(prNumber, repo, partial) {
     };
 }
 /** Run the primary->fallback1->fallback2 cascade and return a result. */
-export function computeGateResult(prNumber, repo, runGh) {
-    let { result, partial } = computePrimary(prNumber, repo, runGh);
+export function computeGateResult(prNumber, repo, runGh, options = {}) {
+    let { result, partial } = computePrimary(prNumber, repo, runGh, options);
     if (result !== null) {
         return result;
     }
-    ({ result, partial } = computeFallback1(prNumber, repo, partial, runGh));
+    ({ result, partial } = computeFallback1(prNumber, repo, partial, runGh, options));
     if (result !== null) {
         return result;
     }

package/dist/pr-merge-readiness/gh.d.ts

@@ -1,4 +1,11 @@
 import type { RunGhFn, RunGhResult } from "./types.js";
+export interface CheckRunRecord {
+    readonly name: string;
+    readonly status: string;
+    readonly conclusion: string;
+    /** check-run `output.summary` text, when present (used by the SLizard verdict gate, #2189). */
+    readonly summary?: string;
+}
 /** UTF-8-safe gh capture via execFile (no shell) — mirrors _safe_subprocess.run_text (#1366). */
 export declare function defaultRunGh(cmd: readonly string[]): RunGhResult;
 export declare function fetchPrHeadSha(prNumber: number, repo: string | null, runGh: RunGhFn): string | null;
@@ -17,6 +24,7 @@ export declare function fetchPrHeadShaRest(prNumber: number, repo: string, runGh
 };
 export declare function fetchCheckRunsRest(sha: string, repo: string, runGh: RunGhFn): {
     summary: Record<string, unknown> | null;
+    checkRuns: CheckRunRecord[];
     error: string;
 };
 //# sourceMappingURL=gh.d.ts.map

package/dist/pr-merge-readiness/gh.js

@@ -229,16 +229,30 @@ export function fetchPrHeadShaRest(prNumber, repo, runGh) {
     }
     return { sha: null, error: "PR JSON missing head.sha" };
 }
+/** Pull the `output.summary` string off a raw check-run payload, if present (#2189). */
+function extractCheckRunSummary(run) {
+    const output = run.output;
+    if (output === null || typeof output !== "object" || Array.isArray(output)) {
+        return null;
+    }
+    const summary = output.summary;
+    return typeof summary === "string" && summary.length > 0 ? summary : null;
+}
 export function fetchCheckRunsRest(sha, repo, runGh) {
     const rc = runGh(["gh", "api", `repos/${repo}/commits/${sha}/check-runs`]);
     if (rc.returncode !== 0) {
         return {
             summary: null,
+            checkRuns: [],
             error: `gh api /commits/${"<"}sha>/check-runs failed: ${rc.stderr.trim()}`,
         };
     }
     if (!rc.stdout.trim()) {
-        return { summary: null, error: "empty body from gh api /commits/<sha>/check-runs" };
+        return {
+            summary: null,
+            checkRuns: [],
+            error: "empty body from gh api /commits/<sha>/check-runs",
+        };
     }
     let payload;
     try {
@@ -246,20 +260,22 @@ export function fetchCheckRunsRest(sha, repo, runGh) {
     }
     catch (exc) {
         const message = exc instanceof Error ? exc.message : String(exc);
-        return { summary: null, error: `could not parse check-runs JSON: ${message}` };
+        return { summary: null, checkRuns: [], error: `could not parse check-runs JSON: ${message}` };
     }
     if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
-        return { summary: null, error: "unexpected check-runs JSON shape (not a dict)" };
+        return { summary: null, checkRuns: [], error: "unexpected check-runs JSON shape (not a dict)" };
     }
     const runs = payload.check_runs;
     if (!Array.isArray(runs)) {
-        return { summary: null, error: "check-runs JSON missing check_runs list" };
+        return { summary: null, checkRuns: [], error: "check-runs JSON missing check_runs list" };
     }
+    const checkRuns = [];
     const summary = {
         total: runs.length,
         by_status: {},
         by_conclusion: {},
         greptile_review: null,
+        slizard_review: null,
     };
     const byStatus = summary.by_status;
     const byConclusion = summary.by_conclusion;
@@ -270,12 +286,21 @@ export function fetchCheckRunsRest(sha, repo, runGh) {
         const r = run;
         const status = typeof r.status === "string" ? r.status : "unknown";
         const conclusion = typeof r.conclusion === "string" ? r.conclusion : "none";
+        const name = typeof r.name === "string" && r.name.length > 0 ? r.name : "<unnamed>";
+        const runSummary = extractCheckRunSummary(r);
+        const record = runSummary === null
+            ? { name, status, conclusion }
+            : { name, status, conclusion, summary: runSummary };
+        checkRuns.push(record);
         byStatus[status] = (byStatus[status] ?? 0) + 1;
         byConclusion[conclusion] = (byConclusion[conclusion] ?? 0) + 1;
         if (r.name === "Greptile Review") {
             summary.greptile_review = { status, conclusion };
         }
+        if (name.toLowerCase().includes("slizard")) {
+            summary.slizard_review = { status, conclusion };
+        }
     }
-    return { summary, error: "" };
+    return { summary, checkRuns, error: "" };
 }
 //# sourceMappingURL=gh.js.map

package/dist/pr-merge-readiness/index.d.ts

@@ -1,3 +1,4 @@
+export { buildCiSummaryLine, evaluateCiGate } from "./ci-gate.js";
 export { computeGateResult } from "./compute.js";
 export * from "./constants.js";
 export { evaluateGates, isMergeReady } from "./evaluate.js";
@@ -5,5 +6,7 @@ export { defaultRunGh } from "./gh.js";
 export { cmdPrMergeReadiness, parseArgs, run } from "./main.js";
 export { emitJson, exitCodeFor, gateResultToDict, printHuman } from "./output.js";
 export { emptyVerdict, isInformalCleanMissingCanonicalFields, parseGreptileBody } from "./parse.js";
+export type { SlizardGateOptions, SlizardGateResult, SlizardGateSummary, SlizardVerdict, } from "./slizard-gate.js";
+export { evaluateSlizardGate, isSlizardCheck, parseSlizardVerdict, SLIZARD_CHECK_NAME, } from "./slizard-gate.js";
 export type { GateResult, GreptileVerdict, RunGhFn, RunGhResult } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/pr-merge-readiness/index.js

@@ -1,3 +1,4 @@
+export { buildCiSummaryLine, evaluateCiGate } from "./ci-gate.js";
 export { computeGateResult } from "./compute.js";
 export * from "./constants.js";
 export { evaluateGates, isMergeReady } from "./evaluate.js";
@@ -5,4 +6,5 @@ export { defaultRunGh } from "./gh.js";
 export { cmdPrMergeReadiness, parseArgs, run } from "./main.js";
 export { emitJson, exitCodeFor, gateResultToDict, printHuman } from "./output.js";
 export { emptyVerdict, isInformalCleanMissingCanonicalFields, parseGreptileBody } from "./parse.js";
+export { evaluateSlizardGate, isSlizardCheck, parseSlizardVerdict, SLIZARD_CHECK_NAME, } from "./slizard-gate.js";
 //# sourceMappingURL=index.js.map

package/dist/pr-merge-readiness/main.d.ts

@@ -3,6 +3,9 @@ export interface ParsedArgs {
     readonly prNumber: number | null;
     readonly repo: string | null;
     readonly emitJson: boolean;
+    readonly skipCi: boolean;
+    readonly skipSlizard: boolean;
+    readonly ciIgnoreChecks: readonly string[];
     readonly error?: string;
 }
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/pr-merge-readiness/main.js

@@ -5,15 +5,51 @@ export function parseArgs(argv) {
     let prNumber = null;
     let repo = null;
     let json = false;
+    let skipCi = false;
+    let skipSlizard = false;
+    const ciIgnoreChecks = [];
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
         if (arg === "--json") {
             json = true;
         }
+        else if (arg === "--skip-ci") {
+            skipCi = true;
+        }
+        else if (arg === "--skip-slizard") {
+            skipSlizard = true;
+        }
+        else if (arg === "--ci-ignore-check") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return {
+                    prNumber,
+                    repo,
+                    emitJson: json,
+                    skipCi,
+                    skipSlizard,
+                    ciIgnoreChecks,
+                    error: "argument --ci-ignore-check: expected one argument",
+                };
+            }
+            ciIgnoreChecks.push(value);
+            i += 1;
+        }
+        else if (arg?.startsWith("--ci-ignore-check=")) {
+            ciIgnoreChecks.push(arg.slice("--ci-ignore-check=".length));
+        }
         else if (arg === "--repo") {
             const value = argv[i + 1];
             if (value === undefined) {
-                return { prNumber, repo, emitJson: json, error: "argument --repo: expected one argument" };
+                return {
+                    prNumber,
+                    repo,
+                    emitJson: json,
+                    skipCi,
+                    skipSlizard,
+                    ciIgnoreChecks,
+                    error: "argument --repo: expected one argument",
+                };
             }
             repo = value;
             i += 1;
@@ -22,17 +58,41 @@ export function parseArgs(argv) {
             repo = arg.slice("--repo=".length);
         }
         else if (arg?.startsWith("-")) {
-            return { prNumber, repo, emitJson: json, error: `unrecognized arguments: ${arg}` };
+            return {
+                prNumber,
+                repo,
+                emitJson: json,
+                skipCi,
+                skipSlizard,
+                ciIgnoreChecks,
+                error: `unrecognized arguments: ${arg}`,
+            };
         }
         else if (prNumber === null) {
             const n = Number(arg);
             if (!Number.isInteger(n) || n <= 0) {
-                return { prNumber, repo, emitJson: json, error: `invalid PR number: ${arg}` };
+                return {
+                    prNumber,
+                    repo,
+                    emitJson: json,
+                    skipCi,
+                    skipSlizard,
+                    ciIgnoreChecks,
+                    error: `invalid PR number: ${arg}`,
+                };
             }
             prNumber = n;
         }
         else {
-            return { prNumber, repo, emitJson: json, error: `unrecognized arguments: ${arg}` };
+            return {
+                prNumber,
+                repo,
+                emitJson: json,
+                skipCi,
+                skipSlizard,
+                ciIgnoreChecks,
+                error: `unrecognized arguments: ${arg}`,
+            };
         }
     }
     if (prNumber === null) {
@@ -40,10 +100,13 @@ export function parseArgs(argv) {
             prNumber,
             repo,
             emitJson: json,
+            skipCi,
+            skipSlizard,
+            ciIgnoreChecks,
             error: "the following arguments are required: pr_number",
         };
     }
-    return { prNumber, repo, emitJson: json };
+    return { prNumber, repo, emitJson: json, skipCi, skipSlizard, ciIgnoreChecks };
 }
 export function run(argv, options = {}) {
     const args = parseArgs(argv);
@@ -52,7 +115,11 @@ export function run(argv, options = {}) {
         return 2;
     }
     const runGh = options.runGh ?? defaultRunGh;
-    const result = computeGateResult(args.prNumber, args.repo, runGh);
+    const result = computeGateResult(args.prNumber, args.repo, runGh, {
+        skipCi: args.skipCi,
+        skipSlizard: args.skipSlizard,
+        ignoreCheckNames: args.ciIgnoreChecks,
+    });
     if (args.emitJson) {
         process.stdout.write(emitJson(result));
     }

package/dist/pr-merge-readiness/output.js

@@ -53,6 +53,26 @@ export function printHuman(result) {
     lines.push(`  Findings:           P0=${result.verdict.p0Count}  ` +
         `P1=${result.verdict.p1Count}  P2=${result.verdict.p2Count}`);
     lines.push(`  Errored sentinel:   ${result.verdict.errored ? "True" : "False"}`);
+    const ciBlock = result.partialData.ci;
+    if (ciBlock !== null && typeof ciBlock === "object" && !Array.isArray(ciBlock)) {
+        const ci = ciBlock;
+        if (typeof ci.summary_line === "string") {
+            lines.push(`  ${ci.summary_line}`);
+        }
+        else if (typeof ci.ready_state === "string") {
+            lines.push(`  CI check-runs: ${ci.ready_state}`);
+        }
+    }
+    const slizardBlock = result.partialData.slizard;
+    if (slizardBlock !== null && typeof slizardBlock === "object" && !Array.isArray(slizardBlock)) {
+        const slizard = slizardBlock;
+        if (typeof slizard.summary_line === "string") {
+            lines.push(`  ${slizard.summary_line}`);
+        }
+        else if (typeof slizard.ready_state === "string") {
+            lines.push(`  SLizard review: ${slizard.ready_state}`);
+        }
+    }
     if (result.via === VIA_FALLBACK2 && Object.keys(result.partialData).length > 0) {
         lines.push("  Fallback2 signal:");
         for (const key of ["pr_state", "merged", "mergeable", "mergeable_state"]) {

package/dist/pr-merge-readiness/slizard-gate.d.ts

@@ -0,0 +1,47 @@
+import type { CheckRunRecord } from "./gh.js";
+/**
+ * Dedicated gate for the SLizard second-reviewer verdict (#2189).
+ *
+ * SLizard posts a check-run whose `output.summary` carries a structured verdict:
+ *
+ *   Decision: request_changes
+ *   Merge impact: blocking
+ *   Findings: 2 (P0: 0, P1: 1, P2: 0, P3: 0)
+ *
+ * The generic CI check-run gate (#2169) only fails closed on a check-run
+ * `conclusion` in the failed set, so a blocking *decision* carried on a
+ * non-`failure` conclusion (e.g. `neutral`) would slip through and the review
+ * is surfaced indistinctly among build/test checks. This gate parses the
+ * structured verdict and fails merge-readiness on a blocking decision.
+ */
+/** Canonical SLizard check-run name; matching is case-insensitive substring for resilience. */
+export declare const SLIZARD_CHECK_NAME = "SLizard";
+export type SlizardReadyState = "ready" | "blocked" | "not_ready_yet" | "skipped";
+export interface SlizardGateOptions {
+    readonly skipSlizard?: boolean;
+}
+export interface SlizardVerdict {
+    readonly decision: string | null;
+    readonly mergeImpact: string | null;
+    readonly p0Count: number | null;
+    readonly p1Count: number | null;
+    readonly p2Count: number | null;
+}
+export interface SlizardGateSummary {
+    readonly ready_state: SlizardReadyState;
+    readonly present: boolean;
+    readonly check_name: string | null;
+    readonly status: string | null;
+    readonly conclusion: string | null;
+    readonly verdict: SlizardVerdict | null;
+    readonly summary_line: string;
+}
+export interface SlizardGateResult {
+    readonly failures: readonly string[];
+    readonly summary: SlizardGateSummary;
+}
+export declare function isSlizardCheck(name: string): boolean;
+/** Parse a SLizard check-run `output.summary` into a structured verdict. */
+export declare function parseSlizardVerdict(summary: string | undefined | null): SlizardVerdict;
+export declare function evaluateSlizardGate(checkRuns: readonly CheckRunRecord[], options?: SlizardGateOptions): SlizardGateResult;
+//# sourceMappingURL=slizard-gate.d.ts.map

package/dist/pr-merge-readiness/slizard-gate.js

@@ -0,0 +1,119 @@
+/**
+ * Dedicated gate for the SLizard second-reviewer verdict (#2189).
+ *
+ * SLizard posts a check-run whose `output.summary` carries a structured verdict:
+ *
+ *   Decision: request_changes
+ *   Merge impact: blocking
+ *   Findings: 2 (P0: 0, P1: 1, P2: 0, P3: 0)
+ *
+ * The generic CI check-run gate (#2169) only fails closed on a check-run
+ * `conclusion` in the failed set, so a blocking *decision* carried on a
+ * non-`failure` conclusion (e.g. `neutral`) would slip through and the review
+ * is surfaced indistinctly among build/test checks. This gate parses the
+ * structured verdict and fails merge-readiness on a blocking decision.
+ */
+/** Canonical SLizard check-run name; matching is case-insensitive substring for resilience. */
+export const SLIZARD_CHECK_NAME = "SLizard";
+const FAILED_CONCLUSIONS = new Set(["failure", "cancelled", "timed_out"]);
+const PENDING_STATUSES = new Set(["queued", "in_progress"]);
+const BLOCKING_DECISIONS = new Set(["request_changes", "changes_requested", "reject"]);
+export function isSlizardCheck(name) {
+    return name.toLowerCase().includes("slizard");
+}
+function firstMatch(text, re) {
+    const m = re.exec(text);
+    return m?.[1] !== undefined ? m[1].trim() : null;
+}
+function countFor(text, sev) {
+    const m = new RegExp(`${sev}\\s*:\\s*(\\d+)`, "i").exec(text);
+    return m?.[1] !== undefined ? Number.parseInt(m[1], 10) : null;
+}
+/** Parse a SLizard check-run `output.summary` into a structured verdict. */
+export function parseSlizardVerdict(summary) {
+    const text = summary ?? "";
+    const decision = firstMatch(text, /Decision\s*:\s*([A-Za-z_]+)/i);
+    const mergeImpact = firstMatch(text, /Merge impact\s*:\s*([A-Za-z_-]+)/i);
+    return {
+        decision: decision ? decision.toLowerCase() : null,
+        mergeImpact: mergeImpact ? mergeImpact.toLowerCase() : null,
+        p0Count: countFor(text, "P0"),
+        p1Count: countFor(text, "P1"),
+        p2Count: countFor(text, "P2"),
+    };
+}
+function skippedSummary(reason) {
+    return {
+        ready_state: "skipped",
+        present: false,
+        check_name: null,
+        status: null,
+        conclusion: null,
+        verdict: null,
+        summary_line: `SLizard review: skipped (${reason})`,
+    };
+}
+function isPending(status, conclusion) {
+    if (PENDING_STATUSES.has(status)) {
+        return true;
+    }
+    return status !== "completed" || conclusion === "none";
+}
+export function evaluateSlizardGate(checkRuns, options = {}) {
+    if (options.skipSlizard === true) {
+        return { failures: [], summary: skippedSummary("--skip-slizard") };
+    }
+    const run = checkRuns.find((r) => isSlizardCheck(r.name));
+    if (run === undefined) {
+        // SLizard is an optional second reviewer; its absence does not block merge.
+        return { failures: [], summary: skippedSummary("no SLizard check-run on this commit") };
+    }
+    const verdict = parseSlizardVerdict(run.summary);
+    const blockingDecision = verdict.decision !== null && BLOCKING_DECISIONS.has(verdict.decision);
+    const blockingImpact = verdict.mergeImpact === "blocking";
+    const failedConclusion = FAILED_CONCLUSIONS.has(run.conclusion);
+    const failures = [];
+    let readyState;
+    if (blockingDecision || blockingImpact || failedConclusion) {
+        readyState = "blocked";
+        const reasons = [];
+        if (verdict.decision !== null) {
+            reasons.push(`decision=${verdict.decision}`);
+        }
+        if (verdict.mergeImpact !== null) {
+            reasons.push(`merge impact=${verdict.mergeImpact}`);
+        }
+        if (failedConclusion) {
+            reasons.push(`conclusion=${run.conclusion}`);
+        }
+        const findings = verdict.p0Count !== null || verdict.p1Count !== null || verdict.p2Count !== null
+            ? ` (P0=${verdict.p0Count ?? 0} P1=${verdict.p1Count ?? 0} P2=${verdict.p2Count ?? 0})`
+            : "";
+        failures.push(`SLizard review is blocking: ${reasons.join(", ")}${findings}. ` +
+            "Resolve the SLizard findings or pass --skip-slizard to override (#2189).");
+    }
+    else if (isPending(run.status, run.conclusion)) {
+        readyState = "not_ready_yet";
+        failures.push(`SLizard review still in progress (${run.status}); wait for the verdict before merge (#2189).`);
+    }
+    else {
+        readyState = "ready";
+    }
+    const parts = [
+        `decision=${verdict.decision ?? "?"}`,
+        `impact=${verdict.mergeImpact ?? "?"}`,
+    ];
+    return {
+        failures,
+        summary: {
+            ready_state: readyState,
+            present: true,
+            check_name: run.name,
+            status: run.status,
+            conclusion: run.conclusion,
+            verdict,
+            summary_line: `SLizard review: ${readyState} (${parts.join(", ")})`,
+        },
+    };
+}
+//# sourceMappingURL=slizard-gate.js.map

package/dist/preflight-cache/evaluate.d.ts

@@ -34,6 +34,7 @@ export interface EvaluateOptions {
     /** Injectable drift probe for tests. */
     probeDriftFn?: (repo: string, cacheRoot: string, source: string) => CacheDriftProbeResult | null;
 }
+export declare function normaliseRepoUrl(url: string): string | null;
 /**
  * Branch-aware recovery hint (#1953 Option 3).
  * Age-stale (or age+drift mixed) → --force bypasses TTL; drift-only → plain refetch.

package/dist/preflight-cache/evaluate.js

@@ -44,19 +44,26 @@ function inferRepoFromGit(projectRoot) {
         return null;
     }
 }
-function normaliseRepoUrl(url) {
+export function normaliseRepoUrl(url) {
     if (!url)
         return null;
-    const cleaned = url.replace(/\/$/, "").replace(/\.git$/, "");
-    if (!cleaned.includes("github.com"))
+    const cleaned = url
+        .trim()
+        .replace(/\/$/, "")
+        .replace(/\.git$/, "");
+    // Match `github.com` only as the HOST component of the remote URL: right
+    // after an optional scheme and optional `user@`, and immediately followed by
+    // `:` or `/`. A plain `includes("github.com")` would also accept spoofed
+    // hosts like `github.com.evil.com` or `evil.com/github.com/...` (CodeQL
+    // js/incomplete-url-substring-sanitization). Supports https/ssh/git schemes
+    // and the scp-like `git@github.com:owner/repo` form.
+    const match = cleaned.match(/^(?:(?:https?|ssh|git):\/\/)?(?:[^/@]+@)?github\.com[:/]+([^/]+)\/([^/]+)/i);
+    if (!match)
         return null;
-    const tail = cleaned
-        .split("github.com")
-        .pop()
-        ?.replace(/^[:/]+/, "") ?? "";
-    const parts = tail.split("/");
-    if (parts.length >= 2 && parts[0] && parts[1]) {
-        return `${parts[0]}/${parts[1]}`;
+    const owner = match[1];
+    const repo = match[2];
+    if (owner && repo) {
+        return `${owner}/${repo}`;
     }
     return null;
 }