@expo/code-review-cli 0.14.0 → 0.15.0

package/build/core/render.js

@@ -67,6 +67,27 @@ export function groupBySeverity(findings) {
 export function commentMarker(tag) {
     return `<!-- ${tag} -->`;
 }
+/**
+ * Per-finding identity marker of an inline (PR review) comment, always rendered at
+ * byte 0 of the body. Substring-safe against `commentMarker(tag)` and any derived
+ * scope tag (`<tag>:<scope>`) in both directions — the closing ` -->` differs —
+ * including a scope literally named `inline`.
+ */
+export function inlineCommentMarker(tag, fp) {
+    return `<!-- ${tag}:inline:fp=${fp} -->`;
+}
+/**
+ * The fingerprint an inline comment of OURS carries, or null. Anchored at byte 0
+ * and constrained to the fingerprint alphabet, so a marker echoed later in a body
+ * (untrusted prose, a quote-reply) can never parse as identity — mechanical
+ * safety, not just the incidental "our renderer emits it first". Identity itself
+ * is author + this marker (see the reporter); the parse alone proves nothing.
+ */
+export function parseInlineMarkerFp(body, tag) {
+    const escapedTag = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const match = body.match(new RegExp(`^<!-- ${escapedTag}:inline:fp=([a-f0-9]{6,64}) -->`));
+    return match ? match[1] : null;
+}
 // @ref LLP 0011#forged-state-markers [implements] — the first-match parsers make an earlier forged marker win, so untrusted prose never keeps a raw `<!--`
 /**
  * Neutralize anything that could impersonate this reviewer's embedded state
@@ -233,7 +254,41 @@ function sourceLabel(value) {
         .replace(/>/g, "&gt;")
         .replace(/([\\[\]])/g, "\\$1");
 }
+/** Longest one-line rationale excerpt the short form keeps in the main comment. */
+const SHORT_RATIONALE_CHARS = 160;
+/**
+ * A rationale reduced to one plain line for the short (inlined) form: whitespace
+ * collapsed, every `<` escaped so a truncated HTML block (`<details>`) can never
+ * leave an unclosed tag in the comment, cut at a word boundary with an ellipsis.
+ * This excerpt is the audit trail that survives the PR author collapsing or
+ * resolving the inline thread, so it must always be non-empty when the rationale is.
+ */
+export function oneLineRationale(text) {
+    const flat = text.replace(/</g, "&lt;").replace(/\s+/g, " ").trim();
+    if (flat.length <= SHORT_RATIONALE_CHARS) {
+        return flat;
+    }
+    const cut = flat.slice(0, SHORT_RATIONALE_CHARS);
+    const atWord = cut.slice(0, cut.lastIndexOf(" "));
+    return `${atWord.length > 0 ? atWord : cut}…`;
+}
+/** Only ever link to github.com from a stored/returned URL (see REPLY_URL_RE). */
+function validInlineUrl(link, id) {
+    const url = link?.inlineUrls?.get(id);
+    return url && REPLY_URL_RE.test(url) ? url : null;
+}
 function renderFindingLines(finding, link, id = fingerprintFinding(finding), reply) {
+    const inlineUrl = validInlineUrl(link, id);
+    if (inlineUrl) {
+        // Short form: the full text lives in the inline thread on the flagged line.
+        // The one-line rationale stays here as the durable audit trail (the author
+        // can collapse/resolve the thread; they cannot edit this comment).
+        return [
+            `- **${stripStateMarkers(finding.title)}** — ${location(finding, link)} _(${finding.category})_ · \`id:${id}\` · 💬 [inline comment](${inlineUrl})${replyAnnotation(reply)}`,
+            ...indentContinuation(oneLineRationale(stripStateMarkers(finding.rationale))),
+            "",
+        ];
+    }
     const out = [
         `- **${stripStateMarkers(finding.title)}** — ${location(finding, link)} _(${finding.category})_ · \`id:${id}\`${replyAnnotation(reply)}`,
         ...indentContinuation(stripStateMarkers(finding.rationale)),
@@ -255,6 +310,47 @@ function renderFindingLines(finding, link, id = fingerprintFinding(finding), rep
     out.push("");
     return out;
 }
+/**
+ * Full body of one inline (PR review) finding comment: identity marker at byte 0,
+ * then the finding rendered whole — everything model-written passes
+ * stripStateMarkers, same as the main comment. The footer teaches the clearing
+ * flow (an UNQUOTED id citation), since the main comment only shows the short form.
+ * The body must never contain `:state=`/`:fingerprints=` (it would be dropped as
+ * our own main comment by the reply matcher's backstop) — it doesn't.
+ */
+export function renderInlineCommentBody(finding, tag, fp) {
+    const lines = [
+        inlineCommentMarker(tag, fp),
+        `**${severityHeading(finding.severity)}: ${stripStateMarkers(finding.title)}** _(${finding.category})_ · \`id:${fp}\``,
+        "",
+        stripStateMarkers(finding.rationale),
+    ];
+    if (finding.sources?.length) {
+        const sources = finding.sources
+            .map((source) => `[${sourceLabel(source.title)}](<${source.url}>)`)
+            .join(", ");
+        lines.push("", `**Sources:** ${sources}`);
+    }
+    if (finding.suggestion) {
+        lines.push("", `**Suggestion:** ${stripStateMarkers(finding.suggestion)}`);
+    }
+    lines.push("", "---", `_🤖 AI review finding — reply here to respond; write \`id:${fp}\` (outside any quote) in your reply to formally answer it. Full review in the main PR comment._`);
+    return lines.join("\n");
+}
+/**
+ * What a no-longer-tracked inline comment is patched to when its thread has human
+ * replies (a bare one is deleted instead). Deliberately NEUTRAL: a finding leaves
+ * the inline set for many reasons that are not resolution — capped out, its line
+ * left the diff, aggregate-state truncation — so this text must never assert
+ * "resolved" or "dismissed". The marker stays, so a returning finding revives the
+ * same thread instead of opening a new one.
+ */
+export function inlineStubBody(tag, fp) {
+    return [
+        inlineCommentMarker(tag, fp),
+        "_🤖 This finding is no longer tracked inline — see the main review comment for current status._",
+    ].join("\n");
+}
 // @ref LLP 0012#run-points-command-and-review [implements] — setup advice renders outside the findings list, so it never blocks
 /** Advice about the reviewer's own setup (stale refs, cited code this PR moves). */
 function setupNote(notes = []) {

package/build/core/responses.js

@@ -15,6 +15,21 @@ const FINDING_ID_RE = /\bid:([a-f0-9]{6,64})\b/gi;
  * would let the review answer itself, so this is the tag-independent backstop.
  */
 const OWN_COMMENT_RE = /<!--[^\n]*:(?:state|fingerprints)=/;
+/** The tag-independent shape of an inline finding comment's identity marker. */
+const INLINE_MARKER_RE = /<!--[^\n]*:inline:fp=/;
+/**
+ * Tag-independent backstop for OUR inline finding comments, which carry an
+ * UNQUOTED `id:<fp>` token in the body (so a maintainer can copy it into a
+ * reply). If the author/tag filters ever miss one — a bot-login fallback, a
+ * commentTag rename, a second posting identity — matching it as a reply would
+ * let the review cite (and, with maintainer association, CLEAR) its own
+ * finding. Only UNQUOTED lines count: GitHub's "Quote reply" copies our marker
+ * verbatim behind `> `, and that comment is a genuine human reply that must
+ * still be matched.
+ */
+export function hasUnquotedInlineMarker(body) {
+    return body.split("\n").some((line) => !/^\s*>/.test(line) && INLINE_MARKER_RE.test(line));
+}
 /**
  * Markdown → comparable text: link text without the target, no backticks or
  * emphasis marks, collapsed whitespace, lowercase, no trailing punctuation. A
@@ -60,6 +75,19 @@ export function extractQuotedLines(body) {
     }
     return out;
 }
+/**
+ * Is `candidate` a more recent reply than `incumbent`? Issue comments carry
+ * positive ids; inline (PR review) replies carry NEGATED ids, so within the
+ * inline stream recency is the raw id's magnitude, not the signed value. The two
+ * sequences are independent, so cross-stream recency is undecidable — the issue
+ * comment wins deterministically (the main thread is the formal reply channel).
+ */
+export function replyIsNewer(candidate, incumbent) {
+    if (candidate >= 0 === incumbent >= 0) {
+        return Math.abs(candidate) > Math.abs(incumbent);
+    }
+    return candidate >= 0;
+}
 /** The `id:<hex>` tokens a comment cites, lowercased and deduped. */
 export function extractFindingIds(body) {
     const ids = [...body.matchAll(FINDING_ID_RE)].map((match) => match[1].toLowerCase());
@@ -108,7 +136,7 @@ export function matchReplies(comments, findings, opts) {
     }
     const newest = new Map();
     for (const comment of comments) {
-        if (OWN_COMMENT_RE.test(comment.body)) {
+        if (OWN_COMMENT_RE.test(comment.body) || hasUnquotedInlineMarker(comment.body)) {
             continue;
         }
         const matched = new Set();
@@ -116,6 +144,11 @@ export function matchReplies(comments, findings, opts) {
         // quote-matched reply still records WHETHER it cites the finding, because that is
         // what decides clearing.
         const cited = new Set(extractCitedFindingIds(comment.body));
+        // An inline reply names its finding structurally — the replier chose which
+        // thread to answer — so it matches in every `match` mode. Never sets `citedId`.
+        if (comment.threadFp && known.has(comment.threadFp)) {
+            matched.add(comment.threadFp);
+        }
         if (opts.match !== "quote") {
             for (const id of extractFindingIds(comment.body)) {
                 if (known.has(id)) {
@@ -139,7 +172,7 @@ export function matchReplies(comments, findings, opts) {
         }
         for (const fp of matched) {
             const previous = newest.get(fp);
-            if (previous && previous.commentId >= comment.id) {
+            if (previous && !replyIsNewer(comment.id, previous.commentId)) {
                 continue;
             }
             newest.set(fp, {

package/build/core/schema.js

@@ -336,7 +336,16 @@ export function applyPins(records, pins) {
     // A pin with no recorded commentId is never lifted by a reply: "unknown" must not
     // read as "older than every comment", which would let any maintainer reply lift it.
     pin.commentId === undefined ||
-        !records.some((record) => record.fp === pin.fp && record.maintainer === true && record.commentId > pin.commentId));
+        !records.some((record) => record.fp === pin.fp &&
+            record.maintainer === true &&
+            // "Posted after the pin" is only decidable within one id sequence. Issue
+            // comments carry positive ids and inline (PR review) replies carry NEGATED
+            // ones (see the reporter's replyComments); the two sequences are
+            // independent, so a cross-stream comparison says nothing about time — keep
+            // the pin. Within a stream, recency is the raw id's magnitude (negation
+            // inverts the signed order for inline ids).
+            record.commentId >= 0 === pin.commentId >= 0 &&
+            Math.abs(record.commentId) > Math.abs(pin.commentId)));
     const pinnedFps = new Set(kept.map((pin) => pin.fp));
     const stamped = records.map((record) => {
         if (pinnedFps.has(record.fp)) {