@expo/code-review-cli 0.2.1 → 0.2.2

package/build/core/render.js

@@ -1,5 +1,41 @@
 import { createHash } from 'node:crypto';
 import { fingerprintFinding, SEVERITIES, SEVERITY_RANK } from './schema.js';
+/**
+ * Build the file → right-side-line-numbers index from changed files' patch text,
+ * by walking each unified-diff hunk (`@@ -a,b +c,d @@`) and collecting the new-tree
+ * line number of every added (`+`) and context (` `) line. Deleted (`-`) lines have
+ * no right-side line and are skipped.
+ */
+export function buildDiffLineIndex(files) {
+    const index = new Map();
+    const hunkRe = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+    for (const file of files) {
+        const lines = new Set();
+        let right = 0;
+        let inHunk = false;
+        for (const raw of file.patch.split('\n')) {
+            const hunk = hunkRe.exec(raw);
+            if (hunk) {
+                right = parseInt(hunk[1], 10);
+                inHunk = true;
+                continue;
+            }
+            if (!inHunk || raw.startsWith('+++') || raw.startsWith('---') || raw.startsWith('\\')) {
+                continue;
+            }
+            const marker = raw[0];
+            if (marker === '+' || marker === ' ') {
+                lines.add(right);
+                right++;
+            }
+            // '-' is left-side only (no new-tree line); anything else is ignored.
+        }
+        if (lines.size > 0) {
+            index.set(file.path, lines);
+        }
+    }
+    return index;
+}
 const DECISION_LABEL = {
     approve: 'Approve',
     approve_with_comments: 'Approve with comments',
@@ -30,19 +66,36 @@ function locationText(finding) {
     return finding.line != null ? `${finding.file}:${finding.line}` : finding.file;
 }
 /**
- * Render a finding's location as inline code, linked to the exact diff line in the
- * PR's "Files changed" tab when PR context is available. GitHub anchors each file's
- * diff as `diff-<sha256(path)>` and each right-hand (added/context) line as `…R<n>`.
+ * Render a finding's location as inline code, linked to the code it points at:
+ *  - in the diff (file+line shown in a hunk) → the PR's "Files changed" tab at that
+ *    line (`#diff-<sha256(path)>R<n>`), so the reader lands in the review diff;
+ *  - not in the diff (unchanged code the PR references, e.g. a caller/helper) → the
+ *    source blob on the PR base at that line (`/blob/<baseSha>/<path>#L<n>`);
+ *  - if neither is possible (no link context / no base SHA) → plain inline code.
+ * Never emits a dead diff anchor for a line that isn't in the diff.
  */
 function location(finding, link) {
     const text = locationText(finding);
     if (!link) {
         return `\`${text}\``;
     }
-    const fileHash = createHash('sha256').update(finding.file).digest('hex');
-    const anchor = finding.line != null ? `diff-${fileHash}R${finding.line}` : `diff-${fileHash}`;
-    const url = `https://github.com/${link.repo}/pull/${link.prNumber}/files#${anchor}`;
-    return `[\`${text}\`](${url})`;
+    const fileLines = link.diffLines?.get(finding.file);
+    // In the diff when the file is present and (if the finding names a line) that line
+    // is one of the diff's right-side lines. A file-level finding (no line) counts as
+    // in-diff as long as the file appears in the diff.
+    const inDiff = fileLines != null && (finding.line == null || fileLines.has(finding.line));
+    if (inDiff) {
+        const fileHash = createHash('sha256').update(finding.file).digest('hex');
+        const anchor = finding.line != null ? `diff-${fileHash}R${finding.line}` : `diff-${fileHash}`;
+        const url = `https://github.com/${link.repo}/pull/${link.prNumber}/files#${anchor}`;
+        return `[\`${text}\`](${url})`;
+    }
+    if (link.baseSha) {
+        const lineAnchor = finding.line != null ? `#L${finding.line}` : '';
+        const url = `https://github.com/${link.repo}/blob/${link.baseSha}/${finding.file}${lineAnchor}`;
+        return `[\`${text}\`](${url})`;
+    }
+    return `\`${text}\``;
 }
 /**
  * GitHub comment body. The marker + embedded state enable in-place updates and

package/build/reporters/github.js

@@ -2,7 +2,8 @@ import { writeFile, mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { run } from '../core/exec.js';
-import { commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
+import { parseUnifiedDiff } from '../core/diff.js';
+import { buildDiffLineIndex, commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
 import { fingerprintFinding } from '../core/schema.js';
 const MAINTAINER_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
 /**
@@ -33,11 +34,43 @@ export class GitHubReporter {
         const dismissed = existing
             ? (parseReviewState(existing.body, this.options.commentTag)?.dismissed ?? [])
             : [];
-        await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, this.linkContext()));
+        const link = await this.linkContextAsync();
+        await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, link));
     }
-    /** PR context for turning finding locations into diff-line links. */
-    linkContext() {
-        return { repo: this.options.repo, prNumber: this.options.prNumber };
+    /**
+     * PR context for turning finding locations into links: the set of lines actually
+     * in the diff (for in-diff findings → diff-anchor links) and the base commit SHA
+     * (for out-of-diff findings → source-blob links on the base). Both fetches fail
+     * soft — a missing piece just degrades to a plain-text location, never a dead link.
+     */
+    async linkContextAsync() {
+        const link = { repo: this.options.repo, prNumber: this.options.prNumber };
+        const prArgs = [String(this.options.prNumber), '--repo', this.options.repo];
+        const cwd = this.options.cwd;
+        await Promise.all([
+            (async () => {
+                try {
+                    const { stdout } = await run('gh', ['pr', 'diff', ...prArgs], { cwd });
+                    link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
+                }
+                catch {
+                    // leave diffLines unset → in-diff findings degrade to plain text
+                }
+            })(),
+            (async () => {
+                try {
+                    const { stdout } = await run('gh', ['pr', 'view', ...prArgs, '--json', 'baseRefOid'], { cwd });
+                    const oid = JSON.parse(stdout).baseRefOid;
+                    if (oid) {
+                        link.baseSha = oid;
+                    }
+                }
+                catch {
+                    // leave baseSha unset → out-of-diff findings degrade to plain text
+                }
+            })(),
+        ]);
+        return link;
     }
     /**
      * Add or remove per-PR finding dismissals in the reviewer's comment and re-render
@@ -61,7 +94,8 @@ export class GitHubReporter {
                 dismissed.push({ fp, by, reason });
             }
         }
-        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, this.linkContext()));
+        const link = await this.linkContextAsync();
+        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, link));
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
     /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {