@expo/code-review-cli 0.2.1 → 0.2.3

package/README.md

@@ -84,9 +84,11 @@ Options (most to least common):
 | `--no-fail` | Always exit 0 (otherwise a `request_changes` decision exits non-zero). |
 | `-h`, `--help` | Show help. |
 
-`--pr` uses the PR's diff (authoritative) but reads your checked-out files for
-surrounding context; for full fidelity, `gh pr checkout <n>` first and run a plain
-`ecr review`.
+`--pr` uses the PR's diff (authoritative) and checks the PR head out into a
+throwaway worktree so the agents' surrounding-source reads and the verifier see the
+PR's versions of files — no manual `gh pr checkout` needed, and your working tree is
+left untouched. (If that materialization can't run — e.g. not a git checkout — it
+falls back to reading the current working directory.)
 
 In CI it runs automatically from the scaffolded workflows — by label or a `/review`
 comment (see **CI usage**). From Claude Code (or another agent), add a slash command

package/build/core/render.js

@@ -1,5 +1,41 @@
 import { createHash } from 'node:crypto';
 import { fingerprintFinding, SEVERITIES, SEVERITY_RANK } from './schema.js';
+/**
+ * Build the file → right-side-line-numbers index from changed files' patch text,
+ * by walking each unified-diff hunk (`@@ -a,b +c,d @@`) and collecting the new-tree
+ * line number of every added (`+`) and context (` `) line. Deleted (`-`) lines have
+ * no right-side line and are skipped.
+ */
+export function buildDiffLineIndex(files) {
+    const index = new Map();
+    const hunkRe = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+    for (const file of files) {
+        const lines = new Set();
+        let right = 0;
+        let inHunk = false;
+        for (const raw of file.patch.split('\n')) {
+            const hunk = hunkRe.exec(raw);
+            if (hunk) {
+                right = parseInt(hunk[1], 10);
+                inHunk = true;
+                continue;
+            }
+            if (!inHunk || raw.startsWith('+++') || raw.startsWith('---') || raw.startsWith('\\')) {
+                continue;
+            }
+            const marker = raw[0];
+            if (marker === '+' || marker === ' ') {
+                lines.add(right);
+                right++;
+            }
+            // '-' is left-side only (no new-tree line); anything else is ignored.
+        }
+        if (lines.size > 0) {
+            index.set(file.path, lines);
+        }
+    }
+    return index;
+}
 const DECISION_LABEL = {
     approve: 'Approve',
     approve_with_comments: 'Approve with comments',
@@ -30,19 +66,36 @@ function locationText(finding) {
     return finding.line != null ? `${finding.file}:${finding.line}` : finding.file;
 }
 /**
- * Render a finding's location as inline code, linked to the exact diff line in the
- * PR's "Files changed" tab when PR context is available. GitHub anchors each file's
- * diff as `diff-<sha256(path)>` and each right-hand (added/context) line as `…R<n>`.
+ * Render a finding's location as inline code, linked to the code it points at:
+ *  - in the diff (file+line shown in a hunk) → the PR's "Files changed" tab at that
+ *    line (`#diff-<sha256(path)>R<n>`), so the reader lands in the review diff;
+ *  - not in the diff (unchanged code the PR references, e.g. a caller/helper) → the
+ *    source blob on the PR base at that line (`/blob/<baseSha>/<path>#L<n>`);
+ *  - if neither is possible (no link context / no base SHA) → plain inline code.
+ * Never emits a dead diff anchor for a line that isn't in the diff.
  */
 function location(finding, link) {
     const text = locationText(finding);
     if (!link) {
         return `\`${text}\``;
     }
-    const fileHash = createHash('sha256').update(finding.file).digest('hex');
-    const anchor = finding.line != null ? `diff-${fileHash}R${finding.line}` : `diff-${fileHash}`;
-    const url = `https://github.com/${link.repo}/pull/${link.prNumber}/files#${anchor}`;
-    return `[\`${text}\`](${url})`;
+    const fileLines = link.diffLines?.get(finding.file);
+    // In the diff when the file is present and (if the finding names a line) that line
+    // is one of the diff's right-side lines. A file-level finding (no line) counts as
+    // in-diff as long as the file appears in the diff.
+    const inDiff = fileLines != null && (finding.line == null || fileLines.has(finding.line));
+    if (inDiff) {
+        const fileHash = createHash('sha256').update(finding.file).digest('hex');
+        const anchor = finding.line != null ? `diff-${fileHash}R${finding.line}` : `diff-${fileHash}`;
+        const url = `https://github.com/${link.repo}/pull/${link.prNumber}/files#${anchor}`;
+        return `[\`${text}\`](${url})`;
+    }
+    if (link.baseSha) {
+        const lineAnchor = finding.line != null ? `#L${finding.line}` : '';
+        const url = `https://github.com/${link.repo}/blob/${link.baseSha}/${finding.file}${lineAnchor}`;
+        return `[\`${text}\`](${url})`;
+    }
+    return `\`${text}\``;
 }
 /**
  * GitHub comment body. The marker + embedded state enable in-place updates and

package/build/core/review.js

@@ -67,7 +67,28 @@ export async function runReview(source, options) {
         });
         return output;
     }
+    // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
+    // and doing it first means nothing that can throw sits between the chdir and the
+    // guarded blocks — so a prepareAuth failure can't leak the worktree or leave cwd
+    // pointing at it.
     const auth = await prepareAuth(config);
+    // Read the PR-head tree (not the current checkout) when the source can materialize
+    // it, so the agents' surrounding-source reads and the verifier's re-reads see the
+    // versions that match the diff. Config is already fully loaded in memory, so the
+    // chdir doesn't affect it; run-log/patch paths are absolute; gh/git calls already
+    // ran above. Fails soft to the current directory.
+    const originalCwd = process.cwd();
+    const readRoot = (await source.prepareReadRootAsync?.()) ?? null;
+    const restoreCwd = async () => {
+        if (readRoot) {
+            process.chdir(originalCwd);
+            await readRoot.cleanup();
+        }
+    };
+    if (readRoot) {
+        progress('Reviewing the PR-head tree (so reads match the PR, not the checkout).');
+        process.chdir(readRoot.dir);
+    }
     progress('Starting OpenCode server…');
     let handle = null;
     try {
@@ -75,6 +96,7 @@ export async function runReview(source, options) {
     }
     catch (error) {
         await auth.cleanup();
+        await restoreCwd();
         throw new Error(`Failed to start the OpenCode server. Ensure the \`opencode\` CLI is installed and ` +
             `model credentials are configured.\n${errorMessage(error)}`);
     }
@@ -382,6 +404,7 @@ export async function runReview(source, options) {
     finally {
         handle?.close();
         await auth.cleanup();
+        await restoreCwd();
     }
 }
 /**

package/build/reporters/github.js

@@ -2,7 +2,8 @@ import { writeFile, mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { run } from '../core/exec.js';
-import { commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
+import { parseUnifiedDiff } from '../core/diff.js';
+import { buildDiffLineIndex, commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
 import { fingerprintFinding } from '../core/schema.js';
 const MAINTAINER_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
 /**
@@ -33,11 +34,43 @@ export class GitHubReporter {
         const dismissed = existing
             ? (parseReviewState(existing.body, this.options.commentTag)?.dismissed ?? [])
             : [];
-        await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, this.linkContext()));
+        const link = await this.linkContextAsync();
+        await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, link));
     }
-    /** PR context for turning finding locations into diff-line links. */
-    linkContext() {
-        return { repo: this.options.repo, prNumber: this.options.prNumber };
+    /**
+     * PR context for turning finding locations into links: the set of lines actually
+     * in the diff (for in-diff findings → diff-anchor links) and the base commit SHA
+     * (for out-of-diff findings → source-blob links on the base). Both fetches fail
+     * soft — a missing piece just degrades to a plain-text location, never a dead link.
+     */
+    async linkContextAsync() {
+        const link = { repo: this.options.repo, prNumber: this.options.prNumber };
+        const prArgs = [String(this.options.prNumber), '--repo', this.options.repo];
+        const cwd = this.options.cwd;
+        await Promise.all([
+            (async () => {
+                try {
+                    const { stdout } = await run('gh', ['pr', 'diff', ...prArgs], { cwd });
+                    link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
+                }
+                catch {
+                    // leave diffLines unset → in-diff findings degrade to plain text
+                }
+            })(),
+            (async () => {
+                try {
+                    const { stdout } = await run('gh', ['pr', 'view', ...prArgs, '--json', 'baseRefOid'], { cwd });
+                    const oid = JSON.parse(stdout).baseRefOid;
+                    if (oid) {
+                        link.baseSha = oid;
+                    }
+                }
+                catch {
+                    // leave baseSha unset → out-of-diff findings degrade to plain text
+                }
+            })(),
+        ]);
+        return link;
     }
     /**
      * Add or remove per-PR finding dismissals in the reviewer's comment and re-render
@@ -61,7 +94,8 @@ export class GitHubReporter {
                 dismissed.push({ fp, by, reason });
             }
         }
-        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, this.linkContext()));
+        const link = await this.linkContextAsync();
+        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, link));
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
     /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */

package/build/sources/github-pr.js

@@ -1,3 +1,6 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import { run } from '../core/exec.js';
 import { parseUnifiedDiff } from '../core/diff.js';
 /**
@@ -33,4 +36,47 @@ export class GitHubPRSource {
         const { stdout } = await run('gh', ['pr', 'diff', String(this.options.prNumber), ...this.repoArgs()], { cwd: this.options.cwd });
         return parseUnifiedDiff(stdout);
     }
+    /**
+     * Check the PR HEAD out into a throwaway git worktree so the agents and verifier
+     * read the PR's versions of files (not whatever branch happens to be checked out).
+     * Fetches the head from the repo's own URL — `refs/pull/<n>/head`, which the base
+     * repo hosts even for fork PRs — so it's always the correct PR, independent of the
+     * local `origin`. Fails SOFT: any problem (not a git repo, fetch/worktree error)
+     * returns null, and the review falls back to reading the current checkout.
+     */
+    async prepareReadRootAsync() {
+        const cwd = this.options.cwd;
+        if (!this.options.repo) {
+            // Without an explicit owner/repo we can't build the fetch URL safely.
+            return null;
+        }
+        const url = `https://github.com/${this.options.repo}.git`;
+        const ref = `refs/pull/${this.options.prNumber}/head`;
+        let parent;
+        try {
+            await run('git', ['fetch', '--no-tags', '--depth=1', url, ref], { cwd });
+            parent = await mkdtemp(path.join(tmpdir(), 'ecr-prhead-'));
+            const dir = path.join(parent, 'head'); // must not pre-exist for `worktree add`
+            await run('git', ['worktree', 'add', '--detach', dir, 'FETCH_HEAD'], { cwd });
+            const removeParent = parent;
+            return {
+                dir,
+                cleanup: async () => {
+                    try {
+                        await run('git', ['worktree', 'remove', '--force', dir], { cwd });
+                    }
+                    catch {
+                        // best effort — fall through to removing the temp dir
+                    }
+                    await rm(removeParent, { recursive: true, force: true });
+                },
+            };
+        }
+        catch {
+            if (parent) {
+                await rm(parent, { recursive: true, force: true }).catch(() => { });
+            }
+            return null;
+        }
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/code-review-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Generic, config-driven AI code reviewer engine. Repos supply their agents via .expo-code-review/.",
   "license": "MIT",
   "repository": {