@humanbased/crosscheck 1.3.1-beta.7 → 1.6.0-beta.11

package/README.md

@@ -17,7 +17,17 @@
 </p>
 
 <p align="center">
-  <img src="./assets/screenshot-watch.png" alt="crosscheck watch — live pipeline view" width="860" />
+  <img src="./assets/demo-block-to-approve.gif" alt="crosscheck reviewing a PR: a BLOCK on a dropped ownership filter, an auto-fix, and the verdict on the repair" width="900" />
+</p>
+
+<p align="center">
+  <strong>The run above is real</strong> — a public fixture PR, every comment permanently linked:<br />
+  <a href="https://github.com/humanbased-ai/crosscheck-proof-fixture/pull/2">the whole thread</a>
+  &nbsp;·&nbsp; <a href="./demo/README.md">how the recording was made</a>
+</p>
+
+<p align="center">
+  <sub>A pagination change that passed CI and dropped <code>ownerId</code> from the transaction query — any caller could read another user's transactions. Reviewed by Codex, repaired by Claude, and re-judged against the repair.</sub>
 </p>
 
 ---
@@ -173,6 +183,7 @@ Full walkthrough: **[docs/linear-identity.md](./docs/linear-identity.md)**.
 | `crosscheck review <pr>` | One-shot review, posts a comment |
 | `crosscheck run <pr>` | Full pipeline for a PR — review, fix, recheck |
 | `crosscheck recheck` / `fix` / `resolve` | Run one step in isolation |
+| `crosscheck merge <pr>` | Merge a PR once the verdict allows it — `--loose` / `--tight` / `--force` |
 | `crosscheck watch` | Listen for PR events and run the pipeline automatically |
 | `crosscheck scan` | Show open PRs with stale crosscheck state |
 | `crosscheck kickass` | Pick a stale PR and drive it to its next step |
@@ -304,6 +315,10 @@ Every option, annotated: **[crosscheck.config.example.yml](./crosscheck.config.e
 crosscheck onboard && crosscheck watch
 ```
 
+<p align="center">
+  <img src="./assets/screenshot-watch.png" alt="crosscheck watch — live pipeline view" width="860" />
+</p>
+
 **On a server** — one always-on watcher for a team, with per-repo depth where it matters.
 
 ```bash

package/dist/__tests__/base-ref-recovery.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=base-ref-recovery.test.d.ts.map

package/dist/__tests__/base-ref-recovery.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-ref-recovery.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/base-ref-recovery.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/base-ref-recovery.test.js

@@ -0,0 +1,102 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { resolveBaseRef, BaseRefUnavailableError, isBaseRefUnavailableError } from '../lib/clone.js';
+// Exercised against a real local origin rather than a mock: the whole point of the
+// recovery chain is which git invocations actually put a ref in place, and a mock
+// that answers "fetched" proves nothing about git.
+describe('resolveBaseRef', () => {
+    let originDir;
+    let workDir;
+    let baseSha;
+    const git = (dir, ...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    const commit = (dir, file, message) => {
+        writeFileSync(join(dir, file), `${message}\n`);
+        git(dir, 'add', '-A');
+        git(dir, '-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-m', message);
+        return git(dir, 'rev-parse', 'HEAD');
+    };
+    beforeEach(() => {
+        // origin: a normal repo with a `main` and a `feature-base` the PR targets.
+        originDir = mkdtempSync(join(tmpdir(), 'crosscheck-origin-'));
+        git(originDir, 'init', '--initial-branch=main', '.');
+        commit(originDir, 'a.txt', 'root');
+        git(originDir, 'checkout', '-b', 'feature-base');
+        baseSha = commit(originDir, 'b.txt', 'base work');
+        git(originDir, 'checkout', '-b', 'pr-head');
+        commit(originDir, 'c.txt', 'pr work');
+        git(originDir, 'checkout', 'main');
+        // The consumer clone, with the PR head checked out — never the base branch.
+        workDir = mkdtempSync(join(tmpdir(), 'crosscheck-work-'));
+        git(workDir, 'clone', originDir, '.');
+        git(workDir, 'checkout', '-b', 'pr-1', 'origin/pr-head');
+        // Drop the tracking ref the clone created, so each case starts from "absent".
+        git(workDir, 'update-ref', '-d', 'refs/remotes/origin/feature-base');
+    });
+    afterEach(() => {
+        rmSync(originDir, { force: true, recursive: true });
+        rmSync(workDir, { force: true, recursive: true });
+    });
+    it('fetches the base by name when the branch exists', async () => {
+        const status = await resolveBaseRef({ tmpDir: workDir, baseRef: 'feature-base', prNumber: 1 });
+        expect(status).toBe('fetched');
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it('recovers by commit when the base branch has been deleted', async () => {
+        // The incident: PR #3649's base branch was gone by the time the review ran.
+        git(originDir, 'branch', '-D', 'feature-base');
+        const recovered = [];
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1, baseSha,
+            onBaseRefRecovered: s => recovered.push(s),
+        });
+        expect(status).toBe('recovered_by_sha');
+        expect(recovered).toEqual(['recovered_by_sha']);
+        // The ref must actually resolve — the whole failure was trusting an exit code.
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it("recovers via the PR's merge ref when the base commit is not fetchable by name", async () => {
+        // GitHub keeps refs/pull/<n>/merge for an open PR; its first parent is the base.
+        const mergeSha = git(originDir, 'commit-tree', `${baseSha}^{tree}`, '-p', baseSha, '-p', git(originDir, 'rev-parse', 'pr-head'), '-m', 'merge');
+        git(originDir, 'update-ref', 'refs/pull/1/merge', mergeSha);
+        git(originDir, 'branch', '-D', 'feature-base');
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            // No baseSha, so recovery 1 cannot run and recovery 2 must carry it.
+        });
+        expect(status).toBe('recovered_by_merge_ref');
+        expect(git(workDir, 'rev-parse', 'refs/remotes/origin/feature-base')).toBe(baseSha);
+    });
+    it('reports unavailable when no recovery path exists', async () => {
+        git(originDir, 'branch', '-D', 'feature-base');
+        const failed = [];
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            onBaseFetchFailed: () => failed.push(1),
+        });
+        expect(status).toBe('unavailable');
+        expect(failed.length).toBeGreaterThan(0);
+    });
+    it('reports unavailable when a stale base sha no longer resolves', async () => {
+        git(originDir, 'branch', '-D', 'feature-base');
+        const status = await resolveBaseRef({
+            tmpDir: workDir, baseRef: 'feature-base', prNumber: 1,
+            baseSha: '0'.repeat(40),
+        });
+        expect(status).toBe('unavailable');
+    });
+});
+describe('BaseRefUnavailableError', () => {
+    it('names the ref and says what to do', () => {
+        const err = new BaseRefUnavailableError('chore/in-4439-registry-machine-ownership');
+        expect(err.message).toContain('origin/chore/in-4439-registry-machine-ownership');
+        expect(err.message).toContain('Retarget the PR');
+    });
+    it('is identifiable through the guard', () => {
+        expect(isBaseRefUnavailableError(new BaseRefUnavailableError('x'))).toBe(true);
+        expect(isBaseRefUnavailableError(new Error('x'))).toBe(false);
+    });
+});
+//# sourceMappingURL=base-ref-recovery.test.js.map

package/dist/__tests__/base-ref-recovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-ref-recovery.test.js","sourceRoot":"","sources":["../../src/__tests__/base-ref-recovery.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAEpG,mFAAmF;AACnF,kFAAkF;AAClF,mDAAmD;AACnD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,SAAiB,CAAA;IACrB,IAAI,OAAe,CAAA;IACnB,IAAI,OAAe,CAAA;IAEnB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc,EAAU,EAAE,CACrD,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAErG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAU,EAAE;QACpE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,CAAA;QAC9C,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAChF,OAAO,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,2EAA2E;QAC3E,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAA;QACpD,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAChD,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC3C,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACrC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QAElC,4EAA4E;QAC5E,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;QACzD,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;QACrC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;QACxD,8EAA8E;QAC9E,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,kCAAkC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,4EAA4E;QAC5E,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAa,EAAE,CAAA;QAE9B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO;YAC9D,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;SAC3C,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACvC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAC/C,+EAA+E;QAC/E,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,SAAS,EAChE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC7E,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAA;QAC3D,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAE9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,qEAAqE;SACtE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAA;QAE3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACxC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAA;QAChF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,yBAAyB,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}