@jphutchins/code-review 0.1.0-alpha.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +103 -0
- package/dist/index.js +1627 -0
- package/dist/index.js.map +1 -0
- package/package.json +58 -0
- package/schema/VERSIONING.md +92 -0
- package/schema/findings.schema.json +88 -0
- package/schema/prices.example.json +9 -0
- package/schema/prices.schema.json +54 -0
- package/schema/triage.schema.json +19 -0
- package/templates/comment.eta +80 -0
- package/templates/inline.eta +9 -0
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://raw.githubusercontent.com/JPHutchins/code-review/main/schema/prices.schema.json",
|
|
4
|
+
"title": "Code Review — price map",
|
|
5
|
+
"description": "A date-stamped map of per-model token prices (USD per 1M tokens) the commenter uses to recompute canonical cost from the abstract result envelope's `models` array (SPEC §6.1). The CLI's `vendor_cost_usd` is vendor-priced and wrong for non-Anthropic backends; this map is the recomputation source. Kept free of $ref/$defs to match the findings schema's house style (inlining is not strictly required here — the price map is never passed to a model — but consistency with findings.schema.json is preferred).",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["_updated", "_unit", "models"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"_comment": {
|
|
11
|
+
"type": "string",
|
|
12
|
+
"description": "Human note; not parsed. Should remind that prices drift and point at the cost formula (SPEC §6.2)."
|
|
13
|
+
},
|
|
14
|
+
"_updated": {
|
|
15
|
+
"type": "string",
|
|
16
|
+
"description": "ISO date (YYYY-MM-DD) the prices were last verified against the provider's pricing page. Prices drift; keep this current."
|
|
17
|
+
},
|
|
18
|
+
"_unit": {
|
|
19
|
+
"type": "string",
|
|
20
|
+
"description": "Unit the prices are expressed in per 1M tokens, e.g. \"USD per 1M tokens\"."
|
|
21
|
+
},
|
|
22
|
+
"models": {
|
|
23
|
+
"type": "object",
|
|
24
|
+
"description": "Map of model identifier → per-token prices. Keys are the model identifiers as they appear in the result envelope's `models[].model`.",
|
|
25
|
+
"additionalProperties": {
|
|
26
|
+
"type": "object",
|
|
27
|
+
"additionalProperties": false,
|
|
28
|
+
"required": ["in", "out", "cache_read", "cache_write"],
|
|
29
|
+
"properties": {
|
|
30
|
+
"in": {
|
|
31
|
+
"type": "number",
|
|
32
|
+
"minimum": 0,
|
|
33
|
+
"description": "Price per 1M input tokens."
|
|
34
|
+
},
|
|
35
|
+
"out": {
|
|
36
|
+
"type": "number",
|
|
37
|
+
"minimum": 0,
|
|
38
|
+
"description": "Price per 1M output tokens."
|
|
39
|
+
},
|
|
40
|
+
"cache_read": {
|
|
41
|
+
"type": "number",
|
|
42
|
+
"minimum": 0,
|
|
43
|
+
"description": "Price per 1M cache-read tokens (prompt-cache hits)."
|
|
44
|
+
},
|
|
45
|
+
"cache_write": {
|
|
46
|
+
"type": "number",
|
|
47
|
+
"minimum": 0,
|
|
48
|
+
"description": "Price per 1M cache-write tokens (prompt-cache population)."
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
}
|
|
54
|
+
}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://raw.githubusercontent.com/JPHutchins/code-review/main/schema/triage.schema.json",
|
|
4
|
+
"title": "Code Review — security triage result",
|
|
5
|
+
"description": "Structured output of the data-only security triage phase. The triage agent reads the diff and surrounding source (never executes) and decides whether it is safe to apply and execute the diff in a CI runner that holds an API key. Inlined (no $ref/$defs/$id fragments) so it works for both JSON-Schema validators and CLI structured-output enforcement.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["safe", "reasons"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"safe": {
|
|
11
|
+
"type": "boolean",
|
|
12
|
+
"description": "Whether the diff is safe to apply and execute in a privileged CI runner."
|
|
13
|
+
},
|
|
14
|
+
"reasons": {
|
|
15
|
+
"type": "string",
|
|
16
|
+
"description": "Human-readable explanation of the triage decision, especially when unsafe."
|
|
17
|
+
}
|
|
18
|
+
}
|
|
19
|
+
}
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
<!-- code-review -->
|
|
2
|
+
<!-- reviewed-sha: <%= it.reviewedSha %> -->
|
|
3
|
+
|
|
4
|
+
### <%= it.verdictBadge(it.findings.verdict) %>
|
|
5
|
+
|
|
6
|
+
**Route:** <%~ it.route %><% if (it.effort) { %> · **effort:** <%~ it.effort %><% } %><% if (it.usageAvailable) { %> · **turns:** <%= it.envelope.turns %> · **wall:** <%~ it.formatDuration(it.envelope.duration_ms) %><% } else { %> · _usage unavailable_<% } %>
|
|
7
|
+
|
|
8
|
+
<%~ it.findings.summary %>
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
<% if (it.totalCount > 0) { %>
|
|
13
|
+
#### 📊 Findings summary — <%= it.totalCount %> finding<%= it.totalCount === 1 ? '' : 's' %> on <%= it.fileCount %> file<%= it.fileCount === 1 ? '' : 's' %>
|
|
14
|
+
|
|
15
|
+
<% if (it.visibleFindings.length > 0) { %>
|
|
16
|
+
| Severity | File | Line | Summary |
|
|
17
|
+
|---|---|---|---|
|
|
18
|
+
<% it.visibleFindings.forEach(function(f) { %>
|
|
19
|
+
| <%= it.severityEmoji(f.severity) %> <%= f.severity %> | `<%= f.path %>` | <%= f.start_line %><% if (f.start_line !== f.end_line) { %>–<%= f.end_line %><% } %> | <%= f.title %> |
|
|
20
|
+
<% }) %>
|
|
21
|
+
|
|
22
|
+
<% } %>
|
|
23
|
+
<% if (it.nitFindings.length > 0) { %>
|
|
24
|
+
<details>
|
|
25
|
+
<summary>⚪ <%= it.nitFindings.length %> nit<%= it.nitFindings.length === 1 ? '' : 's' %> (folded)</summary>
|
|
26
|
+
|
|
27
|
+
| File | Line | Summary |
|
|
28
|
+
|---|---|---|
|
|
29
|
+
<% it.nitFindings.forEach(function(f) { %>
|
|
30
|
+
| `<%= f.path %>` | <%= f.start_line %><% if (f.start_line !== f.end_line) { %>–<%= f.end_line %><% } %> | <%= f.title %> |
|
|
31
|
+
<% }) %>
|
|
32
|
+
|
|
33
|
+
</details>
|
|
34
|
+
<% } %>
|
|
35
|
+
|
|
36
|
+
<% if (it.suggestionCount > 0) { %>
|
|
37
|
+
<%= it.suggestionCount %> finding<%= it.suggestionCount === 1 ? '' : 's' %> included suggestions — see inline comments for details.
|
|
38
|
+
<% } %>
|
|
39
|
+
<% } else { %>
|
|
40
|
+
_No findings — clean review._
|
|
41
|
+
<% } %>
|
|
42
|
+
|
|
43
|
+
<% if (it.testReport) { %>
|
|
44
|
+
---
|
|
45
|
+
|
|
46
|
+
<details>
|
|
47
|
+
<summary>📊 Test results — <%= it.testReport.passed %> passed, <%= it.testReport.failed %> failed</summary>
|
|
48
|
+
|
|
49
|
+
<% if (it.testReport.failed > 0 && it.testReport.failures) { %>
|
|
50
|
+
<% it.testReport.failures.forEach(function(f) { %>
|
|
51
|
+
- **<%= f.name %>**<% if (f.message) { %> — <%~ f.message %><% } %>
|
|
52
|
+
<% }) %>
|
|
53
|
+
<% } else { %>
|
|
54
|
+
All <%= it.testReport.total %> tests passed.
|
|
55
|
+
<% } %>
|
|
56
|
+
|
|
57
|
+
</details>
|
|
58
|
+
<% } %>
|
|
59
|
+
|
|
60
|
+
---
|
|
61
|
+
|
|
62
|
+
<% if (it.usageAvailable) { %>
|
|
63
|
+
<sub>
|
|
64
|
+
|
|
65
|
+
| Model | Input | Output | Cache read | Cache write | Cost |
|
|
66
|
+
|---|--:|--:|--:|--:|--:|
|
|
67
|
+
<% it.costReport.lines.forEach(function(l) { %>
|
|
68
|
+
| <%= l.model %> | <%= it.formatTokens(l.inputTokens) %> | <%= it.formatTokens(l.outputTokens) %> | <%= it.formatTokens(l.cacheReadTokens) %> | <%= it.formatTokens(l.cacheWriteTokens) %> | <%= it.formatCost(l.costUSD) %> |
|
|
69
|
+
<% }) %>
|
|
70
|
+
| **Total** | **<%= it.formatTokens(it.costReport.totalInputTokens) %>** | **<%= it.formatTokens(it.costReport.totalOutputTokens) %>** | **<%= it.formatTokens(it.costReport.totalCacheReadTokens) %>** | **<%= it.formatTokens(it.costReport.totalCacheWriteTokens) %>** | **<%= it.formatCost(it.costReport.totalCostUSD) %>** |
|
|
71
|
+
|
|
72
|
+
</sub>
|
|
73
|
+
<% } else { %>
|
|
74
|
+
> **Usage/cost unavailable** — the result envelope for this run was missing or malformed.
|
|
75
|
+
<% } %>
|
|
76
|
+
|
|
77
|
+
> [!NOTE]
|
|
78
|
+
> **LLM Disclosure** — this review was produced by <%= it.modelNames || "unknown model" %> running
|
|
79
|
+
> headless in an ephemeral, egress-locked CI runner with no write access to the repository. It is
|
|
80
|
+
> advisory and does not block merge.
|