@jphutchins/code-review 0.1.0-alpha.22 → 0.1.0-alpha.24

package/README.md

@@ -39,6 +39,8 @@ npx @jphutchins/code-review <subcommand>
 | --- | --- |
 | `post` | Post a complete review (inline comments + sticky summary) from findings + envelope + diff — the one-call path |
 | `gather` | Resolve the PR from the CI head SHA and gather the review inputs (diff with git-diff fallback, PR context, prior bot review, failing-job logs) into the workspace for the agent |
+| `parse-command` | Resolve a PR's head from its number and parse a ChatOps trigger comment (`/code-review [24m] [$1.00] <instructions>`) into review overrides — the on-demand comment trigger |
+| `react` | Add/remove a GitHub comment reaction — the ChatOps acknowledgement (👀 on receipt, 🚀 on completion) |
 | `render` | Render the sticky-comment markdown from findings + usage + prices |
 | `inline` | Build the GitHub reviews `comments[]` payload from findings + diff (in-diff validation; strays demote to the summary) |
 | `adapt` | Map a native agent-CLI result envelope onto the abstract result envelope (`src/schema.ts`) |

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { defineCommand, runMain } from 'citty';
 import { readFileSync, writeFileSync, statSync, copyFileSync, readdirSync } from 'fs';
+import { randomBytes } from 'crypto';
 import { resolve as resolve$1, join, dirname, basename, extname } from 'path';
 import { Eta } from 'eta';
 import parseDiff from 'parse-diff';
@@ -459,12 +460,12 @@ var sumTranscriptUsage = (entries) => {
     },
     { totals: /* @__PURE__ */ new Map(), turns: 0, seen: /* @__PURE__ */ new Set() }
   );
-  const models = [...summed.totals].map(([model, t4]) => ({
+  const models = [...summed.totals].map(([model, t6]) => ({
     model,
-    input_tokens: t4.input,
-    output_tokens: t4.output,
-    cache_read_tokens: t4.cacheRead,
-    cache_write_tokens: t4.cacheWrite
+    input_tokens: t6.input,
+    output_tokens: t6.output,
+    cache_read_tokens: t6.cacheRead,
+    cache_write_tokens: t6.cacheWrite
   }));
   const bounds = entries.reduce(
     (acc, entry) => {
@@ -801,7 +802,7 @@ var writesToDraft = (toolName, toolInput, draftPath) => {
   const targets = [draftPath, basename(draftPath), "$DRAFT", "${DRAFT}"];
   if (WRITE_TOOLS.has(toolName)) {
     const fp = rec?.["file_path"] ?? rec?.["notebook_path"];
-    if (typeof fp === "string" && targets.some((t4) => fp === t4 || basename(fp) === basename(t4)))
+    if (typeof fp === "string" && targets.some((t6) => fp === t6 || basename(fp) === basename(t6)))
       return true;
   }
   if (toolName === "Bash") {
@@ -897,9 +898,9 @@ var parseWallMs = (raw) => {
 };
 var parseEpochSecMs = (raw) => {
   if (raw === void 0) return null;
-  const t4 = raw.trim();
-  if (!/^\d+$/.test(t4)) return null;
-  const n = Number.parseInt(t4, 10);
+  const t6 = raw.trim();
+  if (!/^\d+$/.test(t6)) return null;
+  const n = Number.parseInt(t6, 10);
   return Number.isFinite(n) && n > 0 ? n * 1e3 : null;
 };
 var anchoredElapsedMs = (src) => {
@@ -1314,8 +1315,8 @@ var priorBotCommentIds = (raw, botLogin) => {
   const nodes = conn?.nodes;
   if (!Array.isArray(nodes)) return { ids: [], truncated };
   const logins = [botLogin.replace(/\[bot\]$/, ""), botLogin];
-  const ids = nodes.flatMap((t4) => {
-    const cnodes = t4.comments?.nodes;
+  const ids = nodes.flatMap((t6) => {
+    const cnodes = t6.comments?.nodes;
     return Array.isArray(cnodes) ? cnodes.map((c) => priorBotCommentId(c, logins)).filter((id) => id !== null) : [];
   });
   return { ids, truncated };
@@ -1579,6 +1580,190 @@ var post = async (input, ghApi = runGhApi) => {
     }
   }
 };
+var DURATION_RE = /^(\d+)(h|m|s)$/;
+var USD_RE = /^\$(\d+(?:\.\d+)?)$/;
+var toSeconds = (n, unit) => unit === "h" ? n * 3600 : unit === "m" ? n * 60 : n;
+var stripTrigger = (body, trigger) => {
+  const trimmed = body.replace(/^\s+/, "");
+  if (!trimmed.startsWith(trigger)) return null;
+  const after = trimmed.slice(trigger.length);
+  return after === "" || /^\s/.test(after) ? after : null;
+};
+var scanLeading = (s, acc) => {
+  const m = /^(\s*)(\S+)([\s\S]*)$/.exec(s);
+  if (m === null) return { ...acc, rest: "" };
+  const [, , token = "", tail = ""] = m;
+  const dm = DURATION_RE.exec(token);
+  if (dm && acc.durationSec === null)
+    return scanLeading(tail, {
+      ...acc,
+      durationSec: toSeconds(Number.parseInt(dm[1] ?? "", 10), dm[2] ?? "s")
+    });
+  const um = USD_RE.exec(token);
+  if (um && acc.usd === null)
+    return scanLeading(tail, { ...acc, usd: Number.parseFloat(um[1] ?? "") });
+  return { ...acc, rest: s };
+};
+var clampDuration = (requested, ceiling) => requested !== null && ceiling !== null && requested > ceiling ? {
+  value: ceiling,
+  notes: [
+    `requested duration ${String(requested)}s exceeds the ${String(ceiling)}s ceiling \u2014 clamped to ${String(ceiling)}s`
+  ]
+} : { value: requested, notes: [] };
+var clampUsd = (requested, ceiling) => requested !== null && ceiling !== null && requested > ceiling ? {
+  value: ceiling,
+  notes: [
+    `requested $${requested.toFixed(2)} exceeds the $${ceiling.toFixed(2)} ceiling \u2014 clamped to $${ceiling.toFixed(2)}`
+  ]
+} : { value: requested, notes: [] };
+var capInstructions = (text, maxLen) => text.length > maxLen ? {
+  value: text.slice(0, maxLen),
+  notes: [
+    `instructions truncated from ${String(text.length)} to ${String(maxLen)} characters`
+  ]
+} : { value: text, notes: [] };
+var parseCommandArgs = (body, options) => {
+  const afterTrigger = stripTrigger(body, options.trigger);
+  if (afterTrigger === null) return { kind: "not-a-command" };
+  const scan = scanLeading(afterTrigger, { durationSec: null, usd: null });
+  const duration = clampDuration(scan.durationSec, options.maxDurationSec);
+  const usd = clampUsd(scan.usd, options.maxUsd);
+  const instructions = capInstructions(scan.rest.trim(), options.maxInstructionsLen);
+  return {
+    kind: "command",
+    args: {
+      durationSec: duration.value,
+      usd: usd.value,
+      instructions: instructions.value,
+      notes: [...duration.notes, ...usd.notes, ...instructions.notes]
+    }
+  };
+};
+var PrHeadCodec = t.type({
+  head_sha: t.string,
+  head_ref: t.string,
+  head_repo: t.union([t.string, t.null]),
+  state: t.string
+});
+var resolvePrHead = async (repo, prNumber, ghApi) => {
+  const stdout = await ghApi([
+    `repos/${repo}/pulls/${String(prNumber)}`,
+    "--jq",
+    "{head_sha: .head.sha, head_ref: .head.ref, head_repo: .head.repo.full_name, state: .state}"
+  ]);
+  const decoded = PrHeadCodec.decode(JSON.parse(stdout));
+  if (decoded._tag === "Left") {
+    throw new Error(`PR head for #${String(prNumber)} did not match the expected shape`);
+  }
+  return decoded.right;
+};
+var parseCommand = async (input, ghApi = runGhApi) => {
+  const parse = parseCommandArgs(input.body, input.options);
+  if (parse.kind === "not-a-command") {
+    return {
+      kind: "skip",
+      reason: `comment does not begin with the trigger "${input.options.trigger}"`
+    };
+  }
+  const head = await resolvePrHead(input.repo, input.prNumber, ghApi).catch(
+    (err) => err instanceof Error ? err : new Error(String(err))
+  );
+  if (head instanceof Error) {
+    return {
+      kind: "skip",
+      reason: `could not resolve PR #${String(input.prNumber)}: ${head.message}`
+    };
+  }
+  if (head.state !== "open") {
+    return {
+      kind: "skip",
+      reason: `PR #${String(input.prNumber)} is not open (state: ${head.state})`
+    };
+  }
+  return {
+    kind: "run",
+    headSha: head.head_sha,
+    headBranch: head.head_ref,
+    headRepo: head.head_repo ?? input.repo,
+    args: parse.args
+  };
+};
+var safeHeredocDelim = (instructions, randomHex, attemptsLeft = 8) => {
+  const candidate = `GHOUT_${randomHex()}`;
+  if (!instructions.split("\n").includes(candidate)) return candidate;
+  if (attemptsLeft <= 0) throw new Error("could not derive a collision-free heredoc delimiter");
+  return safeHeredocDelim(instructions, randomHex, attemptsLeft - 1);
+};
+var renderCommandOutputs = (result, delim) => {
+  if (result.kind === "skip") return "should_run=false\n";
+  const { headSha, headBranch, headRepo, args } = result;
+  return `${[
+    "should_run=true",
+    `head_sha=${headSha}`,
+    `head_branch=${headBranch}`,
+    `head_repo=${headRepo}`,
+    `duration=${args.durationSec === null ? "" : `${String(args.durationSec)}s`}`,
+    `usd=${args.usd === null ? "" : args.usd.toFixed(2)}`,
+    `instructions<<${delim}`,
+    args.instructions,
+    delim
+  ].join("\n")}
+`;
+};
+var REACTIONS = [
+  "+1",
+  "-1",
+  "laugh",
+  "confused",
+  "heart",
+  "hooray",
+  "rocket",
+  "eyes"
+];
+var isReaction = (s) => REACTIONS.includes(s);
+var ReactionCodec = t.type({ id: t.number, content: t.string });
+var reactionsPath = (repo, commentId) => `repos/${repo}/issues/comments/${String(commentId)}/reactions`;
+var removeReactions = async (repo, commentId, content, ghApi) => {
+  const stdout = await ghApi([
+    reactionsPath(repo, commentId),
+    "--paginate",
+    "--jq",
+    ".[] | {id, content}"
+  ]);
+  for (const line of stdout.split("\n").filter((l) => l.trim() !== "")) {
+    const parsed = tryParseJson(line);
+    const decoded = parsed.ok ? ReactionCodec.decode(parsed.value) : void 0;
+    if (decoded === void 0 || decoded._tag === "Left") {
+      process.stderr.write("code-review react: could not decode a reaction entry \u2014 skipping\n");
+      continue;
+    }
+    if (decoded.right.content !== content) continue;
+    await ghApi([
+      "--method",
+      "DELETE",
+      `${reactionsPath(repo, commentId)}/${String(decoded.right.id)}`
+    ]).catch(
+      (err) => process.stderr.write(
+        `code-review react: could not remove reaction ${String(decoded.right.id)} (${errMsg(err)}) \u2014 skipping
+`
+      )
+    );
+  }
+};
+var react = async (input, ghApi = runGhApi) => {
+  if (input.add !== void 0) {
+    await ghApi([
+      "--method",
+      "POST",
+      reactionsPath(input.repo, input.commentId),
+      "-f",
+      `content=${input.add}`
+    ]);
+  }
+  if (input.remove !== void 0) {
+    await removeReactions(input.repo, input.commentId, input.remove, ghApi);
+  }
+};
 var renderOutputs = (result) => {
   switch (result.kind) {
     case "skip":
@@ -3095,6 +3280,120 @@ var postCmd = defineCommand({
     });
   }
 });
+var requireCeilingSec = (raw) => {
+  if (raw === void 0) return null;
+  const ms = parseWallMs(raw);
+  if (ms === null)
+    return fail(`--max-duration must be a duration like 60m, 3600s, or 1h (got "${raw}")`);
+  return Math.floor(ms / 1e3);
+};
+var requireCeilingUsd = (raw) => {
+  if (raw === void 0) return null;
+  const n = Number.parseFloat(raw.replace(/^\$/, ""));
+  if (!Number.isFinite(n) || n < 0) fail(`--max-usd must be a non-negative number (got "${raw}")`);
+  return n;
+};
+var requireMaxInstructions = (raw) => {
+  if (raw === void 0) return 4e3;
+  if (!/^\d+$/.test(raw)) fail(`--max-instructions must be a non-negative integer (got "${raw}")`);
+  return Number.parseInt(raw, 10);
+};
+var requirePositiveInt = (raw, flag) => {
+  const n = Number.parseInt(raw, 10);
+  return Number.isInteger(n) && n > 0 && /^\d+$/.test(raw) ? n : fail(`${flag} must be a positive integer; got "${raw}"`);
+};
+var parseCommandCmd = defineCommand({
+  meta: {
+    name: "parse-command",
+    description: `Resolve a PR's head (SHA/branch/repo) from its NUMBER via the API and parse a ChatOps trigger comment ("/code-review [24m] [$1.00] <instructions>") into $GITHUB_OUTPUT lines. The untrusted comment is parsed here in type-safe code, never in workflow bash, and the head is resolved from the trusted PR number, never from the comment text. Emits should_run=false (and nothing else) when the comment is not the trigger, the PR is closed, or resolution fails.`
+  },
+  args: {
+    repo: { type: "string", description: "Repository (owner/name)", required: true },
+    pr: {
+      type: "string",
+      description: "PR number (from github.event.issue.number \u2014 trusted event data)",
+      required: true
+    },
+    "comment-body": {
+      type: "string",
+      description: "The comment body to parse (default: the CODE_REVIEW_COMMENT_BODY env var \u2014 the safe way to pass untrusted text without shell interpolation)"
+    },
+    trigger: {
+      type: "string",
+      description: 'Trigger token the comment must begin with (default: "/code-review")'
+    },
+    "max-duration": {
+      type: "string",
+      description: "Ceiling the requested duration is clamped to (e.g. 60m); omit for no clamp \u2014 a comment could then request an unbounded wall, so set this"
+    },
+    "max-usd": {
+      type: "string",
+      description: "Ceiling the requested USD budget is clamped to (e.g. 5); omit for no clamp"
+    },
+    "max-instructions": {
+      type: "string",
+      description: "Max characters of free-form instructions kept (default: 4000)"
+    }
+  },
+  run: async ({ args }) => {
+    const body = args["comment-body"] || process.env["CODE_REVIEW_COMMENT_BODY"] || "";
+    const result = await parseCommand({
+      repo: args.repo,
+      prNumber: requirePositiveInt(args.pr, "--pr"),
+      body,
+      options: {
+        trigger: args.trigger || "/code-review",
+        maxDurationSec: requireCeilingSec(args["max-duration"]),
+        maxUsd: requireCeilingUsd(args["max-usd"]),
+        maxInstructionsLen: requireMaxInstructions(args["max-instructions"])
+      }
+    });
+    if (result.kind === "skip") {
+      process.stderr.write(`code-review parse-command: not running \u2014 ${result.reason}
+`);
+      process.stdout.write(renderCommandOutputs(result, "UNUSED"));
+      return;
+    }
+    for (const note of result.args.notes)
+      process.stderr.write(`code-review parse-command: ${note}
+`);
+    const delim = safeHeredocDelim(result.args.instructions, () => randomBytes(16).toString("hex"));
+    process.stdout.write(renderCommandOutputs(result, delim));
+  }
+});
+var requireReaction = (name) => isReaction(name) ? name : fail(`Unknown reaction "${name}" \u2014 one of: ${REACTIONS.join(", ")}`);
+var reactCmd = defineCommand({
+  meta: {
+    name: "react",
+    description: "Add and/or remove a GitHub reaction on a PR/issue comment \u2014 the ChatOps acknowledgement (\u{1F440} on receipt, swapped to \u{1F680} on completion). Cosmetic: warns and exits 0 on any API error so a reaction never fails the job."
+  },
+  args: {
+    repo: { type: "string", description: "Repository (owner/name)", required: true },
+    "comment-id": {
+      type: "string",
+      description: "Comment id to react on (github.event.comment.id)",
+      required: true
+    },
+    add: { type: "string", description: `Reaction to add: ${REACTIONS.join(" | ")}` },
+    remove: {
+      type: "string",
+      description: "Reaction (of the token owner) to remove after adding \u2014 for the \u{1F440}\u2192\u{1F680} swap"
+    }
+  },
+  run: async ({ args }) => {
+    const commentId = requirePositiveInt(args["comment-id"], "--comment-id");
+    const add = args.add ? requireReaction(args.add) : void 0;
+    const remove = args.remove ? requireReaction(args.remove) : void 0;
+    if (add === void 0 && remove === void 0)
+      fail("react: nothing to do \u2014 pass --add and/or --remove");
+    await react({ repo: args.repo, commentId, add, remove }).catch(
+      (err) => process.stderr.write(
+        `code-review react: reaction update failed (${errMsg(err)}) \u2014 continuing (reactions are cosmetic)
+`
+      )
+    );
+  }
+});
 var main = defineCommand({
   meta: {
     name: "code-review",
@@ -3103,6 +3402,8 @@ var main = defineCommand({
   },
   subCommands: {
     gather: gatherCmd,
+    "parse-command": parseCommandCmd,
+    react: reactCmd,
     render: renderCmd,
     inline: inlineCmd,
     post: postCmd,