@jphutchins/code-review 0.1.0-alpha.27 → 0.1.0-alpha.29

package/dist/index.js

@@ -9,6 +9,7 @@ import { Ajv2020 } from 'ajv/dist/2020.js';
 import _addFormats from 'ajv-formats';
 import * as t from 'io-ts';
 import { execFile } from 'child_process';
+import { performance } from 'perf_hooks';
 import { PathReporter } from 'io-ts/lib/PathReporter.js';
 
 // src/cost.ts
@@ -185,6 +186,8 @@ var parseReviewedSha = (body) => {
   const sha = /<!-- reviewed-sha: ([0-9a-fA-F]{40}) -->/.exec(body)?.[1]?.toLowerCase();
   return sha && sha !== ZERO_SHA ? sha : null;
 };
+var REVIEW_COMPLETE_MARKER = "<!-- review-complete -->";
+var parseReviewComplete = (body) => body.includes(REVIEW_COMPLETE_MARKER);
 var parseFindingsMarker = (body) => {
   const match = /<!-- code-review:findings-json;base64 ([A-Za-z0-9+/=]+) -->/.exec(body);
   const b64 = match?.[1];
@@ -239,6 +242,8 @@ var computeSeverityCounts = (findings) => findings.reduce(
 var render = (input) => {
   const eta = new Eta({ autoTrim: false });
   const usageAvailable = input.envelope !== null;
+  const hasUsage = input.envelope !== null && input.envelope.models.length > 0;
+  const incomplete = input.incomplete ?? input.envelope?.incomplete ?? false;
   const costReport = input.envelope ? computeCost(input.envelope.models, input.prices) : null;
   const pricesProvided = input.pricesProvided ?? true;
   const route = input.route ?? input.envelope?.route ?? null;
@@ -248,6 +253,8 @@ var render = (input) => {
     findings: input.findings,
     envelope: input.envelope,
     usageAvailable,
+    hasUsage,
+    incomplete,
     costReport,
     pricesProvided,
     route,
@@ -601,7 +608,12 @@ var ResultEnvelopeCodec = t.intersection([
   t.partial({
     vendor_cost_usd: t.union([t.number, t.null]),
     route: t.string,
-    effort: t.string
+    effort: t.string,
+    // The run produced a notice rather than a completed review (security-gate block, agent kill, no
+    // recoverable findings). An empty `findings` array alone can't say this — a genuine clean review
+    // is also empty — so the render suppresses "clean review" and the sticky precedence guard refuses
+    // to bury a completed review under it. Absent ⇒ a completed review.
+    incomplete: t.boolean
   })
 ]);
 var ModelPricesCodec = t.type({
@@ -958,6 +970,35 @@ var formatMarkdown = (md) => {
 };
 var pad2 = (n) => String(n).padStart(2, "0");
 var formatUtc = (d) => `${String(d.getUTCFullYear())}-${pad2(d.getUTCMonth() + 1)}-${pad2(d.getUTCDate())} ${pad2(d.getUTCHours())}:${pad2(d.getUTCMinutes())} UTC`;
+
+// src/notice.ts
+var isNoticeKind = (s) => s === "security-blocked" || s === "setup-failed" || s === "diff-apply-failed" || s === "no-output";
+var blockquote = (text) => text.replaceAll("\n", "\n> ");
+var noticeSummary = (kind, reasons) => {
+  switch (kind) {
+    case "security-blocked":
+      return reasons !== void 0 && reasons.trim() !== "" ? `### \u{1F6D1} Code review skipped by the security gate
+
+The diff was flagged as unsafe to apply and execute:
+
+> ${blockquote(reasons)}` : "### \u{1F6D1} Code review skipped by the security gate\n\nThe security triage returned an unsafe verdict without a reason. See workflow logs.";
+    case "setup-failed":
+      return "### \u{1F6E0}\uFE0F Review did not run\n\nThe review job failed before the security triage could run (e.g. dependency install or environment setup). See the workflow logs \u2014 this is an infrastructure failure, not a security verdict.";
+    case "diff-apply-failed":
+      return "### \u26A0\uFE0F Could not apply the diff\n\nThe PR diff could not be applied to the checked-out base commit, so the review was skipped rather than run against an unmodified tree. See workflow logs.";
+    case "no-output":
+      return "### \u26A0\uFE0F Review did not complete\n\nThe diff passed triage but the review produced no output. See workflow logs.";
+  }
+};
+var buildNoticeEnvelope = (kind, reasons) => ({
+  schema_version: DEFAULT_SCHEMA_VERSION,
+  findings: noticeFindings(noticeSummary(kind, reasons)),
+  models: [],
+  turns: 0,
+  duration_ms: 0,
+  vendor_cost_usd: null,
+  incomplete: true
+});
 var identity = (decoded) => decoded;
 var findingsTable = [
   {
@@ -1416,6 +1457,15 @@ var post = async (input, ghApi = runGhApi) => {
     DEFAULT_MARKER,
     ghApi
   );
+  const existingComplete = existingSticky !== null && parseReviewComplete(existingSticky.body);
+  const wouldBuryCompleted = (incomplete) => incomplete && existingComplete;
+  const leaveInPlace = () => {
+    process.stderr.write(
+      `Review did not complete and the sticky already reflects a completed review \u2014 leaving it in place
+`
+    );
+    process.exit(0);
+  };
   const prices = JSON.parse(readFileSync(input.pricesPath, "utf-8"));
   const decodedPrices = PriceMapCodec.decode(prices);
   if (decodedPrices._tag === "Left") {
@@ -1427,6 +1477,7 @@ var post = async (input, ghApi = runGhApi) => {
     render({
       findings: noticeFindings(`### \u26A0\uFE0F ${message}`),
       envelope: null,
+      incomplete: true,
       prices: decodedPrices.right,
       pricesProvided: input.pricesProvided,
       template,
@@ -1439,6 +1490,7 @@ var post = async (input, ghApi = runGhApi) => {
     })
   );
   if (isEmptyDiff(diff)) {
+    if (wouldBuryCompleted(true)) leaveInPlace();
     await upsertSticky(
       input.repo,
       prNumber,
@@ -1450,6 +1502,7 @@ var post = async (input, ghApi = runGhApi) => {
   }
   const findingsResult = loadFindings(input.findingsPath);
   if (findingsResult.kind !== "ok") {
+    if (wouldBuryCompleted(true)) leaveInPlace();
     await upsertSticky(
       input.repo,
       prNumber,
@@ -1486,6 +1539,8 @@ var post = async (input, ghApi = runGhApi) => {
     );
     process.exit(0);
   }
+  const thisIncomplete = envelope.incomplete === true;
+  if (wouldBuryCompleted(thisIncomplete)) leaveInPlace();
   const findingsMarker = findingsPointer(findings, input.jsonUrl);
   const {
     comments: rawComments,
@@ -1509,6 +1564,7 @@ var post = async (input, ghApi = runGhApi) => {
   const commonRenderInput = {
     findings,
     envelope,
+    incomplete: thisIncomplete,
     prices: decodedPrices.right,
     pricesProvided: input.pricesProvided,
     template,
@@ -1623,7 +1679,7 @@ var announce = async (input, ghApi = runGhApi) => {
     DEFAULT_MARKER,
     ghApi
   );
-  if (existing !== null && parseReviewedSha(existing.body) === input.headSha.toLowerCase()) {
+  if (existing !== null && parseReviewComplete(existing.body) && parseReviewedSha(existing.body) === input.headSha.toLowerCase()) {
     process.stderr.write(
       `Sticky already reflects a completed review of ${input.headSha} \u2014 leaving it in place
 `
@@ -1829,15 +1885,21 @@ var RunCodec = t.type({
   conclusion: t.union([t.string, t.null]),
   run_number: t.number
 });
-var RunsCodec = t.type({ workflow_runs: t.array(RunCodec) });
+var RUN_JQ = ".workflow_runs[] | {id: .id, name: .name, status: .status, conclusion: .conclusion, run_number: .run_number}";
 var resolveCiRun = async (repo, headSha, workflowName, ghApi) => {
-  const stdout = await ghApi([`repos/${repo}/actions/runs?head_sha=${headSha}&per_page=100`]);
-  const decoded = RunsCodec.decode(JSON.parse(stdout));
-  if (decoded._tag === "Left")
-    throw new Error(
-      `workflow runs for ${headSha} did not match the expected shape: ${PathReporter.report(decoded).join("; ")}`
+  const endpoint = `repos/${repo}/actions/runs?head_sha=${headSha}&per_page=100`;
+  const rows = parseJsonl(await ghApi([endpoint, "--paginate", "--jq", RUN_JQ]));
+  const decoded = rows.map((row) => RunCodec.decode(row));
+  const runs = decoded.flatMap((d) => d._tag === "Right" ? [d.right] : []);
+  const dropped = decoded.length - runs.length;
+  if (dropped > 0) {
+    const firstDrift = decoded.find((d) => d._tag === "Left");
+    const detail = firstDrift === void 0 ? "" : ` (${PathReporter.report(firstDrift).join("; ")})`;
+    process.stderr.write(
+      `Warning: ${String(dropped)} of ${String(rows.length)} workflow-run row(s) from ${endpoint} failed to decode${detail} \u2014 excluded from the lookup
+`
     );
-  const runs = decoded.right.workflow_runs;
+  }
   const latest = runs.filter((r) => r.name === workflowName).reduce(
     (best, r) => best === null || r.run_number > best.run_number ? r : best,
     null
@@ -1848,21 +1910,34 @@ var resolveCiRun = async (repo, headSha, workflowName, ghApi) => {
   };
 };
 var awaitCiConclusion = async (repo, headSha, options, deps = { ghApi: runGhApi, sleep: defaultSleep, elapsedMs: monotonicElapsed() }) => {
-  const poll = async () => {
-    const { run, seenNames } = await resolveCiRun(repo, headSha, options.workflowName, deps.ghApi);
-    if (run !== null && run.status === "completed")
-      return { kind: "concluded", conclusion: run.conclusion ?? "unknown", runId: run.id };
+  const safeResolve = async () => {
+    try {
+      return await resolveCiRun(repo, headSha, options.workflowName, deps.ghApi);
+    } catch (err) {
+      process.stderr.write(
+        `Warning: CI-run lookup for ${headSha} failed (${errMsg(err)}) \u2014 retrying until the timeout
+`
+      );
+      return { run: null, seenNames: [] };
+    }
+  };
+  const poll = async (lastSeenNames, lastRunId) => {
+    const { run, seenNames } = await safeResolve();
+    if (run !== null && run.status === "completed" && run.conclusion !== null)
+      return { kind: "concluded", conclusion: run.conclusion, runId: run.id };
+    const runId = run === null ? lastRunId : run.id;
+    const names = seenNames.length > 0 ? seenNames : lastSeenNames;
     if (deps.elapsedMs() >= options.timeoutMs)
-      return { kind: "timed-out", runId: run === null ? null : run.id, seenNames };
+      return { kind: "timed-out", runId, seenNames: names };
     await deps.sleep(options.pollIntervalMs);
-    return poll();
+    return poll(names, runId);
   };
-  return poll();
+  return poll([], null);
 };
 var defaultSleep = (ms) => new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 var monotonicElapsed = () => {
-  const start = Date.now();
-  return () => Date.now() - start;
+  const start = performance.now();
+  return () => performance.now() - start;
 };
 var renderCiOutputs = (outcome) => outcome.kind === "concluded" ? `ci_settled=true
 ci_conclusion=${outcome.conclusion}
@@ -2345,6 +2420,7 @@ var buildEnvelope = (telemetry, native, agentFilePath, agentFileFallbackPath) =>
         findings: noticeFindings(`### \u26A0\uFE0F Review did not complete
 
 ${outcome.reason}`),
+        incomplete: true,
         ...telemetry
       };
   }
@@ -3105,6 +3181,30 @@ var adaptCmd = defineCommand({
 `);
   }
 });
+var noticeCmd = defineCommand({
+  meta: {
+    name: "notice",
+    description: "Emit an abstract envelope for a run that produced no completed review (security block, setup failure, unapplied diff, or empty run) \u2014 flagged incomplete so the commenter renders it honestly and won't bury a real review"
+  },
+  args: {
+    kind: {
+      type: "positional",
+      description: "One of: security-blocked, setup-failed, diff-apply-failed, no-output",
+      required: true
+    },
+    reasons: {
+      type: "string",
+      description: "security-blocked only: the triage's fail-closed reason string (empty/omitted \u21D2 the no-reason wording)"
+    }
+  },
+  run: ({ args }) => {
+    const kind = isNoticeKind(args.kind) ? args.kind : fail(
+      `Unknown notice kind "${args.kind}" \u2014 expected one of: security-blocked, setup-failed, diff-apply-failed, no-output`
+    );
+    process.stdout.write(`${JSON.stringify(buildNoticeEnvelope(kind, args.reasons), null, 2)}
+`);
+  }
+});
 var isExtractSchemaKind = (s) => s === "findings" || s === "triage";
 var requireExtractSchemaKind = (name) => isExtractSchemaKind(name) ? name : fail(`Unknown kind "${name}" for extract \u2014 expected one of: findings, triage`);
 var failClosedTriage = (outcome) => ({
@@ -3708,6 +3808,7 @@ var main = defineCommand({
     validate: validateCmd,
     "seed-draft": seedDraftCmd,
     adapt: adaptCmd,
+    notice: noticeCmd,
     extract: extractCmd,
     "validate-patches": validatePatchesCmd,
     "print-schema": printSchemaCmd,