@jphutchins/code-review 0.1.0-alpha.37 → 0.1.0-alpha.39

package/dist/index.js

@@ -338,7 +338,8 @@ var parseFindingsMarker = (body) => {
   return decodeBase64Json(b64) ?? null;
 };
 var ROUNDS_RE = /<!-- code-review:rounds;base64 ([A-Za-z0-9+/=]+) -->/;
-var isSeverityCounts = (u) => typeof u === "object" && u !== null && ["critical", "major", "minor", "nit"].every((k) => {
+var SEVERITIES = ["critical", "major", "minor", "nit"];
+var isSeverityCounts = (u) => typeof u === "object" && u !== null && SEVERITIES.every((k) => {
   const v = u[k];
   return typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
 });
@@ -350,7 +351,7 @@ var parseRounds = (body) => {
 };
 var roundsMarker = (rounds) => rounds.length === 0 ? "" : `<!-- code-review:rounds;base64 ${Buffer.from(JSON.stringify(rounds), "utf-8").toString("base64")} -->`;
 var roundChip = (c) => {
-  const parts = ["critical", "major", "minor", "nit"].filter((k) => c[k] > 0).map((k) => `${severityEmoji(k)}${String(c[k])}`);
+  const parts = SEVERITIES.filter((k) => c[k] > 0).map((k) => `${severityEmoji(k)}${String(c[k])}`);
   return parts.length === 0 ? "clean" : parts.join(" ");
 };
 var TRAJECTORY_CHIPS = 8;
@@ -360,6 +361,13 @@ var roundsSummary = (rounds) => {
   const trajectory = rounds.length > TRAJECTORY_CHIPS ? `\u2026 \u2192 ${chips.join(" \u2192 ")}` : chips.join(" \u2192 ");
   return `**Round ${String(rounds.length)}** \xB7 ${trajectory}`;
 };
+var CONVERGENCE_WEIGHTS = { critical: 4, major: 2, minor: 1, nit: 0 };
+var DEFAULT_CONVERGENCE_THRESHOLD = 1;
+var convergenceScore = (counts) => SEVERITIES.reduce((sum, k) => sum + counts[k] * CONVERGENCE_WEIGHTS[k], 0);
+var convergenceSummary = (counts, threshold = DEFAULT_CONVERGENCE_THRESHOLD) => {
+  const score = convergenceScore(counts);
+  return score <= threshold ? `**Convergence** \u{1F3C1} ${String(score)} \u2264 ${String(threshold)} \u2014 converged` : `**Convergence** \u{1F504} ${String(score)} > ${String(threshold)} \u2014 iterating`;
+};
 var carryForwardMarkers = (body) => {
   const findings = /<!-- code-review:findings-json[^>]*-->/.exec(body)?.[0];
   const reviewedSha = /<!-- reviewed-sha: [0-9a-fA-F]{40} -->/.exec(body)?.[0];
@@ -402,6 +410,7 @@ var computeSeverityCounts = (findings) => findings.reduce(
   (acc, f) => f.severity in acc ? { ...acc, [f.severity]: acc[f.severity] + 1 } : acc,
   emptySeverityCounts()
 );
+var isConvergenceRound = (route, incomplete) => route === "full review" && !incomplete;
 var render = (input) => {
   const eta = new Eta({ autoTrim: false });
   const usageAvailable = input.envelope !== null;
@@ -412,6 +421,9 @@ var render = (input) => {
   const route = input.route ?? input.envelope?.route ?? null;
   const effort = input.effort ?? input.envelope?.effort ?? null;
   const modelNames = input.envelope ? input.envelope.models.map((m) => m.model).join(", ") : "";
+  const severityCounts = input.severityCounts ?? computeSeverityCounts(input.findings.findings);
+  const rounds = input.rounds ?? [];
+  const isFullReviewRound = (input.convergenceRound ?? isConvergenceRound(route, incomplete)) && input.findings.verdict !== "error";
   return eta.renderString(input.template, {
     findings: input.findings,
     envelope: input.envelope,
@@ -426,15 +438,16 @@ var render = (input) => {
     testReport: input.testReport ?? null,
     reviewedSha: input.reviewedSha ?? "0000000000000000000000000000000000000000",
     postedAt: input.postedAt ?? "",
-    severityCounts: input.severityCounts ?? computeSeverityCounts(input.findings.findings),
+    severityCounts,
+    convergenceSummary: isFullReviewRound ? convergenceSummary(severityCounts, input.convergenceThreshold) : "",
     strays: (input.strays ?? []).map(sanitizeFinding),
     unanchoredCount: input.unanchoredCount ?? 0,
     inlineDisposition: input.inlineDisposition ?? null,
     runUrl: input.runUrl ?? null,
     jsonUrl: input.jsonUrl ?? null,
     findingsPointer: input.findingsPointer ?? findingsPointer(input.findings, input.jsonUrl),
-    roundsMarker: roundsMarker(input.rounds ?? []),
-    roundsSummary: roundsSummary(input.rounds ?? []),
+    roundsMarker: roundsMarker(rounds),
+    roundsSummary: roundsSummary(rounds),
     reviewUrl: input.reviewUrl ?? null,
     formatTokens: (n) => Number.isFinite(n) && n >= 0 ? n.toLocaleString("en-US") : "\u2014",
     // N/A (never a false $0.00) when no real price map was provided — real tokens, no rates to price them.
@@ -1622,6 +1635,7 @@ var post = async (input, ghApi = runGhApi) => {
       reviewedSha: input.headSha,
       effort: input.effort,
       rounds: priorRounds,
+      convergenceRound: false,
       runUrl: input.runUrl,
       jsonUrl: input.jsonUrl,
       postedAt: input.postedAt
@@ -1668,6 +1682,7 @@ var post = async (input, ghApi = runGhApi) => {
         reviewedSha: input.headSha,
         effort: input.effort,
         rounds: priorRounds,
+        convergenceRound: false,
         testReport,
         inlineDisposition: { kind: "no-envelope" },
         runUrl: input.runUrl,
@@ -1705,7 +1720,8 @@ var post = async (input, ghApi = runGhApi) => {
   const initialDisposition = comments.length === 0 && strays.length > 0 ? { kind: "none-in-diff" } : void 0;
   const currentCounts = computeSeverityCounts(findings.findings);
   const effectiveRoute = input.route ?? envelope.route;
-  const rounds = effectiveRoute === "full review" && !thisIncomplete ? [...priorRounds, currentCounts] : priorRounds;
+  const isRound = isConvergenceRound(effectiveRoute, thisIncomplete);
+  const rounds = isRound ? [...priorRounds, currentCounts] : priorRounds;
   const commonRenderInput = {
     findings,
     envelope,
@@ -1719,6 +1735,8 @@ var post = async (input, ghApi = runGhApi) => {
     testReport,
     severityCounts: currentCounts,
     rounds,
+    convergenceThreshold: input.convergenceThreshold,
+    convergenceRound: isRound,
     strays,
     runUrl: input.runUrl,
     jsonUrl: input.jsonUrl,
@@ -2809,6 +2827,12 @@ var deriveModelHost = (apiBaseUrl) => {
   }
   return host;
 };
+var KNOWN_MODEL_HOST_SUFFIXES = ["anthropic.com", "deepseek.com"];
+var isKnownModelHost = (host, declared = []) => {
+  const normalize = (h) => h.replace(/\.$/, "").toLowerCase();
+  const target = normalize(host);
+  return declared.some((d) => normalize(d) === target) || KNOWN_MODEL_HOST_SUFFIXES.some((suffix) => target.endsWith(`.${suffix}`));
+};
 var parseExtraEndpoints = (extra) => extra.split(/\s+/).map((token) => token.replace(/:\d+$/, "")).filter((token) => token.length > 0);
 var buildSandboxConfig = (opts) => ({
   network: {
@@ -2932,6 +2956,7 @@ var resolvePrices = (pricesArg) => {
   return { kind: "absent", path: bundledPath("schema", "prices.example.json") };
 };
 var TEST_REPORT_DESCRIPTION = 'Path to a JSON test summary: {"passed": number, "failed": number, "total": number, "failures"?: [{"name": string, "message"?: string}]}';
+var CONVERGENCE_THRESHOLD_DESCRIPTION = "Advisory convergence tolerance: the weighted-severity score (critical 4 \xB7 major 2 \xB7 minor 1 \xB7 nit 0) at or below which the sticky reads as converged (default: 1 \u2014 unlimited nits plus at most one minor)";
 var renderCmd = defineCommand({
   meta: {
     name: "render",
@@ -2971,6 +2996,10 @@ var renderCmd = defineCommand({
     "test-report": {
       type: "string",
       description: TEST_REPORT_DESCRIPTION
+    },
+    "convergence-threshold": {
+      type: "string",
+      description: CONVERGENCE_THRESHOLD_DESCRIPTION
     }
   },
   run: async ({ args }) => {
@@ -2991,6 +3020,7 @@ var renderCmd = defineCommand({
       route: args.route,
       effort: args.effort,
       testReport,
+      convergenceThreshold: parseConvergenceThreshold(args["convergence-threshold"]),
       postedAt: formatUtc(/* @__PURE__ */ new Date())
     });
     process.stdout.write(output2);
@@ -3111,6 +3141,18 @@ var parseBudgetUsd = (raw) => {
   const n = Number.parseFloat(raw);
   return Number.isFinite(n) && n >= 0 ? n : null;
 };
+var parseConvergenceThreshold = (raw) => {
+  const trimmed = raw?.trim();
+  if (trimmed === void 0 || trimmed === "") return void 0;
+  if (!/^\d+(\.\d+)?$/.test(trimmed)) {
+    fail(`--convergence-threshold must be a non-negative number; got "${trimmed}"`);
+  }
+  const n = Number.parseFloat(trimmed);
+  if (!Number.isFinite(n)) {
+    fail(`--convergence-threshold is too large to be a meaningful tolerance; got "${trimmed}"`);
+  }
+  return n;
+};
 var mtimeMsOf = (path) => {
   try {
     return statSync(path).mtimeMs;
@@ -3957,6 +3999,10 @@ var postCmd = defineCommand({
     "json-url": {
       type: "string",
       description: "URL to the machine-readable findings JSON artifact, pointed at from the sticky and each inline comment"
+    },
+    "convergence-threshold": {
+      type: "string",
+      description: CONVERGENCE_THRESHOLD_DESCRIPTION
     }
   },
   run: async ({ args }) => {
@@ -3977,6 +4023,7 @@ var postCmd = defineCommand({
       testReportPath: args["test-report"],
       runUrl: args["run-url"],
       jsonUrl: args["json-url"],
+      convergenceThreshold: parseConvergenceThreshold(args["convergence-threshold"]),
       postedAt: formatUtc(/* @__PURE__ */ new Date())
     });
   }
@@ -4292,9 +4339,32 @@ var sandboxConfigCmd = defineCommand({
     out: {
       type: "string",
       description: "Write the settings JSON here instead of stdout"
+    },
+    "known-model-host": {
+      type: "string",
+      description: "Additional model HOST(S) to treat as known (space-separated bare hostnames, not URLs) \u2014 the consumer's declared host(s) for a provider outside the built-in set; a derived host outside the built-ins and this list warns (or fails under --strict-host)"
+    },
+    "strict-host": {
+      type: "boolean",
+      description: "Fail (instead of warning) when the model host derived from api_base_url is not a well-known or declared host \u2014 closes the fail-open-on-typo gap where a mistyped api_base_url would still be allowlisted and sent the key"
     }
   },
   run: ({ args }) => {
+    const modelHost = deriveModelHost(args["api-base-url"]);
+    const declaredHosts = [
+      ...args["known-model-host"] ? parseExtraEndpoints(args["known-model-host"]) : [],
+      ...args.extra ? parseExtraEndpoints(args.extra) : []
+    ];
+    if (!isKnownModelHost(modelHost, declaredHosts)) {
+      const message = `code-review sandbox-config: derived model host "${modelHost}" is not a well-known or declared host \u2014 the jail will allow egress to it and send MODEL_API_KEY there; verify api_base_url is correct`;
+      if (args["strict-host"]) {
+        process.stderr.write(`::error::${annotationSafe(message)}
+`);
+        process.exit(1);
+      }
+      process.stderr.write(`::warning::${annotationSafe(message)}
+`);
+    }
     const config = buildSandboxConfig({ apiBaseUrl: args["api-base-url"], extra: args.extra });
     const json = `${JSON.stringify(config, null, 2)}
 `;