@jphutchins/code-review 0.1.0-alpha.53 → 0.1.0-alpha.54

package/dist/index.js

@@ -568,6 +568,7 @@ var findingPayload = (finding, schemaVersion) => Buffer.from(
   JSON.stringify({ schema_version: schemaVersion, findings: [finding] }),
   "utf-8"
 ).toString("base64");
+var lineRange = (startLine, endLine, separator) => startLine === endLine ? String(startLine) : `${String(startLine)}${separator}${String(endLine)}`;
 var findingPointer = (finding, schemaVersion, jsonUrl) => {
   const payload = findingPayload(finding, schemaVersion);
   if (payload.length > INLINE_EMBED_LIMIT_CHARS) {
@@ -1232,17 +1233,39 @@ var fetchThreadComments = async (ghApi, repo, prNumber) => {
 
 // src/render.ts
 var escapePipes = (text) => text.replace(/\|/g, "\\|");
-var linkSafeUrl = (url) => escapeCodeBackticks(url).replace(/\(/g, "%28").replace(/\)/g, "%29");
+var encodeAutolinkParens = (url) => url.replace(/\(/g, "%28").replace(/\)/g, "%29");
+var linkSafeUrl = (url) => encodeAutolinkParens(escapeCodeBackticks(url));
+var permalinkFor = (base, f, anchor) => {
+  if (f.path === "" || f.side === "LEFT") return void 0;
+  const path = f.path.split("/").map(
+    (segment) => encodeAutolinkParens(
+      encodeURIComponent(
+        segment.replace(
+          /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g,
+          "\uFFFD"
+        )
+      )
+      // Markdown emphasis/syntax characters: `__` runs split the bare URL across CommonMark
+      // nodes and truncate the autolink, and a path-only link ending in one of these loses its
+      // tail to the autolinker's trailing-punctuation trim (issue #231 r4).
+    ).replace(/_/g, "%5F").replace(/\*/g, "%2A").replace(/'/g, "%27").replace(/!/g, "%21")
+  ).join("/");
+  return anchor ? `${base}${path}#L${lineRange(f.start_line, f.end_line, "-L")}` : `${base}${path}`;
+};
 var CARRIED_TOTAL_CHARS = 4e4;
 var SUPPRESSED_NIT_BLOCK_OVERHEAD = 280;
-var sanitizeFinding = (f, answeredNotes) => {
+var sanitizeFinding = (f, answeredNotes, permalinkBase, unanchored) => {
   const key2 = answeredNoteKey(f);
+  const anchored = permalinkBase !== void 0 && !(unanchored?.has(f) ?? false);
+  const permalink = permalinkBase === void 0 ? void 0 : permalinkFor(permalinkBase, f, anchored);
   return {
     ...f,
     title: escapePipes(f.title),
     path: escapeCodeBackticks(f.path),
     ...f.code !== void 0 ? { code: escapeCodeBackticks(f.code), codeKey: f.code } : {},
     ...f.code_url !== void 0 ? { code_url: linkSafeUrl(f.code_url) } : {},
+    rangeLabel: lineRange(f.start_line, f.end_line, "\u2013"),
+    ...permalink !== void 0 ? { permalink, permalinkAnchored: anchored } : {},
     patchProjection: projectPatch(f.patch, "comment-body"),
     answeredNote: answeredNotes !== void 0 && Object.prototype.hasOwnProperty.call(answeredNotes, key2) ? answeredNotes[key2] ?? "" : ""
   };
@@ -1313,6 +1336,8 @@ var render = (input) => {
     },
     { list: [], used: 0, dropped: 0 }
   );
+  const permalinkBase = input.repo !== void 0 && input.repo !== "" && input.reviewedSha !== void 0 && input.reviewedSha !== "" ? `https://github.com/${input.repo}/blob/${input.reviewedSha}/` : void 0;
+  const unanchored = new Set(input.unanchoredStrays ?? []);
   return eta.renderString(input.template, {
     findings: input.findings,
     envelope: input.envelope,
@@ -1333,7 +1358,9 @@ var render = (input) => {
     postedAt: input.postedAt ?? "",
     severityCounts,
     convergenceSummary: !isFullReviewRound ? "" : convergence ? convergenceBadge(convergence) : convergenceSummary(input.findings, input.convergenceThreshold),
-    strays: (input.strays ?? []).map((f) => sanitizeFinding(f, input.answeredNotes)),
+    strays: (input.strays ?? []).map(
+      (f) => sanitizeFinding(f, input.answeredNotes, permalinkBase, unanchored)
+    ),
     suppressedNits: suppressedBudget.list,
     carriedDroppedNits: suppressedBudget.dropped,
     nitVisibilityFloor: input.nitVisibilityFloor ?? DEFAULT_NIT_VISIBILITY_FLOOR,
@@ -2083,14 +2110,32 @@ var execFileWithTimeout = (spec) => new Promise((resolve4, reject) => {
 
 // src/gh.ts
 var describeEndpoint = (args) => args.find((a) => a === "graphql" || a.includes("/") && !a.startsWith("-")) ?? args[0] ?? "(no endpoint)";
-var runGhApi = (args, stdin, env) => execFileWithTimeout({
-  command: "gh",
-  args: ["api", ...args],
-  label: `gh api ${describeEndpoint(args)}`,
-  timeoutMs: subprocessTimeoutMs(),
-  env,
-  stdin
-});
+var flagFirst;
+var withEscapeRetry = async (run2, idempotent) => {
+  if (flagFirst) return run2(true);
+  try {
+    return await run2(false);
+  } catch (err) {
+    if (errMsg(err).includes("--allow-escape-sequences")) {
+      if (!idempotent) throw err;
+      flagFirst = true;
+      return run2(true);
+    }
+    throw err;
+  }
+};
+var isIdempotentCall = (args) => !args.includes("--input") && !args.includes("--method") && !args.includes("graphql");
+var runGhApi = (args, stdin, env) => withEscapeRetry(
+  (withFlag) => execFileWithTimeout({
+    command: "gh",
+    args: ["api", ...withFlag ? ["--allow-escape-sequences"] : [], ...args],
+    label: `gh api ${describeEndpoint(args)}`,
+    timeoutMs: subprocessTimeoutMs(),
+    env,
+    stdin
+  }),
+  isIdempotentCall(args)
+);
 var run = promisify(execFile);
 var STEP_TIMEOUT_MS = 6e4;
 var MARKER_URL = /<!-- code-review:findings-json (https?:\/\/[^\s>]+) -->/;
@@ -2143,11 +2188,14 @@ var readArtifactFindings = (ghApiPath) => {
   };
 };
 var ghArtifactReader = readArtifactFindings(async (url, outPath) => {
-  const { stdout } = await run("gh", ["api", url], {
-    encoding: "buffer",
-    maxBuffer: 256 * 1024 * 1024,
-    timeout: STEP_TIMEOUT_MS
-  });
+  const { stdout } = await withEscapeRetry(
+    (withFlag) => run("gh", ["api", ...withFlag ? ["--allow-escape-sequences"] : [], url], {
+      encoding: "buffer",
+      maxBuffer: 256 * 1024 * 1024,
+      timeout: STEP_TIMEOUT_MS
+    }),
+    true
+  );
   await writeFile(outPath, stdout);
 });
 var withoutKey = (doc, key2) => Object.fromEntries(Object.entries(doc).filter(([k]) => k !== key2));
@@ -2862,6 +2910,7 @@ ${dropNote}` : ""}`,
         template,
         route: effectiveRoute,
         reviewedSha: input.headSha,
+        repo: input.headRepo || input.repo,
         effort: input.effort,
         sameRootNotes: {},
         // The answered-state honesty rules apply on EVERY surface that renders the filtered
@@ -2954,6 +3003,7 @@ ${dropNote}` : ""}`,
     template,
     route: effectiveRoute,
     reviewedSha: input.headSha,
+    repo: input.headRepo || input.repo,
     effort: input.effort,
     testReport,
     clocDiff,
@@ -2980,11 +3030,12 @@ ${dropNote}` : ""}`,
 
 > **Note:** ${String(longFiles.length)} suggestion(s) exceeded GitHub's ~10-line inline suggestion limit and were omitted from the inline comments; the affected findings remain in the review.
 ` : "";
-  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2) => formatMarkdown(
+  const renderBody = (inlineDisposition, reviewUrl2, straysOverride, unanchoredCount2, unanchoredStrays) => formatMarkdown(
     render({
       ...commonRenderInput,
       ...straysOverride ? { strays: straysOverride } : {},
       ...unanchoredCount2 !== void 0 ? { unanchoredCount: unanchoredCount2 } : {},
+      ...unanchoredStrays !== void 0 && unanchoredStrays.length > 0 ? { unanchoredStrays } : {},
       inlineDisposition,
       reviewUrl: reviewUrl2
     }) + longFilesNote
@@ -3041,7 +3092,7 @@ ${dropNote}` : ""}`,
       await patchComment(
         input.repo,
         stickyRef.id,
-        renderBody(finalDisposition, reviewUrl, finalStrays, unanchoredCount),
+        renderBody(finalDisposition, reviewUrl, finalStrays, unanchoredCount, unposted),
         ghApi
       );
       process.stderr.write(
@@ -3060,7 +3111,13 @@ ${dropNote}` : ""}`,
     () => renderBody(
       { kind: "whole-document", inlineCount: inlinePosted, rejectedCount: unanchoredCount },
       reviewUrl,
-      visibleFindings
+      visibleFindings,
+      void 0,
+      // The rejected-anchor invariant holds on EVERY surface, the run summary included — this
+      // document deliberately carries every finding, so the GitHub-rejected ones must keep their
+      // path-only links here too (issue #231 r2). Unconditional: renderBody's own gate treats an
+      // empty array exactly like absence, so the ternary was a duplicated decision (issue #231 r3).
+      unposted
     )
   );
 };
@@ -5447,6 +5504,10 @@ var postCmd = defineCommand({
     const priceResolution = resolvePrices(args.prices);
     await post({
       repo: args.repo,
+      // The workflow's post step threads HEAD_REPO env (the fork's owner/name) — a finding
+      // permalink targets the tree the reviewed SHA lives in (issue #231 r1). Absent/empty ⇒ the
+      // base repo. Env rather than a flag: an older pinned CLI simply ignores it.
+      headRepo: process.env["HEAD_REPO"] || void 0,
       headSha: args["head-sha"],
       botLogin: args["bot-login"] || "github-actions[bot]",
       findingsPath: args.findings,