@jphutchins/code-review 0.1.0-alpha.7 → 0.1.0-alpha.8

package/README.md

@@ -25,8 +25,9 @@ the security boundary, and the cost.
 ## The CLI
 
 The npm package is the **deterministic commenter** — the presentation and posting layer that no
-model should do, plus the adapter glue between an agent CLI's native output and the spec's abstract
-envelope ([SPEC §6.1](SPEC.md#61-result-envelope)).
+model should do, plus the adapter glue between an agent CLI's native output and the abstract result
+envelope defined in [`src/schema.ts`](src/schema.ts) (the deliverable of
+[SPEC §3.2](SPEC.md#32-the-deliverable)).
 
 ```sh
 npm install -g @jphutchins/code-review
@@ -40,7 +41,7 @@ npx @jphutchins/code-review <subcommand>
 | `gather` | Resolve the PR from the CI head SHA and gather the review inputs (diff with git-diff fallback, PR context, prior bot review, failing-job logs) into the workspace for the agent |
 | `render` | Render the sticky-comment markdown from findings + usage + prices |
 | `inline` | Build the GitHub reviews `comments[]` payload from findings + diff (in-diff validation; strays demote to the summary) |
-| `adapt` | Map a native agent-CLI result envelope onto the abstract SPEC §6.1 envelope |
+| `adapt` | Map a native agent-CLI result envelope onto the abstract result envelope (`src/schema.ts`) |
 | `extract` | Recover findings/triage JSON from a native envelope via the deterministic extraction ladder |
 | `validate-patches` | Validate each finding's `patch` against the real PR-head file, aligning the finding's line range to it and keeping the patch (projected into a suggestion at render time), or dropping the patch |
 | `cost` | Recompute USD cost from the envelope's per-model token counts + a price map |
@@ -63,16 +64,17 @@ in [templates/](templates/). See [docs/adapters.md](docs/adapters.md) for the ad
    letting the CLI pick where your key gets sent.
 3. Commit `.github/prices.json` (fork [schema/prices.example.json](schema/prices.example.json) and
    fill in your provider's per-token rates) — without it the cost footer renders **$0**
-   ([SPEC §6.2](SPEC.md#62-price-map)).
+   ([SPEC §4.4](SPEC.md#44-required-controls-conformance)).
 4. Merge to your default branch first — `workflow_run` only fires from the default branch, so the
    introducing PR won't review itself — then open a test PR.
 5. First run: consider `egress-policy: audit` to discover the real allowlist, then switch to `block`
-   ([SPEC §8.4](SPEC.md#84-egress-allowlist)).
+   ([SPEC Appendix A](SPEC.md#appendix-a--reference-realization-github-actions-non-normative)).
 
 Every model knob is committed step `env` on the workflow's triage and review steps — models,
 efforts, the subagent model, and the tier aliases, right where each is consumed — edited and
-PR-reviewed like the rest of the file ([SPEC §8.5](SPEC.md#85-model-backend-env)). Only the backend
-endpoint is a per-repo **Actions variable** (`API_BASE_URL`, required, no default); pointing it at
+PR-reviewed like the rest of the file (implementation detail the spec deliberately leaves to this
+repo — see [SPEC Appendix A](SPEC.md#appendix-a--reference-realization-github-actions-non-normative)).
+Only the backend endpoint is a per-repo **Actions variable** (`API_BASE_URL`, required, no default); pointing it at
 another provider requires adding that provider's API host to the workflow's egress allowlist in the
 same reviewed PR.
 
@@ -87,8 +89,8 @@ links to:
   downstream tool) SHOULD base64-decode and parse that marker rather than parse the comment's prose.
   Embedding in the comment (rather than only linking the artifact) keeps the pointer from expiring
   with artifact retention; when the encoded findings are too large to embed, the sticky falls back to
-  a `<!-- code-review:findings-json <url> -->` link marker instead
-  ([SPEC §5.1 item 7](SPEC.md#51-sticky-summary-comment)).
+  a `<!-- code-review:findings-json <url> -->` link marker instead — the shared serializer is
+  [`src/surface.ts`](src/surface.ts).
 - **`code-review-transcript`** — the full Claude Code session transcripts for the triage and review
   phases. This is advisory/auditability only: it is never read by the comment job and never affects
   what gets posted.

package/dist/index.js

@@ -172,10 +172,18 @@ ${marker}` : "";
 };
 var escapeFence = (text) => text.replace(/```/g, "`` ` ``");
 var projectPatch = (patch) => {
-  if (patch === null || patch === void 0) return { kind: "none" };
+  if (patch === void 0) return { kind: "none" };
   const lowered = patchToSuggestion(patch);
   return typeof lowered === "string" ? { kind: "suggestion", text: escapeFence(lowered) } : { kind: "patch", raw: escapeFence(patch) };
 };
+var formatConfidence = (n) => n.toFixed(2);
+var reviewBodyPointer = (headSha, stickyUrl, marker) => {
+  const sha7 = headSha.slice(0, 7);
+  const linkLine = stickyUrl ? `\u{1F916} Automated code review for \`${sha7}\` \u2014 see the [summary comment](${stickyUrl}) for the verdict, walkthrough, and cost.` : `\u{1F916} Automated code review for \`${sha7}\` \u2014 see the summary comment for the verdict, walkthrough, and cost.`;
+  return marker ? `${marker}
+
+${linkLine}` : linkLine;
+};
 
 // src/render.ts
 var escapePipes = (text) => text.replace(/\|/g, "\\|");
@@ -215,6 +223,7 @@ var render = (input) => {
     modelNames,
     testReport: input.testReport ?? null,
     reviewedSha: input.reviewedSha ?? "0000000000000000000000000000000000000000",
+    postedAt: input.postedAt ?? "",
     severityCounts: input.severityCounts ?? computeSeverityCounts(input.findings.findings),
     strays: (input.strays ?? []).map(sanitizeFinding),
     inlineDisposition: input.inlineDisposition ?? null,
@@ -243,7 +252,8 @@ var render = (input) => {
           return `\u2753 ${v}`;
       }
     },
-    severityEmoji
+    severityEmoji,
+    formatConfidence
   });
 };
 var key = (path, line) => `${path}:${String(line)}`;
@@ -308,6 +318,7 @@ var renderCommentBody = (f, eta, template, modelsText, jsonUrl, pointer) => (
     ...f,
     patchProjection: projectPatch(f.patch),
     severityEmoji,
+    formatConfidence,
     modelsText,
     jsonUrl: jsonUrl ?? null,
     findingsPointer: pointer
@@ -388,7 +399,7 @@ var FindingShape = t.intersection([
     code: t.string,
     code_url: t.string,
     recommendation: t.string,
-    patch: t.union([t.string, t.null])
+    patch: t.string
   })
 ]);
 var EndGeStart = t.refinement(
@@ -528,6 +539,8 @@ var formatMarkdown = (md) => {
   return `${lines.join("\n").replace(/\n+$/, "")}
 `;
 };
+var pad2 = (n) => String(n).padStart(2, "0");
+var formatUtc = (d) => `${String(d.getUTCFullYear())}-${pad2(d.getUTCMonth() + 1)}-${pad2(d.getUTCDate())} ${pad2(d.getUTCHours())}:${pad2(d.getUTCMinutes())} UTC`;
 var identity = (decoded) => decoded;
 var findingsTable = [
   {
@@ -745,11 +758,7 @@ var parseHtmlUrl = (raw) => {
   }
 };
 var postInlineReview = async (repo, prNumber, headSha, comments, stickyUrl, marker, ghApi) => {
-  const sha7 = headSha.slice(0, 7);
-  const linkLine = stickyUrl ? `\u{1F916} Automated code review for \`${sha7}\` \u2014 see the [summary comment](${stickyUrl}) for the verdict, walkthrough, and cost.` : `\u{1F916} Automated code review for \`${sha7}\` \u2014 see the summary comment for the verdict, walkthrough, and cost.`;
-  const pointer = marker ? `${marker}
-
-${linkLine}` : linkLine;
+  const pointer = reviewBodyPointer(headSha, stickyUrl, marker);
   const body = JSON.stringify({
     body: pointer,
     commit_id: headSha,
@@ -901,7 +910,8 @@ var post = async (input, ghApi = runGhApi) => {
       reviewedSha: input.headSha,
       effort: input.effort,
       runUrl: input.runUrl,
-      jsonUrl: input.jsonUrl
+      jsonUrl: input.jsonUrl,
+      postedAt: input.postedAt
     })
   );
   if (isEmptyDiff(diff)) {
@@ -942,7 +952,8 @@ var post = async (input, ghApi = runGhApi) => {
         testReport,
         inlineDisposition: { kind: "no-envelope" },
         runUrl: input.runUrl,
-        jsonUrl: input.jsonUrl
+        jsonUrl: input.jsonUrl,
+        postedAt: input.postedAt
       })
     );
     await upsertSticky(input.repo, prNumber, existingSticky, body, ghApi);
@@ -981,7 +992,8 @@ var post = async (input, ghApi = runGhApi) => {
     strays,
     runUrl: input.runUrl,
     jsonUrl: input.jsonUrl,
-    findingsPointer: findingsMarker
+    findingsPointer: findingsMarker,
+    postedAt: input.postedAt
   };
   const longFilesNote = longFiles.length > 0 ? `
 
@@ -1597,7 +1609,8 @@ var renderCmd = defineCommand({
       reviewedSha: args["reviewed-sha"],
       route: args.route,
       effort: args.effort,
-      testReport
+      testReport,
+      postedAt: formatUtc(/* @__PURE__ */ new Date())
     });
     process.stdout.write(output);
   }
@@ -1813,7 +1826,7 @@ var readFileLines = (path) => {
   }
 };
 var validateFinding = (finding, repoRoot) => {
-  if (finding.patch === void 0 || finding.patch === null) return finding;
+  if (finding.patch === void 0) return finding;
   const lines = readFileLines(resolve$1(repoRoot, finding.path));
   if (lines === null) {
     process.stderr.write(
@@ -2128,7 +2141,8 @@ var postCmd = defineCommand({
       effort: args.effort,
       testReportPath: args["test-report"],
       runUrl: args["run-url"],
-      jsonUrl: args["json-url"]
+      jsonUrl: args["json-url"],
+      postedAt: formatUtc(/* @__PURE__ */ new Date())
     });
   }
 });