@juspay/yama 2.5.0 → 2.6.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [2.6.0](https://github.com/juspay/yama/compare/v2.5.0...v2.6.0) (2026-06-04)
+
+
+### Features
+
+* **action:** add Yama self-review workflow with LiteLLM/Vertex auth ([5ebb73f](https://github.com/juspay/yama/commit/5ebb73f2450951b5f97d97a6a3caa89377a150af))
+
 # [2.5.0](https://github.com/juspay/yama/compare/v2.4.2...v2.5.0) (2026-06-03)
 
 

package/dist/v2/core/MCPServerManager.d.ts

@@ -45,6 +45,14 @@ export declare class MCPServerManager {
      * defaulting to the remote HTTP endpoint.
      */
     private setupGitHubMCP;
+    /**
+     * Poll {@link listMCPServers} until the named server reports "connected" with
+     * at least one tool, or the timeout elapses. Returns the last-seen server
+     * entry (possibly not-yet-connected) so the caller can decide how to proceed.
+     *
+     * Bounded by `timeoutMs` via the loop condition — it cannot run indefinitely.
+     */
+    private waitForMCPServer;
     /**
      * Build the remote HTTP GitHub MCP registration (default path).
      * A Bearer token is required for the hosted endpoint.

package/dist/v2/core/MCPServerManager.js

@@ -240,17 +240,26 @@ export class MCPServerManager {
                 ? this.buildGitHubStdioConfig(githubConfig, ghToken, blockedTools)
                 : this.buildGitHubHttpConfig(githubConfig, ghToken, blockedTools);
             await neurolink.addExternalMCPServer("github", config);
-            // Verify the server actually connected — NeuroLink resolves the promise
-            // even on timeout, so we must check the status explicitly (same pattern
-            // as the Bitbucket path).
-            const servers = await neurolink.listMCPServers();
-            const ghServer = (servers || []).find((s) => s.name === "github");
-            if (!ghServer ||
-                ghServer.status !== "connected" ||
-                ghServer.tools?.length === 0) {
+            // The remote HTTP endpoint (api.githubcopilot.com) connects asynchronously
+            // — TLS handshake + auth + tool discovery take ~3-4s, and NeuroLink may only
+            // finish discovery lazily on the first generate() call. Poll briefly for a
+            // healthy status, but for the HTTP transport DO NOT hard-fail if it is not
+            // yet "connected": the tools are resolved when the review runs (this mirrors
+            // Curator's proven pattern). For a local stdio server we keep the strict
+            // check, since a local process should connect promptly.
+            const ghServer = await this.waitForMCPServer(neurolink, "github", 12000);
+            const connected = ghServer?.status === "connected" && (ghServer?.tools?.length ?? 0) > 0;
+            if (transport === "stdio" && !connected) {
                 throw new MCPServerError(`GitHub MCP server registered but not connected (status: ${ghServer?.status ?? "unknown"}, tools: ${ghServer?.tools?.length ?? 0}). Possible startup timeout.`);
             }
-            console.log(`   ✅ GitHub MCP server registered and tools available (transport: ${transport})`);
+            if (connected) {
+                console.log(`   ✅ GitHub MCP server registered and tools available (transport: ${transport})`);
+            }
+            else {
+                console.warn(`   ⚠️  GitHub MCP server registered but not yet reporting connected ` +
+                    `(status: ${ghServer?.status ?? "unknown"}, tools: ${ghServer?.tools?.length ?? 0}). ` +
+                    `Remote tools are discovered on first use; continuing.`);
+            }
             if (transport === "http") {
                 console.log(`   🌐 Remote endpoint: ${config.url}`);
             }
@@ -260,6 +269,28 @@ export class MCPServerManager {
             throw new MCPServerError(`Failed to setup GitHub MCP server: ${error.message}`);
         }
     }
+    /**
+     * Poll {@link listMCPServers} until the named server reports "connected" with
+     * at least one tool, or the timeout elapses. Returns the last-seen server
+     * entry (possibly not-yet-connected) so the caller can decide how to proceed.
+     *
+     * Bounded by `timeoutMs` via the loop condition — it cannot run indefinitely.
+     */
+    async waitForMCPServer(neurolink, name, timeoutMs) {
+        const deadline = Date.now() + timeoutMs;
+        let last;
+        while (Date.now() < deadline) {
+            const servers = await neurolink
+                .listMCPServers()
+                .catch(() => []);
+            last = (servers || []).find((server) => server.name === name);
+            if (last?.status === "connected" && (last.tools?.length ?? 0) > 0) {
+                return last;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+        }
+        return last;
+    }
     /**
      * Build the remote HTTP GitHub MCP registration (default path).
      * A Bearer token is required for the hosted endpoint.

package/dist/v2/core/YamaV2Orchestrator.js

@@ -99,7 +99,7 @@ export class YamaOrchestrator {
                 if (!this.mcpInitialized) {
                     await this.mcpManager.setupMCPServers(this.neurolink, this.config.mcpServers, this.detectedProvider);
                     if (this.explorer && this.config.ai.explore.enabled) {
-                        await this.explorer.initialize("pr");
+                        await this.explorer.initialize("pr", this.detectedProvider);
                     }
                     this.mcpInitialized = true;
                     this.mcpProvider = this.detectedProvider;

package/dist/v2/exploration/ContextExplorerService.d.ts

@@ -1,6 +1,7 @@
 import { YamaConfig } from "../types/config.types.js";
 import { SessionManager } from "../core/SessionManager.js";
 import { MemoryManager } from "../memory/MemoryManager.js";
+import { type VCSProviderName } from "../providers/ProviderToolset.js";
 import { ExploreContextInput, ExploreExecutionResult, ExploreRuntimeContext } from "./types.js";
 export declare class ContextExplorerService {
     private readonly config;
@@ -14,7 +15,7 @@ export declare class ContextExplorerService {
     private prMcpInitialized;
     private localMcpInitialized;
     constructor(config: YamaConfig, sessionManager: SessionManager, memoryManager: MemoryManager | null, projectRoot?: string);
-    initialize(mode: "pr" | "local"): Promise<void>;
+    initialize(mode: "pr" | "local", provider?: VCSProviderName): Promise<void>;
     explore(input: ExploreContextInput, runtimeContext: ExploreRuntimeContext): Promise<ExploreExecutionResult>;
     private normalizeInput;
     private buildCacheKey;

package/dist/v2/exploration/ContextExplorerService.js

@@ -5,7 +5,7 @@ import { NeuroLink } from "@juspay/neurolink";
 import { MCPServerManager } from "../core/MCPServerManager.js";
 import { KnowledgeBaseManager } from "../learning/KnowledgeBaseManager.js";
 import { buildObservabilityConfigFromEnv, validateObservabilityConfig, } from "../utils/ObservabilityConfig.js";
-import { getProviderToolset } from "../providers/ProviderToolset.js";
+import { getProviderToolset, } from "../providers/ProviderToolset.js";
 import { ExplorerPromptBuilder } from "./ExplorerPromptBuilder.js";
 import { RulesContextLoader } from "./RulesContextLoader.js";
 export class ContextExplorerService {
@@ -27,9 +27,12 @@ export class ContextExplorerService {
         this.rulesContextLoader = new RulesContextLoader(config.memoryBank, config.projectStandards, projectRoot);
         this.neurolink = this.initializeNeurolink();
     }
-    async initialize(mode) {
+    async initialize(mode, provider = "bitbucket") {
         if (mode === "pr" && !this.prMcpInitialized) {
-            await this.mcpManager.setupMCPServers(this.neurolink, this.config.mcpServers);
+            // The explore subagent gets its own MCP servers; they MUST match the
+            // detected provider, otherwise a GitHub run would try to start Bitbucket
+            // MCP (and fail on missing Bitbucket credentials).
+            await this.mcpManager.setupMCPServers(this.neurolink, this.config.mcpServers, provider);
             this.prMcpInitialized = true;
             return;
         }
@@ -39,7 +42,15 @@ export class ContextExplorerService {
         }
     }
     async explore(input, runtimeContext) {
-        await this.initialize(runtimeContext.mode);
+        // Pass the runtime provider through when it is a known VCS provider;
+        // otherwise fall back to the read-only default. VCSProviderName is the
+        // single source of truth for supported providers, so adding one there is
+        // all that's needed for the explore subagent to honour it.
+        const explorerProvider = runtimeContext.provider === "github" ||
+            runtimeContext.provider === "bitbucket"
+            ? runtimeContext.provider
+            : "bitbucket";
+        await this.initialize(runtimeContext.mode, explorerProvider);
         const normalizedInput = this.normalizeInput(input);
         const cacheKey = this.buildCacheKey(normalizedInput, runtimeContext);
         if (this.config.ai.explore.cacheResults) {

package/dist/v2/providers/ProviderToolset.js

@@ -255,7 +255,8 @@ class GitHubToolset {
     systemPromptToolsSection() {
         return `  <tool-usage>
     <tool name="pull_request_read">
-      <use-when>Read PR state. method="get" once at the start for PR metadata and existing comments; method="get_files" to list changed files; method="get_diff" for the unified diff. Always pass owner, repo, pullNumber.</use-when>
+      <use-when>Read PR state by method: "get" for PR metadata; "get_review_comments" to load EXISTING inline review comments (each thread carries isResolved/isOutdated) so you never repeat an already-raised point; "get_reviews" for prior submitted reviews; "get_files" to list changed files; "get_diff" for the unified diff. Always pass owner, repo, pullNumber.</use-when>
+      <important>method="get" does NOT include review comments on GitHub — you MUST call method="get_review_comments" to see them.</important>
     </tool>
 
     <tool name="search_code">
@@ -305,11 +306,16 @@ class GitHubToolset {
     entry with severity=BLOCKING as a blocking criterion for this PR. If the block is
     missing or empty, fall back to <focus-areas> and <blocking-criteria>.
 
-    STEP 2 — Read the PR shell
-    Call pull_request_read(method="get", owner, repo, pullNumber) once to get PR
-    metadata and existing comments, then pull_request_read(method="get_files", ...)
-    to list the changed files. Build a mental map of which files exist and which
-    already have comments. Do NOT request the full PR diff yet.
+    STEP 2 — Read the PR shell + EXISTING review comments
+    Call pull_request_read(method="get", owner, repo, pullNumber) for PR metadata,
+    then pull_request_read(method="get_review_comments", owner, repo, pullNumber) to
+    load existing inline review comments. (On GitHub, method="get" does NOT include
+    review comments — you MUST call get_review_comments.) Build a map of which
+    file+line locations already have comments. Treat any point an existing comment
+    already raises as ALREADY HANDLED: do NOT post a duplicate, and do NOT re-raise it
+    in your decision — especially threads marked isResolved or isOutdated. Then call
+    pull_request_read(method="get_files", ...) to list the changed files. Do NOT
+    request the full PR diff yet.
 
     STEP 3 — Open ONE pending review
     Call pull_request_review_write(method="create", owner, repo, pullNumber) to open a
@@ -329,9 +335,13 @@ class GitHubToolset {
       e. Move to the next file. Never jump between files mid-review.
 
     STEP 5 — Decision (submit the review)
-    After the last file, count issues by severity, apply <blocking-criteria>, and call
-    pull_request_review_write(method="submit", owner, repo, pullNumber, body=&lt;summary&gt;)
-    with event="APPROVE" when clean OR event="REQUEST_CHANGES" when blocking criteria are met.
+    Count ONLY the NEW issues you raised this run — exclude any point already covered by
+    an existing review comment (from STEP 2), and exclude resolved/outdated threads. Apply
+    <blocking-criteria> to that NEW set only. A concern that was already raised and
+    answered/justified in an existing comment thread is NOT grounds to block again.
+    Then call pull_request_review_write(method="submit", owner, repo, pullNumber,
+    body=&lt;summary&gt;) with event="APPROVE" when there are no NEW blocking issues, or
+    event="REQUEST_CHANGES" only when NEW blocking criteria are met this run.
 
     STEP 6 — Summary comment
     Use the submit body above for the summary (file count, issue counts by severity, next

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/yama",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Enterprise-grade Pull Request automation toolkit with AI-powered code review and description enhancement",
   "keywords": [
     "pr",
@@ -160,7 +160,7 @@
     ],
     "overrides": {
       "@semantic-release/npm": "^13.1.2",
-      "undici": "^5.28.5"
+      "undici": "~7.22.0"
     }
   },
   "lint-staged": {