@makerx/yoke 0.17.1 → 0.17.3

package/dist/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@makerx/yoke",
-  version: "0.17.1",
+  version: "0.17.3",
   description: "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   license: "MIT",
   author: "MakerX",
@@ -463,12 +463,38 @@ async function fetchPr(number, exec2 = run) {
   if (!isPullRequest(pr2)) throw new ReviewError("`gh pr view` returned an unexpected response");
   return pr2;
 }
+var diffArgsIgnoringGitConfig = [
+  "-c",
+  "diff.suppressBlankEmpty=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--submodule=short",
+  "--no-relative",
+  "--find-renames",
+  "--unified=3",
+  "--diff-algorithm=myers",
+  "--src-prefix=a/",
+  "--dst-prefix=b/"
+];
+async function requireMergeBase(pr2, root, exec2) {
+  try {
+    await exec2("git", ["merge-base", pr2.baseRefOid, pr2.headRefOid], root);
+  } catch {
+    throw new ReviewError(
+      `#${pr2.number} has no merge base in this checkout, which is likely a shallow clone; fetch full history (e.g. \`git fetch --unshallow\` or \`fetch-depth: 0\`) and run the review again`
+    );
+  }
+}
 async function fetchDiff(pr2, exec2 = run) {
-  const diff = await exec2("gh", ["pr", "diff", String(pr2.number)]);
+  const root = (await exec2("git", ["rev-parse", "--show-toplevel"])).trim();
+  await exec2("git", ["fetch", "--quiet", await prRemote(pr2, root, exec2), `pull/${pr2.number}/head`, pr2.baseRefOid], root);
   const current = await fetchPr(String(pr2.number), exec2);
   if (current.headRefOid !== pr2.headRefOid || current.baseRefOid !== pr2.baseRefOid)
     throw new ReviewError(`#${pr2.number} changed while its diff was being fetched; run the review again`);
-  return diff;
+  await requireMergeBase(pr2, root, exec2);
+  return exec2("git", [...diffArgsIgnoringGitConfig, `${pr2.baseRefOid}...${pr2.headRefOid}`], root);
 }
 var commentFields = '{path, line: (.line // .original_line), author: (.user.login // "ghost"), body}';
 var reviewFields = '{path: null, line: null, author: (.user.login // "ghost"), body}';
@@ -1000,10 +1026,12 @@ This change adds or edits a workflow that calls \`MakerXStudio/yoke/.github/work
 - The \`pull_request_target\` \`labeled\` trigger: a maintainer reads a fork PR's diff, then adds the \`review\` label to run its review with secrets. The reusable workflow runs the review on it only for that label on fork PRs, and refuses to review any commit pushed after the label. Its \`synchronize\` type removes the label when the fork pushes again.
 - The \`actions: write\` and \`statuses: write\` permissions (or \`actions: read\` in older callers): the gate reads earlier runs to find the PR's latest review, records a fork's approved review as a commit status, and re-runs the PR head's gate.
 - Draft PRs being reviewed twice: the reusable workflow already skips drafts.
+- Not passing \`REVIEW_CI_API_KEY\` from a caller that passes \`azure-client-id\` and \`provider: foundry\` (or a \`provider\` from a variable the diff can't show), even when an older workflow passed it: on Foundry the review signs in with the job's GitHub OIDC token and ignores \`REVIEW_CI_API_KEY\`.
 
 Real defects in it are still findings, such as:
 
 - Passing every secret with \`secrets: inherit\` instead of only \`REVIEW_CI_API_KEY\` (plus \`REVIEW_CI_BASE_URL\` from callers that still pass the URL as a secret).
+- Not passing \`REVIEW_CI_API_KEY\` from a LiteLLM caller (\`provider\` defaults to \`litellm\`), even one that passes \`azure-client-id\`, or from a Foundry caller without \`azure-client-id\`: both sign in with it.
 - An input the reusable workflow does not declare.
 - No \`permissions:\` block limiting the token to \`actions: write\`, \`contents: read\`, \`pull-requests: write\` and \`statuses: write\`, plus \`id-token: write\` with \`azure-client-id\`. The reusable workflow sets no permissions of its own, so the caller's block is the only limit on the token its agents run with.
 `;
@@ -1714,6 +1742,8 @@ var reviewerPrompt = `You are acting as a reviewer for a proposed code change ma
 
 Your working directory is the repository under review at the PR's head, so you can read any file in it for context beyond the diff. Do not modify any file.
 
+The base and head commits named in the request, and their merge base, are available in the checkout. You may run read-only git commands such as \`git log\`, \`git blame\`, \`git show\` and \`git diff <base>...<head>\` to understand the surrounding code and its recent changes. Do not run any git command that changes the repository, its refs, index or working tree (no checkout, commit, reset, fetch, stash or similar).
+
 Read the request file, then produce a thorough code review in Markdown.
 
 ## When to flag a finding

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerx/yoke",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "description": "Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.",
   "license": "MIT",
   "author": "MakerX",