@mechanai/deepreview 2.11.0 → 2.13.0

package/src/build-prior-review.test.ts

@@ -14,9 +14,10 @@ function makeThread(
   path: string,
   line: number,
   comments: { login: string; body: string }[],
-  opts?: { startLine?: number; isResolved?: boolean; isOutdated?: boolean },
+  opts?: { id?: string; startLine?: number; isResolved?: boolean; isOutdated?: boolean },
 ): ReviewThread {
   return {
+    id: opts?.id ?? `PRT_${path}_${line}`,
     path,
     startLine: opts?.startLine ?? null,
     line,
@@ -54,10 +55,12 @@ describe("formatPriorReview: sections", () => {
   });
 });
 
+// oxlint-disable-next-line max-lines-per-function -- Why: two inline thread fixtures with full comment arrays are required to test multi-thread grouping and line-range formatting; extracting them would obscure the test intent
 describe("formatPriorReview: thread formatting", () => {
   it("formats threads grouped by file with line numbers", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_1",
         path: "src/foo.ts",
         startLine: 10,
         line: 15,
@@ -79,6 +82,7 @@ describe("formatPriorReview: thread formatting", () => {
         ],
       },
       {
+        id: "PRT_2",
         path: "src/foo.ts",
         startLine: null,
         line: 42,
@@ -248,6 +252,31 @@ describe("mapGraphQLThreads", () => {
     assert.equal(result[0].comments[0].authorType, "bot");
   });
 
+  it("preserves thread id from GraphQL node", () => {
+    const nodes = [
+      {
+        id: "PRT_kwDOABC123",
+        path: "src/foo.ts",
+        startLine: null,
+        line: 10,
+        isResolved: false,
+        isOutdated: false,
+        comments: {
+          pageInfo: { hasNextPage: false, endCursor: null },
+          nodes: [
+            {
+              author: { login: "alice", __typename: "User" },
+              body: "Fix this",
+              createdAt: "2026-01-01T00:00:00Z",
+            },
+          ],
+        },
+      },
+    ];
+    const result = mapGraphQLThreads(nodes);
+    assert.equal(result[0].id, "PRT_kwDOABC123");
+  });
+
   it("detects deepreview by finding ID HTML comment in body", () => {
     const nodes = [
       {
@@ -279,6 +308,7 @@ describe("buildPriorReviewContent: basic behavior", () => {
   it("keeps all content when under budget", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_basic",
         path: "a.ts",
         startLine: null,
         line: 1,
@@ -316,6 +346,7 @@ describe("buildPriorReview (integration shape)", () => {
 describe("buildPriorReviewContent: truncation", () => {
   it("drops oldest threads first when over budget", () => {
     const oldThread: ReviewThread = {
+      id: "PRT_old",
       path: "old.ts",
       startLine: null,
       line: 1,
@@ -331,6 +362,7 @@ describe("buildPriorReviewContent: truncation", () => {
       ],
     };
     const newThread: ReviewThread = {
+      id: "PRT_new",
       path: "new.ts",
       startLine: null,
       line: 1,
@@ -354,6 +386,7 @@ describe("buildPriorReviewContent: truncation", () => {
 
   it("preserves PR description and manual content even when threads are large", () => {
     const bigThread: ReviewThread = {
+      id: "PRT_big",
       path: "big.ts",
       startLine: null,
       line: 1,
@@ -383,6 +416,7 @@ describe("formatPriorReview: formatCommentBody paths", () => {
   it("renders multi-line body as indented blockquote", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_multi",
         path: "src/multi.ts",
         startLine: null,
         line: 1,
@@ -409,6 +443,7 @@ describe("formatPriorReview: formatCommentBody paths", () => {
   it("renders single-line body in quotes", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_single",
         path: "src/single.ts",
         startLine: null,
         line: 1,
@@ -433,6 +468,7 @@ describe("formatPriorReview: formatLineRef paths", () => {
   it("renders startLine only when line is null", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_start_only",
         path: "src/start-only.ts",
         startLine: 42,
         line: null,
@@ -457,6 +493,7 @@ describe("formatPriorReview: formatLineRef paths", () => {
   it("renders file-level when both startLine and line are null", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_file_level",
         path: "src/file-level.ts",
         startLine: null,
         line: null,
@@ -481,6 +518,7 @@ describe("formatPriorReview: formatSourceTag paths", () => {
   it("renders deepreview author type in source tag", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_dr",
         path: "src/dr.ts",
         startLine: null,
         line: 5,
@@ -503,6 +541,7 @@ describe("formatPriorReview: formatSourceTag paths", () => {
   it("renders both resolved and outdated simultaneously", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_both",
         path: "src/both.ts",
         startLine: null,
         line: 10,
@@ -523,10 +562,29 @@ describe("formatPriorReview: formatSourceTag paths", () => {
   });
 });
 
+describe("formatPriorReview: thread ID tags", () => {
+  it("includes thread ID tag in formatted output", () => {
+    const thread = makeThread("src/foo.ts", 10, [{ login: "alice", body: "Fix this" }], {
+      id: "PRT_kwDOABC123",
+    });
+    const result = formatPriorReview("", [thread], null);
+    assert.ok(result.includes("[thread: PRT_kwDOABC123]"));
+  });
+
+  it("places thread ID after source tag", () => {
+    const thread = makeThread("src/foo.ts", 10, [{ login: "alice", body: "Fix this" }], {
+      id: "PRT_kwDOXYZ789",
+    });
+    const result = formatPriorReview("", [thread], null);
+    assert.match(result, /\[source: [^\]]+\] \[thread: PRT_kwDOXYZ789\]/u);
+  });
+});
+
 describe("formatPriorReview: formatThread empty comments", () => {
   it("returns empty output for thread with no comments", () => {
     const threads: ReviewThread[] = [
       {
+        id: "PRT_empty",
         path: "src/empty.ts",
         startLine: null,
         line: 1,
@@ -585,6 +643,7 @@ describe("buildPriorReviewContent: edge cases", () => {
     const hugeThreadBody = "z".repeat(40_000);
     const threads: ReviewThread[] = [
       {
+        id: "PRT_big1",
         path: "big1.ts",
         startLine: null,
         line: 1,
@@ -600,6 +659,7 @@ describe("buildPriorReviewContent: edge cases", () => {
         ],
       },
       {
+        id: "PRT_big2",
         path: "big2.ts",
         startLine: null,
         line: 1,

package/src/build-prior-review.ts

@@ -15,6 +15,7 @@ export interface ThreadComment {
 
 /** A review thread attached to a file path and line range. */
 export interface ReviewThread {
+  id: string;
   path: string;
   startLine: number | null;
   line: number | null;
@@ -54,7 +55,8 @@ function formatThread(thread: ReviewThread): string {
   const lines: string[] = [];
   const lineRef = formatLineRef(thread.startLine, thread.line);
   const tag = formatSourceTag(first, thread);
-  lines.push(`- ${lineRef} ${tag}: ${formatCommentBody(first.body, "  ")}`);
+  const threadTag = `[thread: ${thread.id}]`;
+  lines.push(`- ${lineRef} ${tag} ${threadTag}: ${formatCommentBody(first.body, "  ")}`);
   for (const reply of replies) {
     lines.push(`  - @${reply.authorLogin} replied: ${formatCommentBody(reply.body, "    ")}`);
   }

package/src/diff-classifier.ts

@@ -5,6 +5,7 @@ export interface Finding {
   line: number;
   startLine?: number;
   body: string;
+  replyTo?: string;
 }
 
 export interface ClassifiedFinding extends Finding {
@@ -13,6 +14,11 @@ export interface ClassifiedFinding extends Finding {
   renderedBody?: string;
 }
 
+/** A classified finding that targets an existing thread for reply. */
+export interface ReplyFinding extends ClassifiedFinding {
+  replyTo: string;
+}
+
 interface FileHunks {
   hunks: { newStart: number; newLines: number }[];
 }

package/src/load-pr.test.ts

@@ -0,0 +1,75 @@
+import { describe, it } from "bun:test";
+import assert from "node:assert/strict";
+import { writeFile, mkdir, rm, symlink } from "node:fs/promises";
+import { join } from "node:path";
+import { loadAndValidatePr } from "./load-pr.ts";
+
+const TMP_DIR = "/tmp/opencode/load-pr-test";
+
+describe("loadAndValidatePr — path validation", () => {
+  it("rejects paths with null bytes", async () => {
+    await assert.rejects(
+      loadAndValidatePr("threads\x00.md", 1, undefined, TMP_DIR),
+      /Invalid threadsPath/u,
+    );
+  });
+
+  it("rejects absolute paths", async () => {
+    await assert.rejects(
+      loadAndValidatePr("/etc/passwd", 1, undefined, TMP_DIR),
+      /Invalid threadsPath/u,
+    );
+  });
+
+  it("rejects paths with directory traversal", async () => {
+    await assert.rejects(
+      loadAndValidatePr("../../../etc/passwd", 1, undefined, TMP_DIR),
+      /Invalid threadsPath/u,
+    );
+  });
+
+  it("rejects empty path", async () => {
+    await assert.rejects(loadAndValidatePr("", 1, undefined, TMP_DIR), /Invalid threadsPath/u);
+  });
+});
+
+describe("loadAndValidatePr — file system", () => {
+  it("throws when file does not exist", async () => {
+    await mkdir(TMP_DIR, { recursive: true });
+    await assert.rejects(
+      loadAndValidatePr("nonexistent.md", 1, undefined, TMP_DIR),
+      /Threads file not found/u,
+    );
+  });
+
+  it("throws when resolved path escapes working directory via symlink", async () => {
+    await mkdir(TMP_DIR, { recursive: true });
+    const linkPath = join(TMP_DIR, "escape.md");
+    try {
+      await rm(linkPath);
+    } catch {
+      // ignore if not present
+    }
+    try {
+      await symlink("/etc/hostname", linkPath);
+    } catch {
+      // symlink creation may fail on some systems — skip test
+      return;
+    }
+    try {
+      await assert.rejects(
+        loadAndValidatePr("escape.md", 1, undefined, TMP_DIR),
+        /escapes working directory/u,
+      );
+    } finally {
+      await rm(linkPath);
+    }
+  });
+
+  it("returns null when threads file has no findings", async () => {
+    await mkdir(TMP_DIR, { recursive: true });
+    await writeFile(join(TMP_DIR, "empty.md"), "");
+    const result = await loadAndValidatePr("empty.md", 1, undefined, TMP_DIR);
+    assert.equal(result, null);
+  });
+});

package/src/load-pr.ts

@@ -0,0 +1,44 @@
+import { readFile, realpath } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parseThreads } from "./parse-threads.ts";
+import { type Finding } from "./diff-classifier.ts";
+import { type PrInfo, getPrInfo } from "./graphql.ts";
+import { isValidPath } from "./review-helpers.ts";
+
+/** Load and parse a threads file, validate the PR is open, and verify the head SHA matches. */
+export async function loadAndValidatePr(
+  threadsPath: string,
+  prNumber: number,
+  expectedSha: string | undefined,
+  cwd: string | undefined,
+): Promise<{ findings: Finding[]; prInfo: PrInfo; summary?: string } | null> {
+  if (!isValidPath(threadsPath)) {
+    throw new Error(`Invalid threadsPath: ${threadsPath}`);
+  }
+  const base = await realpath(resolve(cwd ?? process.cwd()));
+  const candidatePath = resolve(base, threadsPath);
+  let resolved: string;
+  try {
+    resolved = await realpath(candidatePath);
+  } catch {
+    throw new Error(`Threads file not found: ${candidatePath}`);
+  }
+  if (!resolved.startsWith(base + "/") && resolved !== base) {
+    throw new Error(`threadsPath escapes working directory: ${threadsPath}`);
+  }
+  const content = await readFile(resolved, "utf8");
+  const { findings, summary } = parseThreads(content);
+  if (findings.length === 0 && (summary === undefined || summary === "")) return null;
+
+  const prInfo = await getPrInfo(prNumber, { cwd });
+  if (prInfo.state !== "OPEN") {
+    throw new Error(`PR is ${prInfo.state}. Aborting.`);
+  }
+
+  const resolvedSha = expectedSha ?? process.env.PR_HEAD_SHA;
+  if (resolvedSha !== undefined && resolvedSha !== "" && resolvedSha !== prInfo.headOid) {
+    throw new Error(`ABORT: PR head moved (expected ${resolvedSha}, got ${prInfo.headOid}).`);
+  }
+
+  return { findings, prInfo, summary };
+}

package/src/parse-threads.test.ts

@@ -125,3 +125,44 @@ describe("parseThreads findings", () => {
     assert.equal(result.findings.length, 0);
   });
 });
+
+describe("parseThreads replyTo", () => {
+  it("extracts replyTo from frontmatter", () => {
+    const input = [
+      "---",
+      "path: src/foo.ts",
+      "line: 42",
+      "replyTo: PRT_kwDOABC123",
+      "---",
+      "This adds a suggestion.",
+    ].join("\n");
+
+    const result = parseThreads(input);
+    assert.equal(result.findings.length, 1);
+    assert.equal(result.findings[0].replyTo, "PRT_kwDOABC123");
+    assert.equal(result.findings[0].startLine, undefined);
+  });
+
+  it("returns undefined replyTo when not present", () => {
+    const input = ["---", "path: src/foo.ts", "line: 42", "---", "Normal finding."].join("\n");
+
+    const result = parseThreads(input);
+    assert.equal(result.findings[0].replyTo, undefined);
+  });
+
+  it("replyTo and startLine are mutually exclusive — replyTo wins", () => {
+    const input = [
+      "---",
+      "path: src/foo.ts",
+      "startLine: 40",
+      "line: 45",
+      "replyTo: PRT_kwDOABC123",
+      "---",
+      "Reply body.",
+    ].join("\n");
+
+    const result = parseThreads(input);
+    assert.equal(result.findings[0].replyTo, "PRT_kwDOABC123");
+    assert.equal(result.findings[0].startLine, undefined);
+  });
+});

package/src/parse-threads.ts

@@ -21,6 +21,36 @@ const safeYamlEngine = (s: string): Record<string, unknown> => {
 };
 const matterOptions = { engines: { yaml: safeYamlEngine } };
 
+/** Build a Finding from parsed frontmatter data and body content. */
+function buildFinding(
+  data: Record<string, unknown>,
+  path: string,
+  lineNum: number,
+  body: string,
+): Finding {
+  const rawStartLine: unknown = data.startLine;
+  const startLineNum =
+    rawStartLine !== null && rawStartLine !== undefined ? Number(rawStartLine) : undefined;
+
+  const rawReplyTo: unknown = data.replyTo;
+  const replyTo = typeof rawReplyTo === "string" && rawReplyTo.length > 0 ? rawReplyTo : undefined;
+
+  // Replies don't use startLine; only set it when present and valid
+  const validStartLine =
+    replyTo === undefined &&
+    startLineNum !== undefined &&
+    startLineNum > 0 &&
+    Number.isFinite(startLineNum);
+
+  return {
+    path,
+    line: lineNum,
+    startLine: validStartLine ? startLineNum : undefined,
+    body,
+    replyTo,
+  };
+}
+
 /**
  * Parse a threads.md file into findings and an optional summary.
  * The file uses --- separators between documents, each with YAML frontmatter.
@@ -60,18 +90,7 @@ function parseThreads(content: string): ParsedThreads {
       continue;
     }
 
-    const rawStartLine: unknown = data.startLine;
-    const startLineNum =
-      rawStartLine !== null && rawStartLine !== undefined ? Number(rawStartLine) : undefined;
-    findings.push({
-      path,
-      line: lineNum,
-      startLine:
-        startLineNum !== undefined && startLineNum > 0 && Number.isFinite(startLineNum)
-          ? startLineNum
-          : undefined,
-      body: parsed.content.trim(),
-    });
+    findings.push(buildFinding(data, path, lineNum, parsed.content.trim()));
   }
 
   return { findings, summary };

package/src/post-review.test.ts

@@ -1,7 +1,7 @@
 import { describe, it } from "bun:test";
 import assert from "node:assert/strict";
 import { parseThreads } from "./parse-threads.ts";
-import { classifyFindings } from "./diff-classifier.ts";
+import { classifyFindings, type ReplyFinding } from "./diff-classifier.ts";
 import { buildReviewBody } from "./review-helpers.ts";
 
 describe("buildReviewBody", () => {
@@ -33,6 +33,59 @@ describe("buildReviewBody", () => {
   });
 });
 
+describe("postReview reply routing", () => {
+  it("classifies findings with replyTo separately from new findings", () => {
+    const threadsContent = [
+      "---",
+      "path: src/foo.ts",
+      "line: 10",
+      "replyTo: PRT_kwDOABC123",
+      "---",
+      "Reply body here.",
+      "---",
+      "path: src/bar.ts",
+      "line: 20",
+      "---",
+      "New finding body.",
+    ].join("\n");
+
+    const { findings } = parseThreads(threadsContent);
+    const replyFindings = findings.filter((f) => f.replyTo !== undefined);
+    const newFindings = findings.filter((f) => f.replyTo === undefined);
+
+    assert.equal(replyFindings.length, 1);
+    assert.equal(replyFindings[0].replyTo, "PRT_kwDOABC123");
+    assert.equal(newFindings.length, 1);
+    assert.equal(newFindings[0].path, "src/bar.ts");
+  });
+});
+
+describe("postReview dry-run with replyTo", () => {
+  it("includes reply findings in dry-run count", () => {
+    const threadsContent = [
+      "---",
+      "path: src/foo.ts",
+      "line: 10",
+      "replyTo: PRT_kwDOABC123",
+      "---",
+      "Reply finding.",
+      "---",
+      "path: src/bar.ts",
+      "startLine: 5",
+      "line: 10",
+      "---",
+      "New finding.",
+    ].join("\n");
+
+    const { findings } = parseThreads(threadsContent);
+    assert.equal(findings.length, 2);
+    assert.equal(findings[0].replyTo, "PRT_kwDOABC123");
+    assert.equal(findings[0].startLine, undefined);
+    assert.equal(findings[1].replyTo, undefined);
+    assert.equal(findings[1].startLine, 5);
+  });
+});
+
 describe("integration: parse → classify", () => {
   const threadsContent = [
     "---",
@@ -80,3 +133,33 @@ describe("integration: parse → classify", () => {
     assert.equal(classified[2].tier, 3);
   });
 });
+
+describe("ReplyFinding type narrowing", () => {
+  it("filter produces ReplyFinding[] when checking replyTo", () => {
+    const { findings } = parseThreads(
+      [
+        "---",
+        "path: src/foo.ts",
+        "line: 10",
+        "replyTo: PRT_kwDOABC123",
+        "---",
+        "Reply body.",
+        "---",
+        "path: src/bar.ts",
+        "line: 20",
+        "---",
+        "New body.",
+      ].join("\n"),
+    );
+
+    const replies: ReplyFinding[] = findings
+      .filter((f): f is ReplyFinding => f.replyTo !== undefined)
+      .map((f) => ({ ...f, tier: 1 as const }));
+
+    assert.equal(replies.length, 1);
+    assert.equal(replies[0].replyTo, "PRT_kwDOABC123");
+    // Type check: replyTo is string (not string | undefined)
+    const threadId: string = replies[0].replyTo;
+    assert.equal(threadId, "PRT_kwDOABC123");
+  });
+});