@mergelight/cli 0.0.0-stage → 0.1.14

package/dist/review.js

@@ -0,0 +1,271 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { actionsUsedBy, fetchActionSources, notRead } from "./action-source.js";
+import { fetchPullRequest } from "./github.js";
+import { buildHunterPrompt, buildSweepPrompt, buildVerifierPrompt, focusesFor, } from "./prompt.js";
+import { LimitError, LoginError } from "./providers/codex.js";
+import { claudeAvailable, runModel, TOOLING } from "./providers/index.js";
+import { candidateSchema, reviewSchema } from "./schema.js";
+import { cacheDir, prepareWorkspace } from "./workspace.js";
+/**
+ * Stable id for a finding: the file plus the code it points at, ignoring
+ * whitespace. It survives line shifts, so later review rounds can tell an old
+ * finding from a new one.
+ */
+function fingerprint(dir, f) {
+    let code = "";
+    try {
+        const lines = readFileSync(join(dir, f.file), "utf8").split("\n");
+        const start = Math.max(1, Math.min(f.line, f.end_line));
+        const end = Math.min(lines.length, Math.max(f.line, f.end_line), start + 30);
+        code = lines.slice(start - 1, end).join("\n").replace(/\s+/g, " ").trim();
+    }
+    catch {
+        code = f.title.toLowerCase();
+    }
+    return createHash("sha1").update(`${f.file}\n${f.class}\n${code}`).digest("hex").slice(0, 10);
+}
+/**
+ * Gives each finding its id. One the verifier matched to an earlier round keeps
+ * that round's id and title, so it stays one comment however the model words or
+ * locates it this time: a fingerprint alone changes whenever the model cites
+ * slightly different lines.
+ */
+export function assignIds(findings, previous, fingerprintOf) {
+    const known = new Map(previous.map((p) => [p.id, p]));
+    const used = new Set();
+    const matched = findings.map((f) => {
+        const prior = f.same_as && !used.has(f.same_as) ? known.get(f.same_as) : undefined;
+        if (prior)
+            used.add(prior.id);
+        return prior;
+    });
+    return findings.map(({ same_as: _, ...f }, i) => {
+        const prior = matched[i];
+        if (prior)
+            return { ...f, id: prior.id, title: prior.title };
+        let id = fingerprintOf(f);
+        // Two findings on the same code still need their own ids.
+        for (let n = 1; used.has(id); n++)
+            id = createHash("sha1").update(`${id}${n}`).digest("hex").slice(0, 10);
+        used.add(id);
+        return { ...f, id };
+    });
+}
+/**
+ * Only the verifier's top picks (at most 3 per PR) get their own comment. Other
+ * findings it says to fix are listed in the summary, decide becomes a "your
+ * call" line and leave is collapsed. In the eval, among problems only Mergelight
+ * raised, teams fixed 38% of Opus's top picks and 14% of its other findings.
+ * Posting everything it would fix meant about 4.5 comments per PR, and all of
+ * Codex's about 6.
+ */
+export function tierOf(f) {
+    // Teams fixed few of these: 19% of minor risks and 10% of rare findings, against 45% of minor bugs. They stay
+    // readable in the collapsed section, and a major bug is never hidden, because it decides the red light.
+    const majorBug = f.class === "bug" && f.severity !== "minor";
+    if (!majorBug && ((f.class === "risk" && f.severity === "minor") || f.likelihood === "rare"))
+        return "hardening";
+    if (f.rank)
+        return "post";
+    if (f.recommendation === "fix")
+        return "list";
+    if (f.recommendation === "decide")
+        return "decision";
+    return "hardening";
+}
+/** Red if a major bug must be fixed, yellow if anything else is posted or needs a decision, green otherwise. */
+export function mergeLight(findings) {
+    if (findings.some((f) => f.class === "bug" && f.severity !== "minor" && f.recommendation === "fix"))
+        return "red";
+    if (findings.some((f) => f.tier !== "hardening"))
+        return "yellow";
+    return "green";
+}
+/** Tests and docs aren't swept: missing tests are never reported, and docs rarely hold real problems. */
+const SKIP_SWEEP = /(^|\/)(test|tests|__tests__|e2e|docs?)\/|\.(spec|test)\.[cm]?[jt]sx?$|\.(md|mdx|txt)$/i;
+const SWEEP_CHUNK = 12;
+const SWEEP_MAX_RUNS = 3;
+function normalizePath(p) {
+    return p.replace(/^\.\//, "").replace(/^\/+/, "");
+}
+const ORDER = { bug: 0, risk: 1, hardening: 2 };
+/**
+ * High, not the Codex default. In the eval, gpt-6.1-sol (whose own default is
+ * low) found 41 of 51 fixed problems at high, 32 at medium and 29 at low.
+ */
+export const DEFAULT_EFFORT = "high";
+/** Tells the prompts which tools the agent has. Without a shell it can't run git diff, so a big diff goes into the checkout. */
+function forProvider(dir, input, provider) {
+    const tooling = TOOLING[provider];
+    if (tooling !== "files" || !input.diffTruncated)
+        return { ...input, tooling };
+    const diffFile = ".mergelight/pr.diff";
+    mkdirSync(join(dir, ".mergelight"), { recursive: true });
+    writeFileSync(join(dir, diffFile), input.diff);
+    return { ...input, tooling, diffFile };
+}
+/**
+ * The verifier: tries to disprove every candidate, merges duplicates, rates the
+ * rest and picks the few that matter most. Exported so the eval can replay the
+ * same candidates through another model.
+ */
+export async function verifyCandidates(dir, input, found, opts) {
+    const result = await runModel(opts.provider, {
+        cwd: dir,
+        prompt: buildVerifierPrompt(forProvider(dir, input, opts.provider), found),
+        schema: reviewSchema,
+        model: opts.model,
+        effort: opts.effort,
+        logFile: opts.logFile,
+        onCommand: opts.onCommand,
+    });
+    const review = result.output;
+    const top = [...new Set((review.top ?? []).filter((n) => Number.isInteger(n) && n >= 1 && n <= review.findings.length))].slice(0, 3);
+    const findings = assignIds(review.findings, input.previous ?? [], (f) => fingerprint(dir, f))
+        .map((f, i) => {
+        const rank = top.includes(i + 1) ? top.indexOf(i + 1) + 1 : null;
+        return { ...f, tier: tierOf({ ...f, rank }), rank };
+    })
+        .sort((a, b) => ORDER[a.class] - ORDER[b.class] || a.file.localeCompare(b.file) || a.line - b.line);
+    return { summary: review.summary, findings, rejected: review.rejected, model: result.model, cost_usd: result.cost_usd ?? null };
+}
+export async function reviewPullRequest(ref, opts = {}) {
+    const started = Date.now();
+    const progress = opts.onProgress ?? (() => { });
+    const effort = opts.effort ?? DEFAULT_EFFORT;
+    const provider = opts.provider ?? "codex";
+    const hunterModel = provider === "claude" ? (opts.model ?? "opus") : opts.model;
+    progress(`Reading ${ref.owner}/${ref.repo}#${ref.number}`);
+    const pr = await fetchPullRequest(ref);
+    progress("Checking out the code");
+    const ws = await prepareWorkspace(pr, opts.at);
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const log = (step) => join(cacheDir(), "logs", `${pr.owner}-${pr.repo}-${pr.number}-${stamp}-${step}.log`);
+    try {
+        const input = {
+            pr,
+            mergeBase: ws.mergeBase,
+            headSha: ws.headSha,
+            diffStat: ws.diffStat,
+            diff: ws.diff,
+            diffTruncated: ws.diffTruncated,
+            previous: opts.previous,
+        };
+        // Step 1: hunters, one per area, in parallel. One failing doesn't sink the review.
+        const addedTo = ws.changedFiles.filter((f) => f.added > 0).map((f) => f.path);
+        const focuses = focusesFor(addedTo);
+        let unread = [];
+        if (focuses.includes("supply")) {
+            const uses = actionsUsedBy(ws.dir, addedTo);
+            if (uses.length)
+                progress("Reading the source of the actions these workflows use");
+            input.actionSources = await fetchActionSources(uses);
+            unread = notRead(input.actionSources);
+        }
+        let done = 0;
+        progress(`Hunting for problems (0 of ${focuses.length} areas done)`);
+        const hunts = await Promise.allSettled(focuses.map(async (focus) => {
+            const result = await runModel(provider, {
+                cwd: ws.dir,
+                prompt: buildHunterPrompt(forProvider(ws.dir, input, provider), focus),
+                schema: candidateSchema,
+                model: hunterModel,
+                effort,
+                logFile: log(`hunt-${focus}`),
+            });
+            done++;
+            progress(`Hunting for problems (${done} of ${focuses.length} areas done)`);
+            return { focus, candidates: result.output.candidates, model: result.model };
+        }));
+        const failed = focuses.filter((_, i) => hunts[i].status === "rejected");
+        if (failed.length === focuses.length) {
+            const reasons = hunts.map((h) => h.reason);
+            throw reasons.find((r) => r instanceof LoginError) ?? reasons.find((r) => r instanceof LimitError) ?? reasons[0];
+        }
+        const found = hunts.flatMap((h) => h.status === "fulfilled" ? h.value.candidates.map((c) => ({ ...c, focus: h.value.focus })) : []);
+        // Step 1b: sweep changed files no hunter reported anything in.
+        const covered = new Set(found.map((c) => normalizePath(c.file)));
+        const uncovered = ws.changedFiles
+            .filter((f) => f.added > 0 && !covered.has(f.path) && !SKIP_SWEEP.test(f.path))
+            .sort((a, b) => b.added - a.added)
+            .slice(0, SWEEP_CHUNK * SWEEP_MAX_RUNS)
+            .map((f) => f.path);
+        if (uncovered.length) {
+            const chunks = [];
+            for (let i = 0; i < uncovered.length; i += SWEEP_CHUNK)
+                chunks.push(uncovered.slice(i, i + SWEEP_CHUNK));
+            progress(`Sweeping ${uncovered.length} file${uncovered.length === 1 ? "" : "s"} the hunters didn't mention`);
+            const sweeps = await Promise.allSettled(chunks.map((files, i) => runModel(provider, {
+                cwd: ws.dir,
+                prompt: buildSweepPrompt(forProvider(ws.dir, input, provider), files),
+                schema: candidateSchema,
+                model: hunterModel,
+                effort,
+                logFile: log(`sweep-${i + 1}`),
+            })));
+            sweeps.forEach((s, i) => {
+                if (s.status === "fulfilled") {
+                    for (const c of s.value.output.candidates)
+                        found.push({ ...c, focus: "sweep" });
+                }
+                else {
+                    failed.push(`sweep-${i + 1}`);
+                }
+            });
+        }
+        // Step 2: the verifier tries to disprove each candidate and sorts the rest.
+        // Opus checks better than Codex: in the eval it posted a third less and kept the same finds.
+        const verifyWith = opts.verifyWith ?? (provider === "claude" || (await claudeAvailable()) ? "claude" : "codex");
+        if (!opts.verifyWith && verifyWith === "codex")
+            progress("Claude Code isn't installed, so Codex checks the findings");
+        progress(`Checking ${found.length} candidate${found.length === 1 ? "" : "s"}${verifyWith === "codex" ? "" : ` with ${verifyWith}`}`);
+        const verified = await verifyCandidates(ws.dir, input, found, {
+            provider: verifyWith,
+            model: verifyWith === "codex" ? (opts.verifyModel ?? opts.model) : (opts.verifyModel ?? "opus"),
+            effort,
+            logFile: log("verify"),
+            onCommand: (cmd) => progress(`Checking ${found.length} candidates: ${cmd.replace(/\s+/g, " ").slice(0, 80)}`, true),
+        });
+        const firstHunt = hunts.find((h) => h.status === "fulfilled");
+        const servedModel = firstHunt?.status === "fulfilled" ? firstHunt.value.model : null;
+        return {
+            schema_version: 1,
+            pr: {
+                owner: pr.owner,
+                repo: pr.repo,
+                number: pr.number,
+                title: pr.title,
+                url: pr.url,
+                base_sha: ws.mergeBase,
+                head_sha: ws.headSha,
+            },
+            provider: { name: provider, model: servedModel, effort },
+            verifier: { name: verifyWith, model: verified.model, effort, cost_usd: verified.cost_usd },
+            light: mergeLight(verified.findings),
+            summary: verified.summary,
+            findings: verified.findings,
+            ...(unread.length ? { not_read: unread } : {}),
+            stats: {
+                duration_ms: Date.now() - started,
+                diff_chars: ws.diff.length,
+                files_changed: pr.changedFiles,
+                additions: pr.additions,
+                deletions: pr.deletions,
+            },
+            trace: {
+                candidates: found,
+                rejected: verified.rejected,
+                failed_hunters: failed,
+            },
+            created_at: new Date().toISOString(),
+        };
+    }
+    finally {
+        if (opts.keep)
+            progress(`Kept the checkout at ${ws.dir}`);
+        else
+            await ws.cleanup();
+    }
+}

package/dist/run.js

@@ -0,0 +1,57 @@
+import { spawn } from "node:child_process";
+export class CommandError extends Error {
+    command;
+    result;
+    constructor(command, result) {
+        const detail = (result.stderr || result.stdout).trim().split("\n").slice(-8).join("\n");
+        super(`${command} failed with exit code ${result.code}${detail ? `:\n${detail}` : ""}`);
+        this.command = command;
+        this.result = result;
+    }
+}
+/** Run a command without a shell. Resolves with its output, whatever the exit code. */
+export function run(cmd, args, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, {
+            cwd: opts.cwd,
+            env: opts.env ?? process.env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timer;
+        if (opts.timeoutMs) {
+            timer = setTimeout(() => child.kill("SIGTERM"), opts.timeoutMs);
+        }
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk;
+            opts.onStdout?.(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        child.on("error", (err) => {
+            if (timer)
+                clearTimeout(timer);
+            reject(err);
+        });
+        child.on("close", (code, signal) => {
+            if (timer)
+                clearTimeout(timer);
+            resolve({ stdout, stderr, code: code ?? (signal ? 128 : 1) });
+        });
+        child.stdin.on("error", () => {
+            /* the process may exit before reading all input */
+        });
+        child.stdin.end(opts.input ?? "");
+    });
+}
+/** Run a command and throw a CommandError if it exits non-zero. */
+export async function runOk(cmd, args, opts = {}) {
+    const result = await run(cmd, args, opts);
+    if (result.code !== 0)
+        throw new CommandError(`${cmd} ${args.slice(0, 3).join(" ")}`, result);
+    return result;
+}

package/dist/schema.js

@@ -0,0 +1,106 @@
+/**
+ * JSON Schema for the model's final answer. It is passed to the provider as a
+ * structured output schema, so it follows the strict rules: every object lists
+ * all its properties as required and allows nothing else.
+ */
+export const candidateSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["candidates"],
+    properties: {
+        candidates: {
+            type: "array",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: ["title", "file", "line", "end_line", "scenario", "impact", "evidence"],
+                properties: {
+                    title: { type: "string" },
+                    file: { type: "string" },
+                    line: { type: "integer" },
+                    end_line: { type: "integer" },
+                    scenario: { type: "string" },
+                    impact: { type: "string" },
+                    evidence: { type: "string" },
+                },
+            },
+        },
+    },
+};
+export const reviewSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["summary", "findings", "rejected", "top"],
+    properties: {
+        top: {
+            type: "array",
+            description: "Up to 3 finding numbers, counting from 1 in the order of findings, that a senior reviewer would hold the merge for, most important first.",
+            items: { type: "integer" },
+        },
+        rejected: {
+            type: "array",
+            description: "Candidates you rejected, with the reason.",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: ["candidate", "reason"],
+                properties: {
+                    candidate: { type: "string", description: "The candidate id, like C3." },
+                    reason: { type: "string" },
+                },
+            },
+        },
+        summary: {
+            type: "string",
+            description: "Two plain sentences for someone who does not read code: what the pull request does, and whether it looks safe to merge.",
+        },
+        findings: {
+            type: "array",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: [
+                    "class",
+                    "title",
+                    "file",
+                    "line",
+                    "end_line",
+                    "how_it_happens",
+                    "likelihood",
+                    "severity",
+                    "what_breaks",
+                    "fix",
+                    "fix_cost",
+                    "recommendation",
+                    "verdict",
+                    "confidence",
+                    "same_as",
+                ],
+                properties: {
+                    class: { type: "string", enum: ["bug", "risk", "hardening"] },
+                    title: { type: "string", description: "Under 80 characters, plain words." },
+                    file: { type: "string", description: "Path relative to the repository root." },
+                    line: { type: "integer", description: "First line of the problem in the head version of the file." },
+                    end_line: { type: "integer", description: "Last line of the problem in the head version of the file." },
+                    how_it_happens: { type: "string", description: "The concrete trigger, in one or two plain sentences." },
+                    likelihood: { type: "string", enum: ["common", "plausible", "rare", "theoretical"] },
+                    severity: {
+                        type: "string",
+                        enum: ["major", "minor"],
+                        description: "major: breaks something, loses data or money, or exposes data. minor: a small but real visible problem.",
+                    },
+                    what_breaks: { type: "string", description: "The user-visible or data consequence." },
+                    fix: { type: "string", description: "The smallest fix that solves it, in one or two sentences." },
+                    fix_cost: { type: "string", enum: ["trivial", "small", "medium", "large"] },
+                    recommendation: { type: "string", enum: ["fix", "decide", "leave"] },
+                    verdict: { type: "string", description: "One short plain sentence a non-engineer understands." },
+                    confidence: { type: "string", enum: ["high", "medium", "low"] },
+                    same_as: {
+                        type: ["string", "null"],
+                        description: "The id of the problem from an earlier review that this finding is, or null.",
+                    },
+                },
+            },
+        },
+    },
+};

package/dist/setup.js

@@ -0,0 +1,180 @@
+import { spawn } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+import { run, runOk } from "./run.js";
+export const INSTALL_URL = "https://github.com/apps/mergelight-ai/installations/new";
+const SECRET = "CODEX_AUTH_JSON";
+const BRANCH = "mergelight-setup";
+const REFRESH = "mergelight-refresh.yml";
+const WORKFLOWS = ["mergelight.yml", "mergelight-approve.yml", REFRESH];
+const SKIP_MARKER = "github.event.pull_request.head.repo.full_name == github.repository";
+const ACTION = "mergelightai/mergelight";
+/** The note in each template saying why it isn't pinned, which stops being true once it is. */
+const NOT_PINNED_NOTE = /^[ \t]*# Not pinned, on purpose[^\n]*\n(?:[ \t]*#[^\n]*\n)*/m;
+/** The workflow files, adjusted for this repository, and pinned to a release if one is given. */
+export function workflowFiles(skipBranches = [], pin) {
+    const dir = join(dirname(fileURLToPath(import.meta.url)), "..", "templates");
+    return WORKFLOWS.map((name) => {
+        let content = readFileSync(join(dir, name), "utf8");
+        if (name === "mergelight.yml" && skipBranches.length) {
+            if (!content.includes(SKIP_MARKER))
+                throw new Error(`${name} has changed: can't add the branches to skip.`);
+            // GitHub expressions quote strings with single quotes, doubled inside, and fromJSON needs double quotes.
+            const json = JSON.stringify(skipBranches).replace(/'/g, "''");
+            // A function, so a $ in a branch name stays a $.
+            content = content.replace(SKIP_MARKER, () => `${SKIP_MARKER} &&\n      !contains(fromJSON('${json}'), github.head_ref)`);
+        }
+        if (pin) {
+            if (!content.includes(`${ACTION}@v0`))
+                throw new Error(`${name} has changed: can't pin it.`);
+            content = content.replace(NOT_PINNED_NOTE, (note) => {
+                const indent = note.match(/^[ \t]*/)[0];
+                return `${indent}# Pinned to a release, so new code only runs here once you merge an update.\n${indent}# Mergelight says on your pull requests when a new version is out.\n`;
+            }).replaceAll(`${ACTION}@v0`, () => `${ACTION}@${pin.sha} # ${pin.tag}`);
+        }
+        return { name, content };
+    });
+}
+/** The latest release, as a commit. */
+async function latestPin(deps) {
+    const tag = (await deps.gh(["api", `repos/${ACTION}/releases/latest`, "--jq", ".tag_name"])).trim();
+    const sha = (await deps.gh(["api", `repos/${ACTION}/commits/${tag}`, "--jq", ".sha"])).trim();
+    return { sha, tag };
+}
+/** A ChatGPT login is only useful in CI if it can refresh itself. */
+export function checkAuthJson(raw) {
+    let auth;
+    try {
+        auth = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("Codex wrote a login file that can't be read. Run setup again.");
+    }
+    if (auth.auth_mode !== "chatgpt" || !auth.tokens?.refresh_token) {
+        throw new Error("That wasn't a ChatGPT login. Log in with your ChatGPT account, or use openai-api-key in the workflow.");
+    }
+}
+async function hasFile(deps, repo, path, ref) {
+    try {
+        const out = await deps.gh(["api", `repos/${repo}/contents/${path}?ref=${encodeURIComponent(ref)}`]);
+        const file = JSON.parse(out);
+        return { sha: file.sha, content: Buffer.from(file.content, "base64").toString("utf8") };
+    }
+    catch {
+        return null;
+    }
+}
+/** Puts the workflows on a branch and opens a pull request. Returns its URL, or null if there's nothing to add. */
+async function openWorkflowPr(deps, opts, base) {
+    const { repo } = opts;
+    const files = workflowFiles(opts.skipBranches, opts.pin !== false ? await latestPin(deps) : undefined);
+    const missing = [];
+    for (const f of files) {
+        const onBase = await hasFile(deps, repo, `.github/workflows/${f.name}`, base);
+        if (onBase?.content !== f.content)
+            missing.push(f);
+    }
+    if (!missing.length)
+        return null;
+    const baseSha = (await deps.gh(["api", `repos/${repo}/git/ref/heads/${base}`, "--jq", ".object.sha"])).trim();
+    try {
+        await deps.gh(["api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/heads/${BRANCH}`, "-f", `sha=${baseSha}`]);
+    }
+    catch {
+        // Left by an earlier setup. The files below are brought up to date on it.
+    }
+    for (const f of missing) {
+        const path = `.github/workflows/${f.name}`;
+        const existing = await hasFile(deps, repo, path, BRANCH);
+        if (existing?.content === f.content)
+            continue;
+        await deps.gh([
+            "api", "-X", "PUT", `repos/${repo}/contents/${path}`,
+            "-f", `message=chore(ci): add ${f.name}`,
+            "-f", `content=${Buffer.from(f.content).toString("base64")}`,
+            "-f", `branch=${BRANCH}`,
+            ...(existing ? ["-f", `sha=${existing.sha}`] : []),
+        ]);
+    }
+    const open = JSON.parse(await deps.gh(["api", `repos/${repo}/pulls?head=${repo.split("/")[0]}:${BRANCH}&state=open`]));
+    if (open[0])
+        return open[0].html_url;
+    const created = await deps.gh([
+        "api", "-X", "POST", `repos/${repo}/pulls`,
+        "-f", "title=chore(ci): add Mergelight review",
+        "-f", `head=${BRANCH}`,
+        "-f", `base=${base}`,
+        "-f", "body=Adds Mergelight's code review. This pull request reviews itself, so you can see it working before you merge.",
+        "--jq", ".html_url",
+    ]);
+    return created.trim();
+}
+/** Sets up one repository: the app, the Codex login, then a pull request with the workflows. */
+export async function setup(opts, deps) {
+    const { repo, yes } = opts;
+    const info = JSON.parse(await deps.gh(["api", `repos/${repo}`]));
+    const base = opts.base ?? info.default_branch;
+    deps.log(`1 of 3: install the Mergelight AI app on ${repo}`);
+    if (yes) {
+        deps.log(`  Skipped asking. If it isn't installed: ${INSTALL_URL}`);
+    }
+    else {
+        await deps.open(INSTALL_URL);
+        await deps.confirm(`  Installed? Press Enter to continue. ${INSTALL_URL} `);
+    }
+    deps.log("2 of 3: Codex login");
+    const secrets = JSON.parse(await deps.gh(["secret", "list", "--repo", repo, "--json", "name"]));
+    if (secrets.some((s) => s.name === SECRET) && !opts.relogin) {
+        deps.log(`  ${repo} already has one.`);
+    }
+    else {
+        const auth = await deps.codexLogin();
+        checkAuthJson(auth);
+        await deps.gh(["secret", "set", SECRET, "--repo", repo], auth);
+        deps.log(`  Saved. It refreshes itself from now on.`);
+    }
+    deps.log(`3 of 3: add the workflows to ${base}`);
+    const url = await openWorkflowPr(deps, opts, base);
+    if (url)
+        deps.log(`\nDone. Merge this to turn it on, it's reviewing itself now:\n${url}`);
+    else
+        deps.log(`\nDone. ${repo} already has the workflows on ${base}.`);
+    return 0;
+}
+/** Logs in with a separate Codex home, so CI never shares a login with your own machine. */
+export async function codexLogin() {
+    const home = mkdtempSync(join(tmpdir(), "mergelight-codex-login-"));
+    try {
+        writeFileSync(join(home, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+        const code = await new Promise((resolve, reject) => {
+            const child = spawn("codex", ["login"], { stdio: "inherit", env: { ...process.env, CODEX_HOME: home } });
+            child.on("error", reject);
+            child.on("close", (c) => resolve(c ?? 1));
+        });
+        const file = join(home, "auth.json");
+        if (code !== 0 || !existsSync(file))
+            throw new Error("Codex login didn't finish.");
+        return readFileSync(file, "utf8");
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+}
+export function realDeps() {
+    return {
+        gh: async (args, input) => (await runOk("gh", args, input === undefined ? {} : { input })).stdout,
+        codexLogin,
+        open: async (url) => {
+            await run(process.platform === "darwin" ? "open" : "xdg-open", [url]).catch(() => undefined);
+        },
+        confirm: async (question) => {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            await rl.question(question);
+            rl.close();
+        },
+        log: (message) => console.log(message),
+    };
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/update.js

@@ -0,0 +1,36 @@
+import { readFileSync } from "node:fs";
+/**
+ * A moving tag like @v0 gets each release by itself. A pinned commit doesn't, so the review
+ * tells those people when there's a newer release. It's only a hint, so anything going wrong
+ * here just means no hint.
+ */
+const CURRENT = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+const parts = (version) => version.replace(/^v/, "").split(".").map(Number);
+export function isNewer(candidate, than) {
+    const [a, b] = [parts(candidate), parts(than)];
+    for (let i = 0; i < 3; i++) {
+        const diff = (a[i] ?? 0) - (b[i] ?? 0);
+        if (diff)
+            return diff > 0;
+    }
+    return false;
+}
+/** The changes a release's generated notes list, without the version bumps. */
+export function releaseNews(notes) {
+    return [...notes.matchAll(/^\* (.+?) by @\S+ in https:\/\/\S+$/gm)].map((m) => m[1]).filter((title) => !/^Release v\d/.test(title));
+}
+/** What a pinned run is missing, if there's a newer release. */
+export async function newerVersion(api, current = CURRENT, ref = process.env.MERGELIGHT_ACTION_REF) {
+    if (!/^[0-9a-f]{40}$/i.test(ref ?? ""))
+        return null;
+    try {
+        const releases = await api.get("/repos/mergelightai/mergelight/releases?per_page=30");
+        const newer = releases.filter((r) => !r.draft && !r.prerelease && isNewer(r.tag_name, current)).sort((a, b) => (isNewer(a.tag_name, b.tag_name) ? -1 : 1));
+        if (!newer.length)
+            return null;
+        return { tag: newer[0].tag_name, current: `v${current.replace(/^v/, "")}`, news: newer.flatMap((r) => releaseNews(r.body ?? "")) };
+    }
+    catch {
+        return null;
+    }
+}