@nanonets/graft 0.15.0 → 0.18.0

package/dist/app/pages.js

@@ -10,23 +10,38 @@
  * capability, not a login. Anyone with the link can read that one page until it
  * expires, which is the same property a GitHub artifact link has, and the link
  * only ever appears in a comment on the pull request it describes.
+ *
+ * Pages are mirrored to `dir`, when one is given, because the token is DERIVED
+ * from the id rather than stored: a link keeps passing the signature check for as
+ * long as the secret lives, so a process that lost its pages answers 404 to a
+ * link that looks perfectly valid. That failure is silent at both ends — the
+ * comment still sits on the pull request, the reviewer just sees "not found" —
+ * and one restart of a container with nothing mounted stranded 29 of them. Disk
+ * is the fix; without a directory this behaves exactly as it did before.
  */
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 /** Long enough to review a PR at leisure, short enough that a leaked link dies. */
 const DEFAULT_TTL_MS = 14 * 24 * 60 * 60 * 1000;
 /** A page is ~50 kB; a few hundred of them is nothing, and eviction is by age. */
 const DEFAULT_MAX_PAGES = 500;
+/** One file per page, named by its id. The extension also means "fully written". */
+const SUFFIX = ".json";
 export class PageStore {
     pages = new Map();
     secret;
     ttlMs;
     maxPages;
     now;
+    dir;
     constructor(opts) {
         this.secret = opts.secret;
         this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
         this.maxPages = opts.maxPages ?? DEFAULT_MAX_PAGES;
         this.now = opts.now ?? Date.now;
+        this.dir = opts.dir;
+        this.hydrate();
     }
     /** `owner/repo#number` → a path segment safe to put in a URL. */
     static idFor(owner, repo, number) {
@@ -35,7 +50,9 @@ export class PageStore {
     /** Store (replacing any previous page for the same PR) and return `id` + `token`. */
     put(owner, repo, number, html) {
         const id = PageStore.idFor(owner, repo, number);
-        this.pages.set(id, { html, storedMs: this.now() });
+        const page = { html, storedMs: this.now() };
+        this.pages.set(id, page);
+        this.write(id, page);
         this.evict();
         return { id, token: this.sign(id) };
     }
@@ -45,13 +62,16 @@ export class PageStore {
      * Expiry is checked against the STORED time rather than encoded in the token,
      * so a link cannot outlive the data it points at — and re-reviewing a PR
      * refreshes both together.
+     *
+     * Answered from memory even when there is a directory: `id` comes off a URL,
+     * and an id that never reaches the filesystem cannot be walked out of it.
      */
     get(id, token) {
         const page = this.pages.get(id);
         if (!page || !token || !this.valid(id, token))
             return null;
         if (this.now() - page.storedMs > this.ttlMs) {
-            this.pages.delete(id);
+            this.remove(id);
             return null;
         }
         return page.html;
@@ -74,13 +94,100 @@ export class PageStore {
         const cutoff = this.now() - this.ttlMs;
         for (const [id, page] of this.pages)
             if (page.storedMs < cutoff)
-                this.pages.delete(id);
+                this.remove(id);
         while (this.pages.size > this.maxPages) {
             const oldest = this.pages.keys().next();
             if (oldest.done)
                 break;
-            this.pages.delete(oldest.value);
+            this.remove(oldest.value);
+        }
+    }
+    /** Take back what a previous process left on disk. */
+    hydrate() {
+        const dir = this.dir;
+        if (!dir)
+            return;
+        let names;
+        try {
+            mkdirSync(dir, { recursive: true });
+            names = readdirSync(dir);
+        }
+        catch (err) {
+            // Nothing usable there: carry on in memory, which is exactly what every
+            // deployment without a directory does anyway.
+            console.warn(`page store: ${dir} is unusable, pages will not survive a restart (${reason(err)})`);
+            return;
+        }
+        const loaded = [];
+        for (const name of names) {
+            // The suffix also skips the temp files a write leaves behind when it dies
+            // partway, so a half-written page is never a candidate to begin with.
+            if (!name.endsWith(SUFFIX))
+                continue;
+            const page = this.read(join(dir, name));
+            if (page)
+                loaded.push([name.slice(0, -SUFFIX.length), page]);
+        }
+        // Oldest first, because eviction takes the front of the Map and readdir order
+        // is the filesystem's business rather than a record of what happened when.
+        loaded.sort((a, b) => a[1].storedMs - b[1].storedMs);
+        for (const [id, page] of loaded)
+            this.pages.set(id, page);
+        // A restart is also when pages that expired while the process was down go.
+        this.evict();
+    }
+    /** A stored page, or nothing: truncated, corrupt and gone are one answer here. */
+    read(file) {
+        try {
+            const parsed = JSON.parse(readFileSync(file, "utf8"));
+            const { html, storedMs } = (parsed ?? {});
+            if (typeof html !== "string" || typeof storedMs !== "number" || !Number.isFinite(storedMs))
+                return null;
+            return { html, storedMs };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Temp file, then rename: a reader only ever sees a whole page, and two reviews
+     * of the same pull request racing each other leave one of them intact rather
+     * than the two interleaved.
+     */
+    write(id, page) {
+        const dir = this.dir;
+        if (!dir)
+            return;
+        const tmp = join(dir, `${id}.${randomBytes(6).toString("hex")}.tmp`);
+        try {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(tmp, JSON.stringify(page));
+            renameSync(tmp, join(dir, `${id}${SUFFIX}`));
+        }
+        catch (err) {
+            // The page is in memory and its link works; it just will not outlive this
+            // process. Worth a line in the log and nothing more: throwing here would
+            // fail a review that has already done all of its work.
+            console.warn(`page store: could not write ${id} (${reason(err)})`);
+            try {
+                unlinkSync(tmp);
+            }
+            catch {
+                // Never created, or already renamed into place.
+            }
+        }
+    }
+    remove(id) {
+        this.pages.delete(id);
+        if (!this.dir)
+            return;
+        try {
+            unlinkSync(join(this.dir, `${id}${SUFFIX}`));
+        }
+        catch {
+            // Already gone: deleted underneath us, or it never reached the disk.
         }
     }
 }
+const reason = (err) => (err instanceof Error ? err.message : String(err));
 //# sourceMappingURL=pages.js.map

package/dist/app/pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/app/pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,mFAAmF;AACnF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAc9B,MAAM,OAAO,SAAS;IACH,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,MAAM,CAAS;IACf,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAEnC,YAAY,IAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;QACtD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;QAC3D,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,EAAU,EAAE,KAAyB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAEO,IAAI,CAAC,EAAU;QACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,KAAa;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oDAAoD;IAC5C,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,IAAI,CAAC,QAAQ,GAAG,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/app/pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mFAAmF;AACnF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,oFAAoF;AACpF,MAAM,MAAM,GAAG,OAAO,CAAC;AAgBvB,MAAM,OAAO,SAAS;IACH,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,MAAM,CAAS;IACf,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,GAAG,CAAe;IAClB,GAAG,CAAqB;IAEzC,YAAY,IAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;QACtD,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;QAC3D,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAU,EAAE,KAAyB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAEO,IAAI,CAAC,EAAU;QACrB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,KAAa;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oDAAoD;IAC5C,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,IAAI,CAAC,QAAQ,GAAG,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,sDAAsD;IAC9C,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,8CAA8C;YAC9C,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,mDAAmD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAgC,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACxC,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,IAAY;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAwB,CAAC;YACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,EAAU,EAAE,IAAgB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,yEAAyE;YACzE,uDAAuD;YACvD,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;CACF;AAED,MAAM,MAAM,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/app/review-process.d.ts

@@ -0,0 +1,66 @@
+import { type ReviewJob } from "./events.js";
+import type { reviewPullRequest, ReviewResult } from "./review.js";
+/** Parent → child, once, immediately after the fork. */
+export interface StartMessage {
+    t: "start";
+    job: ReviewJob;
+    /** Minted by the parent; the child never sees the App's private key. */
+    token: string;
+    api?: string;
+}
+/** Parent → child: the URL a `publish` request ended up at, or null. */
+export interface PublishedMessage {
+    t: "published";
+    seq: number;
+    url: string | null;
+}
+export type ToChild = StartMessage | PublishedMessage;
+/** Child → parent: a line for the App's log, so a review is still traceable. */
+export interface LogMessage {
+    t: "log";
+    msg: string;
+}
+/** Child → parent: store this page and tell me its URL. */
+export interface PublishMessage {
+    t: "publish";
+    seq: number;
+    html: string;
+}
+export interface DoneMessage {
+    t: "done";
+    result: ReviewResult;
+}
+export interface FailedMessage {
+    t: "failed";
+    message: string;
+}
+export type FromChild = LogMessage | PublishMessage | DoneMessage | FailedMessage;
+export interface ChildReviewerOptions {
+    /** The module the child runs. Only tests pass this. */
+    entry?: string;
+    timeoutMs?: number;
+}
+/**
+ * The module a review runs in.
+ *
+ * `dist/app/review-worker.js` in an installed or containerised App. Run from a
+ * checkout there is no `dist`, so fall back to the TypeScript source next door:
+ * `fork` inherits `process.execArgv`, so a parent started through tsx hands the
+ * child the same loader and a `.ts` entry runs. Resolved once, at import.
+ *
+ * Exported so a test can assert the path a deployed App will fork actually exists —
+ * getting this wrong is the one failure here that no unit test of the protocol
+ * would catch and every review would hit.
+ */
+export declare function reviewWorkerEntry(): string;
+/**
+ * A reviewer with `reviewPullRequest`'s signature that runs it in a child process.
+ *
+ * Same shape on purpose: `server.ts` swaps one for the other in a single line, and
+ * every existing test that injects its own reviewer through `AppSeams.review` keeps
+ * running in-process, which is what a test wants.
+ */
+export declare function childReviewer(opts?: ChildReviewerOptions): typeof reviewPullRequest;
+/** The App's default reviewer. */
+export declare const reviewInChildProcess: typeof reviewPullRequest;
+//# sourceMappingURL=review-process.d.ts.map

package/dist/app/review-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-process.d.ts","sourceRoot":"","sources":["../../src/app/review-process.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAc,YAAY,EAAE,MAAM,aAAa,CAAC;AAa/E,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,CAAC,EAAE,OAAO,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,KAAK,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,SAAS,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,QAAQ,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;AAElF,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAsCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,OAAO,iBAAiB,CAIvF;AAoFD,kCAAkC;AAClC,eAAO,MAAM,oBAAoB,0BAAkB,CAAC"}

package/dist/app/review-process.js

@@ -0,0 +1,199 @@
+/**
+ * Running a review somewhere it cannot stop the App answering.
+ *
+ * A review is synchronous from end to end, and not in one place we could fix: the
+ * pull request is fetched with `spawnSync` (`./checkout.ts`), the whole repository
+ * is parsed in one `files.forEach` loop of native tree-sitter calls
+ * (`graph/build.ts`), the graph is written with a blocking `JSON.stringify`, and
+ * the viewer page is exported synchronously too. In-process that holds the event
+ * loop for the entire review.
+ *
+ * That is not a theory. On the deployed App, probing `GET /p/<id>` from outside
+ * every ten seconds while one review ran: three consecutive timeouts (no response
+ * at all, not even with `--max-time 45`), then 404 in 0.9s the moment the queue
+ * emptied. Meanwhile the box's load average was 0.96 on eight vCPUs — one thread
+ * pegged, seven cores idle — and the App's own logs put a single review at 92s to
+ * 274s ("3 changed → 0 affected in 180134ms"). So a *single* in-flight review took
+ * the whole HTTP surface down for minutes: the container's 5s `HEALTHCHECK` failed,
+ * Docker marked the container unhealthy, and pages the App had already produced
+ * were unreachable. On a busy repository that is most of the working day.
+ *
+ * Neither bounding the queue nor lowering `GRAFT_CONCURRENCY` touches this —
+ * concurrency was already 2 and one job is enough. Cooperative yielding inside the
+ * parse loop does not either: a `git fetch` of a large repository is one
+ * uninterruptible `spawnSync` that can legitimately take a minute, and it is not
+ * even using a core while it blocks. The work has to leave the process.
+ *
+ * A child process rather than a `worker_threads` worker, deliberately:
+ *
+ *  - **The native grammars keep loading the way they already do.** `graph/extract.ts`
+ *    imports nine tree-sitter addons at module scope and constructs a `Parser` there
+ *    too, and `graph/generic.ts` loads more through `createRequire`. In a worker all
+ *    of that is re-instantiated per thread, which puts the N-API-in-worker behaviour
+ *    of nine third-party native modules between the App and every review. A fork runs
+ *    byte-identical code to what production runs today.
+ *  - **A review can be killed.** A wedged parse or a 10-minute clone is a process
+ *    to SIGKILL, not a thread with no safe way to stop it.
+ *  - **A crash stops being an outage.** An OOM kill or a grammar segfault on a
+ *    stranger's source now costs one review and is reported as a failure, instead
+ *    of taking the HTTP server with it. This process clones code written by
+ *    people who opened a pull request; that isolation is worth having on its own.
+ *  - **The heap goes away.** A repository's graph is freed by the child exiting
+ *    rather than left for the server process to fragment around.
+ *
+ * The parent keeps exactly the two things a review cannot mint for itself, and
+ * hands each across the IPC channel rather than argv or the environment (`ps` and
+ * `/proc/<pid>/environ` are readable; an installation token belongs in neither):
+ * the token, so the App's private key never crosses the boundary, and page
+ * publishing, because the store and the secret it signs URLs with live with the
+ * server.
+ */
+import { fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { jobKey } from "./events.js";
+/**
+ * How long one review may take before the process running it is killed.
+ *
+ * Generously above the worst honest review observed in production (274s) and above
+ * what `checkout.ts`'s own 120s-per-git-call budget can add up to, because the cost
+ * of being wrong here is a review that never happens. It is a ceiling on a *lost*
+ * queue slot, not on responsiveness — the server no longer cares how long a review
+ * runs, only that the slot comes back.
+ */
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+/**
+ * The module a review runs in.
+ *
+ * `dist/app/review-worker.js` in an installed or containerised App. Run from a
+ * checkout there is no `dist`, so fall back to the TypeScript source next door:
+ * `fork` inherits `process.execArgv`, so a parent started through tsx hands the
+ * child the same loader and a `.ts` entry runs. Resolved once, at import.
+ *
+ * Exported so a test can assert the path a deployed App will fork actually exists —
+ * getting this wrong is the one failure here that no unit test of the protocol
+ * would catch and every review would hit.
+ */
+export function reviewWorkerEntry() {
+    const js = fileURLToPath(new URL("./review-worker.js", import.meta.url));
+    if (existsSync(js))
+        return js;
+    const ts = js.replace(/\.js$/, ".ts");
+    return existsSync(ts) ? ts : js;
+}
+/**
+ * Live review processes.
+ *
+ * `main.ts` force-exits 25 seconds after SIGTERM if a review has not finished
+ * draining. That used to kill the review along with the process; now the review is
+ * a separate process that would outlive us, still holding a clone made with an
+ * installation token. So the last thing this process does is take them with it.
+ *
+ * A container stop is unaffected either way: Docker signals PID 1, not the process
+ * group, so a review keeps going through the grace period and the drain in `main.ts`
+ * means what it says. Ctrl-C in a terminal signals the whole group, so the children
+ * die with the default disposition and their reviews are reported as killed — which
+ * is what an interrupted review was before this too.
+ */
+const live = new Set();
+let hooked = false;
+function track(child) {
+    live.add(child);
+    if (hooked)
+        return;
+    hooked = true;
+    process.on("exit", () => {
+        for (const c of live)
+            c.kill("SIGKILL");
+    });
+}
+/** A dead channel is not worth an exception: the exit handler already covers it. */
+function post(child, msg) {
+    if (!child.connected)
+        return;
+    try {
+        child.send(msg);
+    }
+    catch {
+        /* channel closed under us — `exit` will settle the review */
+    }
+}
+/**
+ * A reviewer with `reviewPullRequest`'s signature that runs it in a child process.
+ *
+ * Same shape on purpose: `server.ts` swaps one for the other in a single line, and
+ * every existing test that injects its own reviewer through `AppSeams.review` keeps
+ * running in-process, which is what a test wants.
+ */
+export function childReviewer(opts = {}) {
+    const entry = opts.entry ?? reviewWorkerEntry();
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return (job, deps) => runInChild(job, deps, entry, timeoutMs);
+}
+async function runInChild(job, deps, entry, timeoutMs) {
+    const log = deps.log ?? (() => { });
+    // Minted here rather than in the child: this is a network round trip, never a
+    // blocking one, and the cache that owns installation tokens — including the
+    // forget-a-rejected-token behaviour — belongs to the one process that sees every
+    // delivery.
+    const token = await deps.token(job.installationId);
+    // The job key as argv makes `ps` in a container say which pull request each
+    // review is; the token stays out of it.
+    const child = fork(entry, [jobKey(job)], { stdio: ["ignore", "inherit", "inherit", "ipc"] });
+    track(child);
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                fn();
+            };
+            const timer = setTimeout(() => {
+                settle(() => reject(new Error(`review exceeded ${timeoutMs}ms and was killed`)));
+            }, timeoutMs);
+            timer.unref();
+            child.on("message", (raw) => {
+                const msg = raw;
+                if (msg.t === "log") {
+                    log(msg.msg);
+                    return;
+                }
+                if (msg.t === "publish") {
+                    // Publishing happens here because the store and its signing secret do.
+                    // A page that cannot be stored costs the link, never the review — the
+                    // same contract `review.ts` already has with a null `publish`.
+                    const stored = deps.publish ? deps.publish(job, msg.html) : Promise.resolve(null);
+                    void stored
+                        .catch(() => null)
+                        .then((url) => post(child, { t: "published", seq: msg.seq, url }));
+                    return;
+                }
+                if (msg.t === "done") {
+                    settle(() => resolve(msg.result));
+                    return;
+                }
+                settle(() => reject(new Error(msg.message)));
+            });
+            child.on("error", (err) => settle(() => reject(err)));
+            // The case that used to be an App-wide outage: a child that dies without
+            // reporting. An OOM kill, a segfault in a grammar on hostile source. Now it
+            // is one failed review, named, with the signal that did it.
+            child.on("exit", (code, signal) => settle(() => reject(new Error(`review process exited ${signal ? `on ${signal}` : `with code ${code}`} before reporting a result`))));
+            post(child, { t: "start", job, token, api: deps.api });
+        });
+    }
+    finally {
+        live.delete(child);
+        // Whatever happened — done, failed, timed out, or a delivery superseded by the
+        // queue — nothing forked here is allowed to outlive the review. `review.ts`
+        // deletes the checkout before it reports, so this leaves nothing behind.
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill("SIGKILL");
+    }
+}
+/** The App's default reviewer. */
+export const reviewInChildProcess = childReviewer();
+//# sourceMappingURL=review-process.js.map

package/dist/app/review-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-process.js","sourceRoot":"","sources":["../../src/app/review-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAGrD;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmD1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;AACrC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,KAAK,CAAC,KAAmB;IAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,SAAS,IAAI,CAAC,KAAmB,EAAE,GAAY;IAC7C,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAc,EACd,IAAgB,EAChB,KAAa,EACb,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,8EAA8E;IAC9E,4EAA4E;IAC5E,iFAAiF;IACjF,YAAY;IACZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEnD,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,KAAK,CAAC,KAAK,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,CAAC;YAEd,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,GAAgB,CAAC;gBAC7B,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxB,uEAAuE;oBACvE,sEAAsE;oBACtE,+DAA+D;oBAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClF,KAAK,MAAM;yBACR,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;yBACjB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;oBACrE,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;oBACrB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAEtD,yEAAyE;YACzE,4EAA4E;YAC5E,4DAA4D;YAC5D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,KAAK,CACP,yBAAyB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,4BAA4B,CACnG,CACF,CACF,CACF,CAAC;YAEF,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,+EAA+E;QAC/E,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAC"}

package/dist/app/review-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=review-worker.d.ts.map

package/dist/app/review-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-worker.d.ts","sourceRoot":"","sources":["../../src/app/review-worker.ts"],"names":[],"mappings":""}

package/dist/app/review-worker.js

@@ -0,0 +1,108 @@
+/**
+ * One review, in its own process. Forked by `./review-process.ts`, never imported.
+ *
+ * The whole file is glue: it waits for a `start`, calls the same
+ * `reviewPullRequest` the server used to call directly, and reports back. Nothing
+ * about a review changes by running here — that is the point. The two dependencies
+ * it cannot satisfy locally are wired to the parent instead:
+ *
+ *  - `token` is handed over in the start message. This process never holds the
+ *    App's private key, so a hostile repository that somehow got code running here
+ *    finds one repository's short-lived token and not the App's identity.
+ *  - `publish` is a round trip. The page store and the webhook secret its signed
+ *    URLs are keyed on live with the HTTP server, and a page is only useful to the
+ *    process that will serve it.
+ *
+ * Deliberately no `graft` state of its own: no lock, no cache directory, no
+ * telemetry. A review works on a throwaway clone in /tmp and takes its findings
+ * with it when it exits.
+ */
+import { reviewPullRequest } from "./review.js";
+/** Publish requests waiting on the parent, by sequence number. */
+const awaiting = new Map();
+let seq = 0;
+/** Fire and forget. `process.send` throws on a closed channel, and a log line is
+ * not worth crashing a review over — the `disconnect` handler below has already
+ * decided what a closed channel means. */
+const send = (msg) => {
+    if (!process.connected)
+        return;
+    try {
+        process.send?.(msg);
+    }
+    catch {
+        /* parent went away mid-review */
+    }
+};
+/** Close the channel, or leave if it is already gone. Either way this is the end of
+ * the process — see the `disconnect` handler below. */
+function bye() {
+    try {
+        if (process.connected)
+            process.disconnect?.();
+        else
+            process.exit(0);
+    }
+    catch {
+        process.exit(0);
+    }
+}
+/**
+ * The last word, then close the channel.
+ *
+ * Sent with a callback because that callback is the flush: `done` has to be on the
+ * wire before the channel closes, or the parent sees a process that exited without
+ * reporting and turns a finished review into a failure.
+ */
+function finish(msg) {
+    if (!process.connected)
+        return bye();
+    try {
+        process.send?.(msg, () => bye());
+    }
+    catch {
+        bye();
+    }
+}
+async function run(start) {
+    try {
+        const result = await reviewPullRequest(start.job, {
+            token: async () => start.token,
+            fetch: globalThis.fetch,
+            api: start.api,
+            publish: (_job, html) => new Promise((resolve) => {
+                const id = (seq += 1);
+                awaiting.set(id, resolve);
+                send({ t: "publish", seq: id, html });
+            }),
+            log: (msg) => send({ t: "log", msg }),
+        });
+        finish({ t: "done", result });
+    }
+    catch (err) {
+        // `reviewPullRequest` has already run the token through `redact`, so this
+        // message is safe to put in the parent's log — which is where it is going.
+        finish({ t: "failed", message: err instanceof Error ? err.message : String(err) });
+    }
+}
+/**
+ * No parent, no point.
+ *
+ * A review whose channel has closed has nowhere to publish a page and nobody to
+ * report to. If the server process died, nothing will SIGKILL this one either, and
+ * without this it would sit in a clone for the rest of the parent's 15-minute
+ * ceiling. Going now leaves the same throwaway tree behind that a SIGKILL would —
+ * what it does not do is spend a quarter of an hour producing a review no one can
+ * receive.
+ */
+process.on("disconnect", () => process.exit(0));
+process.on("message", (raw) => {
+    const msg = raw;
+    if (msg.t === "start") {
+        void run(msg);
+        return;
+    }
+    awaiting.get(msg.seq)?.(msg.url);
+    awaiting.delete(msg.seq);
+});
+//# sourceMappingURL=review-worker.js.map

package/dist/app/review-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-worker.js","sourceRoot":"","sources":["../../src/app/review-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhD,kEAAkE;AAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAC;AACjE,IAAI,GAAG,GAAG,CAAC,CAAC;AAEZ;;0CAE0C;AAC1C,MAAM,IAAI,GAAG,CAAC,GAAc,EAAQ,EAAE;IACpC,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC,CAAC;AAEF;uDACuD;AACvD,SAAS,GAAG;IACV,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,GAAc;IAC5B,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC;IACR,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAmB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE;YAChD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK;YAC9B,KAAK,EAAE,UAAU,CAAC,KAAyB;YAC3C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACtB,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC;YACJ,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC5B,MAAM,GAAG,GAAG,GAAc,CAAC;IAC3B,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACtB,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC"}

package/dist/app/review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,iFAAiF;AACjF,eAAO,MAAM,MAAM,gCAAgC,CAAC;AAIpD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;qBAEiB;IACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAuC/F"}
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,iFAAiF;AACjF,eAAO,MAAM,MAAM,gCAAgC,CAAC;AAIpD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;qBAEiB;IACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAsD/F"}

package/dist/app/review.js

@@ -21,7 +21,10 @@ const DEPTH = 2;
 export async function reviewPullRequest(job, deps) {
     const log = deps.log ?? (() => { });
     const token = await deps.token(job.installationId);
-    const checkout = checkoutPullRequest({ owner: job.owner, repo: job.repo, number: job.number, baseRef: job.baseRef, token });
+    // `log` goes into the checkout because a closed pull request is reviewed from
+    // `refs/pull/N/head` against a different basis than an open one, and the only
+    // place that difference is visible afterwards is this line.
+    const checkout = checkoutPullRequest({ owner: job.owner, repo: job.repo, number: job.number, baseRef: job.baseRef, token, log });
     try {
         log(`${job.owner}/${job.repo}#${job.number}: building`);
         await buildGraph(checkout.dir);
@@ -33,6 +36,16 @@ export async function reviewPullRequest(job, deps) {
         if (!diff)
             throw new Error(`no diff against ${job.baseRef}`);
         const report = blastRadiusIn(graph, contextDir, diff.files, diff.basis, DEPTH);
+        // Same two passes `graft blast --name` runs, in the same order: a reviewer's
+        // reason cites area labels, and naming is what gives an area its final one.
+        // Both are best-effort — without GRAFT_API_KEY the areas keep their symbol
+        // names and the comment still goes out.
+        const { nameReport } = await import("../blast/name.js");
+        const { note } = await nameReport(graph, report, contextDir);
+        if (note)
+            log(`${job.owner}/${job.repo}#${job.number}: ${note}`);
+        const { attachOwners, diffAuthors } = await import("../blast/owners.js");
+        attachOwners(checkout.dir, report, { exclude: diffAuthors(checkout.dir, checkout.base) });
         // NOTE: once #180 lands, pass `{ root: checkout.dir }` so the collapsed list
         // quotes the reaching line here too. It is additive, and the App works without it.
         let body = `${MARKER}\n${markdownReport(report)}`;