@nanonets/graft 0.16.0 → 0.19.0

package/dist/app/review-process.js

@@ -0,0 +1,199 @@
+/**
+ * Running a review somewhere it cannot stop the App answering.
+ *
+ * A review is synchronous from end to end, and not in one place we could fix: the
+ * pull request is fetched with `spawnSync` (`./checkout.ts`), the whole repository
+ * is parsed in one `files.forEach` loop of native tree-sitter calls
+ * (`graph/build.ts`), the graph is written with a blocking `JSON.stringify`, and
+ * the viewer page is exported synchronously too. In-process that holds the event
+ * loop for the entire review.
+ *
+ * That is not a theory. On the deployed App, probing `GET /p/<id>` from outside
+ * every ten seconds while one review ran: three consecutive timeouts (no response
+ * at all, not even with `--max-time 45`), then 404 in 0.9s the moment the queue
+ * emptied. Meanwhile the box's load average was 0.96 on eight vCPUs — one thread
+ * pegged, seven cores idle — and the App's own logs put a single review at 92s to
+ * 274s ("3 changed → 0 affected in 180134ms"). So a *single* in-flight review took
+ * the whole HTTP surface down for minutes: the container's 5s `HEALTHCHECK` failed,
+ * Docker marked the container unhealthy, and pages the App had already produced
+ * were unreachable. On a busy repository that is most of the working day.
+ *
+ * Neither bounding the queue nor lowering `GRAFT_CONCURRENCY` touches this —
+ * concurrency was already 2 and one job is enough. Cooperative yielding inside the
+ * parse loop does not either: a `git fetch` of a large repository is one
+ * uninterruptible `spawnSync` that can legitimately take a minute, and it is not
+ * even using a core while it blocks. The work has to leave the process.
+ *
+ * A child process rather than a `worker_threads` worker, deliberately:
+ *
+ *  - **The native grammars keep loading the way they already do.** `graph/extract.ts`
+ *    imports nine tree-sitter addons at module scope and constructs a `Parser` there
+ *    too, and `graph/generic.ts` loads more through `createRequire`. In a worker all
+ *    of that is re-instantiated per thread, which puts the N-API-in-worker behaviour
+ *    of nine third-party native modules between the App and every review. A fork runs
+ *    byte-identical code to what production runs today.
+ *  - **A review can be killed.** A wedged parse or a 10-minute clone is a process
+ *    to SIGKILL, not a thread with no safe way to stop it.
+ *  - **A crash stops being an outage.** An OOM kill or a grammar segfault on a
+ *    stranger's source now costs one review and is reported as a failure, instead
+ *    of taking the HTTP server with it. This process clones code written by
+ *    people who opened a pull request; that isolation is worth having on its own.
+ *  - **The heap goes away.** A repository's graph is freed by the child exiting
+ *    rather than left for the server process to fragment around.
+ *
+ * The parent keeps exactly the two things a review cannot mint for itself, and
+ * hands each across the IPC channel rather than argv or the environment (`ps` and
+ * `/proc/<pid>/environ` are readable; an installation token belongs in neither):
+ * the token, so the App's private key never crosses the boundary, and page
+ * publishing, because the store and the secret it signs URLs with live with the
+ * server.
+ */
+import { fork } from "node:child_process";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { jobKey } from "./events.js";
+/**
+ * How long one review may take before the process running it is killed.
+ *
+ * Generously above the worst honest review observed in production (274s) and above
+ * what `checkout.ts`'s own 120s-per-git-call budget can add up to, because the cost
+ * of being wrong here is a review that never happens. It is a ceiling on a *lost*
+ * queue slot, not on responsiveness — the server no longer cares how long a review
+ * runs, only that the slot comes back.
+ */
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+/**
+ * The module a review runs in.
+ *
+ * `dist/app/review-worker.js` in an installed or containerised App. Run from a
+ * checkout there is no `dist`, so fall back to the TypeScript source next door:
+ * `fork` inherits `process.execArgv`, so a parent started through tsx hands the
+ * child the same loader and a `.ts` entry runs. Resolved once, at import.
+ *
+ * Exported so a test can assert the path a deployed App will fork actually exists —
+ * getting this wrong is the one failure here that no unit test of the protocol
+ * would catch and every review would hit.
+ */
+export function reviewWorkerEntry() {
+    const js = fileURLToPath(new URL("./review-worker.js", import.meta.url));
+    if (existsSync(js))
+        return js;
+    const ts = js.replace(/\.js$/, ".ts");
+    return existsSync(ts) ? ts : js;
+}
+/**
+ * Live review processes.
+ *
+ * `main.ts` force-exits 25 seconds after SIGTERM if a review has not finished
+ * draining. That used to kill the review along with the process; now the review is
+ * a separate process that would outlive us, still holding a clone made with an
+ * installation token. So the last thing this process does is take them with it.
+ *
+ * A container stop is unaffected either way: Docker signals PID 1, not the process
+ * group, so a review keeps going through the grace period and the drain in `main.ts`
+ * means what it says. Ctrl-C in a terminal signals the whole group, so the children
+ * die with the default disposition and their reviews are reported as killed — which
+ * is what an interrupted review was before this too.
+ */
+const live = new Set();
+let hooked = false;
+function track(child) {
+    live.add(child);
+    if (hooked)
+        return;
+    hooked = true;
+    process.on("exit", () => {
+        for (const c of live)
+            c.kill("SIGKILL");
+    });
+}
+/** A dead channel is not worth an exception: the exit handler already covers it. */
+function post(child, msg) {
+    if (!child.connected)
+        return;
+    try {
+        child.send(msg);
+    }
+    catch {
+        /* channel closed under us — `exit` will settle the review */
+    }
+}
+/**
+ * A reviewer with `reviewPullRequest`'s signature that runs it in a child process.
+ *
+ * Same shape on purpose: `server.ts` swaps one for the other in a single line, and
+ * every existing test that injects its own reviewer through `AppSeams.review` keeps
+ * running in-process, which is what a test wants.
+ */
+export function childReviewer(opts = {}) {
+    const entry = opts.entry ?? reviewWorkerEntry();
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return (job, deps) => runInChild(job, deps, entry, timeoutMs);
+}
+async function runInChild(job, deps, entry, timeoutMs) {
+    const log = deps.log ?? (() => { });
+    // Minted here rather than in the child: this is a network round trip, never a
+    // blocking one, and the cache that owns installation tokens — including the
+    // forget-a-rejected-token behaviour — belongs to the one process that sees every
+    // delivery.
+    const token = await deps.token(job.installationId);
+    // The job key as argv makes `ps` in a container say which pull request each
+    // review is; the token stays out of it.
+    const child = fork(entry, [jobKey(job)], { stdio: ["ignore", "inherit", "inherit", "ipc"] });
+    track(child);
+    try {
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                fn();
+            };
+            const timer = setTimeout(() => {
+                settle(() => reject(new Error(`review exceeded ${timeoutMs}ms and was killed`)));
+            }, timeoutMs);
+            timer.unref();
+            child.on("message", (raw) => {
+                const msg = raw;
+                if (msg.t === "log") {
+                    log(msg.msg);
+                    return;
+                }
+                if (msg.t === "publish") {
+                    // Publishing happens here because the store and its signing secret do.
+                    // A page that cannot be stored costs the link, never the review — the
+                    // same contract `review.ts` already has with a null `publish`.
+                    const stored = deps.publish ? deps.publish(job, msg.html) : Promise.resolve(null);
+                    void stored
+                        .catch(() => null)
+                        .then((url) => post(child, { t: "published", seq: msg.seq, url }));
+                    return;
+                }
+                if (msg.t === "done") {
+                    settle(() => resolve(msg.result));
+                    return;
+                }
+                settle(() => reject(new Error(msg.message)));
+            });
+            child.on("error", (err) => settle(() => reject(err)));
+            // The case that used to be an App-wide outage: a child that dies without
+            // reporting. An OOM kill, a segfault in a grammar on hostile source. Now it
+            // is one failed review, named, with the signal that did it.
+            child.on("exit", (code, signal) => settle(() => reject(new Error(`review process exited ${signal ? `on ${signal}` : `with code ${code}`} before reporting a result`))));
+            post(child, { t: "start", job, token, api: deps.api });
+        });
+    }
+    finally {
+        live.delete(child);
+        // Whatever happened — done, failed, timed out, or a delivery superseded by the
+        // queue — nothing forked here is allowed to outlive the review. `review.ts`
+        // deletes the checkout before it reports, so this leaves nothing behind.
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill("SIGKILL");
+    }
+}
+/** The App's default reviewer. */
+export const reviewInChildProcess = childReviewer();
+//# sourceMappingURL=review-process.js.map

package/dist/app/review-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-process.js","sourceRoot":"","sources":["../../src/app/review-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAGrD;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAmD1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;AACrC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,SAAS,KAAK,CAAC,KAAmB;IAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,SAAS,IAAI,CAAC,KAAmB,EAAE,GAAY;IAC7C,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO;IAC7B,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAc,EACd,IAAgB,EAChB,KAAa,EACb,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACzC,8EAA8E;IAC9E,4EAA4E;IAC5E,iFAAiF;IACjF,YAAY;IACZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEnD,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,KAAK,CAAC,KAAK,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,EAAE,CAAC;YACP,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,CAAC;YAEd,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,GAAgB,CAAC;gBAC7B,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBACxB,uEAAuE;oBACvE,sEAAsE;oBACtE,+DAA+D;oBAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAClF,KAAK,MAAM;yBACR,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;yBACjB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;oBACrE,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;oBACrB,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClC,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAEtD,yEAAyE;YACzE,4EAA4E;YAC5E,4DAA4D;YAC5D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,EAAE,CACV,MAAM,CACJ,IAAI,KAAK,CACP,yBAAyB,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,4BAA4B,CACnG,CACF,CACF,CACF,CAAC;YAEF,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,+EAA+E;QAC/E,4EAA4E;QAC5E,yEAAyE;QACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAC"}

package/dist/app/review-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=review-worker.d.ts.map

package/dist/app/review-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-worker.d.ts","sourceRoot":"","sources":["../../src/app/review-worker.ts"],"names":[],"mappings":""}

package/dist/app/review-worker.js

@@ -0,0 +1,108 @@
+/**
+ * One review, in its own process. Forked by `./review-process.ts`, never imported.
+ *
+ * The whole file is glue: it waits for a `start`, calls the same
+ * `reviewPullRequest` the server used to call directly, and reports back. Nothing
+ * about a review changes by running here — that is the point. The two dependencies
+ * it cannot satisfy locally are wired to the parent instead:
+ *
+ *  - `token` is handed over in the start message. This process never holds the
+ *    App's private key, so a hostile repository that somehow got code running here
+ *    finds one repository's short-lived token and not the App's identity.
+ *  - `publish` is a round trip. The page store and the webhook secret its signed
+ *    URLs are keyed on live with the HTTP server, and a page is only useful to the
+ *    process that will serve it.
+ *
+ * Deliberately no `graft` state of its own: no lock, no cache directory, no
+ * telemetry. A review works on a throwaway clone in /tmp and takes its findings
+ * with it when it exits.
+ */
+import { reviewPullRequest } from "./review.js";
+/** Publish requests waiting on the parent, by sequence number. */
+const awaiting = new Map();
+let seq = 0;
+/** Fire and forget. `process.send` throws on a closed channel, and a log line is
+ * not worth crashing a review over — the `disconnect` handler below has already
+ * decided what a closed channel means. */
+const send = (msg) => {
+    if (!process.connected)
+        return;
+    try {
+        process.send?.(msg);
+    }
+    catch {
+        /* parent went away mid-review */
+    }
+};
+/** Close the channel, or leave if it is already gone. Either way this is the end of
+ * the process — see the `disconnect` handler below. */
+function bye() {
+    try {
+        if (process.connected)
+            process.disconnect?.();
+        else
+            process.exit(0);
+    }
+    catch {
+        process.exit(0);
+    }
+}
+/**
+ * The last word, then close the channel.
+ *
+ * Sent with a callback because that callback is the flush: `done` has to be on the
+ * wire before the channel closes, or the parent sees a process that exited without
+ * reporting and turns a finished review into a failure.
+ */
+function finish(msg) {
+    if (!process.connected)
+        return bye();
+    try {
+        process.send?.(msg, () => bye());
+    }
+    catch {
+        bye();
+    }
+}
+async function run(start) {
+    try {
+        const result = await reviewPullRequest(start.job, {
+            token: async () => start.token,
+            fetch: globalThis.fetch,
+            api: start.api,
+            publish: (_job, html) => new Promise((resolve) => {
+                const id = (seq += 1);
+                awaiting.set(id, resolve);
+                send({ t: "publish", seq: id, html });
+            }),
+            log: (msg) => send({ t: "log", msg }),
+        });
+        finish({ t: "done", result });
+    }
+    catch (err) {
+        // `reviewPullRequest` has already run the token through `redact`, so this
+        // message is safe to put in the parent's log — which is where it is going.
+        finish({ t: "failed", message: err instanceof Error ? err.message : String(err) });
+    }
+}
+/**
+ * No parent, no point.
+ *
+ * A review whose channel has closed has nowhere to publish a page and nobody to
+ * report to. If the server process died, nothing will SIGKILL this one either, and
+ * without this it would sit in a clone for the rest of the parent's 15-minute
+ * ceiling. Going now leaves the same throwaway tree behind that a SIGKILL would —
+ * what it does not do is spend a quarter of an hour producing a review no one can
+ * receive.
+ */
+process.on("disconnect", () => process.exit(0));
+process.on("message", (raw) => {
+    const msg = raw;
+    if (msg.t === "start") {
+        void run(msg);
+        return;
+    }
+    awaiting.get(msg.seq)?.(msg.url);
+    awaiting.delete(msg.seq);
+});
+//# sourceMappingURL=review-worker.js.map

package/dist/app/review-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-worker.js","sourceRoot":"","sources":["../../src/app/review-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhD,kEAAkE;AAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwC,CAAC;AACjE,IAAI,GAAG,GAAG,CAAC,CAAC;AAEZ;;0CAE0C;AAC1C,MAAM,IAAI,GAAG,CAAC,GAAc,EAAQ,EAAE;IACpC,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC,CAAC;AAEF;uDACuD;AACvD,SAAS,GAAG;IACV,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,GAAc;IAC5B,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC;IACR,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,KAAmB;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE;YAChD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK;YAC9B,KAAK,EAAE,UAAU,CAAC,KAAyB;YAC3C,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACtB,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;gBACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC;YACJ,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC5B,MAAM,GAAG,GAAG,GAAc,CAAC;IAC3B,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACtB,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC"}

package/dist/app/review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,iFAAiF;AACjF,eAAO,MAAM,MAAM,gCAAgC,CAAC;AAIpD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;qBAEiB;IACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAmD/F"}
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,iFAAiF;AACjF,eAAO,MAAM,MAAM,gCAAgC,CAAC;AAIpD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;qBAEiB;IACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAsD/F"}

package/dist/app/review.js

@@ -21,7 +21,10 @@ const DEPTH = 2;
 export async function reviewPullRequest(job, deps) {
     const log = deps.log ?? (() => { });
     const token = await deps.token(job.installationId);
-    const checkout = checkoutPullRequest({ owner: job.owner, repo: job.repo, number: job.number, baseRef: job.baseRef, token });
+    // `log` goes into the checkout because a closed pull request is reviewed from
+    // `refs/pull/N/head` against a different basis than an open one, and the only
+    // place that difference is visible afterwards is this line.
+    const checkout = checkoutPullRequest({ owner: job.owner, repo: job.repo, number: job.number, baseRef: job.baseRef, token, log });
     try {
         log(`${job.owner}/${job.repo}#${job.number}: building`);
         await buildGraph(checkout.dir);

package/dist/app/review.js.map

@@ -1 +1 @@
-{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAEpD,MAAM,KAAK,GAAG,CAAC,CAAC;AAqBhB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,IAAgB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5H,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;QACxD,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAEjE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzE,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1F,6EAA6E;QAC7E,mFAAmF;QACnF,IAAI,IAAI,GAAG,GAAG,MAAM,KAAK,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAElD,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,IAAI,wCAAwC,SAAS,iFAAiF,CAAC;YAC7I,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,yBAAyB;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,UAAU,CACvB,MAAwC,EACxC,UAAkB,EAClB,IAAY,EACZ,GAAc;IAEd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC;YACpB,UAAU;YACV,SAAS,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7C,2EAA2E;YAC3E,0BAA0B;YAC1B,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,IAAY,EAAE,KAAa,EAAE,IAAgB;IACxF,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,GAAG,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC;IACnF,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,SAAS,KAAK,EAAE;QAC/B,MAAM,EAAE,6BAA6B;QACrC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,WAAW;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAClH,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACnC,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC,QAAQ,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAA+B,EAAE,SAAgB;IACxF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,sBAAsB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/app/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,6BAA6B,CAAC;AAEpD,MAAM,KAAK,GAAG,CAAC,CAAC;AAqBhB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,IAAgB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,8EAA8E;IAC9E,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAEjI,IAAI,CAAC;QACH,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;QACxD,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/B,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAEjE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACzE,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE1F,6EAA6E;QAC7E,mFAAmF;QACnF,IAAI,IAAI,GAAG,GAAG,MAAM,KAAK,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAElD,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,IAAI,wCAAwC,SAAS,iFAAiF,CAAC;YAC7I,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,yBAAyB;QACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,UAAU,CACvB,MAAwC,EACxC,UAAkB,EAClB,IAAY,EACZ,GAAc;IAEd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC;YACpB,UAAU;YACV,SAAS,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE;YAC7B,YAAY,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;YAC7C,2EAA2E;YAC3E,0BAA0B;YAC1B,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,IAAY,EAAE,KAAa,EAAE,IAAgB;IACxF,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,GAAG,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC;IACnF,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,SAAS,KAAK,EAAE;QAC/B,MAAM,EAAE,6BAA6B;QACrC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,WAAW;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAClH,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACnC,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC,QAAQ,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAA+B,EAAE,SAAgB;IACxF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,sBAAsB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/app/server.d.ts

@@ -9,24 +9,53 @@
  * GitHub retries a delivery it considers failed and gives up after ten seconds,
  * while a review takes tens of them — so the handler validates, queues, and
  * answers 202. Everything real happens on the queue.
+ *
+ * "On the queue" used to mean "on this event loop", and that was the whole of a
+ * multi-minute outage: a review is synchronous end to end, so one in flight left
+ * this server unable to answer /healthz or serve a page it had already produced.
+ * The queue now runs each review in its own process (`./review-process.ts`) and
+ * everything in here is I/O again.
  */
 import { type Server } from "node:http";
 import { type ReviewJob } from "./events.js";
 import { type AppCredentials, type Fetch } from "./identity.js";
+import { buildRepoIntoBrain, checkRepoAccess } from "./brain-build.js";
 import { PageStore } from "./pages.js";
 import { WorkQueue } from "./queue.js";
-import { reviewPullRequest } from "./review.js";
+import type { reviewPullRequest } from "./review.js";
 /** Seams for tests: nothing here has a default that touches the network. */
 export interface AppSeams {
     fetch?: Fetch;
-    /** Swapped out to assert what the queue was handed, without a clone. */
+    /** Swapped out so a test can assert what the route handed the builder without
+     * cloning a repository or reaching GitHub. */
+    brainBuild?: typeof buildRepoIntoBrain;
+    /** Swapped out so a test can assert the access route's answers without
+     * reaching GitHub. */
+    brainAccess?: typeof checkRepoAccess;
+    /** Swapped out to assert what the queue was handed, without a clone — and, being
+     * called in-process, without the fork the default reviewer does. */
     review?: typeof reviewPullRequest;
     now?: () => number;
 }
 export interface AppConfig extends AppCredentials {
     webhookSecret: string;
+    /** Shared secret for `POST /brain/build`. That route is called by the
+     * platform, not by GitHub, so it cannot use the webhook's payload signature —
+     * it takes a bearer token instead. Unset disables the route entirely, which
+     * is the right default for a deployment that only reviews pull requests. */
+    brainBuildSecret?: string;
+    /** Platform base URL the digest is posted to. Defaults to production. */
+    brainBaseUrl?: string;
+    /** Token for reading public repositories the App is not installed on.
+     * Optional — without it the read borrows one of our own installation's
+     * tokens, and only falls back to anonymous if the App has none. */
+    publicToken?: string;
+    /** Whose installation to borrow for that. Defaults to ours. */
+    publicOwner?: string;
     /** Public origin, for the links put in comments, e.g. https://graft.example.com */
     publicUrl: string;
+    /** Where pages are kept, so a restart does not strand the links already posted. */
+    pageDir?: string;
     port?: number;
     concurrency?: number;
     api?: string;

package/dist/app/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AACjG,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAuC,KAAK,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,EACjB,KAAK,GAAE,QAAa,GACnB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAkFnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/app/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAuC,KAAK,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAA8C,MAAM,kBAAkB,CAAC;AAEnH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD,4EAA4E;AAC5E,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd;kDAC8C;IAC9C,UAAU,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACvC;0BACsB;IACtB,WAAW,CAAC,EAAE,OAAO,eAAe,CAAC;IACrC;wEACoE;IACpE,MAAM,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB;;;gFAG4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;uEAEmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,SAAS,EACjB,KAAK,GAAE,QAAa,GACnB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAqLnE"}

package/dist/app/server.js

@@ -9,21 +9,30 @@
  * GitHub retries a delivery it considers failed and gives up after ten seconds,
  * while a review takes tens of them — so the handler validates, queues, and
  * answers 202. Everything real happens on the queue.
+ *
+ * "On the queue" used to mean "on this event loop", and that was the whole of a
+ * multi-minute outage: a review is synchronous end to end, so one in flight left
+ * this server unable to answer /healthz or serve a page it had already produced.
+ * The queue now runs each review in its own process (`./review-process.ts`) and
+ * everything in here is I/O again.
  */
 import { createServer } from "node:http";
+import { timingSafeEqual } from "node:crypto";
 import { jobKey, reviewJobFor } from "./events.js";
 import { InstallationTokens, verifySignature } from "./identity.js";
+import { checkRepoAccess, RepoNotAccessibleError } from "./brain-build.js";
+import { buildRepoInChildProcess } from "./brain-build-process.js";
 import { PageStore } from "./pages.js";
 import { WorkQueue } from "./queue.js";
-import { reviewPullRequest } from "./review.js";
+import { reviewInChildProcess } from "./review-process.js";
 /** A webhook body larger than this is not a pull_request event we can use. */
 const MAX_BODY_BYTES = 2 * 1024 * 1024;
 export function createApp(config, seams = {}) {
     const log = config.log ?? ((msg) => console.log(msg));
     const fetchImpl = seams.fetch ?? globalThis.fetch;
-    const review = seams.review ?? reviewPullRequest;
+    const review = seams.review ?? reviewInChildProcess;
     const tokens = new InstallationTokens(config, fetchImpl, seams.now ?? Date.now, config.api);
-    const pages = new PageStore({ secret: config.webhookSecret });
+    const pages = new PageStore({ secret: config.webhookSecret, dir: config.pageDir });
     const origin = config.publicUrl.replace(/\/$/, "");
     const queue = new WorkQueue(async (job) => {
         const started = Date.now();
@@ -88,6 +97,112 @@ export function createApp(config, seams = {}) {
             log(`${jobKey(decided.job)}: queued${decided.job.fromFork ? " (fork)" : ""}`);
             return send(res, 202, "application/json", JSON.stringify({ queued: true }));
         }
+        // Can we read this repository? The cheap question, answered on its own.
+        //
+        // Same secret as /brain/build, because it is the same caller and the same
+        // trust. Kept separate from it because it costs a second where the build
+        // costs minutes, and the platform needs the answer before it can decide
+        // which screen to show.
+        if (req.method === "POST" && url.pathname === "/brain/access") {
+            if (!config.brainBuildSecret)
+                return send(res, 404, "text/plain", "not found");
+            if (!bearerMatches(header(req, "authorization"), config.brainBuildSecret)) {
+                return send(res, 401, "text/plain", "unauthorized");
+            }
+            const body = await readBody(req);
+            if (body === null)
+                return send(res, 413, "text/plain", "payload too large");
+            let ask;
+            try {
+                ask = JSON.parse(body);
+            }
+            catch {
+                return send(res, 400, "text/plain", "bad json");
+            }
+            if (!ask.owner || !ask.repo) {
+                return send(res, 400, "application/json", JSON.stringify({ error: "owner and repo are required" }));
+            }
+            try {
+                const access = await (seams.brainAccess ?? checkRepoAccess)({ owner: ask.owner, repo: ask.repo }, {
+                    creds: config,
+                    fetch: fetchImpl,
+                    api: config.api,
+                    publicToken: config.publicToken,
+                    publicOwner: config.publicOwner,
+                    log,
+                    now: seams.now,
+                });
+                // 200 either way: "we cannot see it" is an answer, not a failure, and
+                // the platform turns it into a choice rather than an error.
+                return send(res, 200, "application/json", JSON.stringify(access));
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                log(`brain access ${ask.owner}/${ask.repo} failed: ${msg}`);
+                return send(res, 502, "application/json", JSON.stringify({ error: msg }));
+            }
+        }
+        // Build one repository into a brain, on demand. Called by the platform when
+        // someone pastes a repository URL during onboarding — there is no webhook
+        // behind it, so it authenticates with a bearer token rather than a payload
+        // signature.
+        if (req.method === "POST" && url.pathname === "/brain/build") {
+            if (!config.brainBuildSecret)
+                return send(res, 404, "text/plain", "not found");
+            // Compared in constant time for the same reason verifySignature is: this
+            // is a long-lived shared secret, and a timing oracle on it is worth more
+            // to an attacker than one on a per-payload signature.
+            if (!bearerMatches(header(req, "authorization"), config.brainBuildSecret)) {
+                return send(res, 401, "text/plain", "unauthorized");
+            }
+            const body = await readBody(req);
+            if (body === null)
+                return send(res, 413, "text/plain", "payload too large");
+            let job;
+            try {
+                job = JSON.parse(body);
+            }
+            catch {
+                return send(res, 400, "text/plain", "bad json");
+            }
+            // brainId/brainToken are optional: without them the digest comes back in
+            // the response for the caller to ingest itself. See BrainBuildJob.
+            if (!job.owner || !job.repo) {
+                return send(res, 400, "application/json", JSON.stringify({ error: "owner and repo are required" }));
+            }
+            // Synchronous on purpose: the caller is a person waiting on a screen, and
+            // the platform's own import job is what makes the SLOW half (extraction and
+            // placement) asynchronous. This half is a shallow clone and a graph build.
+            try {
+                // The deployment's platform URL wins over anything a caller sends, so a
+                // request cannot redirect a repository's history to another host.
+                if (config.brainBaseUrl)
+                    job.brainBaseUrl = config.brainBaseUrl;
+                // Out of this process by default. A read is minutes of blocking work
+                // and the App has to keep answering — including the one-second access
+                // question the next person's onboarding is waiting on. A test that
+                // injects its own builder still runs in-process, which is what a test
+                // wants.
+                const built = await (seams.brainBuild ?? buildRepoInChildProcess)(job, {
+                    creds: config,
+                    fetch: fetchImpl,
+                    api: config.api,
+                    publicToken: config.publicToken,
+                    publicOwner: config.publicOwner,
+                    log,
+                    now: seams.now,
+                });
+                return send(res, 202, "application/json", JSON.stringify(built));
+            }
+            catch (e) {
+                if (e instanceof RepoNotAccessibleError) {
+                    return send(res, 404, "application/json", JSON.stringify({ error: e.message, ...e.gap }));
+                }
+                const msg = e instanceof Error ? e.message : String(e);
+                log(`brain build ${job.owner}/${job.repo} failed: ${msg}`);
+                return send(res, 502, "application/json", JSON.stringify({ error: msg }));
+            }
+        }
         return send(res, 404, "text/plain", "not found");
     }
     if (config.port !== undefined)
@@ -98,6 +213,18 @@ const header = (req, name) => {
     const v = req.headers[name];
     return Array.isArray(v) ? v[0] : v;
 };
+/** Constant-time `Authorization: Bearer <secret>` check. */
+function bearerMatches(headerValue, secret) {
+    const prefix = "Bearer ";
+    if (!headerValue || !headerValue.startsWith(prefix))
+        return false;
+    const given = Buffer.from(headerValue.slice(prefix.length));
+    const want = Buffer.from(secret);
+    // timingSafeEqual throws on a length mismatch, which is itself a leak of the
+    // secret's length — but one byte of length is not worth a branch that skips
+    // the comparison, and the lengths here are fixed by deployment config.
+    return given.length === want.length && timingSafeEqual(given, want);
+}
 function send(res, status, type, body, extra = {}) {
     res.writeHead(status, { "content-type": type, ...extra });
     res.end(body);