@open-cr-agent/vcs-github 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,101 @@
+import { z } from "zod";
+declare const pullRequestSchema: z.ZodObject<{
+    number: z.ZodNumber;
+    title: z.ZodString;
+    body: z.ZodNullable<z.ZodString>;
+    html_url: z.ZodString;
+    user: z.ZodNullable<z.ZodObject<{
+        login: z.ZodString;
+    }, z.core.$strip>>;
+    base: z.ZodObject<{
+        sha: z.ZodString;
+        ref: z.ZodString;
+    }, z.core.$strip>;
+    head: z.ZodObject<{
+        sha: z.ZodString;
+        ref: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PullRequest = z.infer<typeof pullRequestSchema>;
+declare const commentSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    body: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
+    user: z.ZodNullable<z.ZodObject<{
+        login: z.ZodString;
+        type: z.ZodString;
+    }, z.core.$strip>>;
+    node_id: z.ZodOptional<z.ZodString>;
+    author_association: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type IssueComment = z.infer<typeof commentSchema>;
+export interface ReviewComment {
+    path: string;
+    line: number;
+    start_line?: number;
+    side: "RIGHT";
+    start_side?: "RIGHT";
+    body: string;
+}
+export interface CreateReview {
+    commit_id: string;
+    event: "COMMENT" | "REQUEST_CHANGES";
+    body: string;
+    comments: ReviewComment[];
+}
+export declare class GitHubApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface GitHubApiOptions {
+    token: string;
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}
+declare const reviewSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    state: z.ZodString;
+    user: z.ZodNullable<z.ZodObject<{
+        login: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PullRequestReview = z.infer<typeof reviewSchema>;
+export interface ReviewThread {
+    id: string;
+    isResolved: boolean;
+    resolvedBy: string | undefined;
+    comments: {
+        author: string;
+        association: string;
+        body: string;
+        editor?: string;
+    }[];
+}
+export declare class GitHubApi {
+    private readonly repository;
+    private readonly options;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(repository: {
+        owner: string;
+        repo: string;
+    }, options: GitHubApiOptions);
+    listReviewThreads(number: number): Promise<ReviewThread[]>;
+    resolveReviewThread(threadId: string): Promise<void>;
+    commentEditor(nodeId: string): Promise<string | undefined>;
+    getPullRequest(number: number): Promise<PullRequest>;
+    listIssueComments(number: number): Promise<IssueComment[]>;
+    createIssueComment(number: number, body: string): Promise<void>;
+    updateIssueComment(id: number, body: string): Promise<void>;
+    createReview(number: number, review: CreateReview): Promise<void>;
+    filesWithDiff(number: number): Promise<Set<string>>;
+    canWrite(login: string): Promise<boolean>;
+    listReviews(number: number): Promise<PullRequestReview[]>;
+    dismissReview(number: number, reviewId: number, message: string): Promise<void>;
+    private graphql;
+    private graphqlUrl;
+    private request;
+    private send;
+}
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -0,0 +1,283 @@
+import { z } from "zod";
+import { MAX_ATTEMPTS, retryDecision } from "./retry.js";
+// Commit ids reach git as arguments; anything else is refused at the boundary.
+const sha = z.string().regex(/^[0-9a-f]{40}([0-9a-f]{24})?$/, "not a commit id");
+const pullRequestSchema = z.object({
+    number: z.number(),
+    title: z.string(),
+    body: z.string().nullable(),
+    html_url: z.string(),
+    user: z.object({ login: z.string() }).nullable(),
+    base: z.object({ sha: sha, ref: z.string() }),
+    head: z.object({ sha: sha, ref: z.string() }),
+});
+const commentSchema = z.object({
+    id: z.number(),
+    body: z
+        .string()
+        .nullable()
+        .transform((b) => b ?? ""),
+    user: z.object({ login: z.string(), type: z.string() }).nullable(),
+    node_id: z.string().optional(),
+    author_association: z.string().optional(),
+});
+export class GitHubApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+const reviewSchema = z.object({
+    id: z.number(),
+    state: z.string(),
+    user: z.object({ login: z.string() }).nullable(),
+});
+const MAX_REVIEW_PAGES = 10;
+// GitHub lists at most 3,000 files of a pull request.
+const MAX_FILE_PAGES = 30;
+const pullRequestFileSchema = z.object({ filename: z.string(), patch: z.string().optional() });
+const MAX_COMMENT_PAGES = 30;
+const MAX_THREAD_PAGES = 10;
+const REVIEW_THREADS_QUERY = `query($owner: String!, $repo: String!, $number: Int!, $after: String) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $number) {
+      reviewThreads(first: 100, after: $after) {
+        pageInfo { hasNextPage endCursor }
+        nodes { id isResolved resolvedBy { login } comments(first: 30) { nodes { id body authorAssociation author { login } editor { login } } } latest: comments(last: 30) { nodes { id body authorAssociation author { login } editor { login } } } }
+      }
+    }
+  }
+}`;
+const graphqlResultSchema = z.object({
+    data: z.unknown().optional(),
+    errors: z.array(z.object({ message: z.string(), type: z.string().optional() })).optional(),
+});
+const threadCommentsSchema = z.object({
+    nodes: z.array(z.object({
+        id: z.string().optional(),
+        body: z.string(),
+        authorAssociation: z.string().default("NONE"),
+        author: z.object({ login: z.string() }).nullable(),
+        editor: z.object({ login: z.string() }).nullable().optional(),
+    })),
+});
+// The first page (with ocra's marker comment) followed by the latest replies
+// it did not include; the two overlap in threads of up to 60 comments.
+function mergeComments(first, latest) {
+    const seen = new Set(first.map((c) => c.id).filter((id) => id !== undefined));
+    return [...first, ...latest.filter((c) => c.id !== undefined && !seen.has(c.id))];
+}
+const reviewThreadsSchema = z.object({
+    repository: z.object({
+        pullRequest: z.object({
+            reviewThreads: z.object({
+                pageInfo: z.object({ hasNextPage: z.boolean(), endCursor: z.string().nullable() }),
+                nodes: z.array(z.object({
+                    id: z.string(),
+                    isResolved: z.boolean(),
+                    resolvedBy: z.object({ login: z.string() }).nullable().optional(),
+                    comments: threadCommentsSchema,
+                    // A long thread's latest replies, which the first page misses.
+                    latest: threadCommentsSchema.optional(),
+                })),
+            }),
+        }),
+    }),
+});
+// A thin REST client: every response is validated before it reaches the
+// adapter, and errors never echo the token.
+export class GitHubApi {
+    repository;
+    options;
+    baseUrl;
+    fetchImpl;
+    constructor(repository, options) {
+        this.repository = repository;
+        this.options = options;
+        this.baseUrl = (options.baseUrl ?? "https://api.github.com").replace(/\/$/, "");
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async listReviewThreads(number) {
+        const threads = [];
+        let after = null;
+        for (let page = 0; page < MAX_THREAD_PAGES; page += 1) {
+            const data = reviewThreadsSchema.parse(await this.graphql(REVIEW_THREADS_QUERY, {
+                owner: this.repository.owner,
+                repo: this.repository.repo,
+                number,
+                after,
+            }));
+            const connection = data.repository.pullRequest.reviewThreads;
+            for (const node of connection.nodes) {
+                threads.push({
+                    id: node.id,
+                    isResolved: node.isResolved,
+                    resolvedBy: node.resolvedBy?.login,
+                    comments: mergeComments(node.comments.nodes, node.latest?.nodes ?? []).map((c) => ({
+                        author: c.author?.login ?? "",
+                        association: c.authorAssociation,
+                        body: c.body,
+                        ...(c.editor ? { editor: c.editor.login } : {}),
+                    })),
+                });
+            }
+            if (!connection.pageInfo.hasNextPage)
+                break;
+            after = connection.pageInfo.endCursor;
+        }
+        return threads;
+    }
+    async resolveReviewThread(threadId) {
+        await this.graphql("mutation($id: ID!) { resolveReviewThread(input: { threadId: $id }) { thread { id } } }", { id: threadId });
+    }
+    // Who last edited a comment, if anyone did.
+    async commentEditor(nodeId) {
+        const data = z
+            .object({
+            node: z
+                .object({ editor: z.object({ login: z.string() }).nullable().optional() })
+                .nullable(),
+        })
+            .parse(await this.graphql("query($id: ID!) { node(id: $id) { ... on IssueComment { editor { login } } } }", { id: nodeId }));
+        return data.node?.editor?.login;
+    }
+    async getPullRequest(number) {
+        return pullRequestSchema.parse(await this.request("GET", `/pulls/${number}`));
+    }
+    async listIssueComments(number) {
+        const comments = [];
+        for (let page = 1; page <= MAX_COMMENT_PAGES; page += 1) {
+            const batch = z
+                .array(commentSchema)
+                .parse(await this.request("GET", `/issues/${number}/comments?per_page=100&page=${page}`));
+            comments.push(...batch);
+            if (batch.length < 100)
+                break;
+        }
+        return comments;
+    }
+    async createIssueComment(number, body) {
+        await this.request("POST", `/issues/${number}/comments`, { body });
+    }
+    async updateIssueComment(id, body) {
+        await this.request("PATCH", `/issues/comments/${id}`, { body });
+    }
+    async createReview(number, review) {
+        await this.request("POST", `/pulls/${number}/reviews`, review);
+    }
+    // Files GitHub shows a diff for; only their lines take inline comments.
+    async filesWithDiff(number) {
+        const files = new Set();
+        for (let page = 1; page <= MAX_FILE_PAGES; page += 1) {
+            const batch = z
+                .array(pullRequestFileSchema)
+                .parse(await this.request("GET", `/pulls/${number}/files?per_page=100&page=${page}`));
+            for (const f of batch)
+                if (f.patch !== undefined)
+                    files.add(f.filename);
+            if (batch.length < 100)
+                break;
+        }
+        return files;
+    }
+    // The repository permission of a user: author_association only says how
+    // someone relates to the repository (MEMBER is any organization member),
+    // not whether they may write to it.
+    async canWrite(login) {
+        const data = z
+            .object({ permission: z.string() })
+            .parse(await this.request("GET", `/collaborators/${encodeURIComponent(login)}/permission`));
+        return data.permission === "admin" || data.permission === "write";
+    }
+    async listReviews(number) {
+        const reviews = [];
+        for (let page = 1; page <= MAX_REVIEW_PAGES; page += 1) {
+            const batch = z
+                .array(reviewSchema)
+                .parse(await this.request("GET", `/pulls/${number}/reviews?per_page=100&page=${page}`));
+            reviews.push(...batch);
+            if (batch.length < 100)
+                break;
+        }
+        return reviews;
+    }
+    async dismissReview(number, reviewId, message) {
+        await this.request("PUT", `/pulls/${number}/reviews/${reviewId}/dismissals`, {
+            message,
+            event: "DISMISS",
+        });
+    }
+    // GraphQL reports its rate limit as an error in a 200 response, which the
+    // HTTP retry does not see; it is retried here the same bounded way.
+    async graphql(query, variables) {
+        const sleep = this.options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        let result;
+        for (let attempt = 1;; attempt += 1) {
+            result = graphqlResultSchema.parse(await this.send("POST", this.graphqlUrl(), "/graphql", { query, variables }, true));
+            const limited = result.errors?.some((e) => e.type === "RATE_LIMITED");
+            if (!limited || attempt >= MAX_ATTEMPTS)
+                break;
+            await sleep(1_000 * 2 ** attempt);
+        }
+        if (result.errors?.length) {
+            throw new GitHubApiError(200, `GitHub GraphQL failed: ${result.errors.map((e) => e.message).join("; ")}`);
+        }
+        return result.data;
+    }
+    // github.com serves GraphQL at /graphql; GitHub Enterprise at /api/graphql
+    // next to /api/v3.
+    graphqlUrl() {
+        return this.baseUrl.endsWith("/api/v3")
+            ? `${this.baseUrl.slice(0, -"/v3".length)}/graphql`
+            : `${this.baseUrl}/graphql`;
+    }
+    request(method, path, body) {
+        const { owner, repo } = this.repository;
+        const url = `${this.baseUrl}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${path}`;
+        return this.send(method, url, path, body);
+    }
+    // GraphQL queries and resolving a thread are safe to repeat, although they
+    // are POSTs; REST POSTs create comments and reviews, and are not.
+    async send(method, url, path, body, idempotent = method !== "POST") {
+        const sleep = this.options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        for (let attempt = 1;; attempt += 1) {
+            const init = {
+                method,
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    Authorization: `Bearer ${this.options.token}`,
+                    "X-GitHub-Api-Version": "2022-11-28",
+                    "User-Agent": "open-cr-agent",
+                    ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+                },
+                // Creating a review with many inline comments can take GitHub a while,
+                // and a POST that timed out after GitHub acted cannot be repeated.
+                signal: AbortSignal.timeout(method === "POST" && path.endsWith("/reviews") ? 120_000 : 30_000),
+            };
+            if (body !== undefined)
+                init.body = JSON.stringify(body);
+            let response;
+            try {
+                response = await this.fetchImpl(url, init);
+            }
+            catch (error) {
+                const next = retryDecision(method, idempotent, "network_error", attempt);
+                if (!next.retry)
+                    throw error;
+                await sleep(next.waitMs);
+                continue;
+            }
+            if (response.ok)
+                return response.status === 204 ? undefined : response.json();
+            const detail = (await response.text().catch(() => "")).slice(0, 500);
+            const next = retryDecision(method, idempotent, { status: response.status, headers: response.headers, body: detail }, attempt);
+            if (next.retry) {
+                await sleep(next.waitMs);
+                continue;
+            }
+            throw new GitHubApiError(response.status, `GitHub ${method} ${path.split("?")[0]} failed with ${response.status}: ${detail}`);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./adapter.js";
+export * from "./client.js";
+export * from "./plugin.js";
+export * from "./render.js";
+export * from "./state.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from "./adapter.js";
+export * from "./client.js";
+export * from "./plugin.js";
+export * from "./render.js";
+export * from "./state.js";
+//# sourceMappingURL=index.js.map

package/dist/plugin.d.ts

@@ -0,0 +1,3 @@
+import type { OcraPlugin } from "@open-cr-agent/core";
+export declare const githubPlugin: OcraPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.js

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { DEFAULT_BOT_LOGIN, GitHubAdapter } from "./adapter.js";
+import { GitHubApi } from "./client.js";
+const optionsSchema = z.object({
+    owner: z.string().min(1),
+    repo: z.string().min(1),
+    number: z.number().int().positive(),
+    token: z.string().min(1),
+    apiUrl: z.string().url().optional(),
+    botLogin: z.string().min(1).default(DEFAULT_BOT_LOGIN),
+    requestChanges: z.boolean().default(false),
+    fetch: z.custom((value) => typeof value === "function").optional(),
+    code: z.custom((value) => typeof value === "object" &&
+        value !== null &&
+        ["getDiff", "readFile", "searchCode"].every((m) => typeof value[m] === "function"), "code must provide getDiff, readFile and searchCode"),
+    snapshot: z
+        .custom((value) => typeof value === "object" && value !== null && "head" in value)
+        .optional(),
+    history: z
+        .custom((value) => typeof value === "object" &&
+        value !== null &&
+        typeof value.filesChangedSince === "function", "history must provide filesChangedSince")
+        .optional(),
+});
+export const githubPlugin = {
+    name: "vcs-github",
+    configure(ctx) {
+        ctx.registerVcs("github", (raw) => {
+            const options = optionsSchema.parse(raw);
+            const api = new GitHubApi({ owner: options.owner, repo: options.repo }, {
+                token: options.token,
+                ...(options.apiUrl ? { baseUrl: options.apiUrl } : {}),
+                ...(options.fetch ? { fetch: options.fetch } : {}),
+            });
+            return new GitHubAdapter({
+                pullRequest: { owner: options.owner, repo: options.repo, number: options.number },
+                api,
+                code: options.code,
+                botLogin: options.botLogin,
+                requestChanges: options.requestChanges,
+                ...(options.history ? { history: options.history } : {}),
+                ...(options.snapshot ? { snapshot: options.snapshot } : {}),
+            });
+        });
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/render.d.ts

@@ -0,0 +1,15 @@
+import { type Finding, type ReviewReport } from "@open-cr-agent/core";
+import type { ReviewComment } from "./client.js";
+import { type ReviewState } from "./state.js";
+export declare function safeMarkdown(text: string): string;
+export declare function codeSpan(text: string): string;
+export declare const FINDING_MARKER: RegExp;
+export declare function inlineBody(f: Finding): string;
+export declare function inlineComment(f: Finding): ReviewComment | undefined;
+export interface SummaryInput {
+    report: ReviewReport;
+    commented: ReadonlySet<string>;
+    state: ReviewState;
+}
+export declare function renderSummary({ report, commented, state }: SummaryInput): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.js

@@ -0,0 +1,182 @@
+import { coverageGaps, } from "@open-cr-agent/core";
+import { SUMMARY_MARKER, writeState } from "./state.js";
+// GitHub rejects comments over 65,536 characters.
+const MAX_SUMMARY_CHARS = 65_000;
+const ICON = { critical: "🔴", warning: "🟠", suggestion: "🔵" };
+const VERIFICATION = {
+    confirmed: "verified",
+    uncertain: "unverified (verifier unsure)",
+    unchecked: "not verified",
+};
+// A run that reviewed nothing has no verdict to announce, and one that missed
+// files or could not verify a critical finding says so next to its verdict.
+function headline(report) {
+    const { notReviewed, nothingReviewed } = coverageGaps(report.coverage);
+    if (nothingReviewed)
+        return "⏸️ Not reviewed";
+    const incomplete = notReviewed > 0 || report.unverifiedCriticals > 0;
+    const overridden = report.verdict === "significant_concerns" && report.changeRequest.override
+        ? " · overridden"
+        : "";
+    return `${VERDICT[report.verdict]}${overridden}${incomplete ? " · incomplete" : ""}`;
+}
+// Who overrode a blocking verdict, or how someone entitled to can.
+function overrideNote(report) {
+    if (report.verdict !== "significant_concerns")
+        return [];
+    const override = report.changeRequest.override;
+    if (override) {
+        return [
+            "",
+            `**Overridden** by @\u200b${safeMarkdown(override.by)} for ${codeSpan(report.changeRequest.headSha.slice(0, 7))}: ${safeMarkdown(override.reason)}`,
+        ];
+    }
+    return [
+        "",
+        `Someone with write access other than the author can let this commit pass by commenting \`/ocra override ${report.changeRequest.headSha} <reason>\`.`,
+    ];
+}
+function verification(f) {
+    return VERIFICATION[f.verification ?? "unchecked"];
+}
+const VERDICT = {
+    approved: "✅ Approved",
+    approved_with_comments: "💬 Approved with comments",
+    minor_issues: "⚠️ Minor issues",
+    significant_concerns: "🛑 Significant concerns",
+};
+// Model text is untrusted: it may not close our markup, mention people,
+// pull in images, or render as a link that says one thing and goes elsewhere
+// (a bot comment lends it credibility). Inline links lose their `](`, and
+// every `]:` is escaped, so no link reference definition (`[1]: https://…`)
+// can form, at line start or inside a blockquote or list item, and no
+// reference-style link (`[x][1]`, `[x][]`, `[1]`) has anything to resolve to.
+// Bare URLs still show as text.
+export function safeMarkdown(text) {
+    return text
+        .replaceAll("<!--", "&lt;!--")
+        .replace(/<\/?[a-zA-Z][^>]*>/g, (tag) => tag.replaceAll("<", "&lt;"))
+        .replace(/@(?=[A-Za-z0-9-])/g, "@\u200b")
+        .replace(/!\[/g, "!\u200b[")
+        .replaceAll("](", "]\\(")
+        .replaceAll("]:", "]\\:");
+}
+// File paths come from the diff, so the author controls them: a backtick or
+// newline must not end the code span and let markup through, and angle
+// brackets must not form ocra's HTML-comment markers in the raw body.
+export function codeSpan(text) {
+    const safe = text
+        .replaceAll("`", "\u02cb")
+        .replace(/[\r\n]+/g, " ")
+        .replaceAll("<", "\u2039")
+        .replaceAll(">", "\u203a");
+    return `\`${safe}\``;
+}
+function location(f) {
+    if (!f.lineRange)
+        return codeSpan(f.file);
+    const { start, end } = f.lineRange;
+    return codeSpan(`${f.file}:${start === end ? start : `${start}-${end}`}`);
+}
+export const FINDING_MARKER = /<!-- ocra:finding ([0-9a-f]{16}) -->/;
+export function inlineBody(f) {
+    const parts = [
+        `<!-- ocra:finding ${f.fingerprint} -->`,
+        `${ICON[f.severity]} **${safeMarkdown(f.title)}** · ${f.severity} · ${verification(f)} · ${f.reviewer}${f.lowConfidence ? " · low confidence" : ""}`,
+        "",
+        safeMarkdown(f.body),
+    ];
+    if (f.suggestion)
+        parts.push("", `**Suggestion:** ${safeMarkdown(f.suggestion)}`);
+    return parts.join("\n");
+}
+export function inlineComment(f) {
+    if (!f.lineRange || !f.anchor.inDiff)
+        return undefined;
+    const comment = {
+        path: f.file,
+        line: f.lineRange.end,
+        side: "RIGHT",
+        body: inlineBody(f),
+    };
+    if (f.lineRange.start !== f.lineRange.end) {
+        comment.start_line = f.lineRange.start;
+        comment.start_side = "RIGHT";
+    }
+    return comment;
+}
+export function renderSummary({ report, commented, state }) {
+    const counts = ["critical", "warning", "suggestion"]
+        .map((s) => `${report.findings.filter((f) => f.severity === s).length} ${s}`)
+        .join(", ");
+    const lines = [
+        SUMMARY_MARKER,
+        `## ocra review · ${headline(report)}`,
+        "",
+        safeMarkdown(report.summary),
+        ...overrideNote(report),
+        "",
+        `**${report.findings.length} finding(s)** (${counts}) · risk tier \`${report.tier}\``,
+    ];
+    if (report.scope?.mode === "incremental") {
+        lines.push("", `Reviewed only what changed since ${codeSpan(report.scope.since.slice(0, 7))}.`);
+    }
+    else if (report.scope) {
+        lines.push("", `Reviewed every file again: ${safeMarkdown(report.scope.reason)}.`);
+    }
+    // Only true while no confirmed critical blocks, and low-confidence
+    // findings do not count at all.
+    const unverified = report.verdict === "significant_concerns"
+        ? 0
+        : report.findings.filter((f) => f.severity === "critical" && f.verification !== "confirmed" && !f.lowConfidence).length;
+    if (unverified > 0) {
+        lines.push("", `${unverified} critical finding(s) are not verified, so they cap the verdict at minor issues.`);
+    }
+    if (report.unverifiedCriticals > 0) {
+        lines.push("", `**Incomplete:** verification failed or ran out of budget for ${report.unverifiedCriticals} critical finding(s); check them yourself.`);
+    }
+    const inSummary = report.findings.filter((f) => !commented.has(f.fingerprint));
+    if (inSummary.length > 0) {
+        lines.push("", "### Findings outside the diff");
+        for (const f of inSummary) {
+            lines.push(`- ${ICON[f.severity]} ${location(f)} **${safeMarkdown(f.title)}** _(${verification(f)}${f.lowConfidence ? ", low confidence" : ""})_: ${safeMarkdown(f.body).replaceAll("\n", " ")}`);
+        }
+    }
+    if (report.remembered.length > 0) {
+        lines.push("", `${report.remembered.length} finding(s) matched \`.ocra/memory.json\` and are not repeated.`);
+    }
+    const rereview = report.rereview;
+    if (rereview && rereview.fixed.length > 0) {
+        lines.push("", "### Fixed since the last review");
+        for (const f of rereview.fixed)
+            lines.push(`- ~~${safeMarkdown(f.title)}~~ ${codeSpan(f.file)}`);
+    }
+    if (rereview && rereview.notReproduced.length > 0) {
+        lines.push("", "### Not reported this time, code unchanged", "", "Still open and counted in the verdict until the code changes or a reviewer dismisses them.", "");
+        for (const f of rereview.notReproduced)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    if (rereview && rereview.unchanged.length > 0) {
+        lines.push("", "### Still open in unchanged files", "", "Reported earlier in files not changed since; they count in the verdict.", "");
+        for (const f of rereview.unchanged)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    if (rereview && rereview.dismissed.length > 0) {
+        lines.push("", "### Dismissed by reviewers");
+        for (const f of rereview.dismissed)
+            lines.push(`- ${safeMarkdown(f.title)} ${codeSpan(f.file)}`);
+    }
+    if (rereview && rereview.notRechecked.length > 0) {
+        lines.push("", "### Not re-checked this time", "", "Their files were not reviewed in this run; they stay open and count in the verdict.", "");
+        for (const f of rereview.notRechecked)
+            lines.push(`- ${ICON[f.severity]} ${safeMarkdown(f.title)} ${codeSpan(f.file)} _(${verification(f)})_`);
+    }
+    const failed = report.coverage.filter((c) => c.status === "failed" || c.status === "unreviewed");
+    const { costUsd, inputTokens, outputTokens } = report.usage;
+    lines.push("", "_The verdict is advice from language models that read the change itself, and can be swayed by text in it. Do not use it as a security gate._", "", "<details><summary>Coverage and cost</summary>", "", `${report.coverage.filter((c) => c.status === "reviewed").length} reviewed · ${report.coverage.filter((c) => c.status === "unchanged").length} unchanged since the last review · ${failed.length} not reviewed · ${report.coverage.filter((c) => c.status === "excluded").length} excluded · ${inputTokens} in / ${outputTokens} out tokens · $${costUsd.toFixed(4)}`, ...failed.map((c) => `- not reviewed: ${codeSpan(c.path)}`), "", "</details>");
+    const text = lines.join("\n");
+    const footer = `\n\n${writeState(state)}`;
+    const room = MAX_SUMMARY_CHARS - footer.length;
+    return (text.length > room ? `${text.slice(0, room - 40)}\n\n…(truncated)` : text) + footer;
+}
+//# sourceMappingURL=render.js.map

package/dist/retry.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_ATTEMPTS = 3;
+export interface RetryDecision {
+    retry: boolean;
+    waitMs: number;
+}
+export declare function retryDecision(method: string, idempotent: boolean, outcome: {
+    status: number;
+    headers: Headers;
+    body: string;
+} | "network_error", attempt: number, now?: number): RetryDecision;
+//# sourceMappingURL=retry.d.ts.map