@open-cr-agent/vcs-github 0.1.0

package/dist/retry.js

@@ -0,0 +1,38 @@
+// GitHub answers bursts with 429 or a 403 "secondary rate limit", and has
+// short 5xx outages. One such answer during publish used to throw away a
+// paid review, so requests are retried a bounded number of times.
+export const MAX_ATTEMPTS = 3;
+const MAX_WAIT_MS = 60_000;
+// A request GitHub refused without acting on it (rate limits) can always be
+// repeated. A 5xx or a lost connection may have happened after GitHub acted,
+// so only requests that are safe to repeat retry then: POST would post the
+// same comment or review twice.
+export function retryDecision(method, idempotent, outcome, attempt, now = Date.now()) {
+    const stop = { retry: false, waitMs: 0 };
+    if (attempt >= MAX_ATTEMPTS)
+        return stop;
+    const backoff = 1_000 * 2 ** (attempt - 1);
+    const safe = idempotent || method === "GET";
+    if (outcome === "network_error")
+        return safe ? { retry: true, waitMs: backoff } : stop;
+    const { status, headers, body } = outcome;
+    const rateLimited = status === 429 ||
+        (status === 403 &&
+            (headers.get("x-ratelimit-remaining") === "0" || /secondary rate limit/i.test(body)));
+    if (rateLimited)
+        return { retry: true, waitMs: rateLimitWait(headers, now) ?? backoff };
+    if (safe && status >= 500)
+        return { retry: true, waitMs: backoff };
+    return stop;
+}
+function rateLimitWait(headers, now) {
+    const after = Number(headers.get("retry-after"));
+    if (Number.isFinite(after) && after > 0)
+        return Math.min(after * 1_000, MAX_WAIT_MS);
+    const reset = Number(headers.get("x-ratelimit-reset"));
+    if (Number.isFinite(reset) && reset > 0) {
+        return Math.min(Math.max(reset * 1_000 - now, 0), MAX_WAIT_MS);
+    }
+    return undefined;
+}
+//# sourceMappingURL=retry.js.map

package/dist/state.d.ts

@@ -0,0 +1,14 @@
+import type { PriorFinding } from "@open-cr-agent/core";
+import { type RiskTier } from "@open-cr-agent/core";
+export declare const SUMMARY_MARKER = "<!-- ocra:review -->";
+export declare const MAX_WRITTEN_STATE_CHARS = 30000;
+export interface ReviewState {
+    findings: PriorFinding[];
+    head?: string;
+    pending?: string[];
+    posted?: string[];
+    tier?: RiskTier;
+}
+export declare function readState(body: string): ReviewState | undefined;
+export declare function writeState(state: ReviewState): string;
+//# sourceMappingURL=state.d.ts.map

package/dist/state.js

@@ -0,0 +1,110 @@
+import { RISK_TIERS, severitySchema, verificationSchema } from "@open-cr-agent/core";
+import { z } from "zod";
+export const SUMMARY_MARKER = "<!-- ocra:review -->";
+// Only a state block that ends the comment counts: author-controlled text
+// (file paths, titles) is printed above it and must not be able to plant one.
+const STATE_PATTERN = /<!-- ocra:state v1 ([A-Za-z0-9+/=]+) -->\s*$/;
+const MAX_STATE_FINDINGS = 500;
+const MAX_STATE_CHARS = 60_000;
+// Written states stay well under what is read, so the summary text keeps room
+// in GitHub's 65,536-character comment limit.
+export const MAX_WRITTEN_STATE_CHARS = 30_000;
+const MAX_PENDING_FILES = 1_000;
+const MAX_POSTED = 1_000;
+const SHA = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const stateSchema = z.object({
+    findings: z
+        .array(z.object({
+        fingerprint: z.string().regex(/^[0-9a-f]{16}$/),
+        title: z.string().max(300),
+        file: z.string().max(1_000),
+        severity: severitySchema,
+        commented: z.boolean(),
+        quote: z
+            .object({
+            lines: z.number().int().positive().max(1_000),
+            hash: z.string().regex(/^[0-9a-f]{16}$/),
+        })
+            .optional(),
+        verification: verificationSchema.optional(),
+    }))
+        .max(MAX_STATE_FINDINGS),
+    head: z.string().regex(SHA).optional(),
+    pending: z.array(z.string().max(1_000)).max(MAX_PENDING_FILES).optional(),
+    posted: z
+        .array(z.string().regex(/^[0-9a-f]{16}$/))
+        .max(MAX_POSTED)
+        .optional(),
+    tier: z.enum(RISK_TIERS).optional(),
+});
+// The state lives in a comment anyone with write access can edit, so it is
+// validated and bounded, and the adapter ignores it when someone other than
+// ocra edited the comment. Dismissals are never stored: they are recomputed
+// from review threads on every run.
+export function readState(body) {
+    const encoded = STATE_PATTERN.exec(body)?.[1];
+    if (!encoded || encoded.length > MAX_STATE_CHARS)
+        return undefined;
+    try {
+        const parsed = stateSchema.safeParse(JSON.parse(Buffer.from(encoded, "base64").toString("utf8")));
+        if (!parsed.success)
+            return undefined;
+        const { head, pending, posted, tier } = parsed.data;
+        return {
+            findings: parsed.data.findings.map(({ quote, verification, ...finding }) => ({
+                ...finding,
+                ...(quote ? { quote } : {}),
+                ...(verification ? { verification } : {}),
+            })),
+            ...(head ? { head } : {}),
+            ...(pending ? { pending } : {}),
+            ...(posted?.length ? { posted } : {}),
+            ...(tier ? { tier } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function writeState(state) {
+    const kept = state.findings.slice(0, MAX_STATE_FINDINGS).map((f) => ({
+        fingerprint: f.fingerprint,
+        title: f.title.slice(0, 300),
+        file: f.file.slice(0, 1_000),
+        severity: f.severity,
+        commented: f.commented,
+        ...(f.quote ? { quote: f.quote } : {}),
+        ...(f.verification ? { verification: f.verification } : {}),
+    }));
+    // Without the full list of unfinished files the next run could skip one of
+    // them, so a list that does not fit drops the head and forces a full review.
+    const pending = state.pending ?? [];
+    const scope = state.head && pending.length <= MAX_PENDING_FILES
+        ? {
+            head: state.head,
+            ...(pending.length > 0 ? { pending: pending.map((p) => p.slice(0, 1_000)) } : {}),
+        }
+        : {};
+    // Too large a state first loses its scope (a full review next time), then
+    // findings from the end of the list (this run's come first, most severe
+    // first); a dropped finding's inline comment may be posted again.
+    const extras = {
+        ...(state.posted?.length ? { posted: state.posted.slice(-MAX_POSTED) } : {}),
+        ...(state.tier ? { tier: state.tier } : {}),
+    };
+    let encoded = encode(kept, { ...scope, ...extras });
+    if (encoded.length > MAX_WRITTEN_STATE_CHARS)
+        encoded = encode(kept, extras);
+    if (encoded.length > MAX_WRITTEN_STATE_CHARS)
+        encoded = encode(kept, {});
+    let count = kept.length;
+    while (encoded.length > MAX_WRITTEN_STATE_CHARS && count > 0) {
+        count = Math.floor(count * 0.8);
+        encoded = encode(kept.slice(0, count), {});
+    }
+    return `<!-- ocra:state v1 ${encoded} -->`;
+}
+function encode(findings, scope) {
+    return Buffer.from(JSON.stringify({ findings, ...scope }), "utf8").toString("base64");
+}
+//# sourceMappingURL=state.js.map

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@open-cr-agent/vcs-github",
+  "version": "0.1.0",
+  "description": "GitHub pull request adapter for Open-CR-Agent",
+  "keywords": [
+    "code-review",
+    "github",
+    "pull-request"
+  ],
+  "license": "Apache-2.0",
+  "homepage": "https://ocra.majincheng.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jma49/Open-CR-Agent.git",
+    "directory": "packages/vcs-github"
+  },
+  "bugs": "https://github.com/jma49/Open-CR-Agent/issues",
+  "engines": {
+    "node": ">=22.19"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "dependencies": {
+    "@open-cr-agent/core": "0.1.0",
+    "zod": "^4.6.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}