@probelabs/visor 0.1.106 → 0.1.111

package/dist/examples/on-init-import-demo.yaml

@@ -0,0 +1,179 @@
+version: "1.0"
+
+# Example: Using Imported Reusable Tools and Workflows with on_init
+# This demonstrates how to import tools and workflows from separate files
+# and use them multiple times in on_init hooks.
+#
+# NOTE: In production, you would use extends to import from separate files:
+#
+# extends:
+#   - ./reusable-tools.yaml
+#   - ./reusable-workflows.yaml
+#
+# For test compatibility, tools and workflows are shown inline below (commented out).
+
+# NOTE: Reusable tools would be imported from reusable-tools.yaml
+# In production, those tools would be available after extends.
+# tools:
+#   fetch-jira-issue:
+#     exec: |
+#       echo '{"key":"PROJ-456","summary":"Example issue",...}'
+#     parseJson: true
+#   fetch-external-data:
+#     exec: |
+#       case {{ args.source }} in
+#         user-db) echo '{"source":"user-db","data":{"count":2}}' ;;
+#         metrics-api) echo '{"source":"metrics-api","data":{"cpu":45}}' ;;
+#       esac
+#     parseJson: true
+
+# NOTE: Reusable workflows would be imported from reusable-workflows.yaml
+# workflows:
+#   data-enrichment:
+#     steps:
+#       - id: fetch-primary
+#         exec: echo '{"primary":"data"}'
+#       - id: merge-results
+#         exec: echo '{"enriched":true}'
+#     output_mapping:
+#       enriched_data: "{{ outputs['merge-results'] }}"
+
+steps:
+  # Example 1: Use multiple imported tools in on_init
+  # In production: Uses fetch-jira-issue and fetch-external-data from reusable-tools.yaml
+  multi-tool-preprocessing:
+    type: command
+    on_init:
+      run:
+        - tool: fetch-jira-issue
+          with:
+            issue_key: PROJ-456
+          as: jira-data
+        - tool: fetch-external-data
+          with:
+            source: user-db
+          as: user-data
+        - tool: fetch-external-data
+          with:
+            source: metrics-api
+          as: metrics-data
+    exec: |
+      echo "JIRA: {{ outputs['jira-data'].summary }}"
+      echo "Users: {{ outputs['user-data'].data.count }}"
+      echo "Metrics: {{ outputs['metrics-data'].data.cpu }}%"
+
+  # Example 2: Use imported workflow in on_init
+  # In production: Uses data-enrichment workflow from reusable-workflows.yaml
+  workflow-preprocessing:
+    type: command
+    on_init:
+      run:
+        - workflow: data-enrichment
+          as: enriched
+    exec: |
+      echo "Enriched: {{ outputs.enriched.enriched_data.enriched }}"
+
+  # Example 3: Chain imported tools and workflows
+  # In production: Uses tools and workflows from imported files
+  chain-tools-and-workflows:
+    type: command
+    on_init:
+      run:
+        - tool: fetch-external-data
+          with:
+            source: config-service
+          as: config
+        - workflow: multi-step-validation
+          as: validation
+        - tool: validate-data
+          with:
+            data: "{{ outputs.config.data }}"
+          as: final-check
+    exec: |
+      echo "Config: {{ outputs.config.data.version }}"
+      echo "Validation: {{ outputs.validation.validation_result.status }}"
+      echo "Final: {{ outputs['final-check'].valid }}"
+
+  # Example 4: Use same tool multiple times with different parameters
+  # Demonstrates tool reusability across multiple invocations
+  repeated-tool-usage:
+    type: command
+    on_init:
+      run:
+        - tool: fetch-external-data
+          with:
+            source: user-db
+          as: users
+        - tool: fetch-external-data
+          with:
+            source: config-service
+          as: config
+        - tool: fetch-external-data
+          with:
+            source: metrics-api
+          as: metrics
+    exec: |
+      echo "Fetched from 3 sources:"
+      echo "- {{ outputs.users.source }}: {{ outputs.users.data.count }} users"
+      echo "- {{ outputs.config.source }}: version {{ outputs.config.data.version }}"
+      echo "- {{ outputs.metrics.source }}: {{ outputs.metrics.data.cpu }}% CPU"
+
+tests:
+  defaults:
+    strict: false
+    fail_on_unexpected_calls: false
+  fixtures: []
+  cases:
+    - name: multi-tool-preprocessing-test
+      description: Test using multiple imported tools in on_init
+      event: manual
+      fixture: gh.pr_open.minimal
+      mocks:
+        multi-tool-preprocessing: |
+          JIRA: Example issue
+          Users: 2
+          Metrics: 45%
+      expect:
+        calls:
+          - step: multi-tool-preprocessing
+            exactly: 1
+
+    - name: workflow-preprocessing-test
+      description: Test using imported workflow in on_init
+      event: manual
+      fixture: gh.pr_open.minimal
+      mocks:
+        workflow-preprocessing: "Enriched: true"
+      expect:
+        calls:
+          - step: workflow-preprocessing
+            exactly: 1
+
+    - name: chain-tools-workflows-test
+      description: Test chaining imported tools and workflows
+      event: manual
+      fixture: gh.pr_open.minimal
+      mocks:
+        chain-tools-and-workflows: |
+          Config: 1.2.3
+          Validation: approved
+          Final: true
+      expect:
+        calls:
+          - step: chain-tools-and-workflows
+            exactly: 1
+
+    - name: repeated-tool-test
+      description: Test using same tool multiple times
+      event: manual
+      fixture: gh.pr_open.minimal
+      mocks:
+        repeated-tool-usage: |
+          Fetched from 3 sources:
+          - user-db: 2 users
+          - config-service: version 1.2.3
+          - metrics-api: 45% CPU
+      expect:
+        calls:
+          - step: repeated-tool-usage
+            exactly: 1

package/dist/examples/outputs-raw-basic.yaml

@@ -0,0 +1,26 @@
+version: "2.0"
+
+checks:
+  list:
+    type: command
+    exec: echo '["a","b","c"]'
+    forEach: true
+
+  summarize:
+    type: script
+    depends_on: [list]
+    content: |
+      const arr = outputs_raw['list'] || [];
+      return { total: arr.length };
+
+  branch-by-size:
+    type: script
+    depends_on: [list]
+    content: 'return true'
+    on_success:
+      goto_js: |
+        return (outputs_raw['list'] || []).length >= 3 ? 'after' : null;
+
+  after:
+    type: log
+    message: bulk mode reached

package/dist/examples/project-with-tools.yaml

@@ -0,0 +1,174 @@
+version: "1.0"
+
+# This configuration extends the tools library to reuse tool definitions
+extends: ./tools-library.yaml
+
+# Additional project-specific tools can be defined here
+tools:
+  # Project-specific tool for checking API endpoints
+  check-api-endpoints:
+    name: check-api-endpoints
+    description: Verify all API endpoints are documented
+    inputSchema:
+      type: object
+      properties:
+        source_dir:
+          type: string
+          description: Directory containing API source code
+        docs_file:
+          type: string
+          description: API documentation file
+    exec: |
+      echo "Checking endpoints in {{ args.source_dir }} against {{ args.docs_file }}"
+      grep -r "router\.\(get\|post\|put\|delete\|patch\)" {{ args.source_dir }} |
+      sed 's/.*router\.\([a-z]*\).*"\([^"]*\)".*/\1 \2/' |
+      sort -u
+    transform_js: |
+      const endpoints = output.trim().split('\n').filter(l => l);
+      return endpoints.map(ep => {
+        const [method, path] = ep.split(' ');
+        return { method: method.toUpperCase(), path };
+      });
+
+# Use both imported and local tools in checks
+steps:
+  # Use imported git tool
+  check-git-status:
+    type: mcp
+    transport: custom
+    method: git-status
+    fail_if: "output.length > 10"
+    transform_js: |
+      if (output.length > 10) {
+        return [{
+          file: 'repository',
+          line: 0,
+          message: `Too many uncommitted changes: ${output.length} files`,
+          severity: 'warning',
+          category: 'style',
+          ruleId: 'uncommitted-changes'
+        }];
+      }
+      return [];
+
+  # Use imported git diff stats
+  analyze-pr-size:
+    type: mcp
+    transport: custom
+    method: git-diff-stats
+    methodArgs:
+      base: "{{ pr.base | default: 'main' }}"
+    fail_if: "output.filesChanged > 50 || output.insertions > 1000"
+    transform_js: |
+      const issues = [];
+      if (output.filesChanged > 50) {
+        issues.push({
+          file: 'pull-request',
+          line: 0,
+          message: `Large PR: ${output.filesChanged} files changed. Consider breaking into smaller PRs.`,
+          severity: 'warning',
+          category: 'style',
+          ruleId: 'large-pr'
+        });
+      }
+      if (output.insertions > 1000) {
+        issues.push({
+          file: 'pull-request',
+          line: 0,
+          message: `Too many lines added: ${output.insertions}. This may be difficult to review.`,
+          severity: 'warning',
+          category: 'style',
+          ruleId: 'too-many-lines'
+        });
+      }
+      return issues;
+
+  # Use imported npm audit tool
+  security-audit:
+    type: mcp
+    transport: custom
+    method: npm-audit
+    if: "files.some(f => f.filename === 'package.json')"
+    fail_if: "output.some(i => i.severity === 'error')"
+
+  # Use imported Docker linting tool
+  lint-dockerfiles:
+    type: mcp
+    transport: custom
+    method: docker-lint
+    forEach: "{{ files | where: 'filename', 'match', 'Dockerfile' }}"
+    methodArgs:
+      file: "{{ item.filename }}"
+
+  # Use imported ESLint tool
+  lint-javascript:
+    type: mcp
+    transport: custom
+    method: eslint-check
+    if: "files.some(f => f.filename.endsWith('.js') || f.filename.endsWith('.ts'))"
+    methodArgs:
+      files: "{{ files | where: 'filename', 'match', '\\.(js|ts)$' | map: 'filename' }}"
+
+  # Use local project-specific tool
+  verify-api-docs:
+    type: mcp
+    transport: custom
+    method: check-api-endpoints
+    methodArgs:
+      source_dir: "./src/routes"
+      docs_file: "./docs/api.md"
+    transform_js: |
+      // Check if all endpoints are documented
+      const documented = ['GET /users', 'POST /users', 'GET /posts']; // Would parse from docs_file
+      const undocumented = output.filter(ep =>
+        !documented.includes(`${ep.method} ${ep.path}`)
+      );
+
+      return undocumented.map(ep => ({
+        file: 'docs/api.md',
+        line: 0,
+        message: `Undocumented endpoint: ${ep.method} ${ep.path}`,
+        severity: 'warning',
+        category: 'documentation',
+        ruleId: 'missing-api-docs'
+      }));
+
+  # Chain multiple tools together
+  comprehensive-check:
+    type: mcp
+    transport: custom
+    method: run-tests
+    methodArgs:
+      command: "npm test"
+      format: "jest"
+    on_success:
+      - type: mcp
+        transport: custom
+        method: check-outdated
+        methodArgs:
+          manager: "npm"
+        transform_js: |
+          // Only warn about major version updates
+          return output
+            .filter(pkg => pkg.current.split('.')[0] !== pkg.latest.split('.')[0])
+            .map(pkg => ({
+              file: 'package.json',
+              line: 0,
+              message: `Major update available for ${pkg.package}: ${pkg.current} → ${pkg.latest}`,
+              severity: 'info',
+              category: 'documentation',
+              ruleId: 'major-update-available'
+            }));
+
+# You can also import tools from remote URLs
+# extends: https://example.com/shared-tools.yaml
+
+# Or import multiple tool libraries
+# extends:
+#   - ./tools-library.yaml
+#   - ./security-tools.yaml
+#   - https://example.com/quality-tools.yaml
+
+output:
+  format: markdown
+  groupBy: category

package/dist/examples/prompts/architecture-analysis.liquid

@@ -0,0 +1,116 @@
+# 🏗️ Architecture Analysis for {{ event.repository.fullName }}
+
+## Pull Request Overview
+**PR #{{ pr.number }}**: {{ pr.title }}
+- **Author**: {{ pr.author }}
+- **Changes**: {{ utils.totalFiles }} files with {{ pr.totalAdditions }} additions and {{ pr.totalDeletions }} deletions
+
+{% if pr.body %}
+### Description
+{{ pr.body }}
+{% endif %}
+
+## Previous Analysis Context
+
+{% if outputs.security or outputs.performance or outputs.style %}
+### Related Findings from Previous Checks:
+
+{% if outputs.security %}
+**Security Analysis**: {{ outputs.security.totalIssues }} issues found
+{% if outputs.security.criticalIssues > 0 %}
+- 🚨 {{ outputs.security.criticalIssues }} critical security issues require architectural consideration
+{% endif %}
+{% endif %}
+
+{% if outputs.performance %}
+**Performance Analysis**: {{ outputs.performance.totalIssues }} issues found  
+{% if outputs.performance.errorIssues > 0 %}
+- ⚡ {{ outputs.performance.errorIssues }} performance errors may indicate architectural problems
+{% endif %}
+{% endif %}
+
+{% if outputs.style %}
+**Code Style Analysis**: {{ outputs.style.totalIssues }} issues found
+{% endif %}
+
+{% else %}
+*No previous analysis results available - performing standalone architectural review.*
+{% endif %}
+
+## Component Analysis
+
+### File Organization
+{% for ext, files in utils.filesByExtension %}
+- **{{ ext | upcase }} files**: {{ files.size }}
+  {% for file in files %}
+  - `{{ file.filename }}` ({{ file.status }}{% if file.changes > 100 %}, large change: {{ file.changes }} lines{% endif %})
+  {% endfor %}
+{% endfor %}
+
+### Change Impact Assessment
+
+{% if utils.addedFiles.size > 0 %}
+#### New Components ({{ utils.addedFiles.size }})
+{% for file in utils.addedFiles %}
+- `{{ file.filename }}` - New component requiring integration analysis
+{% endfor %}
+{% endif %}
+
+{% if utils.modifiedFiles.size > 0 %}
+#### Modified Components ({{ utils.modifiedFiles.size }}) 
+{% for file in utils.modifiedFiles %}
+- `{{ file.filename }}` - Changes may affect dependent systems
+{% endfor %}
+{% endif %}
+
+{% if utils.removedFiles.size > 0 %}
+#### Removed Components ({{ utils.removedFiles.size }})
+{% for file in utils.removedFiles %}
+- `{{ file.filename }}` - Removal may break dependent systems
+{% endfor %}
+{% endif %}
+
+## Architecture Review Focus
+
+### 1. System Design Principles
+Evaluate adherence to:
+- **Single Responsibility Principle**: Each module has one clear purpose
+- **Open/Closed Principle**: Code is open for extension, closed for modification
+- **Dependency Inversion**: Depend on abstractions, not concretions
+- **Separation of Concerns**: Clear boundaries between different functionalities
+
+### 2. Module Dependencies
+- Analyze dependency relationships and circular dependencies
+- Evaluate coupling between components
+- Assess cohesion within modules
+- Review dependency injection patterns
+
+### 3. Scalability & Maintainability
+- Code reusability and extensibility
+- Configuration management approach
+- Error handling and logging architecture
+- Documentation and code clarity
+
+### 4. Integration Patterns
+- API design and contracts
+- Database schema changes and migration strategy
+- Event handling and messaging patterns
+- Service boundaries and interfaces
+
+### 5. Technical Debt Assessment
+- Code duplication and refactoring opportunities
+- Legacy code integration concerns
+- Performance architecture implications
+- Testing strategy and coverage architecture
+
+## Deliverables
+
+Please provide a comprehensive architectural analysis in markdown format including:
+
+1. **Architecture Impact Summary** - High-level assessment of changes
+2. **Component Interaction Diagram** - Mermaid diagram showing relationships
+3. **Risk Assessment** - Potential architectural risks and mitigation strategies
+4. **Recommendations** - Specific suggestions for architectural improvements
+5. **Migration Considerations** - Any deployment or database migration concerns
+
+Focus on how these changes fit into the overall system architecture and their long-term maintainability implications.

package/dist/examples/prompts/security-comprehensive.liquid

@@ -0,0 +1,107 @@
+# 🔒 Security Review for PR {{ pr.number }}: {{ pr.title }}
+
+## Context Information
+- **Author**: {{ pr.author }}
+- **Branch**: `{{ pr.headBranch }}` → `{{ pr.baseBranch }}`
+- **Files Changed**: {{ files.size }}
+- **Total Changes**: +{{ pr.totalAdditions }}/-{{ pr.totalDeletions }}
+
+{% if event.comment %}
+**Triggered by comment**: "{{ event.comment.body }}" from {{ event.comment.author }}
+{% endif %}
+
+## File Analysis
+
+{% assign tsFiles = utils.filesByExtension.ts %}
+{% assign jsFiles = utils.filesByExtension.js %}
+{% assign configFiles = utils.filesByExtension.json %}
+
+{% if tsFiles.size > 0 %}
+### TypeScript Files to Review ({{ tsFiles.size }})
+{% for file in tsFiles %}
+- `{{ file.filename }}` (+{{ file.additions }}/-{{ file.deletions }}) - {{ file.status }}
+{% endfor %}
+{% endif %}
+
+{% if jsFiles.size > 0 %}
+### JavaScript Files to Review ({{ jsFiles.size }})
+{% for file in jsFiles %}
+- `{{ file.filename }}` (+{{ file.additions }}/-{{ file.deletions }}) - {{ file.status }}
+{% endfor %}
+{% endif %}
+
+{% if configFiles.size > 0 %}
+### Configuration Files ({{ configFiles.size }})
+{% for file in configFiles %}
+- `{{ file.filename }}` - Pay special attention to security configurations
+{% endfor %}
+{% endif %}
+
+## Previous Security Findings
+
+{% if outputs.security %}
+Previous security scan found {{ outputs.security.totalIssues }} issues:
+- 🔴 **Critical**: {{ outputs.security.criticalIssues }}
+- 🟠 **Errors**: {{ outputs.security.errorIssues }}  
+- 🟡 **Warnings**: {{ outputs.security.warningIssues }}
+- 🔵 **Info**: {{ outputs.security.infoIssues }}
+
+{% if outputs.security.securityIssues.size > 0 %}
+### Existing Security Issues to Address:
+{% for issue in outputs.security.securityIssues %}
+- **{{ issue.severity | upcase }}** in `{{ issue.file }}:{{ issue.line }}`: {{ issue.message }}
+  {% if issue.suggestion %}💡 *{{ issue.suggestion }}*{% endif %}
+{% endfor %}
+{% endif %}
+
+{% else %}
+No previous security analysis available - performing fresh security review.
+{% endif %}
+
+## Review Focus Areas
+
+{% if utils.hasLargeChanges %}
+⚠️ **Large Changes Detected** - This PR requires extra careful review due to significant modifications.
+{% endif %}
+
+Please perform a comprehensive security analysis focusing on:
+
+### 1. Authentication & Authorization
+- JWT token handling and validation
+- Session management security
+- Role-based access control implementation
+- Authentication bypass possibilities
+
+### 2. Input Validation & Sanitization  
+- SQL injection vulnerabilities
+- XSS attack vectors
+- Command injection risks
+- File upload security
+
+### 3. Cryptography & Secrets
+- Proper use of cryptographic functions
+- Secret management and storage
+- API key and token security
+- Encryption at rest and in transit
+
+### 4. Infrastructure Security
+- Configuration security
+- Dependency vulnerabilities
+- Environment variable handling
+- Error message information disclosure
+
+### 5. Data Protection
+- Sensitive data exposure
+- Data validation and sanitization
+- Privacy compliance considerations
+- Audit logging security
+
+## Analysis Instructions
+
+Return results in JSON format matching the code-review schema with:
+- Specific file locations and line numbers
+- Clear severity classifications (critical/error/warning/info)
+- Actionable remediation suggestions
+- Reference to security best practices where applicable
+
+Focus on newly added or modified code, but consider how changes interact with existing security measures.

package/dist/examples/quick-start-tags.yaml

@@ -0,0 +1,53 @@
+# Quick Start: Visor with Tags
+# Simple configuration showing basic tag usage
+
+version: "1.0"
+
+# Define your checks with appropriate tags
+steps:
+  # Fast check for local development
+  quick-review:
+    type: ai
+    prompt: |
+      Quick code review focusing on:
+      - Obvious bugs and errors
+      - Security issues (SQL injection, XSS)
+      - Performance problems (N+1 queries, infinite loops)
+      Keep it brief and actionable.
+    tags: ["local", "fast"]
+    on: [pr_opened, pr_updated]
+
+  # Comprehensive check for CI/CD
+  thorough-review:
+    type: ai
+    prompt: |
+      Comprehensive code review including:
+      - Security vulnerabilities (OWASP Top 10)
+      - Performance optimization opportunities
+      - Code quality and maintainability
+      - Architecture and design patterns
+      - Test coverage gaps
+      Provide detailed feedback with examples.
+    tags: ["remote", "comprehensive"]
+    on: [pr_opened]
+
+  # Optional style check
+  style-review:
+    type: ai
+    prompt: "Check code style, formatting, and naming conventions"
+    tags: ["style", "optional", "fast"]
+    on: [pr_opened, pr_updated]
+
+# Usage Examples:
+#
+# Local development (pre-commit hook):
+#   visor --tags local,fast
+#
+# CI pipeline:
+#   visor --tags remote,comprehensive
+#
+# Everything except optional:
+#   visor --exclude-tags optional
+#
+# Just style checks:
+#   visor --tags style