@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/scripts/post-review.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# post-review.sh — post a REQUEST_CHANGES or COMMENT review on a PR (APPROVE goes through approve-pr.sh).
+#
+# A thin client of the daemon's post endpoint (src/ipc/postshim.ts). The host
+# a session runs on holds no GitHub credential and no config: the daemon
+# builds the payload, runs the posting-time guards and posts through the one
+# MutationGate with the install's dry_run. This script keeps its seeded name
+# and arguments and does nothing else; without the worker socket and the
+# capability fd in env the client refuses.
+#
+# Usage: post-review.sh <pr-number> <REQUEST_CHANGES|COMMENT> <body-file> [comments-json-file]
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+exec node "$ROOT/dist/src/ipc/postshim.js" review "$@"

package/scripts/pr-checks.sh

@@ -0,0 +1,256 @@
+#!/usr/bin/env bash
+# pr-checks.sh — compact read-only CI status for a PR.
+#
+# One line per check run (name, status/conclusion, url) and per commit status
+# (`status <context>: <state>`), plus a final
+#   SUMMARY: n passed / n failed / n pending
+# REST only: GET /pulls/{n} for the head sha, then /commits/{sha}/check-runs
+# and /commits/{sha}/status.
+# Read-only: no gate involvement. On a daemon's host the daemon reads
+# (src/ghread.ts); elsewhere the token comes from scripts/mint-token.sh only.
+#
+# Usage: pr-checks.sh <pr-number> [--why]
+#
+# --why: after the summary, for every FAILING latest check-run, print
+# what CI itself reported — the check's output title/summary/text, its
+# annotations (file:line: message), and for a GitHub Actions job the tail of
+# its log — so the review can tie each failure to the changed lines. Still
+# GETs only; the review reads CI, it never runs, re-runs or cancels anything.
+# The default output (without --why) is unchanged.
+
+set -euo pipefail
+
+API="${GITHUB_API:-https://api.github.com}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# The install locator decides: $QCR_CONFIG, else the install's config home.
+# Never a path built here.
+. "$ROOT/scripts/install-locator.sh"
+CONFIG="$(qcr_locate_config "$ROOT")" || exit 1
+
+die() { echo "pr-checks: $*" >&2; exit 1; }
+
+PR="${1:-}"
+[[ "$PR" =~ ^[0-9]+$ ]] || die "usage: pr-checks.sh <pr-number> [--why]"
+WHY=0
+[[ "${2:-}" == "--why" ]] && WHY=1
+
+cfg() { # cfg <section-or-empty> <key>  (tomllib, sed fallback — as mint-token.sh)
+  local section="$1" key="$2"
+  python3 - "$CONFIG" "$section" "$key" <<'PY' 2>/dev/null || cfg_sed "$section" "$key"
+import sys
+try:
+    import tomllib
+except ModuleNotFoundError:
+    raise SystemExit(1)
+path, section, key = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path, "rb") as fh:
+    data = tomllib.load(fh)
+node = data[section] if section else data
+val = node[key]
+print("true" if val is True else "false" if val is False else val)
+PY
+}
+cfg_sed() {
+  local section="$1" key="$2"
+  if [[ -n "$section" ]]; then sed -n "/^\[$section\]/,/^\[/p" "$CONFIG"
+  else sed -n '1,/^\[/p' "$CONFIG"; fi \
+    | sed -n "s/^[[:space:]]*$key[[:space:]]*=[[:space:]]*//p" \
+    | head -n1 | sed 's/[[:space:]]*#.*$//; s/^"//; s/"$//; s/[[:space:]]*$//'
+}
+
+REPO="$(cfg github repo)"
+[[ -n "$REPO" ]] || die "config.toml: [github].repo missing"
+# On a host the daemon runs (the worker socket and the capability fd are in env)
+# the daemon makes the read with the App's token (src/ghread.ts): the
+# model's tool uid can neither read the App key nor mint a token. Elsewhere the
+# read is our own, with a token from mint-token.sh.
+VIA_DAEMON=0
+[[ -n "${QCR_IPC_SOCKET:-}" && -n "${QCR_IPC_CAP_FD:-}" ]] && VIA_DAEMON=1
+GHREAD="$ROOT/dist/src/ipc/ghreadshim.js"
+TOKEN=""
+[[ "$VIA_DAEMON" == 1 ]] || TOKEN="$("$ROOT/scripts/mint-token.sh")"
+
+get() { # get <path>  → body in $OUT, dies on non-200
+  local status
+  if [[ "$VIA_DAEMON" == 1 ]]; then
+    status="$(node "$GHREAD" get "$1" "$OUT")"
+  else
+    status="$(curl -sS -o "$OUT" -w '%{http_code}' \
+      -H "Authorization: Bearer $TOKEN" \
+      -H "Accept: application/vnd.github+json" \
+      -H "X-GitHub-Api-Version: 2022-11-28" "$API$1")"
+  fi
+  [[ "$status" == "200" ]] || die "GET $1 -> $status: $(head -c 300 "$OUT")"
+}
+
+OUT="$(mktemp)"
+RUNS="$(mktemp)"
+FAILING="$(mktemp)"
+STATUSES="$(mktemp)"
+trap 'rm -f "$OUT" "$RUNS" "$FAILING" "$FAILING.output" "$STATUSES"' EXIT
+
+get "/repos/$REPO/pulls/$PR"
+HEAD_SHA="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["head"]["sha"])' "$OUT")"
+
+# Every page, as src/github.ts listChecks and guards.sh read them: a failing
+# or pending run past row 100 is still a check at this head. Up to 10 pages; a
+# short page ends it, and a malformed page or an exhausted limit dies (no
+# CLASSIFIED line) rather than classifying part of the evidence. The pages accumulate into $RUNS as one {check_runs: [...]}.
+echo '{"check_runs": []}' >"$RUNS"
+for ((page = 1; page <= 10; page++)); do
+  get "/repos/$REPO/commits/$HEAD_SHA/check-runs?per_page=100&page=$page"
+  n="$(python3 -c '
+import json, sys
+acc = json.load(open(sys.argv[1]))
+page_doc = json.load(open(sys.argv[2]))
+rows = page_doc.get("check_runs") if isinstance(page_doc, dict) else None
+if not isinstance(rows, list):
+    raise SystemExit("check-runs page has no check_runs list")
+acc["check_runs"] += rows
+json.dump(acc, open(sys.argv[1], "w"))
+print(len(rows))' "$RUNS" "$OUT")" || die "check-runs page $page unreadable"
+  if ((n < 100)); then break; fi
+done
+((n < 100)) || die "incomplete check-runs: page limit reached"
+
+# The COMMIT STATUSES at the head, every page, as listChecks and guards.sh read
+# them, so a failing status (a deploy preview, an external CI that reports
+# through the status API) classifies red here exactly as guard 4 does. A status
+# is its own check: never collapsed with a check-run of its context, nor with
+# another status (the packages/pi-plugin/src/cigate.ts latestRunPerName rule).
+echo '{"statuses": []}' >"$STATUSES"
+for ((page = 1; page <= 10; page++)); do
+  get "/repos/$REPO/commits/$HEAD_SHA/status?per_page=100&page=$page"
+  n="$(python3 -c '
+import json, sys
+acc = json.load(open(sys.argv[1]))
+page_doc = json.load(open(sys.argv[2]))
+rows = page_doc.get("statuses") if isinstance(page_doc, dict) else None
+if not isinstance(rows, list):
+    raise SystemExit("statuses page has no statuses list")
+acc["statuses"] += rows
+json.dump(acc, open(sys.argv[1], "w"))
+print(len(rows))' "$STATUSES" "$OUT")" || die "statuses page $page unreadable"
+  if ((n < 100)); then break; fi
+done
+((n < 100)) || die "incomplete statuses: page limit reached"
+
+python3 - "$RUNS" "$FAILING" "$STATUSES" <<'PY'
+import json, re, sys
+runs = json.load(open(sys.argv[1])).get("check_runs", [])
+statuses = json.load(open(sys.argv[3])).get("statuses", [])
+# Latest-run-per-name (mirrors packages/pi-plugin/src/cigate.ts latestRunPerName, where the rule
+# is stated exactly): GitHub auto-cancels superseded runs, so only the most
+# recent run of each check name counts.
+# Recency collapses ONLY runs that carry a started_at (latest wins, an equal
+# start resolves to the later list position); a run WITHOUT one never competes
+# with a timestamped one — it is kept beside it and counts on its own, the last
+# such per name. Superseded husks are shown, marked, and excluded from the tally.
+timed, untimed = {}, {}
+for c in runs:
+    key = c.get("name") or "check"
+    at = c.get("started_at") or None
+    if at is None:
+        untimed[key] = c
+    elif key not in timed or at >= timed[key].get("started_at"):
+        timed[key] = c
+latest = list(timed.values()) + list(untimed.values())
+current = set(id(c) for c in latest)
+passed = failed = pending = 0
+for c in runs:
+    concl = c.get("conclusion")
+    state = f"{c['status']}/{concl or '-'}"
+    superseded = id(c) not in current
+    tag = "  [superseded — does not count]" if superseded else ""
+    print(f"{c['name']}: {state}  {c.get('html_url') or '-'}{tag}")
+    if superseded:
+        continue
+    if c["status"] != "completed":
+        pending += 1
+    elif concl in ("success", "neutral", "skipped"):
+        passed += 1
+    else:
+        failed += 1
+        # For --why: the check-run id, the Actions job id when it is one, the name,
+        # and what the check reported about itself.
+        m = re.search(r"/job/(\d+)", c.get("details_url") or c.get("html_url") or "")
+        with open(sys.argv[2], "a") as fh:
+            fh.write(f"{c['id']}\t{m.group(1) if m else '-'}\t{c['name']}\n")
+        out = c.get("output") or {}
+        with open(sys.argv[2] + ".output", "a") as fh:
+            fh.write(json.dumps({"id": c["id"], "title": out.get("title"), "summary": out.get("summary"), "text": out.get("text")}) + "\n")
+for s in statuses:
+    st = s.get("state") or ""
+    desc = (s.get("description") or "").strip()
+    print(f"status {s.get('context') or 'status'}: {st or '-'}  {s.get('target_url') or '-'}" + (f"  ({desc[:200]})" if desc else ""))
+    if st == "pending":
+        pending += 1
+    elif st == "success":
+        passed += 1
+    else:
+        failed += 1
+print(f"SUMMARY: {passed} passed / {failed} failed / {pending} pending (latest run per check only)")
+# The one line the Decide step reads. Same table as the daemon gate + guards.sh:
+# check-runs (latest per name) and commit statuses (each its own check). A
+# failure decides red even while another check still runs — packages/pi-plugin/src/cigate.ts
+# classifyCi and guards.sh's jq both put red first.
+if not latest and not statuses:
+    print("CLASSIFIED: none")
+elif failed:
+    print("CLASSIFIED: red")
+elif pending:
+    print("CLASSIFIED: pending")
+else:
+    succeeded = any((c.get("conclusion") == "success") for c in latest) or any(
+        (s.get("state") == "success") for s in statuses
+    )
+    print("CLASSIFIED: green" if succeeded else "CLASSIFIED: red")
+PY
+
+[[ "$WHY" == 1 && -s "$FAILING" ]] || exit 0
+echo
+echo "WHY — what CI reported for each failing check (read it; tie each failure to the changed lines):"
+while IFS=$'\t' read -r id job name; do
+  echo
+  echo "=== $name (check-run $id)"
+  python3 - "$FAILING.output" "$id" <<'PY'
+import json, sys
+for line in open(sys.argv[1]):
+    o = json.loads(line)
+    if str(o["id"]) != sys.argv[2]:
+        continue
+    for k in ("title", "summary", "text"):
+        v = (o.get(k) or "").strip()
+        if v:
+            print(f"{k}: {v[:1500]}{' …' if len(v) > 1500 else ''}")
+PY
+  if (get "/repos/$REPO/check-runs/$id/annotations?per_page=50") 2>/dev/null; then
+    python3 - "$OUT" <<'PY'
+import json, sys
+anns = json.load(open(sys.argv[1]))
+for a in anns[:30]:
+    print(f"annotation {a.get('path')}:{a.get('start_line')} [{a.get('annotation_level')}] {(a.get('title') or '').strip()} {(a.get('message') or '').strip()[:400]}")
+if len(anns) > 30:
+    print(f"(+{len(anns) - 30} more annotations)")
+PY
+  else
+    echo "annotations: not readable"
+  fi
+  if [[ "$job" != "-" ]]; then
+    # The log endpoint redirects to storage; curl drops the Authorization
+    # header on the cross-host redirect by default, which is what storage wants.
+    if [[ "$VIA_DAEMON" == 1 ]]; then
+      code="$(node "$GHREAD" get "/repos/$REPO/actions/jobs/$job/logs" "$OUT" 2>/dev/null || echo 000)"
+    else
+      code="$(curl -sS -L -o "$OUT" -w '%{http_code}' -H "Authorization: Bearer $TOKEN" \
+        -H "Accept: application/vnd.github+json" "$API/repos/$REPO/actions/jobs/$job/logs" 2>/dev/null || echo 000)"
+    fi
+    if [[ "$code" == "200" ]]; then
+      echo "log tail (last 60 lines):"
+      sed -e 's/^[0-9-]*T[0-9:.]*Z //' "$OUT" | tail -n 60
+    else
+      echo "log: not readable (HTTP $code) — the App may lack Actions: read"
+    fi
+  fi
+done < "$FAILING"
+

package/scripts/pr-context.py

@@ -0,0 +1,174 @@
+#!/usr/bin/env python3
+"""Read-only PR context. Reject incomplete or mixed-head pagination."""
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import urllib.error
+import urllib.request
+import urllib.parse
+
+MAX_PAGES = 100
+
+
+def main():
+    api, repo, number = sys.argv[1:]
+    owner, name = repo.split("/", 1)
+    ghread = os.environ.get("QCR_CONTEXT_GHREAD")
+    token = None if ghread else os.environ["QCR_CONTEXT_TOKEN"]
+
+    origin = urllib.parse.urlsplit(api)
+
+    class ApiRedirects(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, req, fp, code, msg, headers, newurl):
+            target = urllib.parse.urlsplit(newurl)
+            if (target.scheme, target.netloc) != (origin.scheme, origin.netloc):
+                raise ValueError("refused cross-origin GitHub redirect")
+            return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+    opener = urllib.request.build_opener(ApiRedirects())
+
+    def via_daemon(path, payload):
+        # The daemon reads (src/ghread.ts): a REST GET by path, or this script's
+        # GraphQL query by its name there ("pr-context"), the repo filled in by
+        # the daemon. ghreadshim prints GitHub's status and writes the body.
+        with tempfile.NamedTemporaryFile(prefix="pr-context-", delete=False) as fh:
+            out = fh.name
+        try:
+            if payload is None:
+                argv = ["node", ghread, "get", path, out]
+            else:
+                given = payload["variables"]
+                variables = {k: given[k] for k in ("number", "filesCursor", "threadsCursor")}
+                argv = ["node", ghread, "graphql", "pr-context", out, json.dumps(variables)]
+            # the shim reads the command's capability from the inherited fd,
+            # which Python closes in a child unless it is passed on by name
+            cap_fd = int(os.environ["QCR_IPC_CAP_FD"])
+            done = subprocess.run(
+                argv, stdout=subprocess.PIPE, check=False, text=True, pass_fds=(cap_fd,)
+            )
+            if done.returncode != 0:
+                raise ValueError("the daemon's read failed (" + path + ")")
+            if done.stdout.strip() != "200":
+                with open(out, encoding="utf-8", errors="replace") as fh:
+                    raise ValueError(f"{path} -> {done.stdout.strip()}: {fh.read(300)}")
+            with open(out, encoding="utf-8") as fh:
+                return json.load(fh)
+        finally:
+            os.unlink(out)
+
+    def request(path, payload=None):
+        if ghread:
+            return via_daemon(path, payload)
+        data = None if payload is None else json.dumps(payload).encode()
+        req = urllib.request.Request(api + path, data=data, headers={
+            "Authorization": "Bearer " + token,
+            "Accept": "application/vnd.github+json",
+            "Content-Type": "application/json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        })
+        with opener.open(req, timeout=60) as response:
+            return json.load(response)
+
+    query = '''query($owner:String!,$name:String!,$number:Int!,$filesCursor:String,$threadsCursor:String){
+      repository(owner:$owner,name:$name){pullRequest(number:$number){
+        title state headRefOid baseRefName author{login}
+        files(first:100,after:$filesCursor){nodes{path additions deletions} pageInfo{hasNextPage endCursor}}
+        reviews(last:10){nodes{author{login} state submittedAt}}
+        reviewThreads(first:100,after:$threadsCursor){nodes{id isResolved isOutdated path line
+          comments(last:2){nodes{author{login} body}}} pageInfo{hasNextPage endCursor}}
+      }}}'''
+    variables = {"owner": owner, "name": name, "number": int(number), "filesCursor": None, "threadsCursor": None}
+    active = {"files": "filesCursor", "reviewThreads": "threadsCursor"}
+    gathered = {key: [] for key in active}
+    pr = None
+    for _ in range(MAX_PAGES):
+        envelope = request("/graphql", {"query": query, "variables": variables})
+        if envelope.get("errors"):
+            raise ValueError("GraphQL errors: " + json.dumps(envelope["errors"])[:300])
+        page = envelope["data"]["repository"]["pullRequest"]
+        if not page:
+            raise ValueError("no such PR")
+        if pr is None:
+            pr = page
+        elif page["headRefOid"] != pr["headRefOid"]:
+            raise ValueError("PR head changed while reading context; retry")
+        for connection, cursor_key in list(active.items()):
+            value = page[connection]
+            if not isinstance(value["nodes"], list):
+                raise ValueError("unreadable " + connection + " nodes")
+            gathered[connection].extend(value["nodes"])
+            info = value["pageInfo"]
+            if info["hasNextPage"] is False:
+                del active[connection]
+            elif info["hasNextPage"] is True:
+                cursor = info.get("endCursor")
+                if not isinstance(cursor, str) or not cursor or cursor == variables[cursor_key]:
+                    raise ValueError("incomplete " + connection + ": missing or repeated cursor")
+                variables[cursor_key] = cursor
+            else:
+                raise ValueError("incomplete " + connection + " page information")
+        if not active:
+            break
+    else:
+        raise ValueError("incomplete context: GraphQL page limit reached")
+
+    def rest_pages(path, field):
+        rows = []
+        expected = None
+        for page in range(1, MAX_PAGES + 1):
+            result = request(path + f"?per_page=100&page={page}")
+            count = result.get("total_count")
+            if count is not None:
+                if isinstance(count, bool) or not isinstance(count, int) or count < 0:
+                    raise ValueError("unreadable " + field + " total_count")
+                if expected is not None and count != expected:
+                    raise ValueError("incomplete " + field + ": count changed while reading")
+                expected = count
+            batch = result[field]
+            if not isinstance(batch, list):
+                raise ValueError("unreadable " + field)
+            rows.extend(batch)
+            if len(batch) < 100:
+                if expected is not None and len(rows) != expected:
+                    raise ValueError("incomplete " + field + ": advertised count not reached")
+                return rows
+        raise ValueError("incomplete context: " + field + " page limit reached")
+
+    sha = pr["headRefOid"]
+    checks = rest_pages(f"/repos/{repo}/commits/{sha}/check-runs", "check_runs")
+    statuses = rest_pages(f"/repos/{repo}/commits/{sha}/status", "statuses")
+    who = lambda value: (value or {}).get("login", "?")
+    print(f"== META #{number} ==")
+    print(f"title: {pr['title']}")
+    print(f"author: {who(pr['author'])}  state: {pr['state']}")
+    print(f"head: {sha}  base: {pr['baseRefName']}")
+    print("\n== FILES ==")
+    for item in gathered["files"]:
+        print(f"+{item['additions']} -{item['deletions']}  {item['path']}")
+    print("\n== CHECKS ==")
+    for item in checks:
+        print(f"{item['name']}: {item['status']}/{item.get('conclusion') or '-'}")
+    for item in statuses:
+        print(f"status {item.get('context') or 'status'}: {item.get('state') or '-'}")
+    print("\n== REVIEWS (latest) ==")
+    for item in pr["reviews"]["nodes"]:
+        print(f"{who(item['author'])}: {item['state']}  {item.get('submittedAt') or '-'}")
+    print("\n== THREADS (unresolved) ==")
+    for item in gathered["reviewThreads"]:
+        if item["isResolved"]:
+            continue
+        loc = f"{item.get('path') or '?'}:{item.get('line') or '?'}"
+        print(f"-- {item['id']}  outdated={str(item['isOutdated']).lower()}  {loc}")
+        for comment in item["comments"]["nodes"]:
+            body = " ".join((comment.get("body") or "").split())[:400]
+            print(f"   {who(comment['author'])}: {body}")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (OSError, ValueError, KeyError, TypeError, urllib.error.URLError) as error:
+        print("pr-context: " + str(error), file=sys.stderr)
+        sys.exit(1)

package/scripts/pr-context.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# pr-context.sh — one-shot read-only PR bundle for pi review sessions.
+#
+# Prints labeled plain-text sections: META, FILES, CHECKS, REVIEWS, THREADS
+# (unresolved only, last 2 comments each). Files and threads are paginated;
+# REST supplies check runs and legacy commit statuses for the same head.
+# Read-only: no gate involvement. On a daemon's host the daemon reads
+# (src/ghread.ts); elsewhere the token comes from scripts/mint-token.sh only.
+#
+# Usage: pr-context.sh <pr-number>
+
+set -euo pipefail
+
+API="${GITHUB_API:-https://api.github.com}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# The install locator decides: $QCR_CONFIG, else the install's config home.
+# Never a path built here.
+. "$ROOT/scripts/install-locator.sh"
+CONFIG="$(qcr_locate_config "$ROOT")" || exit 1
+
+die() { echo "pr-context: $*" >&2; exit 1; }
+
+PR="${1:-}"
+[[ "$PR" =~ ^[0-9]+$ ]] || die "usage: pr-context.sh <pr-number>"
+
+cfg() { # cfg <section-or-empty> <key>  (tomllib, sed fallback — as mint-token.sh)
+  local section="$1" key="$2"
+  python3 - "$CONFIG" "$section" "$key" <<'PY' 2>/dev/null || cfg_sed "$section" "$key"
+import sys
+try:
+    import tomllib
+except ModuleNotFoundError:
+    raise SystemExit(1)
+path, section, key = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path, "rb") as fh:
+    data = tomllib.load(fh)
+node = data[section] if section else data
+val = node[key]
+print("true" if val is True else "false" if val is False else val)
+PY
+}
+cfg_sed() {
+  local section="$1" key="$2"
+  if [[ -n "$section" ]]; then sed -n "/^\[$section\]/,/^\[/p" "$CONFIG"
+  else sed -n '1,/^\[/p' "$CONFIG"; fi \
+    | sed -n "s/^[[:space:]]*$key[[:space:]]*=[[:space:]]*//p" \
+    | head -n1 | sed 's/[[:space:]]*#.*$//; s/^"//; s/"$//; s/[[:space:]]*$//'
+}
+
+REPO="$(cfg github repo)"
+[[ -n "$REPO" ]] || die "config.toml: [github].repo missing"
+OWNER="${REPO%%/*}"; NAME="${REPO##*/}"
+# On a host the daemon runs (the worker socket and the capability fd are in env)
+# the daemon makes the reads with the App's token (src/ghread.ts): the
+# model's tool uid can neither read the App key nor mint a token. Elsewhere the
+# reads are our own, with a token from mint-token.sh.
+if [[ -n "${QCR_IPC_SOCKET:-}" && -n "${QCR_IPC_CAP_FD:-}" ]]; then
+  QCR_CONTEXT_GHREAD="$ROOT/dist/src/ipc/ghreadshim.js" \
+    exec python3 "$ROOT/scripts/pr-context.py" "$API" "$REPO" "$PR"
+fi
+TOKEN="$("$ROOT/scripts/mint-token.sh")"
+
+QCR_CONTEXT_TOKEN="$TOKEN" exec python3 "$ROOT/scripts/pr-context.py" "$API" "$REPO" "$PR"

package/scripts/pr-self.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# pr-self.sh — the session's sanctioned READ-ONLY self-verification helper.
+#
+# One entry point for the four questions a review session keeps asking about
+# its own PR:
+#   reviews  the bot's posted reviews on this PR (id, state, commit, when)
+#   threads  unresolved review threads with ids   (delegates to pr-threads.sh)
+#   head     the PR's current head sha
+#   checks   CI rollup at the head                (delegates to pr-checks.sh)
+#
+# READ-ONLY BY CONSTRUCTION. This file performs GET requests only — no method
+# overrides, no request bodies — and its two delegates are the sibling
+# read-only scripts. There is no gate involvement because there is no mutation
+# path: posting always goes through post-review.sh / approve-pr.sh /
+# reply-thread.sh (each asks the daemon over its post endpoint, which runs the gate). Never add a write here.
+# On a daemon's host the daemon reads (src/ghread.ts); elsewhere the
+# token comes from scripts/mint-token.sh only (app credential; never GH_TOKEN); when
+# no credential is available (test stubs) the read goes out unauthenticated.
+#
+# Usage: pr-self.sh <pr-number> <reviews|threads|head|checks>
+
+set -euo pipefail
+
+API="${GITHUB_API:-https://api.github.com}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# The install locator decides: $QCR_CONFIG, else the install's config home.
+# Never a path built here.
+. "$ROOT/scripts/install-locator.sh"
+CONFIG="$(qcr_locate_config "$ROOT")" || exit 1
+
+die() { echo "pr-self: $*" >&2; exit 1; }
+usage() { die "usage: pr-self.sh <pr-number> <reviews|threads|head|checks>"; }
+
+PR="${1:-}"
+SUB="${2:-}"
+[[ "$PR" =~ ^[0-9]+$ ]] || usage
+[[ -n "$SUB" ]] || usage
+
+# The delegating subcommands hand off wholesale to the sibling read scripts.
+case "$SUB" in
+  threads) exec "$ROOT/scripts/pr-threads.sh" "$PR" ;;
+  checks)  exec "$ROOT/scripts/pr-checks.sh" "$PR" ;;
+  reviews|head) ;;
+  *) usage ;;
+esac
+
+cfg() { # cfg <section-or-empty> <key>  (tomllib, sed fallback — as mint-token.sh)
+  local section="$1" key="$2"
+  python3 - "$CONFIG" "$section" "$key" <<'PY' 2>/dev/null || cfg_sed "$section" "$key"
+import sys
+try:
+    import tomllib
+except ModuleNotFoundError:
+    raise SystemExit(1)
+path, section, key = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path, "rb") as fh:
+    data = tomllib.load(fh)
+node = data[section] if section else data
+val = node[key]
+print("true" if val is True else "false" if val is False else val)
+PY
+}
+cfg_sed() {
+  local section="$1" key="$2"
+  if [[ -n "$section" ]]; then sed -n "/^\[$section\]/,/^\[/p" "$CONFIG"
+  else sed -n '1,/^\[/p' "$CONFIG"; fi \
+    | sed -n "s/^[[:space:]]*$key[[:space:]]*=[[:space:]]*//p" \
+    | head -n1 | sed 's/[[:space:]]*#.*$//; s/^"//; s/"$//; s/[[:space:]]*$//'
+}
+
+REPO="$(cfg github repo)"
+[[ -n "$REPO" ]] || die "config.toml: [github].repo missing"
+
+# On a host the daemon runs (the worker socket and the capability fd are in env)
+# the daemon makes the read with the App's token (src/ghread.ts): the
+# model's tool uid can neither read the App key nor mint a token. Elsewhere the
+# read is our own, with a token from mint-token.sh.
+VIA_DAEMON=0
+[[ -n "${QCR_IPC_SOCKET:-}" && -n "${QCR_IPC_CAP_FD:-}" ]] && VIA_DAEMON=1
+GHREAD="$ROOT/dist/src/ipc/ghreadshim.js"
+# App credential when present; unauthenticated read otherwise (loopback stubs).
+TOKEN=""
+[[ "$VIA_DAEMON" == 1 ]] || TOKEN="$("$ROOT/scripts/mint-token.sh" 2>/dev/null || true)"
+
+OUT="$(mktemp)"
+ALL="$(mktemp)"
+trap 'rm -f "$OUT" "$ALL"' EXIT
+
+get() { # get <path>  → body in $OUT, dies on non-200. GET only, ever.
+  local status
+  local -a auth=()
+  if [[ "$VIA_DAEMON" == 1 ]]; then
+    status="$(node "$GHREAD" get "$1" "$OUT")"
+  else
+    [[ -n "$TOKEN" ]] && auth=(-H "Authorization: Bearer $TOKEN")
+    status="$(curl -sS -o "$OUT" -w '%{http_code}' \
+      "${auth[@]}" \
+      -H "Accept: application/vnd.github+json" \
+      -H "X-GitHub-Api-Version: 2022-11-28" "$API$1")"
+  fi
+  [[ "$status" == "200" ]] || die "GET $1 -> $status: $(head -c 300 "$OUT")"
+}
+
+case "$SUB" in
+  head)
+    get "/repos/$REPO/pulls/$PR"
+    python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["head"]["sha"])' "$OUT"
+    ;;
+  reviews)
+    BOT="$(cfg github bot_login)"
+    [[ -n "$BOT" ]] || die "config.toml: [github].bot_login missing"
+    # Every page, as guards.sh and src/github.ts listReviews read them: reviews
+    # are oldest-first, so on a long PR the bot's latest reviews are exactly
+    # what a first-page read misses. Up to 30 pages; a short page ends it. A
+    # page that is not an array is an error, never an empty page.
+    echo '[]' >"$ALL"
+    for ((page = 1; page <= 30; page++)); do
+      get "/repos/$REPO/pulls/$PR/reviews?per_page=100&page=$page"
+      n="$(python3 -c '
+import json, sys
+acc = json.load(open(sys.argv[1]))
+rows = json.load(open(sys.argv[2]))
+if not isinstance(rows, list):
+    raise SystemExit("reviews page is not a list")
+acc += rows
+json.dump(acc, open(sys.argv[1], "w"))
+print(len(rows))' "$ALL" "$OUT")" || die "reviews page $page unreadable"
+      if ((n < 100)); then break; fi
+    done
+    ((n < 100)) || die "incomplete review history: page limit reached"
+    python3 - "$ALL" "$BOT" "$PR" <<'PY'
+import json, sys
+reviews = json.load(open(sys.argv[1]))
+bot, pr = sys.argv[2], sys.argv[3]
+mine = [r for r in reviews if (r.get("user") or {}).get("login") == bot]
+if not mine:
+    print(f"no reviews posted by {bot} on #{pr}")
+for r in mine:
+    body = " ".join((r.get("body") or "").split())[:200]
+    print(f"[{r.get('id')}] {r.get('state')} @ {r.get('commit_id')} "
+          f"({r.get('submitted_at') or '-'}) {body}")
+PY
+    ;;
+esac