@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/src/cliops.ts

@@ -0,0 +1,384 @@
+// qcr checklist / qcr compare — production wiring of the cutover harnesses. Local
+// runs exercise the offline halves; the live halves (tunnel, real searches,
+// live rounds) light up on the VM where the daemon and pi are running.
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { runChecklist, type ChecklistDeps } from "./checklist.js";
+import { loadConfig, sandboxRoot, type Config } from "./config.js";
+import { dispatchOnce } from "./dispatch.js";
+import { ESCALATION_TAG } from "./escalation.js";
+import {
+  MIGRATION_COMMENT_CLOSING,
+  MIGRATION_COMMENT_HEADING,
+} from "@quickchatai/pi-quickreview/src/migrations.js";
+import { zoneDateString } from "./eod.js";
+import type { GateResult } from "@quickchatai/pi-quickreview/src/gate.js";
+import type { GitHubAdapter, PrRef } from "./github.js";
+import { readDryrunDir, runCompare, type CompareDeps, type ReviewSnapshot } from "./compare.js";
+import { runDirOf } from "./ipc/capability.js";
+import { recheckFingerprint } from "./recheck.js";
+import { reconcileOnce } from "./reconcile.js";
+import { standingVerdict } from "@quickchatai/pi-quickreview/src/standing-review.js";
+import { isBotAuthor } from "./statemachine.js";
+import { StateStore } from "./state.js";
+import { stubSessionHooks } from "./stubs.js";
+import type { RoundOrder } from "@quickchatai/pi-quickreview/src/types.js";
+import { createWorkerLiveness } from "./workerliveness.js";
+import { applyInterpretation, interpretEvent } from "./webhook.js";
+import { buildParts, type ProductionParts } from "./wire.js";
+
+function dryGateResult(): GateResult {
+  return { executed: false };
+}
+
+/** Offline push-with-old-approval simulation: the real reconcile and dispatch
+ * paths run against a moved head and must stay quiet without an explicit
+ * label/team review re-request. The fixture is a TRACKED PR whose approved
+ * head is the old sha — an untracked PR is skipped by reconcile outright, and
+ * a probe over one would pass without exercising anything. */
+export function stalenessSimulation(
+  cfg: Config,
+  hooksRoot: string = join(sandboxRoot(), "state", "checklist-sim"),
+) {
+  const store = new StateStore(":memory:");
+  const issued: RoundOrder[] = [];
+  const fixture = {
+    number: 999901,
+    head_sha: "fixture-head-sha",
+    approved_sha: "fixture-approved-sha",
+  };
+  const prRef: PrRef = {
+    number: fixture.number,
+    title: "pushed approved PR fixture",
+    author: "someone",
+    head_sha: fixture.head_sha,
+    base_ref: cfg.github.base_branch,
+    updated_at: new Date().toISOString(),
+    state: "open",
+    draft: false,
+    merged: false,
+    labels: [],
+  };
+  const adapter = {
+    searchLabelTriggered: async () => [],
+    searchTeamTriggered: async () => [],
+    listOpenPrs: async () => [prRef],
+    getPr: async () => prRef,
+    listBotReviewComments: async () => [],
+    listPrFiles: async () => [
+      { filename: "src/x.ts", additions: 1, deletions: 0, status: "modified" },
+    ],
+    addLabel: async () => dryGateResult(),
+    removeLabel: async () => dryGateResult(),
+    deleteTeamReviewRequest: async () => dryGateResult(),
+    createReview: async () => dryGateResult(),
+  };
+  const hooks = {
+    ...stubSessionHooks(hooksRoot),
+    async dispatchRound(order: RoundOrder) {
+      issued.push(order);
+    },
+  };
+  return {
+    fixture,
+    store,
+    injectStalePr: (f: typeof fixture) => {
+      // Reviewed and approved at the old head, one finished round behind it.
+      store.upsertPr({
+        number: f.number,
+        state: "tracked",
+        head_sha: f.approved_sha,
+        title: prRef.title,
+        author: prRef.author,
+        trigger_ts: null,
+        stale_recheck: 0,
+        migration_gate: 0,
+      });
+      const round = store.startRound(f.number, "first", [], 60);
+      store.finishRound(round, "APPROVE", null);
+      store.recordReviewedHead(f.number, {
+        head_sha: f.approved_sha,
+        verdict: "APPROVE",
+        posted_event: "APPROVE",
+        round_no: 1,
+      });
+    },
+    runStalenessReconcile: async () => {
+      // reconcileOnce contains a failed step in its report rather than
+      // throwing; a step that failed did not exercise the push, so "no round
+      // issued" would be a pass for the wrong reason.
+      const report = await reconcileOnce({ cfg, store, adapter, hooks, log: () => {} });
+      if (report.errors.length > 0)
+        throw new Error(`reconcile failed in the simulation: ${report.errors.join("; ")}`);
+      await dispatchOnce({ cfg, store, adapter, hooks, log: () => {} });
+    },
+    issuedOrders: () => issued.map((o) => ({ pr: o.pr, round_type: o.round_type })),
+  };
+}
+
+/** Offline ping-pong plumbing probe: the real interpreter + apply path with an
+ * isolated registry; the inject write lands in the real inject/ dir. The live
+ * end-to-end (real author reply through the tunnel) is a VM item. */
+function pingPongSimulation(cfg: Config, root: string) {
+  const store = new StateStore(":memory:");
+  const botCommentId = 424242;
+  const pr = 999902;
+  store.registerBotComment(botCommentId, pr);
+  const event = {
+    comment: {
+      id: 555,
+      in_reply_to_id: botCommentId,
+      body: "author reply fixture",
+      user: { login: "someone", type: "User" },
+      path: "src/x.ts",
+    },
+    pull_request: {
+      number: pr,
+      title: "pingpong fixture",
+      user: { login: "someone" },
+      head: { sha: "abc" },
+    },
+    sender: { login: "someone", type: "User" },
+  };
+  return {
+    injectDir: join(root, "inject"),
+    event,
+    pr,
+    interpret: async (payload: unknown) => {
+      const i = interpretEvent("pull_request_review_comment", "created", payload, {
+        botLogin: cfg.github.bot_login,
+        triggerLabel: cfg.github.trigger_label,
+        reviewTeam: cfg.github.review_team,
+        botCommentPr: (id) => store.botCommentPr(id, "review_comment"),
+      });
+      await applyInterpretation(
+        {
+          cfg,
+          store,
+          onAuthorReply: async (reply) => {
+            const dir = join(root, "inject", `pr-${reply.pr}`);
+            mkdirSync(dir, { recursive: true });
+            const { writeFileSync } = await import("node:fs");
+            writeFileSync(join(dir, `${Date.now()}-pingpong-probe.md`), reply.body);
+          },
+        },
+        i,
+      );
+    },
+  };
+}
+
+/** ② The daemon's side of the queue comparison: the PRs still OWED a trigger
+ * consumption. Live, dispatch consumes the label and team request as the round
+ * starts, so a `reviewing` row no longer shows in the manual searches; in
+ * dry-run nothing is consumed, so it still does. */
+export function derivedQueueOf(
+  rows: ReadonlyArray<{ number: number; state: string }>,
+  dryRun: boolean,
+): number[] {
+  return rows
+    .filter((r) => r.state === "queued" || (dryRun && r.state === "reviewing"))
+    .map((r) => r.number);
+}
+
+/** What the manual side reads to judge a search hit the way reconcile does. */
+export type TriggerEligibilityStore = Pick<
+  StateStore,
+  "getPr" | "lastVerdictHead" | "reviewedHead" | "hasRecheck" | "triggerLevel"
+>;
+
+/** ② The manual searches' side: every search hit reconcile would queue, with
+ * reconcile's own skips applied in its own order — a bot's PR, a closed row
+ * a lagging search still lists, a paused row, standing trigger residue at a
+ * head a push recheck already claimed after an approval, and (dry-run, where
+ * nothing is consumed) a PR reviewed at the head its last verdict was applied
+ * to. A queued or reviewing row is kept: it is already owed. A hit whose
+ * trigger level the store holds as absent is a fresh edge the next pass acts
+ * on, so residue suppression does not apply to it. A PR whose trigger was
+ * withdrawn is in no search result, so it is never counted. */
+export function manualQueueOf(
+  found: ReadonlyArray<{ number: number; user?: { login?: string; type?: string } | null }>,
+  kind: "label" | "team_request",
+  dryRun: boolean,
+  botLogin: string,
+  store: TriggerEligibilityStore,
+): number[] {
+  return found
+    .filter((item) => {
+      const pr = item.number;
+      if (isBotAuthor(item.user?.login ?? "", botLogin) || item.user?.type === "Bot") return false;
+      const r = store.getPr(pr);
+      if (r === undefined) return true;
+      if (r.state === "closed") return false;
+      if (r.state === "queued" || r.state === "reviewing") return true;
+      if (r.paused) return false;
+      const fresh = store.triggerLevel(pr, kind) === false;
+      const reviewed = store.reviewedHead(pr);
+      const pushHandled =
+        !fresh &&
+        reviewed !== undefined &&
+        standingVerdict(reviewed) === "APPROVE" &&
+        reviewed.head_sha !== r.head_sha &&
+        store.hasRecheck(pr, recheckFingerprint({ trigger: "push" }, r.head_sha));
+      if (pushHandled) return false;
+      return !(dryRun && r.head_sha !== "" && store.lastVerdictHead(pr) === r.head_sha);
+    })
+    .map((item) => item.number);
+}
+
+export async function cmdChecklist(parts?: ProductionParts): Promise<number> {
+  const root = sandboxRoot();
+  const cfg = loadConfig();
+  const p = parts ?? buildParts(root, cfg);
+  const store = new StateStore(join(root, "state", "state.db"));
+  let secret = "";
+  try {
+    secret = readFileSync(join(cfg.github.secrets_dir, "webhook_secret"), "utf8").trim();
+  } catch {
+    // No secrets on this machine — the tunnel probe will fail with detail.
+  }
+  const deps: ChecklistDeps = {
+    tunnel: {
+      url: `http://127.0.0.1:${cfg.server.port}/webhook`,
+      webhookSecret: secret,
+      hostname: cfg.server.hostname,
+      post: async (url, headers, body) => {
+        const res = await fetch(url, { method: "POST", headers, body });
+        return { status: res.status, text: await res.text() };
+      },
+    },
+    queue: {
+      labelTriggered: async () =>
+        manualQueueOf(
+          await p.adapter.searchLabelTriggered(),
+          "label",
+          cfg.dry_run,
+          cfg.github.bot_login,
+          store,
+        ),
+      teamTriggered: async () =>
+        manualQueueOf(
+          await p.adapter.searchTeamTriggered(),
+          "team_request",
+          cfg.dry_run,
+          cfg.github.bot_login,
+          store,
+        ),
+      derivedQueue: () => derivedQueueOf(store.allPrs(), cfg.dry_run),
+    },
+    staleness: stalenessSimulation(cfg),
+    pingPong: pingPongSimulation(cfg, root),
+    digest: {
+      digestDir: join(root, "digest"),
+      statusPath: join(root, "state", "status.json"),
+      today: zoneDateString(new Date(), cfg.eod.timezone),
+    },
+    tmux: {
+      // Workers are the only PR host and the overseer is retired (rule 9):
+      // judge the worker inventory, which is empty between rounds.
+      listSessions: () => liveWorkerSessions(runDirOf(join(root, "state"))),
+      requireOverseer: false,
+      requirePrSession: false,
+    },
+    restart: {
+      statusPath: join(root, "state", "status.json"),
+      // Dry pass: the workers a restarted daemon would find (their leases).
+      adoptExistingSessions: () => liveWorkerSessions(runDirOf(join(root, "state"))),
+    },
+    bot_login: cfg.github.bot_login,
+    labels: {
+      trigger: cfg.github.trigger_label,
+      in_progress: cfg.github.in_progress_label,
+      reviewed: cfg.github.reviewed_label,
+    },
+  };
+  try {
+    const run = await runChecklist(deps);
+    return run.exitCode;
+  } finally {
+    store.close();
+  }
+}
+
+/** The sessions workers run for now, from their leases. Leases that cannot be
+ * read are UNKNOWN and throw, so the checklist reports a failed look rather
+ * than an empty inventory. */
+export function liveWorkerSessions(runDir: string): string[] {
+  const names = createWorkerLiveness({ runDir }).liveSessions();
+  if (names === null) throw new Error("the worker leases could not be read (liveness unknown)");
+  return names;
+}
+
+/** The known mechanically authored COMMENT bodies carry no round verdict. */
+function mechanicalReviewBody(body: string): boolean {
+  return (
+    body.startsWith(`${ESCALATION_TAG} @`) ||
+    (body.startsWith(`${MIGRATION_COMMENT_HEADING}\n`) && body.includes(MIGRATION_COMMENT_CLOSING))
+  );
+}
+
+function oldReviewFetcher(adapter: GitHubAdapter, botLogin: string) {
+  return async (pr: number): Promise<ReviewSnapshot | null> => {
+    const reviews = (await adapter.listReviewsFull(pr)).filter(
+      (r) =>
+        r.user === botLogin &&
+        ["APPROVED", "CHANGES_REQUESTED", "COMMENTED"].includes(r.state) &&
+        !(r.state === "COMMENTED" && mechanicalReviewBody(r.body)),
+    );
+    const latest = reviews[reviews.length - 1];
+    if (!latest) return null;
+    const comments = (await adapter.listReviewCommentsFull(pr)).filter(
+      (c) => c.pull_request_review_id === latest.id,
+    );
+    return {
+      source: "old-flow",
+      state: latest.state,
+      body: latest.body,
+      comments: comments.map((c) => ({ path: c.path, line: c.line ?? 0, body: c.body })),
+      commit_id: latest.commit_id,
+      ...(latest.submitted_at ? { submitted_at: latest.submitted_at } : {}),
+    };
+  };
+}
+
+export async function cmdCompare(prs: number[], parts?: ProductionParts): Promise<number> {
+  const root = sandboxRoot();
+  const cfg = loadConfig();
+  const p = parts ?? buildParts(root, cfg);
+  const dryrunDir = join(root, "state", "dryrun");
+  const deps: CompareDeps = {
+    // Locally the pi session can't execute a round; the harness collects
+    // whatever dry-run records prior rounds produced. On the VM, trigger the
+    // rounds via the daemon (label the PRs) before running compare.
+    dispatchDryRun: async (pr) => {
+      console.log(
+        `compare: not dispatching #${pr} — collect-only (trigger rounds via the daemon on the VM first)`,
+      );
+    },
+    readRecords: (pr) =>
+      readDryrunDir(dryrunDir).filter((r) => r.pr === pr || r.kind === "unparseable"),
+    fetchOldReview: oldReviewFetcher(p.adapter, cfg.github.bot_login),
+    fetchPatches: async (pr) =>
+      (await p.adapter.listPrFiles(pr))
+        .filter((f) => typeof f.patch === "string")
+        .map((f) => ({ path: f.filename, patch: f.patch! })),
+    readLedger: (pr) => {
+      for (const candidate of [
+        join(root, "archive", `pr-${pr}`, "ledger.md"),
+        join(root, "state", "ledgers", `pr-${pr}.md`),
+      ]) {
+        if (existsSync(candidate)) return readFileSync(candidate, "utf8");
+      }
+      return "";
+    },
+    // Deliberately NOT set. `qcr compare` is collect-only: the records on disk
+    // were produced by some earlier daemon round through a gate this process
+    // never held, so there is nothing here to observe. Reporting this process's
+    // own gate would be a fabricated attestation about someone else's run.
+    // The reports say the dry-run claim is UNVERIFIED, which is the truth.
+    // observeDryRun: …
+    outDir: join(root, "reports"),
+  };
+  const run = await runCompare(prs, deps);
+  return run.exitCode;
+}

package/src/clonedir.ts

@@ -0,0 +1,15 @@
+// The base clone's directory name, derived from the repo — one rule for the
+// config (`githubCloneDir`) and the worktree manager, which keeps zero config
+// imports. `scripts/deploy.sh` mirrors it in shell (tests/deploy.test.ts holds
+// the two together). Pure.
+
+/** A repo slug's or URL's last path segment, `.git` and trailing slashes
+ * stripped; "repo" when nothing is left ("owner/name" ⇒ "name"). */
+export function repoCloneDirName(repo: string): string {
+  const tail = repo
+    .replace(/\/+$/, "")
+    .replace(/\.git$/, "")
+    .split("/")
+    .pop();
+  return tail || "repo";
+}

package/src/commandeffects.ts

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+import type { FileOutcome } from "./improvements.js";
+import type { StateStore } from "./state.js";
+
+/** Only the watcher supplies delivery identity; payload bytes bind its meaning. */
+export function commandEffectKey(
+  kind: string,
+  deliveryKey: string | undefined,
+  payload: unknown,
+): string | undefined {
+  return deliveryKey
+    ? createHash("sha256")
+        .update(JSON.stringify([kind, deliveryKey, payload]))
+        .digest("hex")
+    : undefined;
+}
+
+function previous(result: string | null): FileOutcome {
+  return result === null
+    ? {
+        ok: false,
+        reason:
+          "command outcome unknown after interrupted delivery; submit a fresh command to retry",
+      }
+    : (JSON.parse(result) as FileOutcome);
+}
+
+/** A bounded grant, its charge, and its accepted result commit together. */
+export function atomicCommandEffect(
+  store: StateStore,
+  key: string | undefined,
+  perform: () => FileOutcome,
+): FileOutcome {
+  return store.db.transaction(() => {
+    if (key) {
+      const receipt = store.commandEffectReceipt(key);
+      if (receipt) return previous(receipt.result);
+      store.reserveCommandEffect(key);
+    }
+    const outcome = perform();
+    if (key) store.settleCommandEffect(key, outcome);
+    return outcome;
+  })();
+}
+
+/** Never replay an uncertain process mutation against a replacement session. */
+export async function asyncCommandEffect(
+  store: StateStore,
+  key: string | undefined,
+  perform: () => Promise<FileOutcome>,
+): Promise<FileOutcome> {
+  if (!key) return perform();
+  if (!store.reserveCommandEffect(key)) return previous(store.commandEffectReceipt(key)!.result);
+  const outcome = await perform();
+  store.settleCommandEffect(key, outcome);
+  return outcome;
+}