@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/sandbox/dist/tasks/refresh-s3-urls/refresh-s3-urls.js

@@ -0,0 +1,214 @@
+import { performance } from 'node:perf_hooks';
+import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { App } from 'octokit';
+import { isKnownDoistbotLogin } from '../../core/bot-logins.js';
+import { recordTaskMetrics, } from '../../core/datadog-metrics.js';
+import { logger } from '../../core/logging.js';
+import { removeIssueCommentReactionIfPresent } from '../../core/reactions.js';
+import { LOG_SNAPSHOT_MARKER, parseS3MetadataFromComment, PRESIGN_EXPIRY_SECONDS, } from '../../core/snapshot-helpers.js';
+import { shutdownTracing } from '../../core/tracing-setup.js';
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`Missing required environment variable: ${name}`);
+    return value;
+}
+function parseContext() {
+    return {
+        owner: requiredEnv('REPO_OWNER'),
+        repo: requiredEnv('REPO_NAME'),
+        issueNumber: Number(requiredEnv('ISSUE_NUMBER')),
+        installationId: Number(requiredEnv('INSTALLATION_ID')),
+        appId: requiredEnv('APP_ID'),
+        privateKey: requiredEnv('PRIVATE_KEY'),
+        logSnapshotBucket: requiredEnv('LOG_SNAPSHOT_BUCKET'),
+        commentId: process.env.COMMENT_ID ? Number(process.env.COMMENT_ID) : undefined,
+        reactionId: process.env.REACTION_ID ? Number(process.env.REACTION_ID) : undefined,
+        deliveryId: process.env.DELIVERY_ID?.trim() || 'unknown',
+    };
+}
+export async function main() {
+    const startedAt = performance.now();
+    const ctx = parseContext();
+    let exitCode = 0;
+    let metricOutcome = 'failure';
+    let metricReason;
+    logger.setBaseContext({
+        deliveryId: ctx.deliveryId,
+        repository: `${ctx.owner}/${ctx.repo}`,
+        issueNumber: ctx.issueNumber,
+    });
+    logger.info('Refresh-s3-urls task started', {
+        task: 'refresh-s3-urls',
+        issueNumber: ctx.issueNumber,
+    });
+    let octokit;
+    let cleanedUp = false;
+    async function cleanup() {
+        if (cleanedUp)
+            return;
+        cleanedUp = true;
+        if (!octokit)
+            return;
+        await removeIssueCommentReactionIfPresent({
+            octokit,
+            owner: ctx.owner,
+            repo: ctx.repo,
+            commentId: ctx.commentId,
+            reactionId: ctx.reactionId,
+            warnMessage: 'Failed to remove refresh-s3-urls reaction',
+            successMessage: 'Refresh-s3-urls reaction removed',
+            logMeta: { task: 'refresh-s3-urls', reactionId: ctx.reactionId },
+        });
+    }
+    try {
+        const app = new App({ appId: ctx.appId, privateKey: ctx.privateKey });
+        octokit = await app.getInstallationOctokit(ctx.installationId);
+        const snapshotComment = await findSnapshotComment(octokit, ctx);
+        if (!snapshotComment) {
+            await octokit.rest.issues.createComment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                issue_number: ctx.issueNumber,
+                body: 'No log snapshot found on this issue. Run `@doistbot /persist-logs` first.',
+            });
+            metricOutcome = 'success';
+            return;
+        }
+        logger.info('Found snapshot comment, parsing S3 metadata', {
+            task: 'refresh-s3-urls',
+            snapshotCommentId: snapshotComment.id,
+        });
+        const parsed = parseS3MetadataFromComment(snapshotComment.body ?? '');
+        if (!parsed) {
+            await octokit.rest.issues.createComment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                issue_number: ctx.issueNumber,
+                body: 'The existing log snapshot does not contain S3 metadata. Please run `@doistbot /persist-logs` again to create a new snapshot with refreshable links.',
+            });
+            metricOutcome = 'success';
+            return;
+        }
+        if (parsed.bucket !== ctx.logSnapshotBucket) {
+            logger.warn('Snapshot bucket mismatch — refusing to sign', {
+                task: 'refresh-s3-urls',
+                expected: ctx.logSnapshotBucket,
+                found: parsed.bucket,
+            });
+            await octokit.rest.issues.createComment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                issue_number: ctx.issueNumber,
+                body: 'The log snapshot references an unexpected S3 bucket. Please run `@doistbot /persist-logs` again.',
+            });
+            metricOutcome = 'success';
+            return;
+        }
+        // Generate fresh presigned URLs for all S3 keys
+        logger.info('Generating fresh presigned URLs', {
+            task: 'refresh-s3-urls',
+            bucket: parsed.bucket,
+            keyCount: parsed.keys.length,
+        });
+        const s3 = new S3Client({});
+        const urlMap = new Map();
+        for (const key of parsed.keys) {
+            const freshUrl = await getSignedUrl(s3, new GetObjectCommand({ Bucket: parsed.bucket, Key: key }), { expiresIn: PRESIGN_EXPIRY_SECONDS });
+            urlMap.set(key, freshUrl);
+        }
+        // Replace all presigned S3 URLs in the comment body
+        const updatedBody = replacePresignedUrls(snapshotComment.body ?? '', urlMap);
+        logger.info('Presigned URLs refreshed, updating comment', {
+            task: 'refresh-s3-urls',
+            urlsReplaced: urlMap.size,
+        });
+        await octokit.rest.issues.updateComment({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            comment_id: snapshotComment.id,
+            body: updatedBody,
+        });
+        metricOutcome = 'success';
+        logger.info('Refresh-s3-urls task completed', {
+            task: 'refresh-s3-urls',
+            issueNumber: ctx.issueNumber,
+            snapshotCommentId: snapshotComment.id,
+            durationMs: performance.now() - startedAt,
+        });
+    }
+    catch (error) {
+        metricReason = 'exception';
+        logger.error('Refresh-s3-urls task failed', {
+            task: 'refresh-s3-urls',
+            issueNumber: ctx.issueNumber,
+            error: error instanceof Error ? error.message : String(error),
+            durationMs: performance.now() - startedAt,
+        });
+        if (octokit) {
+            try {
+                await octokit.rest.issues.createComment({
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    issue_number: ctx.issueNumber,
+                    body: 'Sorry, I encountered an error while refreshing the log snapshot URLs. Please try again.',
+                });
+            }
+            catch {
+                // Best effort
+            }
+        }
+        exitCode = 1;
+    }
+    finally {
+        // Independent network targets (GitHub vs Datadog) — safe to run concurrently.
+        await Promise.all([
+            cleanup(),
+            recordTaskMetrics({
+                type: 'refresh',
+                repository: `${ctx.owner}/${ctx.repo}`,
+                model: 'none',
+                outcome: metricOutcome,
+                durationMs: performance.now() - startedAt,
+                reason: metricReason,
+            }),
+        ]);
+    }
+    if (exitCode !== 0) {
+        await shutdownTracing();
+        process.exit(exitCode);
+    }
+}
+async function findSnapshotComment(octokit, ctx) {
+    const comments = await octokit.paginate(octokit.rest.issues.listComments, {
+        owner: ctx.owner,
+        repo: ctx.repo,
+        issue_number: ctx.issueNumber,
+        per_page: 100,
+    });
+    // Return the most recent bot-authored snapshot so /refresh-s3-urls targets the latest one
+    let latest = null;
+    for (const comment of comments) {
+        const login = comment.user?.login;
+        if (isKnownDoistbotLogin(login) && comment.body?.includes(LOG_SNAPSHOT_MARKER)) {
+            latest = { id: comment.id, body: comment.body };
+        }
+    }
+    return latest;
+}
+/**
+ * Replaces presigned S3 URLs in a comment body with fresh ones.
+ * Matches any URL containing `X-Amz-` query params (the presigned URL signature)
+ * and swaps it if the URL path contains one of our known S3 keys.
+ */
+export function replacePresignedUrls(body, urlMap) {
+    return body.replace(/https:\/\/[^\s)]+X-Amz-[^\s)]+/g, (existingUrl) => {
+        for (const [key, freshUrl] of urlMap) {
+            if (existingUrl.includes(encodeURIComponent(key)) || existingUrl.includes(key)) {
+                return freshUrl;
+            }
+        }
+        return existingUrl;
+    });
+}

package/sandbox/dist/tasks/review/check-run.js

@@ -0,0 +1,326 @@
+import { isAnotherDeliveryInProgress, postCheckRun } from '../../core/check-run.js';
+import { logger } from '../../core/logging.js';
+import { appendReviewFeedbackLink } from './review-feedback.js';
+import { parseSeverity } from './severity.js';
+const CHECK_RUN_NAME = 'doistbot/review';
+/**
+ * Stale-pointer Check Run encoding — mirrors
+ * `apps/webhook-handler/src/tasks/review/stale-check-run.ts` so the two paths
+ * interoperate: a webhook-handler synchronize that lands after the sandbox
+ * posts a pointer here will find this pointer on `payload.before` and unwrap
+ * to the same `reviewedSha`. Kept in sync by convention; if we ever extract
+ * the upsert mechanics into a shared package, the constants move with it.
+ */
+const STALE_POINTER_EXTERNAL_ID_PREFIX = 'stale-pointer:';
+const STALE_TITLE_PREFIX = 'Stale: ';
+const MAX_TITLE_LENGTH = 100;
+function truncateTitle(value) {
+    if (value.length <= MAX_TITLE_LENGTH)
+        return value;
+    return `${value.slice(0, MAX_TITLE_LENGTH - 1)}…`;
+}
+/**
+ * Concurrency lock for the review task: returns `true` if a different
+ * delivery's `in_progress` Check Run is already running on this SHA. Skips
+ * the duplicate review. Replaces the pre-Check-Runs PR-comment-based lock.
+ */
+export function isAnotherReviewInProgress(params) {
+    return isAnotherDeliveryInProgress({ ...params, name: CHECK_RUN_NAME });
+}
+// Mapped type (not `Record<Severity, Lowercase<Severity>>`) so each key is
+// tied to its own lowercase value. `{ P0: 'p1', ... }` would type-check
+// under the looser `Record` form; this one rejects it.
+const SEVERITY_TO_COUNTER_KEY = {
+    P0: 'p0',
+    P1: 'p1',
+    P2: 'p2',
+    P3: 'p3',
+};
+/**
+ * Counts findings by their `[Pn]` severity tag, looking at both the inline
+ * comments and any summary-only findings the bot included. Findings without
+ * a recognizable tag are bucketed as `untagged`.
+ */
+export function countFindingsBySeverity(review) {
+    const counts = {
+        p0: 0,
+        p1: 0,
+        p2: 0,
+        p3: 0,
+        untagged: 0,
+        total: 0,
+    };
+    function increment(sev) {
+        if (sev)
+            counts[SEVERITY_TO_COUNTER_KEY[sev]] += 1;
+        else
+            counts.untagged += 1;
+        counts.total += 1;
+    }
+    for (const comment of review.comments ?? []) {
+        increment(comment.body ? parseSeverity(comment.body) : null);
+    }
+    // Summary may also contain `[Pn]`-tagged findings — the prompt's fallback
+    // tells the model to surface findings in the summary when inline placement
+    // fails (e.g. unclear line numbers). Scan line-by-line so we don't
+    // double-count tags repeated within the same sentence; only increment for
+    // lines that match.
+    for (const line of review.summary?.split('\n') ?? []) {
+        const sev = parseSeverity(line);
+        if (sev)
+            increment(sev);
+    }
+    return counts;
+}
+/**
+ * Builds a human-readable title for a successful check run.
+ * Examples: "No findings", "3 findings (2 P1, 1 P2)".
+ */
+export function buildSuccessTitle(counts) {
+    if (counts.total === 0) {
+        return 'No findings';
+    }
+    const parts = [];
+    if (counts.p0 > 0)
+        parts.push(`${counts.p0} P0`);
+    if (counts.p1 > 0)
+        parts.push(`${counts.p1} P1`);
+    if (counts.p2 > 0)
+        parts.push(`${counts.p2} P2`);
+    if (counts.p3 > 0)
+        parts.push(`${counts.p3} P3`);
+    if (counts.untagged > 0)
+        parts.push(`${counts.untagged} other`);
+    const breakdown = parts.length > 0 ? ` (${parts.join(', ')})` : '';
+    return `${counts.total} finding${counts.total === 1 ? '' : 's'}${breakdown}`;
+}
+/**
+ * Builds the markdown summary body for a successful check run. Renders in the
+ * Checks tab when expanded. Distinguishes between inline and summary-only
+ * findings so the wording matches reality (the prompt's fallback contract
+ * lets the model surface findings in `review.summary` when it can't place
+ * them inline — saying "inline comments" in that case sends authors to look
+ * for threads that don't exist).
+ */
+export function buildSuccessSummary(review, pullRequestUrl, counts = countFindingsBySeverity(review)) {
+    if (counts.total === 0) {
+        return [
+            'Doistbot reviewed this PR and surfaced no findings.',
+            '',
+            `[View PR](${pullRequestUrl})`,
+        ].join('\n');
+    }
+    const inlineCount = review.comments?.length ?? 0;
+    let placement;
+    if (inlineCount === counts.total) {
+        placement = 'as inline comments';
+    }
+    else if (inlineCount === 0) {
+        placement = 'in the review summary';
+    }
+    else {
+        placement = 'on this PR (some inline, some in the review summary)';
+    }
+    return [
+        `Doistbot posted **${counts.total} finding${counts.total === 1 ? '' : 's'}** ${placement}.`,
+        '',
+        `[View PR](${pullRequestUrl})`,
+    ].join('\n');
+}
+/**
+ * Private helper: shared boilerplate (`detailsUrl`, `name`, footer links) for
+ * the in-progress, success, and failure wrappers below. Appends the standard
+ * Datadog-logs + feedback-issue footer used elsewhere in the review output, so
+ * authors can act on the Check Run summary directly without hopping back to the
+ * PR conversation comment.
+ */
+async function postReviewCheckRun(params) {
+    const { octokit, owner, repo, sha, pullNumber, deliveryId, checkRunId, title, summaryBody } = params;
+    const pullRequestUrl = `https://github.com/${owner}/${repo}/pull/${pullNumber}`;
+    const summary = appendReviewFeedbackLink(summaryBody, {
+        owner,
+        repo,
+        prNumber: pullNumber,
+        deliveryId,
+    });
+    const sharedArgs = {
+        octokit,
+        owner,
+        repo,
+        sha,
+        title,
+        summary,
+        detailsUrl: pullRequestUrl,
+        name: CHECK_RUN_NAME,
+        externalId: deliveryId,
+        checkRunId,
+    };
+    if (params.status === 'in_progress') {
+        await postCheckRun({ ...sharedArgs, status: 'in_progress' });
+        return;
+    }
+    await postCheckRun({ ...sharedArgs, conclusion: params.conclusion });
+}
+/**
+ * Posts an `in_progress` check run when the review starts, so the PR's Checks
+ * tab shows that Doistbot is working. The summary carries the standard
+ * footer (Datadog logs + feedback link), so authors can follow live progress
+ * via the logs link without waiting for the final result. The completion call
+ * (`postReviewSuccessCheckRun` / `postReviewFailureCheckRun`) updates this
+ * same run via the upsert path.
+ */
+export async function postReviewInProgressCheckRun({ octokit, owner, repo, sha, pullNumber, deliveryId, }) {
+    await postReviewCheckRun({
+        octokit,
+        owner,
+        repo,
+        sha,
+        pullNumber,
+        deliveryId,
+        status: 'in_progress',
+        title: 'Doistbot review in progress',
+        summaryBody: 'Doistbot is reviewing this PR. Live logs are linked below.',
+    });
+}
+/**
+ * Phase-1 advisory mode: conclusion is always `success`, regardless of finding
+ * severity. Title summarizes the count + breakdown so authors see it at a
+ * glance in the Checks tab. Future phases (per the rollout proposal in
+ * `Doist/doistbot-app#237`) may flip to `failure` based on P0/P1 counts.
+ */
+export async function postReviewSuccessCheckRun({ octokit, owner, repo, sha, pullNumber, deliveryId, review, }) {
+    const pullRequestUrl = `https://github.com/${owner}/${repo}/pull/${pullNumber}`;
+    const counts = countFindingsBySeverity(review);
+    await postReviewCheckRun({
+        octokit,
+        owner,
+        repo,
+        sha,
+        pullNumber,
+        deliveryId,
+        conclusion: 'success',
+        title: buildSuccessTitle(counts),
+        summaryBody: buildSuccessSummary(review, pullRequestUrl, counts),
+    });
+}
+/** Shared title used by both the failure Check Run and stale-pointer recovery. */
+const FAILURE_TITLE = 'Doistbot review unavailable';
+/**
+ * Recovers the title that the terminal Check Run posted to `reviewedSha`,
+ * given the same input shape `postFinalCheckRun` already has. Lets the
+ * stale-pointer follow-up cite "Original result: …" without duplicating
+ * the title-building logic in two places.
+ */
+export function getReviewCheckRunTitle(input) {
+    if (input.conclusion === 'success') {
+        return buildSuccessTitle(countFindingsBySeverity(input.review));
+    }
+    return FAILURE_TITLE;
+}
+/**
+ * Posts a `neutral` check run with a "review unavailable" title so PR authors
+ * aren't left wondering whether the bot ran. `neutral` (gray −) visually
+ * distinguishes "didn't run" from "ran successfully" without blocking merges,
+ * per the rollout proposal: never block merges on Doistbot's own degradation.
+ */
+export async function postReviewFailureCheckRun({ octokit, owner, repo, sha, pullNumber, deliveryId, }) {
+    const pullRequestUrl = `https://github.com/${owner}/${repo}/pull/${pullNumber}`;
+    await postReviewCheckRun({
+        octokit,
+        owner,
+        repo,
+        sha,
+        pullNumber,
+        deliveryId,
+        conclusion: 'neutral',
+        title: FAILURE_TITLE,
+        summaryBody: [
+            "Doistbot's review didn't complete (provider outage, rate limit, or other failure).",
+            '',
+            "Optionally re-trigger with `@doistbot /review`. Don't block your PR on this.",
+            '',
+            `[View PR](${pullRequestUrl})`,
+        ].join('\n'),
+    });
+}
+/**
+ * After the terminal Check Run lands on `reviewedSha`, look up the PR's
+ * current head SHA. If it has moved during the review (i.e. the user pushed
+ * at least one commit while the review was in flight), post a neutral
+ * stale-pointer Check Run on the current head that links back to
+ * `reviewedSha`. Closes the in-progress-during-push gap that the webhook-side
+ * fix in [#311](https://github.com/Doist/doistbot-app/pull/311) can't cover
+ * on its own: that path only fires on `pull_request.synchronize` and only
+ * surfaces a pointer when a *completed* run sits on `payload.before`, so any
+ * commits pushed before the review terminated stayed empty.
+ *
+ * Uses the same `stale-pointer:<sha>` `external_id` format and same summary
+ * copy as `apps/webhook-handler/src/tasks/review/stale-check-run.ts` so the
+ * two paths interoperate: a subsequent synchronize-driven post finds this
+ * pointer on the prior head and unwraps to `reviewedSha`, keeping the
+ * "reference original" semantics across chained pushes.
+ *
+ * Skips quietly when:
+ * - Current head equals `reviewedSha` (no movement — the common case).
+ * - `pulls.get` fails (warn + return; restoring visibility is degraded UX,
+ *   not a correctness issue).
+ *
+ * The `postCheckRun` call itself swallows write failures with a warn, same
+ * pattern as the other terminal-write helpers.
+ *
+ * TOCTOU caveat: a push between the `pulls.get` here and the `postCheckRun`
+ * write can leave the new pointer on a SHA that's no longer the head. Same
+ * race shape and same bound as the existing TOCTOU notes elsewhere; the
+ * webhook-side handler will paper over it on the next synchronize.
+ */
+export async function postStaleReviewPointerIfHeadMoved({ octokit, owner, repo, pullNumber, reviewedSha, reviewedTitle, }) {
+    let currentHeadSha;
+    try {
+        const { data } = await octokit.rest.pulls.get({
+            owner,
+            repo,
+            pull_number: pullNumber,
+        });
+        currentHeadSha = data.head.sha;
+    }
+    catch (error) {
+        logger.warn('Failed to fetch PR current head; skipping stale pointer', {
+            component: 'stale-check-run',
+            pr_number: pullNumber,
+            reviewed_sha: reviewedSha,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    if (currentHeadSha === reviewedSha) {
+        return;
+    }
+    const reviewedShaShort = reviewedSha.slice(0, 7);
+    const commitUrl = `https://github.com/${owner}/${repo}/pull/${pullNumber}/commits/${reviewedSha}`;
+    const summary = [
+        `⚠️ Doistbot reviewed an earlier commit ([\`${reviewedShaShort}\`](${commitUrl})).`,
+        '',
+        `**Original result:** ${reviewedTitle}`,
+        '',
+        'Inline review comments from the original run are still on this PR; ' +
+            'they were against the prior commit and may not reflect the current diff. ' +
+            'Comment `@doistbot /review` to re-run against the latest commit.',
+    ].join('\n');
+    await postCheckRun({
+        octokit,
+        owner,
+        repo,
+        sha: currentHeadSha,
+        name: CHECK_RUN_NAME,
+        title: truncateTitle(`${STALE_TITLE_PREFIX}${reviewedTitle}`),
+        summary,
+        conclusion: 'neutral',
+        externalId: `${STALE_POINTER_EXTERNAL_ID_PREFIX}${reviewedSha}`,
+    });
+    logger.info('Posted stale-pointer Check Run on current head (head moved during review)', {
+        component: 'stale-check-run',
+        pr_number: pullNumber,
+        reviewed_sha: reviewedSha,
+        current_head_sha: currentHeadSha,
+    });
+}

package/sandbox/dist/tasks/review/comment-mapper.js

@@ -0,0 +1,46 @@
+import { logger } from '../../core/logging.js';
+/**
+ * Converts model findings to review comments, filtering out invalid diff locations.
+ */
+function getInvalidFindingLocationReason(finding, lineLookup) {
+    const fileLines = lineLookup.get(finding.path);
+    if (!fileLines) {
+        return 'file not in diff';
+    }
+    const validLines = finding.side === 'LEFT' ? fileLines.old : fileLines.new;
+    if (!validLines.has(finding.line)) {
+        return 'line not in diff';
+    }
+    return null;
+}
+export function canMapFindingToComment(finding, lineLookup) {
+    return getInvalidFindingLocationReason(finding, lineLookup) == null;
+}
+export function convertFindingsToComments(findings, lineLookup) {
+    const comments = [];
+    const skipped = [];
+    for (const finding of findings) {
+        const invalidReason = getInvalidFindingLocationReason(finding, lineLookup);
+        if (invalidReason) {
+            skipped.push({
+                path: finding.path,
+                line: finding.line,
+                reason: invalidReason,
+            });
+            continue;
+        }
+        comments.push({
+            path: finding.path,
+            line: finding.line,
+            side: finding.side,
+            body: finding.body,
+        });
+    }
+    if (skipped.length > 0) {
+        logger.info('Filtered invalid findings', {
+            skippedCount: skipped.length,
+            skipped,
+        });
+    }
+    return comments;
+}