@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/sandbox/dist/tasks/review/review-summary.js

@@ -0,0 +1,123 @@
+import { logger } from '../../core/logging.js';
+import { requestReviewSummary } from './summary-model.js';
+export const MAX_SUMMARY_BODY_CHARS = 2000;
+const MAX_REVIEW_OBSERVATION_CHARS = 500;
+export function buildReviewSummaryPrompt({ prTitle, prBody, findings, reviewObservations = [], }) {
+    const safeTitle = prTitle.trim() || 'Untitled';
+    const safeBody = prBody.trim();
+    const condensedBody = safeBody
+        ? safeBody.slice(0, MAX_SUMMARY_BODY_CHARS)
+        : 'No PR description was provided.';
+    const findingsBlock = findings.length > 0
+        ? findings
+            .map((finding) => `<review-finding>\n${finding.trim()}\n</review-finding>`)
+            .join('\n\n')
+        : 'No issues were flagged in the inline comments.';
+    const observationsBlock = reviewObservations.length > 0
+        ? reviewObservations
+            .map((observation) => observation.trim())
+            .filter(Boolean)
+            .slice(0, 8)
+            .map((observation) => `<review-observation>\n${observation.slice(0, MAX_REVIEW_OBSERVATION_CHARS)}\n</review-observation>`)
+            .join('\n\n') || 'No additional review observations were captured.'
+        : 'No additional review observations were captured.';
+    return `You are an expert code review summarizer for the Doist engineering team.
+
+<pr_title>
+${safeTitle}
+</pr_title>
+
+<pr_description>
+${condensedBody}
+</pr_description>
+
+<review_findings>
+${findingsBlock}
+</review_findings>
+
+<review_observations>
+${observationsBlock}
+</review_observations>
+
+Write the complete GitHub review summary body. Synthesize the findings into grouped themes—do not mirror every inline comment one-for-one or reference the reviewers, models, focus passes, or review observations. Use review observations only as context for the overview. Do not mention issues not present in the <review-finding> blocks. If there are no <review-finding> blocks, state that no inline issues were flagged.
+
+Structure:
+- Start with one short sentence giving a concise overview of what changed.
+- If issues exist, add a blank line, then the exact heading "Few things worth tightening:", then 1-4 concise bullets grouping what to improve.
+- If no issues exist, do not add a heading or bullets.
+
+Keep it human and compact: the opener should be 1 sentence, or 2 only if the PR is large and the second sentence adds useful context. Use a kind, warm, and supportive tone while staying concrete, constructive, and pragmatic. Avoid generic praise or flattery. Bullets should be short fragments or single sentences, not paragraphs. Do not include any <review-finding> or <review-observation> tags in the output.
+
+Respond with only valid JSON in this exact shape:
+{"summary":"<your summary>","comments":[]}`;
+}
+export async function summarizeReviewFindings({ credential, provider = 'zai', modelName, fallbackModels = [], prTitle, prBody, findings, reviewObservations, workspaceDir, requestReview = requestReviewSummary, }) {
+    const prompt = buildReviewSummaryPrompt({
+        prTitle,
+        prBody,
+        findings,
+        reviewObservations,
+    });
+    logger.info('Summarizing review findings with the review summary model', {
+        findingsCount: findings.length,
+        reviewObservationsCount: reviewObservations?.length ?? 0,
+    });
+    const summaryModels = [
+        {
+            provider,
+            credential,
+            ...(modelName ? { modelName } : {}),
+        },
+        ...fallbackModels,
+    ];
+    for (const [index, summaryModel] of summaryModels.entries()) {
+        // The `review.summary` span lives in requestReviewSummary, around the
+        // actual model invoke — so a missing-credential config error returns
+        // before any span and never shows a fake model attempt.
+        const result = await requestReview({
+            credential: summaryModel.credential,
+            provider: summaryModel.provider,
+            ...(summaryModel.modelName ? { modelName: summaryModel.modelName } : {}),
+            prompt,
+            workspaceDir,
+        });
+        if (result.status === 'failed') {
+            logger.warn('Review summary synthesis failed', {
+                findingsCount: findings.length,
+                reviewObservationsCount: reviewObservations?.length ?? 0,
+                failureReason: result.reason,
+                provider: summaryModel.provider,
+                ...(summaryModel.modelName ? { modelName: summaryModel.modelName } : {}),
+                attempt: index + 1,
+                attemptsTotal: summaryModels.length,
+                ...(result.error ? { error: result.error } : {}),
+                ...(result.timedOut !== undefined ? { timedOut: result.timedOut } : {}),
+                ...(result.durationMs !== undefined ? { durationMs: result.durationMs } : {}),
+                ...(result.outputChars !== undefined ? { outputChars: result.outputChars } : {}),
+            });
+            continue;
+        }
+        const summary = result.summary.trim();
+        logger.info('Review summary synthesis succeeded', {
+            findingsCount: findings.length,
+            reviewObservationsCount: reviewObservations?.length ?? 0,
+            provider: summaryModel.provider,
+            ...(summaryModel.modelName ? { modelName: summaryModel.modelName } : {}),
+            attempt: index + 1,
+            attemptsTotal: summaryModels.length,
+            durationMs: result.durationMs,
+            outputChars: result.outputChars,
+            summaryChars: summary.length,
+        });
+        return summary;
+    }
+    return null;
+}
+export function buildFallbackSummary({ prTitle, findings, }) {
+    const safeTitle = prTitle.trim();
+    const base = safeTitle ? `This PR updates ${safeTitle}.` : 'This PR updates the codebase.';
+    if (findings.length === 0) {
+        return `${base} No issues were flagged in the reviewed diff.`;
+    }
+    return `${base}\n\nFew things worth tightening:\n- See the inline comments for the issues found in the review.`;
+}

package/sandbox/dist/tasks/review/review.js

@@ -0,0 +1,391 @@
+import { performance } from 'node:perf_hooks';
+import { SpanStatusCode } from '@opentelemetry/api';
+import { getDefaultReviewModels } from 'doistbot-repo-config';
+import { recordTaskMetrics } from '../../core/datadog-metrics.js';
+import { parseBaseContext, requiredEnv, WORKSPACE_DIR } from '../../core/environment.js';
+import { logger } from '../../core/logging.js';
+import { cloneRepository, createGitHubClients } from '../../core/shared.js';
+import { withPhase } from '../../core/tracing.js';
+import { shutdownTracing } from '../../core/tracing-setup.js';
+import { createOpenRouterCredential } from '../../providers/credentials.js';
+import { getReviewCheckRunTitle, isAnotherReviewInProgress, postReviewFailureCheckRun, postReviewInProgressCheckRun, postReviewSuccessCheckRun, postStaleReviewPointerIfHeadMoved, } from './check-run.js';
+import { fetchReviewConversationContext } from './conversation-context.js';
+import {} from './diff.js';
+import { formatReviewForTerminal } from './format.js';
+import { formatGithubReviewComments, formatGithubReviewSummary } from './github-comment-format.js';
+import { REVIEW_FOCUS_DEFINITIONS } from './multi-focus-prompt.js';
+import { appendReviewFeedbackLink } from './review-feedback.js';
+import { createGitHubReviewModeContext } from './review-mode-github.js';
+import { runSharedReview } from './runner.js';
+const REVIEW_EVENT = 'COMMENT';
+const DEFAULT_PRODUCTION_REVIEW_MODELS = getDefaultReviewModels();
+const SUPPORTED_PRODUCTION_REVIEW_MODELS = ['openai', 'deepseek', 'grok', 'zai'];
+const REVIEW_FOCUSES = REVIEW_FOCUS_DEFINITIONS.map((focus) => focus.name);
+function optionalEnv(name) {
+    const value = process.env[name]?.trim();
+    return value ? value : undefined;
+}
+function parseContext() {
+    const base = parseBaseContext();
+    return {
+        ...base,
+        branch: requiredEnv('BRANCH'),
+        baseBranch: requiredEnv('BASE_BRANCH'),
+        headSha: optionalEnv('HEAD_SHA'),
+        geminiApiKey: optionalEnv('GEMINI_API_KEY'),
+        openRouterApiKey: optionalEnv('OPENROUTER_API_KEY'),
+        openaiApiKey: optionalEnv('OPENAI_KEY'),
+        reviewModelsEnabled: parseReviewModelsEnv(process.env.REVIEW_MODELS_ENABLED),
+        reviewFocusesEnabled: parseReviewFocusesEnv(process.env.REVIEW_FOCUSES_ENABLED),
+        reviewRoutingCategory: optionalEnv('REVIEW_ROUTING_CATEGORY'),
+        reviewRoutingRuleId: optionalEnv('REVIEW_ROUTING_RULE_ID'),
+        reviewDispatchLockAcquired: process.env.REVIEW_DISPATCH_LOCK_ACQUIRED === 'true',
+        reviewDispatchLockCheckRunId: optionalNumberEnv('REVIEW_DISPATCH_LOCK_CHECK_RUN_ID'),
+        dryRun: process.env.DRY_RUN?.toLowerCase() === 'true',
+    };
+}
+export function parseReviewModelsEnv(value) {
+    return parseCsvAllowList({
+        value,
+        allowedValues: SUPPORTED_PRODUCTION_REVIEW_MODELS,
+        fallback: DEFAULT_PRODUCTION_REVIEW_MODELS,
+        envName: 'REVIEW_MODELS_ENABLED',
+    });
+}
+export function parseReviewFocusesEnv(value) {
+    return parseCsvAllowList({
+        value,
+        allowedValues: REVIEW_FOCUSES,
+        fallback: REVIEW_FOCUSES,
+        envName: 'REVIEW_FOCUSES_ENABLED',
+    });
+}
+function parseCsvAllowList({ value, allowedValues, fallback, envName, }) {
+    if (value === undefined) {
+        return [...fallback];
+    }
+    const allowed = new Set(allowedValues);
+    const requested = value
+        .split(',')
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0);
+    if (requested.length === 0) {
+        throw new Error(`${envName} must include at least one supported value when set.`);
+    }
+    const unsupported = requested.filter((item) => !allowed.has(item));
+    if (unsupported.length > 0) {
+        throw new Error(`${envName} contains unsupported value(s): ${[...new Set(unsupported)].join(', ')}. ` +
+            `Supported values: ${allowedValues.join(', ')}.`);
+    }
+    return [...new Set(requested)];
+}
+function optionalNumberEnv(name) {
+    const value = optionalEnv(name);
+    if (value === undefined) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function getConversationSummaryApiKeys(ctx) {
+    const apiKeys = {};
+    if (ctx.geminiApiKey) {
+        apiKeys.gemini = ctx.geminiApiKey;
+    }
+    if (ctx.reviewModelsEnabled.includes('openai') && ctx.openaiApiKey) {
+        apiKeys.openai = ctx.openaiApiKey;
+    }
+    return apiKeys;
+}
+async function main() {
+    const startedAt = performance.now();
+    const ctx = parseContext();
+    const logContext = {
+        deliveryId: ctx.deliveryId ?? 'unknown',
+        repository: `${ctx.owner}/${ctx.repo}`,
+        prNumber: ctx.prNumber,
+    };
+    logger.setBaseContext(logContext);
+    logger.info('Review task started', {
+        dryRun: ctx.dryRun,
+        reviewModelsEnabled: ctx.reviewModelsEnabled,
+        reviewFocusesEnabled: ctx.reviewFocusesEnabled,
+        reviewRoutingCategory: ctx.reviewRoutingCategory,
+        reviewRoutingRuleId: ctx.reviewRoutingRuleId,
+    });
+    let exitCode = 0;
+    let reviewCompletedSuccessfully = false;
+    let reviewMetricModels = [];
+    await withPhase('review', {
+        task: 'review',
+        'gen_ai.operation.name': 'invoke_agent',
+        'gen_ai.agent.name': 'doistbot.review',
+        'pr.number': ctx.prNumber,
+        dry_run: ctx.dryRun,
+    }, async (span) => {
+        // Inside the span so installation-auth/setup failures are captured
+        // by the root `review` trace.
+        const { app, readOctokit, writeOctokit } = await createGitHubClients(ctx);
+        // GitHub's Check Runs API requires App-installation auth; calling it
+        // with writeOctokit (the doistbot PAT) returns 403. Centralize the
+        // choice here so it can't drift as new Check Run call sites get added.
+        // See: https://docs.github.com/rest/checks/runs#create-a-check-run
+        const checkRunOctokit = readOctokit;
+        // Centralizes the boilerplate for posting the final Check Run from the
+        // ~7 cleanup paths below. Skips silently when no headSha is available
+        // (rare; logged at startup) or when running under dryRun.
+        async function postFinalCheckRun(input) {
+            if (ctx.dryRun || !ctx.headSha)
+                return;
+            const baseArgs = {
+                octokit: checkRunOctokit,
+                owner: ctx.owner,
+                repo: ctx.repo,
+                sha: ctx.headSha,
+                pullNumber: ctx.prNumber,
+                deliveryId: ctx.deliveryId,
+                checkRunId: ctx.reviewDispatchLockCheckRunId,
+            };
+            if (input.conclusion === 'success') {
+                await postReviewSuccessCheckRun({ ...baseArgs, review: input.review });
+            }
+            else {
+                await postReviewFailureCheckRun(baseArgs);
+            }
+            // If the PR head moved during the review, also drop a neutral
+            // stale-pointer Check Run on the current head so reviewers can
+            // find their way back to the original. Closes the in-progress-
+            // during-push gap the webhook-side fix (#311) can't cover on its
+            // own — see the helper doc-comment for the full timeline.
+            await postStaleReviewPointerIfHeadMoved({
+                octokit: checkRunOctokit,
+                owner: ctx.owner,
+                repo: ctx.repo,
+                pullNumber: ctx.prNumber,
+                reviewedSha: ctx.headSha,
+                reviewedTitle: getReviewCheckRunTitle(input),
+            });
+        }
+        try {
+            if (!ctx.dryRun && ctx.headSha) {
+                // Concurrency lock + "review running" signal both come from the
+                // same Check Run: an `in_progress` run is posted at start (and
+                // upserted to the final conclusion when the review completes).
+                //
+                // Caveat: the lock is keyed by the *triggering* SHA, but the
+                // review pipeline itself (cloneRepository / pulls.listFiles)
+                // operates on the PR's current head — they're not pinned to
+                // ctx.headSha. So a new commit landing during a review can slip
+                // past this lock and produce a duplicate review of the same final
+                // PR state. Cost is bounded (≤2× LLM per fast-push-during-review)
+                // and the case is rare; pinning the pipeline is its own follow-up
+                // (see PR #274's "Deferred" section, finding C2).
+                //
+                // There's also a small TOCTOU window between this check and the
+                // in_progress post — same race the prior comment-based lock had,
+                // and same bound (one duplicate review when it fires).
+                if (!ctx.reviewDispatchLockAcquired) {
+                    const otherInProgress = await isAnotherReviewInProgress({
+                        octokit: checkRunOctokit,
+                        owner: ctx.owner,
+                        repo: ctx.repo,
+                        sha: ctx.headSha,
+                        deliveryId: ctx.deliveryId,
+                    });
+                    if (otherInProgress) {
+                        logger.info('Another review is already in progress on this SHA, skipping');
+                        return;
+                    }
+                }
+                await postReviewInProgressCheckRun({
+                    octokit: checkRunOctokit,
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    sha: ctx.headSha,
+                    pullNumber: ctx.prNumber,
+                    deliveryId: ctx.deliveryId,
+                    checkRunId: ctx.reviewDispatchLockCheckRunId,
+                });
+            }
+            else if (ctx.dryRun) {
+                logger.info('Dry run enabled, skipping check-run posting');
+            }
+            else {
+                // No HEAD_SHA available — can't post Check Runs (which need a
+                // SHA) and can't lock. Reviews proceed unguarded; a rare
+                // simultaneous /review may double-bill on the same PR. Log so
+                // this is visible.
+                logger.warn('HEAD_SHA missing; review will proceed without a Check Run lock or status posting');
+            }
+            await cloneRepository({
+                app,
+                owner: ctx.owner,
+                repo: ctx.repo,
+                prNumber: ctx.prNumber,
+                installationId: ctx.installationId,
+            });
+            const [prResponse, files] = await Promise.all([
+                readOctokit.rest.pulls.get({
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    pull_number: ctx.prNumber,
+                }),
+                readOctokit.paginate(readOctokit.rest.pulls.listFiles, {
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    pull_number: ctx.prNumber,
+                    per_page: 100,
+                }),
+            ]);
+            const pr = prResponse.data;
+            const prAuthor = pr.user?.login ?? 'unknown';
+            function loadPrConversation() {
+                return fetchReviewConversationContext({
+                    octokit: readOctokit,
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    pullNumber: ctx.prNumber,
+                    prAuthor: pr.user?.login ?? undefined,
+                    summaryApiKeys: getConversationSummaryApiKeys(ctx),
+                    workspaceDir: WORKSPACE_DIR,
+                });
+            }
+            reviewMetricModels = [...ctx.reviewModelsEnabled];
+            const reviewApiKeys = {};
+            if (ctx.geminiApiKey) {
+                reviewApiKeys.gemini = ctx.geminiApiKey;
+            }
+            if (ctx.openRouterApiKey) {
+                reviewApiKeys.deepseek = createOpenRouterCredential(ctx.openRouterApiKey);
+                reviewApiKeys.grok = createOpenRouterCredential(ctx.openRouterApiKey);
+                reviewApiKeys.zai = createOpenRouterCredential(ctx.openRouterApiKey);
+            }
+            if (ctx.openaiApiKey) {
+                reviewApiKeys.openai = ctx.openaiApiKey;
+            }
+            const reviewMode = createGitHubReviewModeContext({
+                octokit: readOctokit,
+                owner: ctx.owner,
+                repo: ctx.repo,
+                pullNumber: ctx.prNumber,
+                baseSha: pr.base.sha,
+                labels: pr.labels,
+            });
+            const reviewResult = await runSharedReview({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                prNumber: ctx.prNumber,
+                branch: ctx.branch,
+                baseBranch: ctx.baseBranch,
+                prTitle: pr.title ?? '',
+                prBody: pr.body ?? '',
+                loadPrConversation,
+                ...(reviewMode ? { reviewMode } : {}),
+                prAuthor,
+                files: files,
+                apiKeys: reviewApiKeys,
+                reviewModelsEnabled: ctx.reviewModelsEnabled,
+                reviewFocusesEnabled: ctx.reviewFocusesEnabled,
+                requiredReviewModels: ctx.reviewModelsEnabled,
+                workspaceDir: WORKSPACE_DIR,
+            });
+            reviewMetricModels = reviewResult.metricModels;
+            if (reviewResult.status === 'skipped') {
+                if (reviewResult.reason === 'no_diff' || reviewResult.reason === 'empty_diff') {
+                    await postFinalCheckRun({
+                        conclusion: 'success',
+                        review: { summary: '', comments: [] },
+                    });
+                }
+                else {
+                    // no_models / no_review / empty_review post a failing
+                    // check run, so the span must end ERROR to match — a
+                    // return-based failure won't trip withPhase's throw path.
+                    span.setStatus({
+                        code: SpanStatusCode.ERROR,
+                        message: `review skipped: ${reviewResult.reason}`,
+                    });
+                    await postFinalCheckRun({ conclusion: 'failure' });
+                }
+                return;
+            }
+            const { review } = reviewResult;
+            if (ctx.dryRun) {
+                logger.info('Dry run enabled, printing review output instead of posting to GitHub', {
+                    commentsCount: review.comments.length,
+                });
+                process.stdout.write(`${formatReviewForTerminal({
+                    review,
+                })}\n`);
+            }
+            else {
+                await submitReview({
+                    octokit: writeOctokit,
+                    owner: ctx.owner,
+                    repo: ctx.repo,
+                    pull_number: ctx.prNumber,
+                    deliveryId: ctx.deliveryId,
+                    review,
+                });
+                await postFinalCheckRun({ conclusion: 'success', review });
+            }
+            logger.info('Review task completed');
+            reviewCompletedSuccessfully = true;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logger.error('Review failed', {
+                error: message,
+            });
+            await postFinalCheckRun({ conclusion: 'failure' });
+            // Set the span status before the run exits; deferring process.exit
+            // until after withPhase lets phase.end flush.
+            span.setStatus({ code: SpanStatusCode.ERROR, message });
+            exitCode = 1;
+        }
+        finally {
+            if (reviewMetricModels.length > 0) {
+                await recordTaskMetrics({
+                    type: 'review',
+                    repository: `${ctx.owner}/${ctx.repo}`,
+                    model: reviewMetricModels,
+                    outcome: reviewCompletedSuccessfully ? 'success' : 'failure',
+                    durationMs: performance.now() - startedAt,
+                });
+            }
+        }
+    });
+    if (exitCode !== 0) {
+        await shutdownTracing();
+        process.exit(exitCode);
+    }
+}
+async function submitReview({ octokit, owner, repo, pull_number, deliveryId, review, }) {
+    const payload = {
+        owner,
+        repo,
+        pull_number,
+        event: REVIEW_EVENT,
+    };
+    if (review.summary?.length) {
+        const summaryWithFeedbackLink = appendReviewFeedbackLink(formatGithubReviewSummary(review.summary), {
+            owner,
+            repo,
+            prNumber: pull_number,
+            deliveryId,
+        });
+        if (summaryWithFeedbackLink) {
+            payload.body = summaryWithFeedbackLink;
+        }
+    }
+    if (review.comments?.length) {
+        payload.comments = formatGithubReviewComments(review.comments);
+    }
+    await octokit.rest.pulls.createReview(payload);
+    logger.info('Submitted review', {
+        commentsCount: review.comments?.length ?? 0,
+    });
+}
+if (process.env.VITEST !== 'true') {
+    main();
+}