@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/sandbox/_node_modules/doistbot-repo-config/package.json

@@ -0,0 +1,12 @@
+{
+    "name": "doistbot-repo-config",
+    "version": "1.0.0",
+    "type": "module",
+    "main": "dist/index.js",
+    "exports": {
+        ".": {
+            "types": "./src/index.ts",
+            "default": "./dist/index.js"
+        }
+    }
+}

package/sandbox/dist/core/autofix-resources.js

@@ -0,0 +1,58 @@
+import { readFileSync } from 'node:fs';
+function readNumber(file) {
+    try {
+        const value = Number(readFileSync(file, 'utf8').trim());
+        return Number.isFinite(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readCounter(file, key) {
+    try {
+        const match = readFileSync(file, 'utf8').match(new RegExp(`^${key}\\s+(\\d+)$`, 'm'));
+        return match?.[1] ? Number(match[1]) : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function sampleAutofixResources(elapsedMs) {
+    const cpuMicros = readCounter('/sys/fs/cgroup/cpu.stat', 'usage_usec');
+    const cpuNanos = cpuMicros === null ? readNumber('/sys/fs/cgroup/cpuacct/cpuacct.usage') : null;
+    return {
+        elapsedMs,
+        cpuSeconds: cpuMicros === null ? (cpuNanos === null ? null : cpuNanos / 1e9) : cpuMicros / 1e6,
+        memoryBytes: readNumber('/sys/fs/cgroup/memory.current') ??
+            readNumber('/sys/fs/cgroup/memory/memory.usage_in_bytes'),
+        memoryLimitBytes: readNumber('/sys/fs/cgroup/memory.max') ??
+            readNumber('/sys/fs/cgroup/memory/memory.limit_in_bytes'),
+        oomKills: readCounter('/sys/fs/cgroup/memory.events', 'oom_kill') ??
+            readCounter('/sys/fs/cgroup/memory/memory.oom_control', 'oom_kill'),
+    };
+}
+export function summarizeAutofixResources(samples) {
+    const first = samples[0];
+    const last = samples.at(-1);
+    const memory = samples.flatMap((sample) => sample.memoryBytes === null ? [] : [sample.memoryBytes]);
+    let peakCpuCores = null;
+    for (let index = 1; index < samples.length; index++) {
+        const previous = samples[index - 1];
+        const current = samples[index];
+        const seconds = (current.elapsedMs - previous.elapsedMs) / 1000;
+        if (seconds > 0 && current.cpuSeconds !== null && previous.cpuSeconds !== null) {
+            peakCpuCores = Math.max(peakCpuCores ?? 0, (current.cpuSeconds - previous.cpuSeconds) / seconds);
+        }
+    }
+    return {
+        sampledPeakMemoryBytes: memory.length ? Math.max(...memory) : null,
+        memoryLimitBytes: last?.memoryLimitBytes ?? null,
+        cpuSeconds: first?.cpuSeconds != null && last?.cpuSeconds != null
+            ? Math.max(0, last.cpuSeconds - first.cpuSeconds)
+            : null,
+        peakCpuCores,
+        oomKills: first?.oomKills != null && last?.oomKills != null
+            ? Math.max(0, last.oomKills - first.oomKills)
+            : null,
+    };
+}

package/sandbox/dist/core/autofix-service-query.js

@@ -0,0 +1,69 @@
+export function serviceQueryArgs(cli, args) {
+    if (!args.length || args.length > 100 || args.some((arg) => arg.includes('\0'))) {
+        throw new Error('Supply CLI arguments for a read-only evidence query');
+    }
+    if (!args.includes('--') &&
+        (args.at(-1) === '--help' || args.at(-1) === '-h' || args[0] === '--version'))
+        return args;
+    const [group, action] = args;
+    const route = `${group} ${action}`;
+    if (cli === 'gh') {
+        for (let index = 0; index < args.length; index++) {
+            const arg = args[index];
+            if (/^--hostname(?:=|$)/.test(arg))
+                throw new Error('GitHub evidence queries must use github.com');
+            if (/^https?:\/\//i.test(arg)) {
+                const url = new URL(arg);
+                if (url.protocol !== 'https:' ||
+                    url.host !== 'github.com' ||
+                    url.username ||
+                    url.password)
+                    throw new Error('GitHub evidence queries must use HTTPS on github.com');
+            }
+            const repo = arg === '-R' || arg === '--repo'
+                ? args[index + 1]
+                : arg.startsWith('--repo=')
+                    ? arg.slice(7)
+                    : arg.startsWith('-R')
+                        ? arg.slice(2)
+                        : route === 'repo view' && index === 2 && !arg.startsWith('-')
+                            ? arg
+                            : undefined;
+            if (repo &&
+                !repo.startsWith('https://github.com/') &&
+                repo.split('/').length > 2 &&
+                !repo.startsWith('github.com/'))
+                throw new Error('GitHub repository queries must use github.com');
+        }
+        if (group === 'api') {
+            if (args.some((arg) => /^-(?:X|f|F)|^--(?:method|field|raw-field|input)(?:=|$)/.test(arg))) {
+                throw new Error('GitHub API queries use GET and cannot supply a request body');
+            }
+            return [...args, '--method', 'GET', '--hostname', 'github.com'];
+        }
+        if ([
+            'issue view',
+            'issue list',
+            'pr view',
+            'pr diff',
+            'pr list',
+            'pr checks',
+            'repo view',
+            'run view',
+            'run list',
+            'search issues',
+            'search prs',
+            'search code',
+            'search commits',
+        ].includes(route))
+            return args;
+    }
+    if (cli === 'pup' &&
+        ['logs search', 'logs query', 'logs list', 'logs aggregate'].includes(route))
+        return args;
+    if (cli === 'sentry' &&
+        ['issue', 'event', 'trace', 'span', 'project', 'org'].includes(group ?? '') &&
+        ['view', 'get', 'list', 'search'].includes(action ?? ''))
+        return args;
+    throw new Error('Only read-only GitHub, Datadog log, and Sentry evidence queries are supported');
+}

package/sandbox/dist/core/autofix-test-policy.js

@@ -0,0 +1,11 @@
+import path from 'node:path';
+const UI_TEST_PATH = /(?:^|\/)(?:androidTest|uiTests?|uitests?|e2e|cypress|\.maestro)(?:\/|$)|(?:^|\/)[^/]*(?:UITests|UiTest|\.ui\.test\.|\.e2e\.)/i;
+const UI_TEST_FRAMEWORK = /^\s*(?:import\b.*|from\s+|}\s*from\s+).*(?:androidx\.(?:test\.(?:espresso|uiautomator)|compose\.ui\.test)|app\.cash\.paparazzi|AndroidJUnit4|@playwright\/test)|^\s*@RunWith\(AndroidJUnit4|^\s*(?:(?:let|var|val|const)\s+\w+\s*=\s*)?(?:XCUIApplication|Espresso|UiDevice|composeTestRule|browser\.url|cy\.(?:visit|get))\b/m;
+export function isForbiddenAutofixTest(file, extraPaths = [], content = '') {
+    const normalized = file.replaceAll('\\', '/');
+    return (UI_TEST_PATH.test(normalized) ||
+        UI_TEST_FRAMEWORK.test(content) ||
+        extraPaths.some((pattern) => normalized === pattern ||
+            normalized.startsWith(`${pattern.replace(/\/$/, '')}/`) ||
+            path.matchesGlob(normalized, pattern)));
+}

package/sandbox/dist/core/autofix-verification.js

@@ -0,0 +1,355 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { Ajv } from 'ajv';
+import { buildVerificationEnvironment } from './tool-environment.js';
+import { safeToolOutput } from './tool-output.js';
+export const AUTOFIX_RUNTIME_ENV = 'DOISTBOT_AUTOFIX_RUNTIME';
+const OUTPUT_LIMIT = 64_000;
+export const autofixPolicySchema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['verification'],
+    properties: {
+        guidance: { type: 'string', maxLength: 8000 },
+        forbidden_test_paths: { type: 'array', items: { type: 'string', minLength: 1 } },
+        verification: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['checks'],
+            properties: {
+                checks: {
+                    type: 'array',
+                    maxItems: 20,
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['name', 'command'],
+                        properties: {
+                            name: { type: 'string', pattern: '^[a-zA-Z0-9_-]{1,64}$' },
+                            command: { type: 'string', minLength: 1, maxLength: 4000 },
+                            use_test_selectors: { type: 'boolean' },
+                        },
+                    },
+                },
+            },
+        },
+    },
+};
+export const validateAutofixPolicy = new Ajv().compile(autofixPolicySchema);
+const checkResultProperties = {
+    name: { type: 'string' },
+    command: { type: 'string' },
+    round: { type: 'integer', minimum: 1 },
+    fingerprint: { type: 'string' },
+    testSelectors: {
+        type: 'array',
+        maxItems: 30,
+        items: { type: 'string', maxLength: 200 },
+    },
+    startedAtMs: { type: 'integer' },
+    buildStartedAtMs: { type: ['integer', 'null'] },
+    buildDurationMs: { type: ['number', 'null'] },
+    setupDurationMs: { type: ['number', 'null'] },
+    durationMs: { type: 'number', minimum: 0 },
+    exitCode: { type: ['integer', 'null'] },
+    signal: { type: ['string', 'null'] },
+    timedOut: { type: 'boolean' },
+    output: { type: 'string', maxLength: OUTPUT_LIMIT },
+    outputTruncated: { type: 'boolean' },
+    status: { enum: ['running', 'finished'] },
+};
+export const verificationStateSchema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['roundsUsed', 'results'],
+    properties: {
+        roundsUsed: { type: 'integer', minimum: 0 },
+        testSelectors: checkResultProperties.testSelectors,
+        results: {
+            type: 'array',
+            items: {
+                type: 'object',
+                additionalProperties: false,
+                required: Object.keys(checkResultProperties),
+                properties: checkResultProperties,
+            },
+        },
+    },
+};
+const validateState = new Ajv().compile(verificationStateSchema);
+const validateResult = new Ajv().compile({
+    type: 'object',
+    additionalProperties: false,
+    required: Object.keys(checkResultProperties),
+    properties: checkResultProperties,
+});
+const validateRuntime = new Ajv().compile({
+    type: 'object',
+    additionalProperties: false,
+    required: ['repoPath', 'statePath', 'deadlineMs', 'policy'],
+    properties: {
+        repoPath: { type: 'string', minLength: 1 },
+        statePath: { type: 'string', minLength: 1 },
+        deadlineMs: { type: 'integer', minimum: 1 },
+        policy: autofixPolicySchema,
+    },
+});
+export function readAutofixRuntime(file) {
+    const data = JSON.parse(readFileSync(file, 'utf8'));
+    if (!validateRuntime(data))
+        throw new Error('Invalid autofix runtime configuration');
+    return data;
+}
+export function readVerificationState(file) {
+    const data = JSON.parse(readFileSync(file, 'utf8'));
+    if (!validateState(data))
+        throw new Error('Invalid autofix verification state');
+    let partial;
+    try {
+        partial = JSON.parse(readFileSync(`${file}.running`, 'utf8'));
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+    }
+    if (partial !== undefined) {
+        if (!validateResult(partial))
+            throw new Error('Invalid running verification result');
+        const index = data.results.findIndex((result) => result.status === 'running' &&
+            result.name === partial.name &&
+            result.round === partial.round &&
+            result.startedAtMs === partial.startedAtMs &&
+            result.command === partial.command &&
+            result.fingerprint === partial.fingerprint);
+        if (index >= 0)
+            data.results[index] = partial;
+    }
+    return data;
+}
+export function saveVerificationState(file, state) {
+    writeFileSync(`${file}.tmp`, JSON.stringify(state), { mode: 0o600 });
+    renameSync(`${file}.tmp`, file);
+}
+export function selectCheckResult(state, check, fingerprint) {
+    const results = [...state.results]
+        .reverse()
+        .filter((result) => result.name === check.name && result.command === check.command);
+    const current = results.filter((result) => isCurrentCheck(result, check, fingerprint, state));
+    return (current.find((result) => result.status === 'finished' && result.exitCode === 0 && !result.timedOut) ??
+        current[0] ??
+        results[0]);
+}
+export function isCurrentCheck(result, check, fingerprint, state) {
+    return (result.fingerprint === fingerprint &&
+        JSON.stringify(result.testSelectors) ===
+            JSON.stringify(check.use_test_selectors ? (state.testSelectors ?? []) : []));
+}
+export function summarizeVerification(state, policy, fingerprint) {
+    const summary = {
+        roundsUsed: state.roundsUsed,
+        results: policy.verification.checks.map((check) => {
+            const result = selectCheckResult(state, check, fingerprint);
+            return {
+                name: check.name,
+                status: result
+                    ? isCurrentCheck(result, check, fingerprint, state)
+                        ? result.status
+                        : 'stale'
+                    : 'not-run',
+                exitCode: result?.exitCode ?? null,
+                signal: result?.signal ?? null,
+                timedOut: result?.timedOut ?? false,
+                round: result?.round ?? null,
+                durationMs: result?.durationMs ?? null,
+                buildDurationMs: result?.buildDurationMs ?? null,
+                setupDurationMs: result?.setupDurationMs ?? null,
+                output: result?.output.slice(-6000) ?? '',
+                outputTruncated: result
+                    ? result.outputTruncated || result.output.length > 6000
+                    : false,
+            };
+        }),
+    };
+    let text = JSON.stringify(summary);
+    while (text.length > 24_000) {
+        for (const result of summary.results) {
+            if (result.output) {
+                result.output = result.output.slice(-Math.floor(result.output.length / 2));
+                if (result.output.length === 1)
+                    result.output = '';
+                result.outputTruncated = true;
+            }
+        }
+        text = JSON.stringify(summary);
+    }
+    return text;
+}
+export class AutofixVerifier {
+    runtime;
+    fingerprint;
+    record;
+    busy = false;
+    constructor(runtime, fingerprint, record) {
+        this.runtime = runtime;
+        this.fingerprint = fingerprint;
+        this.record = record;
+    }
+    async verify(names, signal, testSelectors) {
+        if (this.busy)
+            throw new Error('A verification round is already running');
+        this.busy = true;
+        try {
+            const { policy, statePath, deadlineMs } = this.runtime;
+            const requested = new Set(names);
+            const selected = policy.verification.checks.filter((check) => requested.has(check.name));
+            if (requested.size === 0 || selected.length !== requested.size) {
+                throw new Error('Select one or more check names from the repository policy');
+            }
+            const state = readVerificationState(statePath);
+            const checks = state.roundsUsed === 0 ? policy.verification.checks : selected;
+            const fingerprint = this.fingerprint();
+            state.testSelectors = testSelectors ?? state.testSelectors ?? [];
+            const pending = checks.filter((check) => {
+                const result = selectCheckResult(state, check, fingerprint);
+                return (!result ||
+                    !isCurrentCheck(result, check, fingerprint, state) ||
+                    result.status !== 'finished' ||
+                    result.exitCode !== 0 ||
+                    result.timedOut);
+            });
+            saveVerificationState(statePath, state);
+            if (pending.length === 0)
+                return state;
+            if (signal?.aborted || Date.now() >= deadlineMs)
+                throw new Error('Autofix time limit reached');
+            state.roundsUsed++;
+            saveVerificationState(statePath, state);
+            for (const check of pending) {
+                if (signal?.aborted || Date.now() >= deadlineMs)
+                    break;
+                const result = {
+                    name: check.name,
+                    command: check.command,
+                    round: state.roundsUsed,
+                    fingerprint,
+                    testSelectors: check.use_test_selectors ? state.testSelectors : [],
+                    startedAtMs: Date.now(),
+                    buildStartedAtMs: null,
+                    buildDurationMs: null,
+                    setupDurationMs: null,
+                    durationMs: 0,
+                    exitCode: null,
+                    signal: null,
+                    timedOut: false,
+                    output: '',
+                    outputTruncated: false,
+                    status: 'running',
+                };
+                state.results.push(result);
+                saveVerificationState(statePath, state);
+                await this.runCheck(result, state, signal);
+            }
+            return state;
+        }
+        finally {
+            this.busy = false;
+        }
+    }
+    async runCheck(result, state, signal) {
+        const startedAt = Date.now();
+        const child = spawn('/bin/sh', ['-c', result.command], {
+            cwd: this.runtime.repoPath,
+            detached: process.platform !== 'win32',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...buildVerificationEnvironment(),
+                DOISTBOT_TEST_SELECTORS: result.testSelectors.join('\n'),
+            },
+        });
+        let rawTail = '';
+        const { deadlineMs, statePath } = this.runtime;
+        let stopping;
+        function stop() {
+            if (stopping)
+                return;
+            result.timedOut = Date.now() >= deadlineMs;
+            function kill(signalName) {
+                try {
+                    if (child.pid && process.platform !== 'win32')
+                        process.kill(-child.pid, signalName);
+                    else
+                        child.kill(signalName);
+                }
+                catch {
+                    /* The process can finish before cancellation. */
+                }
+            }
+            kill('SIGTERM');
+            stopping = new Promise((resolve) => {
+                setTimeout(() => {
+                    kill('SIGKILL');
+                    resolve();
+                }, 1000);
+            });
+        }
+        const timer = setTimeout(stop, Math.max(1, this.runtime.deadlineMs - Date.now()));
+        signal?.addEventListener('abort', stop, { once: true });
+        if (signal?.aborted)
+            stop();
+        function saveOutput() {
+            try {
+                result.output = safeToolOutput(rawTail).slice(-OUTPUT_LIMIT);
+            }
+            catch {
+                result.output = 'Tool output withheld: filtering failed.';
+            }
+            result.durationMs = Date.now() - startedAt;
+            if (result.buildStartedAtMs !== null) {
+                result.buildDurationMs = Date.now() - result.buildStartedAtMs;
+                result.setupDurationMs = result.buildStartedAtMs - startedAt;
+            }
+        }
+        function saveRunning() {
+            saveOutput();
+            writeFileSync(`${statePath}.running.tmp`, JSON.stringify(result), { mode: 0o600 });
+            renameSync(`${statePath}.running.tmp`, `${statePath}.running`);
+        }
+        function onData(chunk) {
+            const next = rawTail + chunk;
+            if (result.buildStartedAtMs === null && /(?:^|\n)DOISTBOT_BUILD_START\r?\n/.test(next))
+                result.buildStartedAtMs = Date.now();
+            result.outputTruncated ||= next.length > OUTPUT_LIMIT;
+            rawTail = next.slice(-OUTPUT_LIMIT);
+        }
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', onData);
+        child.stderr.on('data', onData);
+        const outputTimer = setInterval(saveRunning, 1000);
+        await new Promise((resolve) => {
+            child.once('error', (error) => {
+                onData(error.message);
+                result.exitCode = -1;
+                resolve();
+            });
+            child.once('close', (code, childSignal) => {
+                result.exitCode = code;
+                result.signal = childSignal;
+                resolve();
+            });
+        });
+        clearTimeout(timer);
+        clearInterval(outputTimer);
+        await stopping;
+        signal?.removeEventListener('abort', stop);
+        result.status = 'finished';
+        saveOutput();
+        saveVerificationState(statePath, state);
+        rmSync(`${statePath}.running`, { force: true });
+        this.record(result);
+    }
+}
+export function hashAutofixInputs(value) {
+    return createHash('sha256').update(value).digest('hex');
+}

package/sandbox/dist/core/bot-logins.js

@@ -0,0 +1,14 @@
+export const KNOWN_DOISTBOT_LOGINS = new Set([
+    'doistbot',
+    'doistbot[bot]',
+    'doist-bot',
+    'doist-bot[bot]',
+    'doistbot-app',
+    'doistbot-app[bot]',
+]);
+export function isKnownDoistbotLogin(login) {
+    if (!login) {
+        return false;
+    }
+    return KNOWN_DOISTBOT_LOGINS.has(login.toLowerCase());
+}

package/sandbox/dist/core/check-run.js

@@ -0,0 +1,158 @@
+import { logger } from './logging.js';
+/**
+ * GitHub Check Run output titles render in the Checks tab list and in the PR
+ * conversation; we keep them short for at-a-glance scannability.
+ */
+const MAX_TITLE_LENGTH = 100;
+function truncateTitle(value) {
+    if (value.length <= MAX_TITLE_LENGTH)
+        return value;
+    return `${value.slice(0, MAX_TITLE_LENGTH - 1)}…`;
+}
+/**
+ * Generic GitHub Check Run poster. Failures (e.g., missing `checks:write`
+ * permission) are logged at `warn` and swallowed — callers have typically
+ * already completed their main work and we don't want a check-posting failure
+ * to mask the primary outcome (a review, a fix-retry, etc.).
+ *
+ * Upserts on (sha, name): if a check run with the same name already exists for
+ * the SHA (e.g. an earlier in-progress run from this delivery, or a previous
+ * `/review` invocation), updates that run in place rather than appending a
+ * fresh one. Matches the prior commit-status behavior of "single current
+ * result" per (SHA, context), and lets the in_progress→completed transition
+ * happen naturally on the second call.
+ */
+export async function postCheckRun(params) {
+    const { octokit, owner, repo, sha, title, summary, detailsUrl, name, externalId } = params;
+    const checkRunId = params.checkRunId;
+    const status = params.status ?? 'completed';
+    const conclusion = status === 'completed' ? params.conclusion : undefined;
+    const truncatedTitle = truncateTitle(title);
+    // Fields shared between checks.create and checks.update — extracted so the
+    // two call sites stay in sync as fields are added.
+    const payload = {
+        owner,
+        repo,
+        status,
+        conclusion,
+        details_url: detailsUrl,
+        external_id: externalId,
+        output: { title: truncatedTitle, summary },
+    };
+    try {
+        if (checkRunId !== undefined) {
+            await octokit.rest.checks.update({
+                ...payload,
+                check_run_id: checkRunId,
+            });
+            logger.info('Updated known check run', {
+                component: 'check-run',
+                name,
+                sha,
+                status,
+                conclusion,
+                checkRunId,
+            });
+            return;
+        }
+        const existing = await octokit.rest.checks.listForRef({
+            owner,
+            repo,
+            ref: sha,
+            check_name: name,
+            per_page: 5,
+        });
+        // Prefer matching by external_id when we have one; otherwise fall back
+        // to the first run for the (sha, name) tuple. This keeps a delivery
+        // from accidentally clobbering another delivery's run if multiple
+        // exist (e.g. after a transient lock-lookup failure).
+        const existingRun = externalId
+            ? (existing.data.check_runs.find((run) => (run.external_id ?? undefined) === externalId) ?? existing.data.check_runs[0])
+            : existing.data.check_runs[0];
+        if (existingRun) {
+            await octokit.rest.checks.update({
+                ...payload,
+                check_run_id: existingRun.id,
+            });
+            logger.info('Updated existing check run', {
+                component: 'check-run',
+                name,
+                sha,
+                status,
+                conclusion,
+                checkRunId: existingRun.id,
+            });
+            return;
+        }
+        await octokit.rest.checks.create({
+            ...payload,
+            name,
+            head_sha: sha,
+        });
+        logger.info('Posted check run', {
+            component: 'check-run',
+            name,
+            sha,
+            status,
+            conclusion,
+        });
+    }
+    catch (error) {
+        logger.warn('Failed to post check run', {
+            component: 'check-run',
+            name,
+            sha,
+            status,
+            conclusion,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Concurrency lock: returns `true` if there's an `in_progress` check run for
+ * the given (sha, name) whose `external_id` is from a different delivery.
+ *
+ * Replaces the pre-Check-Runs PR-comment-based lock. Same semantics: if a
+ * different delivery is already mid-review on the same SHA, skip rather
+ * than double-bill the LLM. Same-delivery in-progress runs (e.g. a retry
+ * after a webhook redelivery) are not treated as locks.
+ *
+ * `per_page: 5` defends against the rare case where multiple in-progress
+ * runs slipped through earlier (e.g. transient lock-lookup failure); we'd
+ * still see them all and lock if any belongs to another delivery. The
+ * normal steady state is one run per (sha, name).
+ *
+ * Caveat — TOCTOU: there's a window between this check and the caller's
+ * subsequent in_progress post where a concurrent delivery can pass its
+ * own check too, leading both to proceed. The pre-Check-Runs comment lock
+ * had the same race; bound is the same (≤2× LLM per concurrent fire).
+ *
+ * Failures are logged at `warn` and treated as "no lock found" so a
+ * read-side outage can't permanently wedge the bot. The cost of a false
+ * negative is one duplicate review.
+ */
+export async function isAnotherDeliveryInProgress({ octokit, owner, repo, sha, name, deliveryId, }) {
+    try {
+        const response = await octokit.rest.checks.listForRef({
+            owner,
+            repo,
+            ref: sha,
+            check_name: name,
+            per_page: 5,
+        });
+        return response.data.check_runs.some(
+        // GitHub returns `null` for `external_id` when it was unset on
+        // creation; normalise to `undefined` so it compares equal to a
+        // missing `deliveryId` (e.g. local CLI retries).
+        (run) => run.status === 'in_progress' && (run.external_id ?? undefined) !== deliveryId);
+    }
+    catch (error) {
+        logger.warn('Failed to look up in-progress check runs (lock check)', {
+            component: 'check-run',
+            name,
+            sha,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}