@usepipr/runtime 0.3.2 → 0.3.3

package/dist/{commands-CQg9QVZt.mjs → commands-C1sVsbEj.mjs}

@@ -2398,6 +2398,14 @@ type CategorizedFinding = {
   suggestedFix?: string;
 };
 
+type ReviewSummary = {
+  headline: string;
+  changeSummary: string[];
+  riskLevel: "low" | "medium" | "high";
+  riskSummary: string;
+  reviewerFocus: string[];
+};
+
 const categorizedFindingSchema = z.strictObject({
   title: z.string(),
   severity: z.enum(["critical", "high", "medium", "low", "nit"]),
@@ -2420,6 +2428,14 @@ const categorizedFindingSchema = z.strictObject({
   suggestedFix: z.string().optional(),
 });
 
+const reviewSummarySchema = z.strictObject({
+  headline: z.string(),
+  changeSummary: z.array(z.string()).min(1).max(4),
+  riskLevel: z.enum(["low", "medium", "high"]),
+  riskSummary: z.string(),
+  reviewerFocus: z.array(z.string()).max(4),
+});
+
 export default definePipr((pipr) => {
   const model = pipr.model({
     provider: "deepseek",
@@ -2433,7 +2449,7 @@ export default definePipr((pipr) => {
   const reviewOutput = pipr.schema({
     id: "review/categorized-findings",
     schema: z.strictObject({
-      summary: z.string(),
+      summary: reviewSummarySchema,
       findings: z.array(categorizedFindingSchema),
     }),
   });
@@ -2449,6 +2465,11 @@ export default definePipr((pipr) => {
       medium for important follow-up, low for minor actionable improvements,
       and nit only for tiny but concrete issues. Include suggestedFix only when
       there is an exact replacement for the selected range.
+
+      Make summary maintainer-facing and scannable: one concrete headline, one
+      to four behavior-focused change bullets, a risk level with rationale, and
+      reviewer focus only for useful human follow-up. Put actionable defects in
+      findings, not only in summary.
     \`,
     output: reviewOutput,
     tools: pipr.tools.readOnly,
@@ -2477,18 +2498,24 @@ export default definePipr((pipr) => {
       });
       await ctx.comment({
         main: [
-          result.summary,
+          "## Summary",
           "",
-          "## Findings",
+          \`**\${result.summary.headline}**\`,
           "",
-          findingsTable(result.findings),
+          summaryTable(result.summary, result.findings.length),
+          "",
+          "## What Changed",
+          "",
+          bulletList(result.summary.changeSummary, "No changed behavior summarized."),
+          "",
+          "## Reviewer Focus",
           "",
-          "<details>",
-          "<summary>Finding rationales</summary>",
+          bulletList(result.summary.reviewerFocus, "No special reviewer focus."),
           "",
-          findingRationales(result.findings),
+          "## Findings",
           "",
-          "</details>",
+          findingsTable(result.findings),
+          ...(result.findings.length > 0 ? ["", findingRationalesBlock(result.findings)] : []),
         ].join("\\n"),
         inlineFindings,
       });
@@ -2499,6 +2526,23 @@ export default definePipr((pipr) => {
   pipr.command({ pattern: "@pipr review", permission: "write", task });
 });
 
+function summaryTable(summary: ReviewSummary, findingCount: number): string {
+  return [
+    "| Outcome | Risk | Risk summary |",
+    "| --- | --- | --- |",
+    \`| \${findingOutcome(findingCount)} | \${labelValue(summary.riskLevel)} | \${tableCell(
+      summary.riskSummary,
+    )} |\`,
+  ].join("\\n");
+}
+
+function findingOutcome(findingCount: number): string {
+  if (findingCount === 0) {
+    return "No findings";
+  }
+  return findingCount === 1 ? "1 finding" : \`\${findingCount} findings\`;
+}
+
 function findingsTable(findings: CategorizedFinding[]): string {
   if (findings.length === 0) {
     return [
@@ -2519,22 +2563,48 @@ function findingsTable(findings: CategorizedFinding[]): string {
   ].join("\\n");
 }
 
-function findingRationales(findings: CategorizedFinding[]): string {
+function findingRationalesBlock(findings: CategorizedFinding[]): string {
   if (findings.length === 0) {
-    return "No findings.";
+    return "";
   }
-  return findings
-    .map((finding, index) =>
-      [
-        \`### \${index + 1}. \${finding.title}\`,
-        "",
-        \`**Severity:** \${finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1)}\`,
-        \`**Category:** \${finding.category.replaceAll("-", " ")}\`,
-        "",
-        finding.rationale,
-      ].join("\\n"),
-    )
-    .join("\\n\\n");
+  return [
+    "<details>",
+    "<summary>Finding rationales</summary>",
+    "",
+    findings
+      .map((finding, index) =>
+        [
+          \`### \${index + 1}. \${finding.title}\`,
+          "",
+          \`**Severity:** \${labelValue(finding.severity)}\`,
+          \`**Category:** \${labelValue(finding.category)}\`,
+          "",
+          finding.rationale,
+        ].join("\\n"),
+      )
+      .join("\\n\\n"),
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function bulletList(items: string[], emptyText: string): string {
+  if (items.length === 0) {
+    return emptyText;
+  }
+  return items.map((item) => \`- \${lineText(item)}\`).join("\\n");
+}
+
+function labelValue(value: string): string {
+  return value.replaceAll("-", " ").replace(/^./, (char) => char.toUpperCase());
+}
+
+function lineText(value: string): string {
+  return value.replaceAll("\\n", " ").trim();
+}
+
+function tableCell(value: string): string {
+  return lineText(value).replaceAll("|", "\\\\|");
 }
 `
 };
@@ -2552,15 +2622,25 @@ const securitySastRecipe = {
 	configTs: `import { definePipr } from "@usepipr/sdk";
 import type { ReviewFinding } from "@usepipr/sdk";
 
+type SecuritySummary = {
+  headline: string;
+  riskLevel: "low" | "medium" | "high";
+  riskSummary: string;
+  reviewerFocus: string[];
+};
+
+type SecurityRisk = {
+  title: string;
+  category: "auth" | "injection" | "secret" | "crypto" | "data-exposure" | "other";
+  severity: "low" | "medium" | "high" | "critical";
+  rationale: string;
+  finding?: ReviewFinding;
+};
+
 type SecurityReview = {
-  summary: string;
-  risks: Array<{
-    title: string;
-    category: "auth" | "injection" | "secret" | "crypto" | "data-exposure" | "other";
-    severity: "low" | "medium" | "high" | "critical";
-    rationale: string;
-    finding?: ReviewFinding;
-  }>;
+  summary: SecuritySummary;
+  risks: SecurityRisk[];
+  diagramMermaid?: string;
 };
 
 export default definePipr((pipr) => {
@@ -2578,7 +2658,20 @@ export default definePipr((pipr) => {
       additionalProperties: false,
       required: ["summary", "risks"],
       properties: {
-        summary: { type: "string" },
+        summary: {
+          type: "object",
+          additionalProperties: false,
+          required: ["headline", "riskLevel", "riskSummary", "reviewerFocus"],
+          properties: {
+            headline: { type: "string" },
+            riskLevel: { type: "string", enum: ["low", "medium", "high"] },
+            riskSummary: { type: "string" },
+            reviewerFocus: {
+              type: "array",
+              items: { type: "string" },
+            },
+          },
+        },
         risks: {
           type: "array",
           items: {
@@ -2610,6 +2703,7 @@ export default definePipr((pipr) => {
             },
           },
         },
+        diagramMermaid: { type: "string" },
       },
     },
   });
@@ -2621,6 +2715,11 @@ export default definePipr((pipr) => {
       Review for exploitable security issues only. Focus on auth bypasses,
       injection, unsafe deserialization, secret exposure, cryptography misuse,
       authorization gaps, and data exposure. Do not report hypothetical style issues.
+      Make summary maintainer-facing and scannable with a concrete headline,
+      risk level, risk rationale, and only useful security follow-up. Set
+      diagramMermaid only when a high or critical risk has a concrete source-to-sink
+      path and a small Mermaid flowchart clarifies it. Do not include Markdown
+      fences in diagramMermaid.
     \`,
     output: securityOutput,
     tools: pipr.tools.readOnly,
@@ -2636,14 +2735,40 @@ export default definePipr((pipr) => {
     async run(ctx) {
       const manifest = await ctx.change.diffManifest({ compressed: true });
       const result = await ctx.pi.run(security, { manifest });
-      const inlineFindings = result.risks.flatMap((risk) => (risk.finding ? [risk.finding] : []));
-      if (result.risks.some((risk) => risk.severity === "critical" || risk.severity === "high")) {
+      const inlineFindings: ReviewFinding[] = result.risks.flatMap((risk) =>
+        risk.finding ? [risk.finding] : [],
+      );
+      const hasHighOrCriticalRisk = result.risks.some(isHighOrCriticalRisk);
+      const hasConcreteHighOrCriticalRisk = result.risks.some(
+        (risk) => isHighOrCriticalRisk(risk) && risk.finding,
+      );
+      if (hasHighOrCriticalRisk) {
         ctx.check.fail("High or critical security risk found.");
       } else {
         ctx.check.pass("No high or critical security risks found.");
       }
       await ctx.comment({
-        main: result.summary,
+        main: [
+          "## Summary",
+          "",
+          \`**\${result.summary.headline}**\`,
+          "",
+          securityStatusTable(result.summary, result.risks),
+          "",
+          result.summary.riskSummary,
+          "",
+          "## Reviewer Focus",
+          "",
+          bulletList(result.summary.reviewerFocus, "No special security follow-up."),
+          "",
+          "## Security Risks",
+          "",
+          securityRisksTable(result.risks),
+          ...(result.risks.length > 0 ? ["", riskRationalesBlock(result.risks)] : []),
+          ...(hasConcreteHighOrCriticalRisk && result.diagramMermaid?.trim()
+            ? ["", attackPathDiagramBlock(result.diagramMermaid, hasConcreteHighOrCriticalRisk)]
+            : []),
+        ].join("\\n"),
         inlineFindings,
       });
     },
@@ -2652,6 +2777,122 @@ export default definePipr((pipr) => {
   pipr.on.changeRequest({ actions: ["opened", "updated", "reopened", "ready"], task });
   pipr.command({ pattern: "@pipr security", permission: "write", task });
 });
+
+function securityStatusTable(summary: SecuritySummary, risks: SecurityRisk[]): string {
+  return [
+    "| Status | Summary risk | Max severity | Risks |",
+    "| --- | --- | --- | ---: |",
+    \`| \${risks.some(isHighOrCriticalRisk) ? "Fail" : "Pass"} | \${labelValue(
+      summary.riskLevel,
+    )} | \${maxSeverity(risks)} | \${risks.length} |\`,
+  ].join("\\n");
+}
+
+function securityRisksTable(risks: SecurityRisk[]): string {
+  if (risks.length === 0) {
+    return [
+      "| Severity | Category | Title |",
+      "| --- | --- | --- |",
+      "| - | - | No security risks found. |",
+    ].join("\\n");
+  }
+  return [
+    "| Severity | Category | Title |",
+    "| --- | --- | --- |",
+    ...risks.map(
+      (risk) =>
+        \`| \${labelValue(risk.severity)} | \${tableCell(risk.category)} | \${tableCell(risk.title)} |\`,
+    ),
+  ].join("\\n");
+}
+
+function riskRationalesBlock(risks: SecurityRisk[]): string {
+  if (risks.length === 0) {
+    return "";
+  }
+  return [
+    "<details>",
+    "<summary>Risk rationales</summary>",
+    "",
+    risks
+      .map((risk, index) =>
+        [
+          \`### \${index + 1}. \${risk.title}\`,
+          "",
+          \`**Severity:** \${labelValue(risk.severity)}\`,
+          \`**Category:** \${labelValue(risk.category)}\`,
+          "",
+          risk.rationale,
+        ].join("\\n"),
+      )
+      .join("\\n\\n"),
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function attackPathDiagramBlock(
+  diagramMermaid: string | undefined,
+  hasConcreteHighOrCriticalRisk: boolean,
+): string {
+  const diagram = diagramMermaid?.trim();
+  if (!diagram || !hasConcreteHighOrCriticalRisk) {
+    return "";
+  }
+  const fence = markdownFenceFor(diagram);
+  return [
+    "<details>",
+    "<summary>Attack path diagram</summary>",
+    "",
+    \`\${fence}mermaid\`,
+    diagram,
+    fence,
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function maxSeverity(risks: SecurityRisk[]): string {
+  const order: SecurityRisk["severity"][] = ["low", "medium", "high", "critical"];
+  const severity = risks.reduce<SecurityRisk["severity"] | undefined>((current, risk) => {
+    if (!current || order.indexOf(risk.severity) > order.indexOf(current)) {
+      return risk.severity;
+    }
+    return current;
+  }, undefined);
+  return severity ? labelValue(severity) : "None";
+}
+
+function isHighOrCriticalRisk(risk: SecurityRisk): boolean {
+  return risk.severity === "high" || risk.severity === "critical";
+}
+
+function bulletList(items: string[], emptyText: string): string {
+  if (items.length === 0) {
+    return emptyText;
+  }
+  return items.map((item) => \`- \${lineText(item)}\`).join("\\n");
+}
+
+function labelValue(value: string): string {
+  return value.replaceAll("-", " ").replace(/^./, (char) => char.toUpperCase());
+}
+
+function lineText(value: string): string {
+  return value.replaceAll("\\n", " ").trim();
+}
+
+function tableCell(value: string): string {
+  return lineText(value).replaceAll("|", "\\\\|");
+}
+
+function markdownFenceFor(value: string): string {
+  const longestBacktickRun = Math.max(
+    0,
+    ...[...value.matchAll(/\`+/g)].map((match) => match[0].length),
+  );
+  return "\`".repeat(Math.max(3, longestBacktickRun + 1));
+}
 `
 };
 //#endregion
@@ -2713,8 +2954,8 @@ function isOfficialInitRecipeId(recipe) {
 //#endregion
 //#region src/config/init.ts
 const supportedOfficialInitAdapters = ["github"];
-const defaultWorkflowActionRef = "somus/pipr@v0.3.2";
-const defaultSdkVersion = "0.3.2";
+const defaultWorkflowActionRef = "somus/pipr@v0.3.3";
+const defaultSdkVersion = "0.3.3";
 const defaultTypesBunVersion = "1.3.14";
 function resolveOfficialInitAdapters(adapters) {
 	if (adapters === void 0) return [...supportedOfficialInitAdapters];
@@ -4799,10 +5040,10 @@ function buildRepairPrompt(options) {
 }
 //#endregion
 //#region package.json
-var version = "0.3.2";
+var version = "0.3.3";
 //#endregion
 //#region src/review/comment-branding.ts
-const piprLogoUrl = "https://pipr.run/apple-touch-icon.png";
+const piprLogoUrl = "https://pipr.run/images/pipr/pipr-mark.svg";
 const piprRepositoryUrl = "https://github.com/somus/pipr";
 const mainCommentTitle = `# <img src="${piprLogoUrl}" width="22" height="22" alt=""> Pipr Review`;
 const mainCommentTitles = new Set([
@@ -8311,4 +8552,4 @@ async function runActionCommandWithDependencies(options) {
 //#endregion
 export { runInspectCommand as a, PublicationError as c, listOfficialInitRecipes as d, supportedOfficialInitRecipes as f, piThinkingLevels as g, piRequiredCliFlags as h, runInitCommand as i, isPublishableSuggestedFixSelection as l, piReadOnlyToolNames as m, runActionCommandWithDependencies as n, runLocalReviewCommand as o, piBuiltinToolNames as p, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, supportedOfficialInitAdapters as u };
 
-//# sourceMappingURL=commands-CQg9QVZt.mjs.map
+//# sourceMappingURL=commands-C1sVsbEj.mjs.map