@usepipr/runtime 0.5.0 → 0.6.0

package/dist/{official-github-workflow-DNzV5Z70.mjs → official-github-workflow-B3yeaCgq.mjs}

@@ -16,7 +16,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const fallback = pipr.model({
@@ -24,29 +24,29 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 8 } });
 
-  const reviewer = pipr.reviewer({
-    name: "bug-hunter",
-    model: primary,
-    fallbacks: [fallback],
-    instructions: \`
-      Review only defects with a reproducible failure path or a violated
-      repository contract: broken logic, edge cases, concurrency risks, data
-      loss, performance regressions, and behavior changes missing meaningful
-      tests. For API, async, state, and concurrency changes, inspect relevant
-      callers and tests before reporting. Suppress generic maintainability,
-      style-only, and broad refactor feedback.
-    \`,
-    timeout: "7m",
-  });
-
   pipr.review({
     id: "bug-hunter",
-    reviewer,
+    model: primary,
+    fallbacks: [fallback],
+    instructions: {
+      findings: \`
+        Review only defects with a reproducible failure path or a violated
+        repository contract: broken logic, edge cases, concurrency risks, data
+        loss, performance regressions, and behavior changes missing meaningful
+        tests. For API, async, state, and concurrency changes, inspect relevant
+        callers and tests before reporting. Suppress generic maintainability,
+        style-only, and broad refactor feedback.
+      \`,
+      summary: \`
+        Summarize the changed behavior and concrete defect risk. Use merged
+        findings as evidence and omit generic praise or speculative concerns.
+      \`,
+    },
     paths: {
       exclude: ["docs/**", "**/*.md"],
     },
@@ -77,7 +77,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   const changelogOutput = pipr.schema({
@@ -140,7 +140,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const ciTriageOutput = pipr.schema({
@@ -241,7 +241,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({ publication: { maxInlineComments: 5 } });
@@ -249,12 +249,18 @@ export default definePipr((pipr) => {
   pipr.review({
     id: "review",
     model,
-    instructions: \`
-      Review changed behavior for correctness, security, maintainability, and
-      meaningful regression gaps. Focus on concrete impact and compatibility
-      with repository contracts. Return only actionable findings that target
-      valid diff ranges.
-    \`,
+    instructions: {
+      findings: \`
+        Review changed behavior for correctness, security, maintainability, and
+        meaningful regression gaps. Focus on concrete impact and compatibility
+        with repository contracts. Return only actionable findings that target
+        valid diff ranges.
+      \`,
+      summary: \`
+        Summarize the changed behavior, overall risk, and useful reviewer focus.
+        Use merged findings as evidence without introducing new defects.
+      \`,
+    },
     timeout: "10m",
     comment: (result, context) => {
       const inlineFindingSummary =
@@ -304,7 +310,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const dependencyOutput = pipr.schema({
@@ -404,7 +410,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const diagnosticOutput = pipr.schema({
@@ -480,7 +486,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({ publication: { maxInlineComments: 6 } });
@@ -1063,7 +1069,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const askAgent = pipr.agent({
@@ -1109,6 +1115,7 @@ export default definePipr((pipr) => {
 //#region src/config/recipes/multi-agent-review.ts
 const multiAgentReviewRecipe = {
 	id: "multi-agent-review",
+	requiresChecksPermission: true,
 	title: "Multi-agent Review",
 	description: "Security, test, and maintainability agents with an aggregator agent.",
 	sourceTools: [
@@ -1124,7 +1131,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const fast = pipr.model({
@@ -1132,7 +1139,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   const specialistPrompt = (input: { manifest: unknown; focus: string }) => pipr.prompt\`
@@ -1232,7 +1239,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const memory = pipr.use(
@@ -1656,7 +1663,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 0 } });
@@ -1843,6 +1850,7 @@ function markdownFenceFor(value: string): string {
 //#region src/config/recipes/pr-hygiene.ts
 const prHygieneRecipe = {
 	id: "pr-hygiene",
+	requiresChecksPermission: true,
 	title: "PR Hygiene",
 	description: "Change request hygiene checks for tests, docs, lockfiles, and size.",
 	sourceTools: ["Danger JS"],
@@ -1854,7 +1862,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 5 } });
@@ -2002,6 +2010,7 @@ function policyTable(checks: PolicyCheck[]): string {
 //#region src/config/recipes/quality-gate.ts
 const qualityGateRecipe = {
 	id: "quality-gate",
+	requiresChecksPermission: true,
 	title: "Quality Gate",
 	description: "Required review check that fails on blocking correctness and test risks.",
 	sourceTools: ["SonarQube", "Snyk"],
@@ -2013,7 +2022,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({
@@ -2294,7 +2303,11 @@ const structuredReviewRecipe = {
 		"Greptile"
 	],
 	configTs: `import { definePipr, z } from "@usepipr/sdk";
-import type { ReviewFinding } from "@usepipr/sdk";
+import type {
+  DefaultReviewSummaryManifest,
+  DiffManifest,
+  ReviewFinding,
+} from "@usepipr/sdk";
 
 type ReviewSummary = {
   headline: string;
@@ -2305,7 +2318,7 @@ type ReviewSummary = {
 };
 
 const categorizedFindingSchema = z.strictObject({
-  title: z.string().regex(/^[^\\r\\n]+$/),
+  title: z.string().min(1).max(160),
   severity: z.enum(["critical", "high", "medium", "low"]),
   category: z.enum([
     "correctness",
@@ -2316,24 +2329,121 @@ const categorizedFindingSchema = z.strictObject({
     "maintainability",
     "documentation",
   ]),
-  rationale: z.string(),
-  body: z.string(),
-  path: z.string(),
-  rangeId: z.string(),
+  rationale: z.string().min(1).max(1200),
+  body: z.string().min(1).max(700),
+  path: z.string().min(1),
+  rangeId: z.string().min(1),
   side: z.enum(["RIGHT", "LEFT"]),
   startLine: z.number().int().positive(),
   endLine: z.number().int().positive(),
-  suggestedFix: z.string().optional(),
+  suggestedFix: z.string().min(1).optional(),
 });
+type CategorizedFinding = ReviewFinding & {
+  title: string;
+  severity: "critical" | "high" | "medium" | "low";
+  category:
+    | "correctness"
+    | "security"
+    | "reliability"
+    | "performance"
+    | "test-coverage"
+    | "maintainability"
+    | "documentation";
+  rationale: string;
+};
 
 const reviewSummarySchema = z.strictObject({
-  headline: z.string(),
-  changeSummary: z.array(z.string()).min(1).max(4),
+  headline: z.string().min(1).max(160),
+  changeSummary: z.array(z.string().min(1).max(500)).min(1).max(4),
   riskLevel: z.enum(["low", "medium", "high"]),
-  riskSummary: z.string(),
-  reviewerFocus: z.array(z.string()).max(4),
+  riskSummary: z.string().min(1).max(500),
+  reviewerFocus: z.array(z.string().min(1).max(500)).max(4),
 });
 
+const severityRank = { critical: 0, high: 1, medium: 2, low: 3 } as const;
+
+function hasCommentableAnchor(
+  finding: ReviewFinding,
+  manifest: DiffManifest,
+): boolean {
+  const range = manifest.files
+    .find((file) => file.path === finding.path)
+    ?.commentableRanges.find(
+      (candidate) =>
+        candidate.id === finding.rangeId &&
+        candidate.path === finding.path &&
+        candidate.side === finding.side,
+    );
+  return Boolean(
+    range &&
+      finding.startLine <= finding.endLine &&
+      finding.startLine >= range.startLine &&
+      finding.endLine <= range.endLine,
+  );
+}
+
+function deduplicateFindings(findings: CategorizedFinding[]): CategorizedFinding[] {
+  const seen = new Set<string>();
+  return findings.filter((finding) => {
+    const key = JSON.stringify([
+      finding.path,
+      finding.rangeId,
+      finding.side,
+      finding.startLine,
+      finding.endLine,
+      finding.body,
+    ]);
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  });
+}
+
+function summaryManifest(manifest: DiffManifest): DefaultReviewSummaryManifest {
+  const files: DefaultReviewSummaryManifest["files"][number][] = [];
+  let serializedCharacters = 0;
+
+  for (const file of manifest.files) {
+    const projected = {
+      path: file.path.slice(0, 1_000),
+      ...(file.previousPath
+        ? { previousPath: file.previousPath.slice(0, 1_000) }
+        : {}),
+      status: file.status,
+      ...(file.language ? { language: file.language.slice(0, 100) } : {}),
+      additions: file.additions,
+      deletions: file.deletions,
+      ...(file.changedSymbols?.length
+        ? {
+            changedSymbols: file.changedSymbols
+              .slice(0, 20)
+              .map((symbol) => symbol.slice(0, 200)),
+          }
+        : {}),
+      ...(file.excludedReason
+        ? { excludedReason: file.excludedReason.slice(0, 500) }
+        : {}),
+    };
+    const projectedCharacters = JSON.stringify(projected).length;
+    if (serializedCharacters + projectedCharacters > 40_000) {
+      continue;
+    }
+    files.push(projected);
+    serializedCharacters += projectedCharacters;
+  }
+
+  return {
+    baseSha: manifest.baseSha,
+    headSha: manifest.headSha,
+    mergeBaseSha: manifest.mergeBaseSha,
+    fileCount: manifest.files.length,
+    omittedFileCount: manifest.files.length - files.length,
+    files,
+  };
+}
+
 function escapeInlineCommentHtml(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
@@ -2343,21 +2453,33 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
-  pipr.config({ publication: { maxInlineComments: 8 } });
+  pipr.config({
+    publication: {
+      maxInlineComments: 8,
+      autoResolve: {
+        enabled: true,
+        synchronize: true,
+        userReplies: {
+          enabled: true,
+          respondWhenStillValid: true,
+          allowedActors: "write",
+        },
+      },
+    },
+  });
 
-  const reviewOutput = pipr.schema({
+  const findingsOutput = pipr.schema({
     id: "review/categorized-findings",
     schema: z.strictObject({
-      summary: reviewSummarySchema,
-      findings: z.array(categorizedFindingSchema),
+      inlineFindings: z.array(categorizedFindingSchema),
     }),
   });
 
-  const reviewer = pipr.agent({
-    name: "reviewer",
+  const findingsReviewer = pipr.agent({
+    name: "findings-reviewer",
     model,
     instructions: \`
       Review the change request diff for correctness, security, reliability,
@@ -2367,30 +2489,67 @@ export default definePipr((pipr) => {
       concrete non-blocking defects; and low for small but actionable issues. Each
       rationale must connect repository evidence to the defect and its concrete
       impact. Keep each finding title to one line. Put supporting evidence and
-      reasoning in rationale instead of appending it to the body.
-
-      Make summary maintainer-facing and scannable: one concrete headline, one
-      to four behavior-focused change bullets, a risk level with rationale, and
-      reviewer focus only for useful human follow-up.
+      reasoning in rationale instead of appending it to the body. Return no more
+      than 20 findings for each diff shard.
+      Never copy secret-looking literals into title, body, rationale, or
+      suggestedFix. Describe only the secret kind and location.
     \`,
-    output: reviewOutput,
+    output: findingsOutput,
     tools: pipr.tools.readOnly,
     retry: { invalidOutput: 1, transientFailure: 1 },
     timeout: "10m",
     prompt: () => "Review this change with severity and category metadata.",
   });
 
+  const summaryOutput = pipr.schema({
+    id: "review/rich-summary",
+    schema: reviewSummarySchema,
+  });
+
+  const summaryReviewer = pipr.agent({
+    name: "summary-reviewer",
+    model,
+    instructions: \`
+      Make the summary maintainer-facing and scannable: one concrete headline,
+      one to four behavior-focused change bullets, a risk level with rationale,
+      and reviewer focus only for useful human follow-up. Use the selected
+      findings as evidence, but do not invent additional defects or copy
+      secret-looking literals into any summary field.
+    \`,
+    output: summaryOutput,
+    tools: pipr.tools.readOnly,
+    retry: { invalidOutput: 1, transientFailure: 1 },
+    timeout: "10m",
+    prompt: ({ inlineFindings, manifestSummary }) =>
+      pipr.prompt\`
+        Summarize this change using the selected findings.
+
+        \${pipr.section("Scoped compressed manifest", pipr.json(manifestSummary, { maxCharacters: 60_000 }))}
+
+        \${pipr.section("Selected findings", pipr.json(inlineFindings, { maxCharacters: 60_000 }))}
+      \`,
+  });
+
   const task = pipr.task({
     name: "review",
     async run(ctx) {
       const manifest = await ctx.change.diffManifest({ compressed: true });
-      const result = await ctx.pi.run(reviewer, { manifest });
-      const inlineFindings: ReviewFinding[] = result.findings.map((finding) => {
+      const result = await ctx.pi.run(findingsReviewer, { manifest });
+      const selectedFindings = deduplicateFindings(
+        result.inlineFindings.filter((finding) => hasCommentableAnchor(finding, manifest)),
+      )
+        .sort((left, right) => severityRank[left.severity] - severityRank[right.severity])
+        .slice(0, 8);
+      const summary = await ctx.pi.run(summaryReviewer, {
+        manifestSummary: summaryManifest(manifest),
+        inlineFindings: selectedFindings,
+      });
+      const inlineFindings: ReviewFinding[] = selectedFindings.map((finding) => {
         const severity = finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1);
         const category = finding.category.replaceAll("-", " ");
         return {
           body: [
-            \`**\${severity} \${category}:** \${escapeInlineCommentHtml(finding.title)}\`,
+            \`**\${severity} \${category}:** \${escapeInlineCommentHtml(lineText(finding.title))}\`,
             "",
             escapeInlineCommentHtml(finding.body),
             "",
@@ -2413,17 +2572,17 @@ export default definePipr((pipr) => {
         main: [
           "## Summary",
           "",
-          \`**\${result.summary.headline}**\`,
+          \`**\${lineText(summary.headline)}**\`,
           "",
-          summaryTable(result.summary),
+          summaryTable(summary),
           "",
           "## What Changed",
           "",
-          bulletList(result.summary.changeSummary, "No changed behavior summarized."),
+          bulletList(summary.changeSummary, "No changed behavior summarized."),
           "",
           "## Reviewer Focus",
           "",
-          bulletList(result.summary.reviewerFocus, "No special reviewer focus."),
+          bulletList(summary.reviewerFocus, "No special reviewer focus."),
           "",
         ].join("\\n"),
         inlineFindings,
@@ -2457,7 +2616,7 @@ function labelValue(value: string): string {
 }
 
 function lineText(value: string): string {
-  return value.replaceAll("\\n", " ").trim();
+  return value.replace(/\\r\\n?|\\n/g, " ").trim();
 }
 
 function tableCell(value: string): string {
@@ -2469,6 +2628,7 @@ function tableCell(value: string): string {
 //#region src/config/recipes/security-sast.ts
 const securitySastRecipe = {
 	id: "security-sast",
+	requiresChecksPermission: true,
 	title: "Security SAST",
 	description: "Security review with custom severity and category output.",
 	sourceTools: [
@@ -2504,7 +2664,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const securityOutput = pipr.jsonSchema<SecurityReview>({
@@ -2843,6 +3003,9 @@ function officialInitRecipeFiles(recipe) {
 function officialInitRecipeWorkflowEnvSecrets(recipe) {
 	return resolveOfficialInitRecipe(recipe).workflowEnvSecrets ?? [];
 }
+function officialInitRecipeRequiresChecksPermission(recipe) {
+	return resolveOfficialInitRecipe(recipe).requiresChecksPermission ?? false;
+}
 function resolveOfficialInitRecipe(recipe) {
 	const id = recipe ?? "default-review";
 	if (!isOfficialInitRecipeId(id)) throw new Error(`Unsupported pipr init recipe '${id}'. Supported recipes: ${supportedOfficialInitRecipes.join(", ")}.`);
@@ -2853,7 +3016,7 @@ function isOfficialInitRecipeId(recipe) {
 }
 //#endregion
 //#region src/config/official-github-workflow.ts
-const defaultWorkflowActionRef = "somus/pipr@v0.5.0";
+const defaultWorkflowActionRef = "somus/pipr@v0.6.0";
 /** Internal shared renderer for `pipr init` and generated recipe docs. */
 function renderOfficialGithubWorkflow(options = {}) {
 	const relativeConfigDir = options.relativeConfigDir ?? ".pipr";
@@ -2862,25 +3025,19 @@ function renderOfficialGithubWorkflow(options = {}) {
 		"",
 		"on:",
 		"  pull_request:",
+		"    types: [opened, synchronize, reopened, ready_for_review]",
 		"  issue_comment:",
 		"    types: [created]",
 		"  pull_request_review_comment:",
 		"    types: [created]",
 		"",
 		"permissions:",
-		"  contents: write",
+		"  contents: read",
 		"  pull-requests: write",
-		"  issues: write",
-		"  checks: write",
-		"",
-		"jobs:",
-		"  review:",
-		"    runs-on: ubuntu-latest",
-		"    steps:",
-		"      - uses: actions/checkout@v6",
-		"        with:",
-		"          fetch-depth: 0"
+		"  issues: write"
 	];
+	if (officialInitRecipeRequiresChecksPermission(options.recipe)) lines.push("  checks: write");
+	lines.push("", "jobs:", "  review:", "    runs-on: ubuntu-latest", "    steps:", "      - uses: actions/checkout@v6", "        with:", "          fetch-depth: 0");
 	if (!options.minimal) lines.push("      - uses: actions/cache@v4", "        with:", "          path: /home/runner/work/_temp/_github_home/.bun/install/cache", `          key: pipr-bun-${githubExpression(`hashFiles('${relativeConfigDir}/bun.lock')`)}`);
 	lines.push(`      - uses: ${defaultWorkflowActionRef}${options.includeReleasePleaseVersionMarker ? " # x-release-please-version" : ""}`, "        env:", `          DEEPSEEK_API_KEY: ${githubExpression("secrets.DEEPSEEK_API_KEY")}`, `          GITHUB_TOKEN: ${githubExpression("github.token")}`);
 	for (const secret of officialInitRecipeWorkflowEnvSecrets(options.recipe)) lines.push(`          ${secret.env}: ${githubExpression(`secrets.${secret.secret}`)}`);
@@ -2898,4 +3055,4 @@ function githubExpression(expression) {
 //#endregion
 export { officialInitRecipeWorkflowEnvSecrets as a, officialInitRecipeFiles as i, listOfficialInitRecipes as n, supportedOfficialInitRecipes as o, officialInitRecipeConfigTs as r, renderOfficialGithubWorkflow as t };
 
-//# sourceMappingURL=official-github-workflow-DNzV5Z70.mjs.map
+//# sourceMappingURL=official-github-workflow-B3yeaCgq.mjs.map