@usepipr/runtime 0.5.0 → 0.6.0

package/dist/official-github-workflow-B3yeaCgq.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"official-github-workflow-B3yeaCgq.mjs","names":[],"sources":["../src/config/recipes/bug-hunter.ts","../src/config/recipes/changelog-draft.ts","../src/config/recipes/ci-triage-command.ts","../src/config/recipes/default-review.ts","../src/config/recipes/dependency-risk.ts","../src/config/recipes/diff-diagnostics.ts","../src/config/recipes/fix-suggestions.ts","../src/config/recipes/interactive-ask.ts","../src/config/recipes/multi-agent-review.ts","../src/config/recipes/plugin-tool-review.ts","../src/config/recipes/pr-briefing.ts","../src/config/recipes/pr-hygiene.ts","../src/config/recipes/quality-gate.ts","../src/config/recipes/rich-review.ts","../src/config/recipes/security-sast.ts","../src/config/recipes.ts","../src/config/official-github-workflow.ts"],"sourcesContent":["import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const bugHunterRecipe = {\n  id: \"bug-hunter\",\n  title: \"Bug Hunter\",\n  description: \"Bug-focused review for correctness, edge cases, races, and regressions.\",\n  sourceTools: [\"Graphite AI Reviews\", \"CodeRabbit\", \"GitHub Copilot code review\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const primary = pipr.model({\n    id: \"deepseek/deepseek-v4-pro-primary\",\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const fallback = pipr.model({\n    id: \"deepseek/deepseek-v4-pro-fast\",\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"medium\",\n  });\n\n  pipr.config({ publication: { maxInlineComments: 8 } });\n\n  pipr.review({\n    id: \"bug-hunter\",\n    model: primary,\n    fallbacks: [fallback],\n    instructions: {\n      findings: \\`\n        Review only defects with a reproducible failure path or a violated\n        repository contract: broken logic, edge cases, concurrency risks, data\n        loss, performance regressions, and behavior changes missing meaningful\n        tests. For API, async, state, and concurrency changes, inspect relevant\n        callers and tests before reporting. Suppress generic maintainability,\n        style-only, and broad refactor feedback.\n      \\`,\n      summary: \\`\n        Summarize the changed behavior and concrete defect risk. Use merged\n        findings as evidence and omit generic praise or speculative concerns.\n      \\`,\n    },\n    paths: {\n      exclude: [\"docs/**\", \"**/*.md\"],\n    },\n    timeout: \"7m\",\n    entrypoints: {\n      changeRequest: [\"opened\", \"updated\", \"reopened\", \"ready\"],\n      command: {\n        pattern: \"@pipr bugs\",\n        permission: \"write\",\n        description: \"Run a defect-focused review.\",\n      },\n    },\n  });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const changelogDraftRecipe = {\n  id: \"changelog-draft\",\n  title: \"Changelog Draft\",\n  description: \"PR-Agent update_changelog-style release note draft as a comment.\",\n  sourceTools: [\"PR-Agent /update_changelog\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"medium\",\n  });\n\n  const changelogOutput = pipr.schema({\n    id: \"release/changelog-draft\",\n    schema: z.strictObject({\n      category: z.enum([\"added\", \"changed\", \"fixed\", \"removed\", \"security\", \"internal\"]),\n      entry: z.string(),\n      rationale: z.string(),\n    }),\n  });\n\n  const changelog = pipr.agent({\n    name: \"changelog-draft\",\n    model,\n    instructions: \\`\n      Draft one concise, release-facing changelog entry grounded in changed\n      behavior and change request intent. Use category \"internal\" when there is no\n      user-visible effect. Mention breaking behavior only when the repository\n      evidence proves it. Do not invent issue IDs, versions, release claims, or\n      behavior not supported by the change. Do not edit files.\n    \\`,\n    output: changelogOutput,\n    prompt: () => \"Draft the changelog entry for this change.\",\n  });\n\n  const task = pipr.task({\n    name: \"changelog-draft\",\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(changelog, { manifest });\n      await ctx.comment(\n        [\n          \\`**Category:** \\${result.category}\\`,\n          \"\",\n          result.entry,\n          \"\",\n          \"## Rationale\",\n          result.rationale,\n        ].join(\"\\\\n\"),\n      );\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\"], task });\n  pipr.command({ pattern: \"@pipr changelog\", permission: \"write\", task });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const ciTriageCommandRecipe = {\n  id: \"ci-triage-command\",\n  title: \"CI Triage Command\",\n  description: \"Command-only CI failure triage from a pasted log excerpt.\",\n  sourceTools: [\"CodeRabbit\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const ciTriageOutput = pipr.schema({\n    id: \"ci/triage\",\n    schema: z.strictObject({\n      status: z.enum([\"diagnosed\", \"insufficient-context\"]),\n      summary: z.string(),\n      evidence: z.array(z.string()).max(4),\n      likelyCauses: z.array(z.string()).max(3),\n      nextSteps: z.array(z.string()).max(4),\n    }),\n  });\n\n  const ciTriage = pipr.agent({\n    name: \"ci-triage\",\n    model,\n    instructions: \\`\n      Diagnose CI failures using only the pasted log excerpt, change request\n      metadata, prior review state, and repository evidence. Identify the first\n      actionable failure and separate it from downstream cascade errors. Use\n      status \"insufficient-context\" when the excerpt cannot support a diagnosis.\n      Do not infer a cause from a final exit code alone.\n    \\`,\n    output: ciTriageOutput,\n    prompt: (input: { log: string; manifest: unknown; prior: unknown }) => pipr.prompt\\`\n      \\${pipr.section(\"CI log excerpt\", input.log)}\n      \\${pipr.section(\"Prior pipr review\", pipr.json(input.prior, { maxCharacters: 20000 }))}\n    \\`,\n  });\n\n  const task = pipr.task<{ log: string }>({\n    name: \"ci-triage\",\n    async run(ctx, input) {\n      if (!ctx.command) {\n        throw new Error(\"ci-triage is a command-only task\");\n      }\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const prior = await ctx.review.prior();\n      const result = await ctx.pi.run(ciTriage, { log: input.log, manifest, prior });\n      await ctx.command.reply(ciTriageComment(result));\n    },\n  });\n\n  pipr.command({\n    pattern: \"@pipr ci <log...>\",\n    permission: \"write\",\n    description: \"Triage a pasted CI failure log.\",\n    parse: (args) => ({ log: args.log ?? \"\" }),\n    task,\n  });\n});\n\ntype CiTriageResult = {\n  status: \"diagnosed\" | \"insufficient-context\";\n  summary: string;\n  evidence: string[];\n  likelyCauses: string[];\n  nextSteps: string[];\n};\n\nfunction ciTriageComment(result: CiTriageResult): string {\n  const sections = [\n    \"## CI Triage\",\n    \"\",\n    \"**Status:** \" + labelValue(result.status),\n    \"\",\n    result.summary,\n  ];\n  appendList(sections, \"Evidence\", result.evidence);\n  appendList(sections, \"Likely Causes\", result.likelyCauses);\n  appendList(sections, \"Next Steps\", result.nextSteps);\n  return sections.join(\"\\\\n\");\n}\n\nfunction appendList(sections: string[], title: string, items: string[]): void {\n  if (items.length === 0) {\n    return;\n  }\n  sections.push(\"\", \"## \" + title, \"\", ...items.map((item) => \"- \" + item));\n}\n\nfunction labelValue(value: string): string {\n  return value.replaceAll(\"-\", \" \").replace(/^./, (char) => char.toUpperCase());\n}\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const defaultReviewRecipe = {\n  id: \"default-review\",\n  title: \"Default Review\",\n  description: \"General change request review with bounded inline comments.\",\n  sourceTools: [\"pipr\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  pipr.config({ publication: { maxInlineComments: 5 } });\n\n  pipr.review({\n    id: \"review\",\n    model,\n    instructions: {\n      findings: \\`\n        Review changed behavior for correctness, security, maintainability, and\n        meaningful regression gaps. Focus on concrete impact and compatibility\n        with repository contracts. Return only actionable findings that target\n        valid diff ranges.\n      \\`,\n      summary: \\`\n        Summarize the changed behavior, overall risk, and useful reviewer focus.\n        Use merged findings as evidence without introducing new defects.\n      \\`,\n    },\n    timeout: \"10m\",\n    comment: (result, context) => {\n      const inlineFindingSummary =\n        result.inlineFindings.length === 0\n          ? \"No inline findings.\"\n          : \"See inline comments in the diff.\";\n      const localInlineFindingSummary = [\n        \"## Inline Findings\",\n        \"\",\n        result.inlineFindings.length === 0\n          ? \"No inline findings.\"\n          : result.inlineFindings.map((finding) => \\`- \\${finding.body}\\`).join(\"\\\\n\"),\n      ].join(\"\\\\n\");\n\n      return {\n        main: [\n          \"## Summary\",\n          \"\",\n          result.summary.body,\n          \"\",\n          \"## Review Result\",\n          \"\",\n          \"| Signal | Result |\",\n          \"| --- | ---: |\",\n          \\`| Inline findings | \\${result.inlineFindings.length} |\\`,\n          \"\",\n          context.run.trigger === \"local\" ? localInlineFindingSummary : inlineFindingSummary,\n        ].join(\"\\\\n\"),\n        inlineFindings: result.inlineFindings,\n      };\n    },\n  });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const dependencyRiskRecipe = {\n  id: \"dependency-risk\",\n  title: \"Dependency Risk\",\n  description: \"Dependency manifest and lockfile review with Renovate-style risk notes.\",\n  sourceTools: [\"Renovate\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const dependencyOutput = pipr.schema({\n    id: \"dependency/risk-summary\",\n    schema: z.strictObject({\n      summary: z.string(),\n      risks: z.array(z.string()).max(6),\n      followUps: z.array(z.string()).max(6),\n    }),\n  });\n\n  const dependencyReviewer = pipr.agent({\n    name: \"dependency-risk\",\n    model,\n    instructions: \\`\n      Review dependency manifest and lockfile changes. Distinguish direct from\n      transitive changes, runtime from development scope, and manifest intent\n      from generated lockfile churn. Check manifest-lock consistency. Flag\n      evidenced breaking upgrades, suspicious additions, install script risk,\n      lockfile drift, and required migration work. Do not make external release,\n      compatibility, or CVE claims that are not evidenced in the change.\n    \\`,\n    output: dependencyOutput,\n    prompt: () => \"Review the dependency-related changes in this change request.\",\n  });\n\n  const task = pipr.task({\n    name: \"dependency-risk\",\n    async run(ctx) {\n      const paths = {\n        include: [\n          \"**/package.json\",\n          \"**/bun.lock\",\n          \"**/package-lock.json\",\n          \"**/pnpm-lock.yaml\",\n          \"**/yarn.lock\",\n          \"**/requirements*.txt\",\n          \"**/pyproject.toml\",\n          \"**/deno.json\",\n          \"**/deno.jsonc\",\n          \"**/jsr.json\",\n          \"**/uv.lock\",\n          \"**/poetry.lock\",\n          \"**/Pipfile\",\n          \"**/Pipfile.lock\",\n          \"**/Gemfile\",\n          \"**/Gemfile.lock\",\n          \"**/composer.json\",\n          \"**/composer.lock\",\n          \"**/Package.swift\",\n          \"**/Package.resolved\",\n          \"**/Directory.Packages.props\",\n          \"**/packages.lock.json\",\n          \"**/Cargo.toml\",\n          \"**/Cargo.lock\",\n          \"**/go.mod\",\n          \"**/go.sum\",\n        ],\n      };\n      const manifest = await ctx.change.diffManifest({ compressed: true, paths });\n      if (manifest.files.length === 0) {\n        await ctx.comment(\"No dependency files changed.\");\n        return;\n      }\n      const result = await ctx.pi.run(dependencyReviewer, { manifest }, { paths });\n      await ctx.comment(\n        [\n          result.summary,\n          \"\",\n          \"## Risks\",\n          ...result.risks.map((risk) => \\`- \\${risk}\\`),\n          \"\",\n          \"## Follow-ups\",\n          ...result.followUps.map((followUp) => \\`- \\${followUp}\\`),\n        ].join(\"\\\\n\"),\n      );\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\"], task });\n  pipr.command({ pattern: \"@pipr dependency-risk\", permission: \"write\", task });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const diffDiagnosticsRecipe = {\n  id: \"diff-diagnostics\",\n  title: \"Diff Diagnostics\",\n  description: \"reviewdog-style diagnostic review mapped into inline findings.\",\n  sourceTools: [\"reviewdog\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\nimport type { ReviewFinding } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const diagnosticOutput = pipr.schema({\n    id: \"diagnostics/reviewdog-style\",\n    schema: z.strictObject({\n      summary: z.string(),\n      diagnostics: z.array(z.strictObject({\n        body: z.string(),\n        path: z.string(),\n        rangeId: z.string(),\n        side: z.enum([\"RIGHT\", \"LEFT\"]),\n        startLine: z.number().int().positive(),\n        endLine: z.number().int().positive(),\n        suggestedFix: z.string().optional(),\n      })),\n    }),\n  });\n\n  const diagnostics = pipr.agent({\n    name: \"diff-diagnostics\",\n    model,\n    instructions: \\`\n      Produce short compiler-style diagnostics for actionable defects only.\n      State the concrete defect and impact in at most two sentences. Suppress\n      style preferences, broad refactors, and diagnostics without exact changed-line anchors.\n    \\`,\n    output: diagnosticOutput,\n    prompt: () => \"Summarize the diff-scoped diagnostics for this change.\",\n  });\n\n  const task = pipr.task({\n    name: \"diff-diagnostics\",\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(diagnostics, { manifest });\n      const inlineFindings: ReviewFinding[] = result.diagnostics.map((diagnostic) => ({\n        body: diagnostic.body,\n        path: diagnostic.path,\n        rangeId: diagnostic.rangeId,\n        side: diagnostic.side,\n        startLine: diagnostic.startLine,\n        endLine: diagnostic.endLine,\n        ...(diagnostic.suggestedFix ? { suggestedFix: diagnostic.suggestedFix } : {}),\n      }));\n      await ctx.comment({\n        main: result.summary,\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\"], task });\n  pipr.command({ pattern: \"@pipr diagnostics\", permission: \"write\", task });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const fixSuggestionsRecipe = {\n  id: \"fix-suggestions\",\n  title: \"Fix Suggestions\",\n  description: \"Command-first exact suggested fixes for actionable review improvements.\",\n  sourceTools: [\"Qodo Merge /improve\", \"GitHub Copilot code review\", \"Cursor Bugbot\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\nimport type { CommentableRange, DiffManifest, ReviewFinding } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  pipr.config({ publication: { maxInlineComments: 6 } });\n\n  const fixSuggestionSchema = z.strictObject({\n    title: z.string(),\n    category: z.enum([\"correctness\", \"tests\", \"maintainability\", \"typing\", \"documentation\"]),\n    body: z.string(),\n    path: z.string(),\n    rangeId: z.string(),\n    side: z.enum([\"RIGHT\", \"LEFT\"]),\n    startLine: z.number().int().positive(),\n    endLine: z.number().int().positive(),\n    suggestedFix: z.string().min(1),\n  });\n\n  type FixSuggestion = z.infer<typeof fixSuggestionSchema>;\n\n  const fixSuggestionOutput = pipr.schema({\n    id: \"review/fix-suggestions\",\n    schema: z.strictObject({\n      suggestions: z.array(fixSuggestionSchema),\n    }),\n  });\n\n  const fixVerificationOutput = pipr.schema({\n    id: \"review/fix-suggestion-verification\",\n    schema: z.strictObject({\n      verdicts: z.array(z.strictObject({\n        index: z.number().int().nonnegative(),\n        accepted: z.boolean(),\n        reason: z.string(),\n      })),\n    }),\n  });\n\n  const fixer = pipr.agent({\n    name: \"fix-suggestions\",\n    model,\n    instructions: \\`\n      Find directly applicable fixes for this change request. Return an item only\n      when an exact patch can resolve the reported defect; otherwise omit the\n      entire item. Prioritize correctness, missing tests, type safety, and small\n      maintainability improvements. Do not report broad refactors, style\n      preferences, or issues without an exact patch.\n    \\`,\n    output: fixSuggestionOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"7m\",\n    prompt: () => \"Find exact suggested changes for this change request.\",\n  });\n\n  const verifier = pipr.agent({\n    name: \"fix-suggestion-verifier\",\n    model,\n    instructions: \\`\n      Semantically verify candidate fixes after deterministic range validation.\n      Accept a candidate only when the defect is real and introduced or exposed\n      by the change, the body and replacement address the same defect, the exact\n      replacement preserves surrounding contracts, and no secret or config\n      dependency is invented. Reject speculative, style-only, or broad changes.\n      Return one verdict for every supplied candidate index and never invent indexes.\n    \\`,\n    output: fixVerificationOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"7m\",\n    prompt: (input: { manifest: unknown; candidates: FixSuggestion[] }) => pipr.prompt\\`\n      \\${pipr.section(\n        \"Candidate suggestions\",\n        pipr.json(input.candidates, { maxCharacters: 60000 }),\n      )}\n    \\`,\n  });\n\n  const task = pipr.task({\n    name: \"fix-suggestions\",\n    async run(ctx) {\n      if (!ctx.command) {\n        throw new Error(\"fix-suggestions is a command-only task\");\n      }\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(fixer, { manifest });\n      const deterministicCandidates = result.suggestions.filter(\n        (suggestion) => isPublishableSuggestion(suggestion, manifest),\n      );\n      const publishableSuggestions =\n        deterministicCandidates.length === 0\n          ? []\n          : acceptedSuggestions(\n              deterministicCandidates,\n              (\n                await ctx.pi.run(verifier, {\n                  manifest,\n                  candidates: deterministicCandidates,\n                })\n              ).verdicts,\n            );\n      const inlineFindings: ReviewFinding[] = publishableSuggestions.map((suggestion) => {\n        const category = suggestion.category\n          .replaceAll(\"-\", \" \")\n          .replace(/^./, (char) => char.toUpperCase());\n        return {\n          body: \\`**\\${category}:** \\${suggestion.title}. \\${suggestion.body}\\`,\n          path: suggestion.path,\n          rangeId: suggestion.rangeId,\n          side: suggestion.side,\n          startLine: suggestion.startLine,\n          endLine: suggestion.endLine,\n          suggestedFix: suggestion.suggestedFix,\n        };\n      });\n      await ctx.comment({\n        main: [\n          suggestionSummary(publishableSuggestions.length),\n          \"\",\n          \"## Exact Suggested Changes\",\n          \"\",\n          suggestionsTable(publishableSuggestions),\n        ].join(\"\\\\n\"),\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.command({\n    pattern: \"@pipr improve\",\n    permission: \"write\",\n    description: \"Find exact suggested fixes for this change request.\",\n    task,\n  });\n});\n\ntype FixSuggestionVerdict = {\n  index: number;\n  accepted: boolean;\n  reason: string;\n};\n\nfunction acceptedSuggestions(\n  candidates: FixSuggestion[],\n  verdicts: FixSuggestionVerdict[],\n): FixSuggestion[] {\n  const verdictByIndex = new Map<number, FixSuggestionVerdict>();\n  const duplicateIndexes = new Set<number>();\n  for (const verdict of verdicts) {\n    if (verdict.index < 0 || verdict.index >= candidates.length) {\n      continue;\n    }\n    if (verdictByIndex.has(verdict.index)) {\n      duplicateIndexes.add(verdict.index);\n      continue;\n    }\n    verdictByIndex.set(verdict.index, verdict);\n  }\n  return candidates.filter((_, index) => {\n    const verdict = verdictByIndex.get(index);\n    return !duplicateIndexes.has(index) && verdict?.accepted === true;\n  });\n}\n\nfunction suggestionSummary(count: number): string {\n  if (count === 0) {\n    return \"No exact suggested changes passed validation.\";\n  }\n  const noun = count === 1 ? \"change\" : \"changes\";\n  return count + \" exact suggested \" + noun + \" passed validation.\";\n}\n\ntype FindingAnchor = Pick<ReviewFinding, \"path\" | \"rangeId\" | \"side\" | \"startLine\" | \"endLine\">;\n\nfunction isPublishableSuggestion(suggestion: FixSuggestion, manifest: DiffManifest): boolean {\n  if (suggestion.suggestedFix.trim().length === 0) {\n    return false;\n  }\n  const range = commentableRangeForFinding(suggestion, manifest);\n  return Boolean(\n    range &&\n      isPublishableSuggestedFixSelection({\n        side: suggestion.side,\n        kind: range.kind,\n        rangeStartLine: range.startLine,\n        startLine: suggestion.startLine,\n        endLine: suggestion.endLine,\n        preview: range.preview,\n        suggestedFix: suggestion.suggestedFix,\n      }),\n  );\n}\n\nfunction commentableRangeForFinding(\n  finding: FindingAnchor,\n  manifest: DiffManifest,\n): CommentableRange | undefined {\n  for (const file of manifest.files) {\n    const range = file.commentableRanges.find((candidate) => candidate.id === finding.rangeId);\n    if (!range) {\n      continue;\n    }\n    return finding.rangeId === range.id &&\n      finding.path === range.path &&\n      finding.side === range.side &&\n      finding.startLine <= finding.endLine &&\n      finding.startLine >= range.startLine &&\n      finding.endLine <= range.endLine\n      ? range\n      : undefined;\n  }\n  return undefined;\n}\n\nfunction isPublishableSuggestedFixSelection(selection: {\n  side: \"RIGHT\" | \"LEFT\";\n  kind: \"added\" | \"deleted\" | \"context\" | \"mixed\";\n  rangeStartLine: number;\n  startLine: number;\n  endLine: number;\n  preview?: string;\n  suggestedFix: string;\n}): boolean {\n  const suggestedLines = normalizedSuggestedFixLines(selection.suggestedFix);\n  const selectedLineCount = selection.endLine - selection.startLine + 1;\n  if (\n    selection.side !== \"RIGHT\" ||\n    selection.kind === \"deleted\" ||\n    selectedLineCount > 12 ||\n    suggestedLines.length > 20\n  ) {\n    return false;\n  }\n\n  const originalLines = selectedPreviewLines(selection, selectedLineCount);\n  if (!originalLines) {\n    return false;\n  }\n  const firstOriginalEdge = structuralEdgeToken(originalLines[0]);\n  const firstSuggestedEdge = structuralEdgeToken(suggestedLines[0]);\n  const lastOriginalEdge = structuralEdgeToken(originalLines.at(-1));\n  const lastSuggestedEdge = structuralEdgeToken(suggestedLines.at(-1));\n  const originalLinesWithoutTrailingBlanks = originalLines.slice(\n    0,\n    lastNonBlankLineIndex(originalLines) + 1,\n  );\n  const suggestedLinesWithoutTrailingBlanks = suggestedLines.slice(\n    0,\n    lastNonBlankLineIndex(suggestedLines) + 1,\n  );\n  const hasTextChange =\n    originalLinesWithoutTrailingBlanks.length !== suggestedLinesWithoutTrailingBlanks.length ||\n    originalLinesWithoutTrailingBlanks.some(\n      (line, index) => line !== suggestedLinesWithoutTrailingBlanks[index],\n    );\n  return Boolean(\n    hasTextChange &&\n      !onlyChangesWhitespace(originalLinesWithoutTrailingBlanks, suggestedLinesWithoutTrailingBlanks) &&\n      !suggestionIntroducesNewEnvironmentAccess(selection.preview, selection.suggestedFix) &&\n      (firstOriginalEdge === undefined || firstOriginalEdge === firstSuggestedEdge) &&\n      (lastOriginalEdge === undefined || lastOriginalEdge === lastSuggestedEdge) &&\n      !hasUnchangedSelectionEdge(originalLines, suggestedLines) &&\n      !suggestionIncludesUnselectedContext(selection, selectedLineCount, suggestedLines),\n  );\n}\n\nfunction structuralEdgeToken(line: string | undefined): string | undefined {\n  const token = line?.trim().replace(/[;,]$/, \"\");\n  return token && Array.from(token).every((char) => \"{}[]()<>\".includes(char))\n    ? token\n    : undefined;\n}\n\nfunction normalizedSuggestedFixLines(value: string): string[] {\n  const normalized = value.replace(/\\\\r\\\\n/g, \"\\\\n\").replace(/\\\\r/g, \"\\\\n\");\n  const withoutFinalNewline = normalized.endsWith(\"\\\\n\") ? normalized.slice(0, -1) : normalized;\n  return withoutFinalNewline.length === 0 ? [] : withoutFinalNewline.split(\"\\\\n\");\n}\n\nfunction selectedPreviewLines(\n  selection: {\n    rangeStartLine: number;\n    startLine: number;\n    preview?: string;\n  },\n  selectedLineCount: number,\n): string[] | undefined {\n  if (!selection.preview) {\n    return undefined;\n  }\n  const offset = selection.startLine - selection.rangeStartLine;\n  if (offset < 0) {\n    return undefined;\n  }\n  const previewLines = selection.preview.replace(/\\\\r\\\\n/g, \"\\\\n\").replace(/\\\\r/g, \"\\\\n\").split(\"\\\\n\");\n  if (offset + selectedLineCount > previewLines.length) {\n    return undefined;\n  }\n  return previewLines.slice(offset, offset + selectedLineCount);\n}\n\nfunction suggestionIncludesUnselectedContext(\n  selection: {\n    rangeStartLine: number;\n    startLine: number;\n    preview?: string;\n  },\n  selectedLineCount: number,\n  suggestedLines: string[],\n): boolean {\n  if (!selection.preview || suggestedLines.length <= selectedLineCount) {\n    return false;\n  }\n  const offset = selection.startLine - selection.rangeStartLine;\n  if (offset < 0) {\n    return false;\n  }\n  const previewLines = selection.preview.replace(/\\\\r\\\\n/g, \"\\\\n\").replace(/\\\\r/g, \"\\\\n\").split(\"\\\\n\");\n  const contextLines = [\n    offset > 0 ? previewLines[offset - 1] : undefined,\n    previewLines[offset + selectedLineCount],\n  ].filter((line): line is string => Boolean(line?.trim()));\n  return contextLines.some((line) => suggestedLines.includes(line));\n}\n\nfunction hasUnchangedSelectionEdge(originalLines: string[], suggestedLines: string[]): boolean {\n  const firstLineUnchanged = originalLines[0] === suggestedLines[0];\n  const lastLineUnchanged = originalLines.at(-1) === suggestedLines.at(-1);\n  if (originalLines.length === suggestedLines.length || originalLines.length === 1) {\n    return firstLineUnchanged || lastLineUnchanged;\n  }\n  return firstLineUnchanged && lastLineUnchanged;\n}\n\nfunction lastNonBlankLineIndex(lines: string[]): number {\n  for (let index = lines.length - 1; index >= 0; index -= 1) {\n    if (lines[index]?.trim() !== \"\") {\n      return index;\n    }\n  }\n  return -1;\n}\n\nfunction onlyChangesWhitespace(originalLines: string[], suggestedLines: string[]): boolean {\n  const original = originalLines.join(\"\\\\n\");\n  const suggested = suggestedLines.join(\"\\\\n\");\n  const originalScan = scanCodeWhitespace(original);\n  const suggestedScan = scanCodeWhitespace(suggested);\n  if (originalScan.containsCommentSyntax || suggestedScan.containsCommentSyntax) {\n    return false;\n  }\n  return originalScan.stripped === suggestedScan.stripped;\n}\n\nfunction scanCodeWhitespace(value: string): {\n  stripped: string;\n  containsCommentSyntax: boolean;\n} {\n  let result = \"\";\n  const state: CodeWhitespaceScanState = {\n    literalDelimiter: undefined,\n    escaped: false,\n    regexCharacterClass: false,\n    templateExpressionDepths: [],\n  };\n\n  for (let index = 0; index < value.length; index += 1) {\n    const char = value.charAt(index);\n    if (advanceCodeLiteralScan(state, char, value[index + 1])) {\n      result += char;\n      continue;\n    }\n    if (char === \"/\" && [\"/\", \"*\"].includes(value[index + 1] ?? \"\")) {\n      return { stripped: result, containsCommentSyntax: true };\n    }\n    if (/\\\\s/.test(char)) {\n      const nextNonWhitespace = value.slice(index + 1).match(/\\\\S/)?.[0];\n      result += codeTokenSeparator(result.at(-1), nextNonWhitespace);\n      continue;\n    }\n    advanceTemplateExpressionScan(state, char);\n    state.literalDelimiter ??= openingCodeLiteralDelimiter(char, value[index + 1], result);\n    state.regexCharacterClass = false;\n    result += char;\n  }\n\n  return { stripped: result, containsCommentSyntax: false };\n}\n\nfunction codeTokenSeparator(\n  previousChar: string | undefined,\n  nextChar: string | undefined,\n): string {\n  if (!previousChar || !nextChar) {\n    return \"\";\n  }\n  if (/[A-Za-z0-9_$]/.test(previousChar) && /[A-Za-z0-9_$]/.test(nextChar)) {\n    return \" \";\n  }\n  const requiresSeparator = [\"++\", \"--\", \"//\", \"/*\", \"**\", \"??\", \"?.\", \"=>\", \"==\", \"!=\", \"<=\", \">=\", \"&&\", \"||\", \"<<\", \">>\"].includes(\n    previousChar + nextChar,\n  );\n  return requiresSeparator ? \" \" : \"\";\n}\n\ntype CodeWhitespaceScanState = {\n  literalDelimiter: string | undefined;\n  escaped: boolean;\n  regexCharacterClass: boolean;\n  templateExpressionDepths: number[];\n};\n\nfunction advanceCodeLiteralScan(\n  state: CodeWhitespaceScanState,\n  char: string,\n  nextChar: string | undefined,\n): boolean {\n  if (!state.literalDelimiter) {\n    return false;\n  }\n  if (state.escaped) {\n    state.escaped = false;\n    return true;\n  }\n  if (char === \"\\\\\\\\\") {\n    state.escaped = true;\n    return true;\n  }\n  if (state.literalDelimiter.charCodeAt(0) === 96 && char === \"$\" && nextChar === \"{\") {\n    state.templateExpressionDepths.push(0);\n    state.literalDelimiter = undefined;\n    return true;\n  }\n  if (state.literalDelimiter !== \"/\") {\n    if (char === state.literalDelimiter) {\n      state.literalDelimiter = undefined;\n    }\n    return true;\n  }\n  advanceRegexLiteralScan(state, char);\n  return true;\n}\n\nfunction advanceTemplateExpressionScan(state: CodeWhitespaceScanState, char: string): void {\n  const depthIndex = state.templateExpressionDepths.length - 1;\n  const depth = state.templateExpressionDepths[depthIndex];\n  if (depth === undefined) {\n    return;\n  }\n  if (char === \"{\") {\n    state.templateExpressionDepths[depthIndex] = depth + 1;\n  } else if (char === \"}\") {\n    if (depth <= 1) {\n      state.templateExpressionDepths.pop();\n      state.literalDelimiter = \"\\`\";\n    } else {\n      state.templateExpressionDepths[depthIndex] = depth - 1;\n    }\n  }\n}\n\nfunction advanceRegexLiteralScan(state: CodeWhitespaceScanState, char: string): void {\n  if (char === \"[\") {\n    state.regexCharacterClass = true;\n  } else if (char === \"]\") {\n    state.regexCharacterClass = false;\n  } else if (char === \"/\" && !state.regexCharacterClass) {\n    state.literalDelimiter = undefined;\n  }\n}\n\nfunction openingCodeLiteralDelimiter(\n  char: string,\n  nextChar: string | undefined,\n  previousCode: string,\n): string | undefined {\n  if (char === '\"' || char === \"'\" || char.charCodeAt(0) === 96) {\n    return char;\n  }\n  return startsRegexLiteral(char, nextChar, previousCode) ? \"/\" : undefined;\n}\n\nfunction startsRegexLiteral(\n  char: string,\n  nextChar: string | undefined,\n  previousCode: string,\n): boolean {\n  const previousChar = previousCode.at(-1);\n  const previousWord = previousCode.split(/[^A-Za-z]+/).at(-1);\n  const followsRegexKeyword = [\n    \"return\",\n    \"throw\",\n    \"case\",\n    \"delete\",\n    \"void\",\n    \"typeof\",\n    \"instanceof\",\n    \"in\",\n    \"of\",\n    \"yield\",\n    \"await\",\n  ].includes(previousWord ?? \"\");\n  return (\n    char === \"/\" &&\n    nextChar !== \"/\" &&\n    nextChar !== \"*\" &&\n    (previousChar === undefined ||\n      \"([{:;,=!?&|+-*%^~<>)\".includes(previousChar) ||\n      followsRegexKeyword)\n  );\n}\n\nfunction suggestionIntroducesNewEnvironmentAccess(\n  preview: string | undefined,\n  suggestedFix: string,\n): boolean {\n  const suggestedKeys = environmentAccessKeys(suggestedFix);\n  if (suggestedKeys.size === 0) {\n    return false;\n  }\n  const existingKeys = environmentAccessKeys(preview ?? \"\");\n  return Array.from(suggestedKeys).some((key) => !existingKeys.has(key));\n}\n\nfunction environmentAccessKeys(value: string): Set<string> {\n  const environmentKeyAccessPattern =\n    /\\\\b(?:process|Bun|import\\\\.meta)(?:\\\\s*\\\\.|\\\\s*\\\\?\\\\.)\\\\s*env(?:\\\\s*(?:\\\\.|\\\\?\\\\.)\\\\s*([A-Za-z_][A-Za-z0-9_]*)|\\\\s*\\\\?\\\\.\\\\s*\\\\[\\\\s*[\"']([A-Za-z_][A-Za-z0-9_]*)[\"']\\\\s*\\\\]|\\\\s*\\\\[\\\\s*[\"']([A-Za-z_][A-Za-z0-9_]*)[\"']\\\\s*\\\\])|\\\\bDeno(?:\\\\s*\\\\.|\\\\s*\\\\?\\\\.)\\\\s*env(?:\\\\s*\\\\.|\\\\s*\\\\?\\\\.)\\\\s*get\\\\s*\\\\(\\\\s*[\"']([A-Za-z_][A-Za-z0-9_]*)[\"']\\\\s*\\\\)/g;\n  const keys = new Set<string>();\n  for (const match of value.matchAll(environmentKeyAccessPattern)) {\n    const key = match[1] ?? match[2] ?? match[3] ?? match[4];\n    if (key) {\n      keys.add(key);\n    }\n  }\n  const environmentDestructurePattern =\n    /\\\\{([^{}]*)\\\\}\\\\s*=\\\\s*(?:process|Bun|import\\\\.meta)(?:\\\\s*\\\\.|\\\\s*\\\\?\\\\.)\\\\s*env\\\\b/g;\n  for (const match of value.matchAll(environmentDestructurePattern)) {\n    const bindings = match[1]?.split(\",\") ?? [];\n    for (const binding of bindings) {\n      const key = binding.split(/[:=]/, 1)[0]?.trim().replace(/^[\"']|[\"']$/g, \"\");\n      if (key && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key) && !key.startsWith(\"...\")) {\n        keys.add(key);\n      }\n    }\n  }\n  return keys;\n}\n\nfunction suggestionsTable(suggestions: FixSuggestion[]): string {\n  if (suggestions.length === 0) {\n    return [\n      \"| Category | Title |\",\n      \"| --- | --- |\",\n      \"| - | No exact suggested fixes found. |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Category | Title |\",\n    \"| --- | --- |\",\n    ...suggestions.map((suggestion) => {\n      const category = suggestion.category\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      const title = suggestion.title.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      return \\`| \\${category} | \\${title} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const interactiveAskRecipe = {\n  id: \"interactive-ask\",\n  title: \"Interactive Ask\",\n  description: \"PR-Agent ask-style free-form command over diff and prior review context.\",\n  sourceTools: [\"PR-Agent /ask\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const askAgent = pipr.agent({\n    name: \"interactive-ask\",\n    model,\n    instructions: \\`\n      Answer the reviewer question directly using the current diff, repository,\n      and prior Pipr findings. Cite relevant paths or symbols when available.\n      Distinguish evidence from inference. When external systems or hidden state\n      are required, state precisely which missing context prevents an answer.\n    \\`,\n    output: pipr.schemas.summary,\n    prompt: (input: { question: string; manifest: unknown; prior: unknown }) => pipr.prompt\\`\n      \\${pipr.section(\"Question\", input.question)}\n      \\${pipr.section(\"Prior pipr review\", pipr.json(input.prior, { maxCharacters: 20000 }))}\n    \\`,\n  });\n\n  const task = pipr.task<{ question: string }>({\n    name: \"interactive-ask\",\n    async run(ctx, input) {\n      if (!ctx.command) {\n        throw new Error(\"interactive-ask is a command-only task\");\n      }\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const prior = await ctx.review.prior();\n      const answer = await ctx.pi.run(askAgent, { question: input.question, manifest, prior });\n      await ctx.command.reply(answer.body);\n    },\n  });\n\n  pipr.command({\n    pattern: \"@pipr ask <question...>\",\n    permission: \"read\",\n    description: \"Ask a question about this change request.\",\n    parse: (args) => ({ question: args.question ?? \"\" }),\n    task,\n  });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const multiAgentReviewRecipe = {\n  id: \"multi-agent-review\",\n  requiresChecksPermission: true,\n  title: \"Multi-agent Review\",\n  description: \"Security, test, and maintainability agents with an aggregator agent.\",\n  sourceTools: [\"PR-Agent\", \"CodeRabbit\", \"GitHub Copilot code review\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const primary = pipr.model({\n    id: \"deepseek/deepseek-v4-pro-primary\",\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const fast = pipr.model({\n    id: \"deepseek/deepseek-v4-pro-fast\",\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"medium\",\n  });\n\n  const specialistPrompt = (input: { manifest: unknown; focus: string }) => pipr.prompt\\`\n    \\${pipr.section(\"Focus\", input.focus)}\n  \\`;\n\n  const security = pipr.agent({\n    name: \"security-specialist\",\n    model: primary,\n    instructions:\n      \"Report only exploitable security paths introduced or weakened by the change. Ignore non-security and style feedback.\",\n    output: pipr.schemas.review,\n    tools: pipr.tools.readOnly,\n    prompt: specialistPrompt,\n  });\n  const strictSecurity = security.extend({\n    instructions: \"Prioritize directly exploitable paths and suppress speculative findings.\",\n  });\n  const tests = pipr.agent({\n    name: \"test-specialist\",\n    model: fast,\n    instructions:\n      \"Report only meaningful regression gaps where changed behavior lacks evidence that would catch a concrete failure.\",\n    output: pipr.schemas.review,\n    tools: pipr.tools.readOnly,\n    prompt: specialistPrompt,\n  });\n  const maintainability = pipr.agent({\n    name: \"maintainability-specialist\",\n    model: primary,\n    instructions:\n      \"Report only changed complexity, duplication, or brittle contracts that create a concrete correctness or reliability risk. Ignore cleanup preferences.\",\n    output: pipr.schemas.review,\n    tools: pipr.tools.readOnly,\n    prompt: specialistPrompt,\n  });\n\n  const aggregator = pipr.agent({\n    name: \"review-aggregator\",\n    model: primary,\n    fallbacks: [fast],\n    instructions: \\`\n      Merge specialist reviews into one concise review. Deduplicate findings,\n      then independently revalidate changed-code causality, concrete impact,\n      relevant contract and test context, and exact inline anchoring. Drop\n      unsupported, conflicting, duplicate, speculative, or style-only items.\n    \\`,\n    output: pipr.schemas.review,\n    tools: pipr.tools.readOnly,\n    prompt: (input: { manifest: unknown; specialistResults: unknown; prior: unknown }) => pipr.prompt\\`\n      \\${pipr.section(\"Prior pipr review\", pipr.json(input.prior, { maxCharacters: 20000 }))}\n      \\${pipr.section(\"Specialist results\", pipr.json(input.specialistResults, { maxCharacters: 60000 }))}\n    \\`,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"6m\",\n  });\n\n  const task = pipr.task({\n    name: \"multi-agent-review\",\n    check: { enabled: true, name: \"multi-agent review\", required: true },\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const prior = await ctx.review.prior();\n      const [securityResult, testResult, maintainabilityResult] = await Promise.all([\n        ctx.pi.run(strictSecurity, { manifest, focus: \"security\" }, { model: primary, fallbacks: [fast] }),\n        ctx.pi.run(tests, { manifest, focus: \"tests\" }, { model: fast, fallbacks: [primary] }),\n        ctx.pi.run(maintainability, { manifest, focus: \"maintainability\" }),\n      ]);\n      const result = await ctx.pi.run(aggregator, {\n        manifest,\n        specialistResults: { securityResult, testResult, maintainabilityResult },\n        prior,\n      });\n      ctx.check.pass(\"Multi-agent review completed.\");\n      await ctx.comment({\n        main: result.summary.body,\n        inlineFindings: result.inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({ pattern: \"@pipr multi\", permission: \"write\", task });\n});\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nconst r2MemoryTs = `import { S3Client } from \"bun\";\nimport { definePlugin, type SecretRef, type TaskContext, z } from \"@usepipr/sdk\";\n\nexport const memoryLimits = {\n  subjectCharacters: 120,\n  bodyCharacters: 4000,\n  tagCount: 12,\n  tagCharacters: 50,\n  queryCharacters: 500,\n  resultDefault: 5,\n  resultMinimum: 1,\n  resultMaximum: 20,\n  searchObjectMaximum: 2000,\n} as const;\n\nconst memorySource = z.strictObject({\n  kind: z.enum([\"maintainer-command\", \"agent-tool\"]),\n  runId: z.string().min(1).max(200),\n  platform: z.string().min(1).max(50),\n  changeRequestNumber: z.number().int().nonnegative().optional(),\n  headSha: z.string().min(1).max(200),\n});\n\nconst memoryItem = z.strictObject({\n  id: z.string().uuid().optional(),\n  subject: z.string().trim().min(1).max(memoryLimits.subjectCharacters),\n  body: z.string().trim().min(1).max(memoryLimits.bodyCharacters),\n  tags: z\n    .array(z.string().trim().min(1).max(memoryLimits.tagCharacters))\n    .max(memoryLimits.tagCount)\n    .optional(),\n  source: memorySource.optional(),\n  updatedAt: z.string().max(50).optional(),\n});\n\nconst memorySearchInput = z.strictObject({\n  query: z.string().trim().min(1).max(memoryLimits.queryCharacters),\n  limit: z\n    .number()\n    .int()\n    .min(memoryLimits.resultMinimum)\n    .max(memoryLimits.resultMaximum)\n    .optional(),\n});\n\nconst memoryStoreInput = z.strictObject({\n  subject: z.string().trim().min(1).max(memoryLimits.subjectCharacters),\n  body: z.string().trim().min(1).max(memoryLimits.bodyCharacters),\n  tags: z\n    .array(z.string().trim().min(1).max(memoryLimits.tagCharacters))\n    .max(memoryLimits.tagCount)\n    .optional(),\n});\n\ntype MemoryItem = ReturnType<typeof memoryItem.parse>;\ntype MemorySearchInput = ReturnType<typeof memorySearchInput.parse>;\ntype MemoryStoreInput = ReturnType<typeof memoryStoreInput.parse>;\n\nexport type R2MemoryOptions = {\n  bucket: SecretRef;\n  endpoint: SecretRef;\n  accessKeyId: SecretRef;\n  secretAccessKey: SecretRef;\n  sessionToken?: SecretRef;\n  region?: string;\n  prefix?: string;\n};\n\nexport function r2MemoryPlugin(options: R2MemoryOptions) {\n  return definePlugin((pipr) => {\n    const searchInput = pipr.schema({\n      id: \"memory/search-input\",\n      schema: memorySearchInput,\n    });\n    const searchOutput = pipr.schema({\n      id: \"memory/search-output\",\n      schema: z.strictObject({\n        memories: z.array(memoryItem),\n        skippedObjects: z.number().int().nonnegative(),\n      }),\n    });\n    const storeInput = pipr.schema({\n      id: \"memory/store-input\",\n      schema: memoryStoreInput,\n    });\n    const storeOutput = pipr.schema({\n      id: \"memory/store-output\",\n      schema: z.strictObject({\n        stored: z.boolean(),\n        key: z.string(),\n        id: z.string().uuid(),\n      }),\n    });\n\n    return {\n      search: pipr.tool({\n        name: \"r2_memory_search\",\n        description: \"Search durable reviewer memory stored in Cloudflare R2.\",\n        input: searchInput,\n        output: searchOutput,\n        async run({ input, ctx, signal }) {\n          return await searchMemory(input, ctx, options, signal);\n        },\n        toModelOutput(output) {\n          return output;\n        },\n      }),\n      store: pipr.tool({\n        name: \"r2_memory_store\",\n        description: \"Store reusable, non-sensitive reviewer memory in Cloudflare R2.\",\n        input: storeInput,\n        output: storeOutput,\n        async run({ input, ctx, signal }) {\n          return await storeMemory(input, ctx, options, \"agent-tool\", signal);\n        },\n        toModelOutput(output) {\n          return output;\n        },\n      }),\n      curate(input: MemoryStoreInput, ctx: TaskContext, signal?: AbortSignal) {\n        return storeMemory(input, ctx, options, \"maintainer-command\", signal);\n      },\n    };\n  });\n}\n\nasync function searchMemory(\n  input: MemorySearchInput,\n  ctx: TaskContext,\n  options: R2MemoryOptions,\n  signal?: AbortSignal,\n): Promise<{ memories: MemoryItem[]; skippedObjects: number }> {\n  signal?.throwIfAborted();\n  const bucket = r2Bucket(ctx, options);\n  const memories: MemoryItem[] = [];\n  let continuationToken: string | undefined;\n  let scannedObjects = 0;\n  let skippedObjects = 0;\n\n  do {\n    signal?.throwIfAborted();\n    const listed = await bucket.list({\n      prefix: memoryPrefix(ctx, options) + \"/\",\n      maxKeys: 200,\n      continuationToken,\n    });\n\n    const objects = (listed.contents ?? []).slice(\n      0,\n      memoryLimits.searchObjectMaximum - scannedObjects,\n    );\n    scannedObjects += objects.length;\n    for (const object of objects) {\n      signal?.throwIfAborted();\n      try {\n        const value = memoryItem.parse(await bucket.file(object.key).json());\n        if (matchesMemory(value, input.query)) {\n          memories.push(value);\n        }\n      } catch {\n        // Exclude malformed or concurrently deleted objects and report the count.\n        skippedObjects += 1;\n      }\n    }\n\n    continuationToken = listed.isTruncated ? listed.nextContinuationToken : undefined;\n  } while (continuationToken && scannedObjects < memoryLimits.searchObjectMaximum);\n\n  const limit = Math.min(\n    Math.max(Math.trunc(input.limit ?? memoryLimits.resultDefault), memoryLimits.resultMinimum),\n    memoryLimits.resultMaximum,\n  );\n  return {\n    memories: memories\n      .sort((left, right) => (right.updatedAt ?? \"\").localeCompare(left.updatedAt ?? \"\"))\n      .slice(0, limit),\n    skippedObjects,\n  };\n}\n\nasync function storeMemory(\n  input: MemoryStoreInput,\n  ctx: TaskContext,\n  options: R2MemoryOptions,\n  sourceKind: \"maintainer-command\" | \"agent-tool\",\n  signal?: AbortSignal,\n): Promise<{ stored: boolean; key: string; id: string }> {\n  signal?.throwIfAborted();\n  const bucket = r2Bucket(ctx, options);\n  const parsedInput = memoryStoreInput.parse(input);\n  const curatedKey =\n    sourceKind === \"maintainer-command\"\n      ? memoryPrefix(ctx, options) +\n        \"/maintainer-command/\" +\n        encodeURIComponent(ctx.run.id) +\n        \".json\"\n      : undefined;\n\n  const id = curatedKey ? await stableCommandMemoryId(ctx.run.id) : crypto.randomUUID();\n  const entry = memoryItem.parse({\n    ...parsedInput,\n    id,\n    source: {\n      kind: sourceKind,\n      runId: ctx.run.id,\n      platform: ctx.platform.id,\n      changeRequestNumber: ctx.change.number,\n      headSha: ctx.change.head.sha,\n    },\n    updatedAt: new Date().toISOString(),\n  });\n  const key = curatedKey ?? memoryKey(id, parsedInput.subject, ctx, options);\n  await bucket.write(key, JSON.stringify(entry, null, 2), { type: \"application/json\" });\n  return { stored: true, key, id };\n}\n\nasync function stableCommandMemoryId(runId: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest(\n      \"SHA-256\",\n      new TextEncoder().encode(\"pipr-memory/maintainer-command/\" + runId),\n    ),\n  );\n  digest[6] = (digest[6]! & 0x0f) | 0x50;\n  digest[8] = (digest[8]! & 0x3f) | 0x80;\n  const hex = Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20)].join(\n    \"-\",\n  );\n}\n\nfunction r2Bucket(ctx: TaskContext, options: R2MemoryOptions): S3Client {\n  return new S3Client({\n    bucket: ctx.secret(options.bucket),\n    endpoint: ctx.secret(options.endpoint),\n    accessKeyId: ctx.secret(options.accessKeyId),\n    secretAccessKey: ctx.secret(options.secretAccessKey),\n    region: options.region ?? \"auto\",\n    sessionToken: options.sessionToken ? ctx.secret(options.sessionToken) : undefined,\n  });\n}\n\nfunction memoryPrefix(ctx: TaskContext, options: R2MemoryOptions): string {\n  return cleanPathSegment(options.prefix ?? \"pipr-memory\") + \"/\" + repositoryScope(ctx);\n}\n\nfunction repositoryScope(ctx: TaskContext): string {\n  return cleanPathSegment([ctx.repository.owner, ctx.repository.name].filter(Boolean).join(\"/\"));\n}\n\nfunction cleanPathSegment(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9/_-]+/g, \"-\")\n      .replace(/^\\\\/+|\\\\/+$/g, \"\") || \"pipr-memory\"\n  );\n}\n\nfunction memoryKey(\n  id: string,\n  subject: string,\n  ctx: TaskContext,\n  options: R2MemoryOptions,\n): string {\n  const slug = subject\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-|-$/g, \"\")\n    .slice(0, 60);\n  return (\n    memoryPrefix(ctx, options) +\n    \"/\" +\n    new Date().toISOString() +\n    \"-\" +\n    id +\n    \"-\" +\n    (slug || \"memory\") +\n    \".json\"\n  );\n}\n\nfunction matchesMemory(item: MemoryItem, query: string): boolean {\n  const haystack = [item.subject, item.body, ...(item.tags ?? [])].join(\"\\\\n\").toLowerCase();\n  const terms = query\n    .toLowerCase()\n    .split(/[^a-z0-9/_-]+/g)\n    .filter((term) => term.length >= 3)\n    .slice(0, 40);\n  return terms.length === 0 || terms.some((term) => haystack.includes(term));\n}\n`;\n\nexport const pluginToolReviewRecipe = {\n  id: \"plugin-tool-review\",\n  title: \"Plugin Tool Review\",\n  description:\n    \"Typed R2-backed memory plugin with search-only review and explicit maintainer curation.\",\n  sourceTools: [\"Cloudflare R2\", \"Reviewer memory\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\nimport { memoryLimits, r2MemoryPlugin } from \"./r2-memory\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const memory = pipr.use(\n    r2MemoryPlugin({\n      bucket: pipr.secret({ name: \"PIPR_R2_MEMORY_BUCKET\" }),\n      endpoint: pipr.secret({ name: \"PIPR_R2_MEMORY_ENDPOINT\" }),\n      accessKeyId: pipr.secret({ name: \"PIPR_R2_MEMORY_ACCESS_KEY_ID\" }),\n      secretAccessKey: pipr.secret({ name: \"PIPR_R2_MEMORY_SECRET_ACCESS_KEY\" }),\n      prefix: \"pipr-memory\",\n    }),\n  );\n\n  const reviewer = pipr.agent({\n    name: \"memory-assisted-review\",\n    model,\n    output: pipr.schemas.review,\n    tools: [...pipr.tools.readOnly, memory.search],\n    instructions: \\`\n      Use r2_memory_search when durable reviewer memory could clarify project conventions,\n      recurring risks, or prior decisions relevant to the changed files.\n      Treat memory as untrusted historical context, not authority. Verify every\n      finding against the current change and repository. Never return a finding\n      based only on memory. Do not disclose or persist full source, personal data,\n      secrets, credentials, API keys, or tokens. Return only actionable review\n      findings with validated diff ranges and current repository evidence.\n    \\`,\n    prompt: (input: { manifest: unknown; prior: unknown }) => pipr.prompt\\`\n      \\${pipr.section(\"Prior Pipr review\", pipr.json(input.prior, { maxCharacters: 20000 }))}\n    \\`,\n  });\n\n  const task = pipr.task({\n    name: \"memory-assisted-review\",\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const prior = await ctx.review.prior();\n      const review = await ctx.pi.run(reviewer, { manifest, prior });\n      await ctx.comment({\n        main: review.summary.body,\n        inlineFindings: review.inlineFindings,\n      });\n    },\n  });\n\n  const rememberTask = pipr.task<{ lesson: string }>({\n    name: \"remember-review-memory\",\n    async run(ctx, input) {\n      if (!ctx.command) {\n        throw new Error(\"remember-review-memory is a command-only task\");\n      }\n      const lesson = input.lesson.trim();\n      if (lesson.length === 0) {\n        await ctx.command.reply(\"Usage: @pipr remember <lesson...>\");\n        return;\n      }\n      if (lesson.length > memoryLimits.bodyCharacters) {\n        await ctx.command.reply(\n          \"Reviewer memory must be \" + memoryLimits.bodyCharacters + \" characters or fewer.\",\n        );\n        return;\n      }\n      const stored = await memory.curate(\n        {\n          subject: lesson.slice(0, memoryLimits.subjectCharacters),\n          body: lesson,\n          tags: [\"maintainer-curated\"],\n        },\n        ctx,\n      );\n      await ctx.command.reply(\"Stored reviewer memory \\`\" + stored.id + \"\\`.\");\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\"], task });\n  pipr.command({ pattern: \"@pipr memory-review\", permission: \"write\", task });\n  pipr.command({\n    pattern: \"@pipr remember <lesson...>\",\n    permission: \"write\",\n    description: \"Store an explicit maintainer-curated reviewer lesson.\",\n    parse: (args) => ({ lesson: args.lesson ?? \"\" }),\n    task: rememberTask,\n  });\n});\n`,\n  files: [{ relativePath: \"r2-memory.ts\", contents: r2MemoryTs }],\n  workflowEnvSecrets: [\n    { env: \"PIPR_R2_MEMORY_BUCKET\", secret: \"PIPR_R2_MEMORY_BUCKET\" },\n    { env: \"PIPR_R2_MEMORY_ENDPOINT\", secret: \"PIPR_R2_MEMORY_ENDPOINT\" },\n    { env: \"PIPR_R2_MEMORY_ACCESS_KEY_ID\", secret: \"PIPR_R2_MEMORY_ACCESS_KEY_ID\" },\n    { env: \"PIPR_R2_MEMORY_SECRET_ACCESS_KEY\", secret: \"PIPR_R2_MEMORY_SECRET_ACCESS_KEY\" },\n  ],\n  docsDetailsMdx: `## Memory service\n\nThis recipe uses Bun's S3-compatible client against Cloudflare R2. R2 credentials are declared with \\`pipr.secret(...)\\`, then resolved inside tool execution with \\`ctx.secret(...)\\`. The generated GitHub workflow maps \\`PIPR_R2_MEMORY_BUCKET\\`, \\`PIPR_R2_MEMORY_ENDPOINT\\`, \\`PIPR_R2_MEMORY_ACCESS_KEY_ID\\`, and \\`PIPR_R2_MEMORY_SECRET_ACCESS_KEY\\` repository secrets into matching runtime environment variables.\n\nR2 is object storage, not a search index. The sample paginates up to 2,000 JSON memory objects under \\`prefix/repository-owner/repository-name\\` and filters them locally, which keeps each search bounded and is enough for small reviewer-memory sets. Change \\`prefix\\` in \\`.pipr/config.ts\\` when multiple repositories share one bucket; Pipr still adds the repository scope below it. The generated defaults cap subjects at 120 characters, bodies at 4,000 characters, tags at 12 entries of 50 characters, queries at 500 characters, and results at 20. Existing entries without ids or provenance remain readable when they satisfy those bounds. Search results include \\`skippedObjects\\`, the number of malformed, unavailable, or over-limit objects excluded during that search, so upgrades do not hide incompatible entries without a diagnostic.\n\nThe generated reviewer treats memory as untrusted historical context and requires current repository evidence for findings. It only searches memory by default. A repository user with write permission can store one bounded, provenance-bearing lesson with \\`@pipr remember <lesson...>\\`; re-delivery of the same command run deterministically reuses its stored object and UUID. Full review summaries and human feedback are not persisted automatically; feedback collection, eval generation, scheduling, and proposal pull requests remain user-owned extensions.\n\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const prBriefingRecipe = {\n  id: \"pr-briefing\",\n  title: \"PR Briefing\",\n  description: \"PR-Agent describe-style overview, risk summary, and walkthrough.\",\n  sourceTools: [\"PR-Agent /describe\", \"CodeRabbit PR summaries\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"medium\",\n  });\n\n  pipr.config({ publication: { maxInlineComments: 0 } });\n\n  const briefingSchema = z.strictObject({\n    summary: z.string(),\n    prType: z.enum([\"feature\", \"bugfix\", \"refactor\", \"docs\", \"tests\", \"dependency\", \"infra\", \"mixed\"]),\n    riskLevel: z.enum([\"low\", \"medium\", \"high\"]),\n    riskSummary: z.string(),\n    changeMap: z.array(z.strictObject({\n      area: z.string(),\n      files: z.array(z.string()).max(4),\n      change: z.string(),\n    })).max(6),\n    reviewerFocus: z.array(z.string()).max(4),\n    notableFiles: z.array(z.strictObject({\n      path: z.string(),\n      reason: z.string(),\n    })).max(6),\n    walkthrough: z.array(z.string()).max(6),\n    diagramMermaid: z.string().optional(),\n  });\n\n  type Briefing = z.infer<typeof briefingSchema>;\n\n  const briefingOutput = pipr.schema({\n    id: \"briefing/pr-reviewer\",\n    schema: briefingSchema,\n  });\n\n  const briefing = pipr.agent({\n    name: \"pr-briefing\",\n    model,\n    instructions: \\`\n      Produce a maintainer briefing instead of a defect hunt. Summarize what changed,\n      classify the PR type, explain review risk, list notable files, and include\n      a concise reviewer walkthrough. Use reviewerFocus for what humans should\n      inspect first. Use diagramMermaid only when a small flowchart clarifies\n      multi-step control flow, data flow, or package boundaries; omit it for\n      straightforward changes. Ground every file and claim in the Diff Manifest\n      and change metadata. Walkthrough items must explain behavior flow rather\n      than repeat file lists. Return empty arrays for list sections with no useful content;\n      the renderer omits those empty sections. Do not report inline findings.\n    \\`,\n    output: briefingOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"7m\",\n    prompt: () => \"Prepare a maintainer briefing for this change request.\",\n  });\n\n  const task = pipr.task({\n    name: \"pr-briefing\",\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(briefing, { manifest });\n      const sections = [\n        overviewTable(result, ctx.change.title),\n        \"\",\n        \"## Summary\",\n        \"\",\n        result.summary,\n      ];\n      if (result.changeMap.length > 0) {\n        sections.push(\"\", \"## Change Map\", \"\", changeMapTable(result.changeMap));\n      }\n      if (result.reviewerFocus.length > 0) {\n        sections.push(\n          \"\",\n          \"## Reviewer Focus\",\n          \"\",\n          result.reviewerFocus.map((item) => \\`- \\${item}\\`).join(\"\\\\n\"),\n        );\n      }\n      if (result.notableFiles.length > 0) {\n        sections.push(\"\", \"## Notable Files\", \"\", notableFilesTable(result.notableFiles));\n      }\n      if (result.walkthrough.length > 0) {\n        sections.push(\n          \"\",\n          \"## Walkthrough\",\n          \"\",\n          result.walkthrough.map((item) => \\`- \\${item}\\`).join(\"\\\\n\"),\n        );\n      }\n      const diagram = diagramBlock(result.diagramMermaid);\n      if (diagram) {\n        sections.push(\"\", diagram);\n      }\n      await ctx.comment(sections.join(\"\\\\n\"));\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({\n    pattern: \"@pipr describe\",\n    permission: \"read\",\n    description: \"Generate a reviewer briefing for this change request.\",\n    task,\n  });\n});\n\nfunction overviewTable(briefing: Briefing, title: string): string {\n  const titleCell = title.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n  const prType = briefing.prType.replaceAll(\"-\", \" \").replace(/^./, (char) => char.toUpperCase());\n  const riskLevel = briefing.riskLevel\n    .replaceAll(\"-\", \" \")\n    .replace(/^./, (char) => char.toUpperCase());\n  const riskSummary = briefing.riskSummary.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n  return [\n    \"| Change | Type | Risk | Risk summary |\",\n    \"| --- | --- | --- | --- |\",\n    \\`| \\${titleCell} | \\${prType} | \\${riskLevel} | \\${riskSummary} |\\`,\n  ].join(\"\\\\n\");\n}\n\nfunction changeMapTable(changeMap: Briefing[\"changeMap\"]): string {\n  if (changeMap.length === 0) {\n    return [\n      \"| Area | Files | Change |\",\n      \"| --- | --- | --- |\",\n      \"| - | - | No changed areas summarized. |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Area | Files | Change |\",\n    \"| --- | --- | --- |\",\n    ...changeMap.map((item) => {\n      const area = item.area.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      const files = item.files.join(\"<br>\").replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      const change = item.change.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      return \\`| \\${area} | \\${files} | \\${change} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n\nfunction notableFilesTable(files: Briefing[\"notableFiles\"]): string {\n  if (files.length === 0) {\n    return [\n      \"| File | Why it matters |\",\n      \"| --- | --- |\",\n      \"| - | No notable files called out. |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| File | Why it matters |\",\n    \"| --- | --- |\",\n    ...files.map((file) => {\n      const filePath = file.path.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      const reason = file.reason.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      return \\`| \\${filePath} | \\${reason} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n\nfunction diagramBlock(diagramMermaid: string | undefined): string {\n  const diagram = diagramMermaid?.trim();\n  if (!diagram) {\n    return \"\";\n  }\n  const fence = markdownFenceFor(diagram);\n  return [\n    \"<details>\",\n    \"<summary>Flow diagram</summary>\",\n    \"\",\n    \\`\\${fence}mermaid\\`,\n    diagram,\n    fence,\n    \"\",\n    \"</details>\",\n  ].join(\"\\\\n\");\n}\n\nfunction markdownFenceFor(value: string): string {\n  const longestBacktickRun = Math.max(\n    0,\n    ...[...value.matchAll(/\\`+/g)].map((match) => match[0].length),\n  );\n  return \"\\`\".repeat(Math.max(3, longestBacktickRun + 1));\n}\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const prHygieneRecipe = {\n  id: \"pr-hygiene\",\n  requiresChecksPermission: true,\n  title: \"PR Hygiene\",\n  description: \"Change request hygiene checks for tests, docs, lockfiles, and size.\",\n  sourceTools: [\"Danger JS\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\nimport type { ReviewFinding } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"medium\",\n  });\n\n  pipr.config({ publication: { maxInlineComments: 5 } });\n\n  const hygienePolicySchema = z.enum([\n    \"tests\",\n    \"docs\",\n    \"lockfiles\",\n    \"generated-files\",\n    \"change-size\",\n  ]);\n\n  const policyCheckSchema = z.strictObject({\n    policy: hygienePolicySchema,\n    status: z.enum([\"pass\", \"attention\", \"not-applicable\"]),\n    evidence: z.string(),\n  });\n\n  const policyCheckFor = <const Policy extends z.infer<typeof hygienePolicySchema>>(\n    policy: Policy,\n  ) => policyCheckSchema.extend({ policy: z.literal(policy) });\n\n  const policyChecksSchema = z.tuple([\n    policyCheckFor(\"tests\"),\n    policyCheckFor(\"docs\"),\n    policyCheckFor(\"lockfiles\"),\n    policyCheckFor(\"generated-files\"),\n    policyCheckFor(\"change-size\"),\n  ]);\n\n  const hygieneFindingSchema = z.strictObject({\n    title: z.string(),\n    policy: hygienePolicySchema,\n    body: z.string(),\n    path: z.string(),\n    rangeId: z.string(),\n    side: z.enum([\"RIGHT\", \"LEFT\"]),\n    startLine: z.number().int().positive(),\n    endLine: z.number().int().positive(),\n    suggestedFix: z.string().optional(),\n  });\n\n  type PolicyCheck = z.infer<typeof policyChecksSchema>[number];\n\n  const hygieneOutput = pipr.schema({\n    id: \"review/pr-hygiene\",\n    schema: z.strictObject({\n      summary: z.string(),\n      checks: policyChecksSchema,\n      findings: z.array(hygieneFindingSchema),\n    }),\n  });\n\n  const hygiene = pipr.agent({\n    name: \"pr-hygiene\",\n    model,\n    instructions: \\`\n      Review change request hygiene, not code correctness. Evaluate tests, docs,\n      lockfiles, generated files, and change size. Return exactly one policy\n      check for each policy, using not-applicable when it does not apply. Ground\n      evidence in changed files or counts. Use policy attention for file-level\n      gaps; return inline findings only for concrete gaps in exact changed lines.\n    \\`,\n    output: hygieneOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"6m\",\n    prompt: () => \"Check this change request for repository hygiene and merge readiness.\",\n  });\n\n  const task = pipr.task({\n    name: \"pr-hygiene\",\n    check: { enabled: true, name: \"pr hygiene\", required: false },\n    async run(ctx) {\n      const changedFiles = await ctx.change.changedFiles();\n      ctx.log.info(\\`Checking PR hygiene for \\${changedFiles.length} changed file(s).\\`);\n      const manifest = await ctx.change.diffManifest({ compressed: true, maxPreviewLines: 80 });\n      const result = await ctx.pi.run(hygiene, { manifest, changedFiles });\n      const inlineFindings: ReviewFinding[] = result.findings.map((finding) => {\n        const policy = finding.policy\n          .replaceAll(\"-\", \" \")\n          .replace(/^./, (char) => char.toUpperCase());\n        return {\n          body: \\`**\\${policy}:** \\${finding.title}. \\${finding.body}\\`,\n          path: finding.path,\n          rangeId: finding.rangeId,\n          side: finding.side,\n          startLine: finding.startLine,\n          endLine: finding.endLine,\n          ...(finding.suggestedFix ? { suggestedFix: finding.suggestedFix } : {}),\n        };\n      });\n      const attentionCount = result.checks.filter((check) => check.status === \"attention\").length;\n      if (attentionCount > 0) {\n        const noun = attentionCount === 1 ? \"check\" : \"checks\";\n        const verb = attentionCount === 1 ? \"needs\" : \"need\";\n        ctx.check.neutral(attentionCount + \" hygiene \" + noun + \" \" + verb + \" attention.\");\n      } else {\n        ctx.check.pass(\"PR hygiene review completed.\");\n      }\n      await ctx.comment({\n        main: [\n          result.summary,\n          \"\",\n          \"## Policy Checks\",\n          \"\",\n          policyTable(result.checks),\n        ].join(\"\\\\n\"),\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({ pattern: \"@pipr hygiene\", permission: \"write\", task });\n});\n\nfunction policyTable(checks: PolicyCheck[]): string {\n  if (checks.length === 0) {\n    return [\n      \"| Policy | Status | Evidence |\",\n      \"| --- | --- | --- |\",\n      \"| - | Not applicable | No policy checks were relevant. |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Policy | Status | Evidence |\",\n    \"| --- | --- | --- |\",\n    ...checks.map((check) => {\n      const policy = check.policy\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      const status = check.status\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      const evidence = check.evidence.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      return \\`| \\${policy} | \\${status} | \\${evidence} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const qualityGateRecipe = {\n  id: \"quality-gate\",\n  requiresChecksPermission: true,\n  title: \"Quality Gate\",\n  description: \"Required review check that fails on blocking correctness and test risks.\",\n  sourceTools: [\"SonarQube\", \"Snyk\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\nimport type { CommentableRange, DiffManifest, ReviewFinding } from \"@usepipr/sdk\";\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  pipr.config({\n    publication: {\n      maxInlineComments: 6,\n      autoResolve: {\n        enabled: true,\n        model,\n        instructions:\n          \"Resolve only when current-head evidence proves the original concrete risk no longer applies; otherwise return unknown.\",\n        synchronize: true,\n        userReplies: { enabled: true, allowedActors: \"write\" },\n      },\n    },\n    checks: {\n      aggregate: { enabled: true, name: \"pipr quality gate\" },\n    },\n    limits: {\n      timeoutSeconds: 420,\n      diffManifest: {\n        fullMaxEstimatedTokens: 32000,\n        condensedMaxEstimatedTokens: 64000,\n      },\n    },\n  });\n\n  const blockerSchema = z.strictObject({\n    title: z.string(),\n    category: z.enum([\"correctness\", \"security\", \"reliability\", \"test-coverage\"]),\n    impact: z.string(),\n    body: z.string(),\n    path: z.string(),\n    rangeId: z.string(),\n    side: z.enum([\"RIGHT\", \"LEFT\"]),\n    startLine: z.number().int().positive(),\n    endLine: z.number().int().positive(),\n    suggestedFix: z.string().optional(),\n  });\n\n  type QualityBlocker = z.infer<typeof blockerSchema>;\n\n  const qualityGateOutput = pipr.schema({\n    id: \"review/quality-gate\",\n    schema: z.strictObject({\n      summary: z.string(),\n      blockers: z.array(blockerSchema),\n    }),\n  });\n\n  const reviewer = pipr.agent({\n    name: \"quality-gate\",\n    model,\n    instructions: \\`\n      Act as a merge quality gate. Report only blocking correctness, security,\n      reliability, or test coverage issues that must prevent merge. A blocker\n      must have a concrete changed-code range and an impact that maintainers can\n      verify through the changed contract, relevant callers, or tests. If no\n      blocking issue exists, return an empty blockers array.\n    \\`,\n    output: qualityGateOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"7m\",\n    prompt: () => \"Run the required quality gate for this change request.\",\n  });\n\n  const task = pipr.task({\n    name: \"quality-gate\",\n    check: { enabled: true, name: \"quality gate\", required: true },\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(reviewer, { manifest });\n      const commentableBlockers = filterCommentableBlockers(result.blockers, manifest);\n      const droppedBlockerCount = result.blockers.length - commentableBlockers.length;\n      const inlineFindings: ReviewFinding[] = commentableBlockers.map((blocker) => {\n        const category = blocker.category\n          .replaceAll(\"-\", \" \")\n          .replace(/^./, (char) => char.toUpperCase());\n        return {\n          body: \\`**\\${category} blocker:** \\${blocker.title}. \\${blocker.body}\\`,\n          path: blocker.path,\n          rangeId: blocker.rangeId,\n          side: blocker.side,\n          startLine: blocker.startLine,\n          endLine: blocker.endLine,\n          ...(blocker.suggestedFix ? { suggestedFix: blocker.suggestedFix } : {}),\n        };\n      });\n\n      if (commentableBlockers.length > 0) {\n        const issueNoun = commentableBlockers.length === 1 ? \"issue\" : \"issues\";\n        ctx.check.fail(\\`\\${commentableBlockers.length} blocking quality \\${issueNoun} found.\\`);\n      } else {\n        ctx.check.pass(\"No blocking quality issues found.\");\n      }\n\n      await ctx.comment({\n        main: [\n          statusTable(commentableBlockers),\n          \"\",\n          droppedBlockersNote(droppedBlockerCount),\n          \"\",\n          result.summary,\n          \"\",\n          \"## Blocking Findings\",\n          \"\",\n          blockersTable(commentableBlockers),\n          \"\",\n          \"## Category Breakdown\",\n          \"\",\n          categoryBreakdownTable(commentableBlockers),\n        ].join(\"\\\\n\"),\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({ pattern: \"@pipr quality\", permission: \"write\", task });\n});\n\ntype FindingAnchor = Pick<ReviewFinding, \"path\" | \"rangeId\" | \"side\" | \"startLine\" | \"endLine\">;\n\nfunction filterCommentableBlockers(\n  blockers: QualityBlocker[],\n  manifest: DiffManifest,\n): QualityBlocker[] {\n  const seen = new Set<string>();\n  return blockers.filter((blocker) => {\n    if (!commentableRangeForFinding(blocker, manifest)) {\n      return false;\n    }\n    const key = [\n      blocker.path,\n      blocker.rangeId,\n      blocker.side,\n      blocker.startLine,\n      blocker.endLine,\n      blocker.body,\n    ].join(\"\\\\n\");\n    if (seen.has(key)) {\n      return false;\n    }\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction commentableRangeForFinding(\n  finding: FindingAnchor,\n  manifest: DiffManifest,\n): CommentableRange | undefined {\n  for (const file of manifest.files) {\n    const range = file.commentableRanges.find((candidate) => candidate.id === finding.rangeId);\n    if (!range) {\n      continue;\n    }\n    return finding.rangeId === range.id &&\n      finding.path === range.path &&\n      finding.side === range.side &&\n      finding.startLine <= finding.endLine &&\n      finding.startLine >= range.startLine &&\n      finding.endLine <= range.endLine\n      ? range\n      : undefined;\n  }\n  return undefined;\n}\n\nfunction statusTable(blockers: QualityBlocker[]): string {\n  return [\n    \"| Status | Blocking findings | Categories |\",\n    \"| --- | ---: | --- |\",\n    \\`| \\${blockers.length === 0 ? \"Pass\" : \"Fail\"} | \\${blockers.length} | \\${categorySummary(\n      blockers,\n    )} |\\`,\n  ].join(\"\\\\n\");\n}\n\nfunction blockersTable(blockers: QualityBlocker[]): string {\n  if (blockers.length === 0) {\n    return [\n      \"| Category | Title | Impact |\",\n      \"| --- | --- | --- |\",\n      \"| - | No blocking findings. | - |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Category | Title | Impact |\",\n    \"| --- | --- | --- |\",\n    ...blockers.map((blocker) => {\n      const category = blocker.category\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      const title = blocker.title.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      const impact = blocker.impact.replaceAll(\"\\\\n\", \" \").replaceAll(\"|\", \"\\\\\\\\|\");\n      return \\`| \\${category} | \\${title} | \\${impact} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n\nfunction droppedBlockersNote(count: number): string {\n  if (count === 0) {\n    return \"\";\n  }\n  const blockerNoun = count === 1 ? \"blocker\" : \"blockers\";\n  const verb = count === 1 ? \"was\" : \"were\";\n  const pronoun = count === 1 ? \"it does\" : \"they do\";\n  return [\n    \"<sub>\",\n    count,\n    \" model-reported \",\n    blockerNoun,\n    \" \",\n    verb,\n    \" ignored because \",\n    pronoun,\n    \" not match a commentable diff range or duplicates another blocker.\",\n    \"</sub>\",\n  ].join(\"\");\n}\n\nfunction categoryBreakdownTable(blockers: QualityBlocker[]): string {\n  const counts = categoryCounts(blockers);\n  if (counts.length === 0) {\n    return [\n      \"| Category | Count |\",\n      \"| --- | ---: |\",\n      \"| - | 0 |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Category | Count |\",\n    \"| --- | ---: |\",\n    ...counts.map(([category, count]) => {\n      const categoryLabel = category\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      return \\`| \\${categoryLabel} | \\${count} |\\`;\n    }),\n  ].join(\"\\\\n\");\n}\n\nfunction categorySummary(blockers: QualityBlocker[]): string {\n  const counts = categoryCounts(blockers);\n  if (counts.length === 0) {\n    return \"None\";\n  }\n  return counts\n    .map(([category, count]) => {\n      const categoryLabel = category\n        .replaceAll(\"-\", \" \")\n        .replace(/^./, (char) => char.toUpperCase());\n      return \\`\\${categoryLabel} (\\${count})\\`;\n    })\n    .join(\", \");\n}\n\nfunction categoryCounts(blockers: QualityBlocker[]): Array<[string, number]> {\n  const counts = new Map<string, number>();\n  for (const blocker of blockers) {\n    counts.set(blocker.category, (counts.get(blocker.category) ?? 0) + 1);\n  }\n  return [...counts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]));\n}\n\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const structuredReviewRecipe = {\n  id: \"rich-review\",\n  title: \"Structured Review\",\n  description: \"General change request review with severity and category metadata.\",\n  sourceTools: [\"CodeRabbit\", \"Qodo Merge\", \"Greptile\"],\n  configTs: `import { definePipr, z } from \"@usepipr/sdk\";\nimport type {\n  DefaultReviewSummaryManifest,\n  DiffManifest,\n  ReviewFinding,\n} from \"@usepipr/sdk\";\n\ntype ReviewSummary = {\n  headline: string;\n  changeSummary: string[];\n  riskLevel: \"low\" | \"medium\" | \"high\";\n  riskSummary: string;\n  reviewerFocus: string[];\n};\n\nconst categorizedFindingSchema = z.strictObject({\n  title: z.string().min(1).max(160),\n  severity: z.enum([\"critical\", \"high\", \"medium\", \"low\"]),\n  category: z.enum([\n    \"correctness\",\n    \"security\",\n    \"reliability\",\n    \"performance\",\n    \"test-coverage\",\n    \"maintainability\",\n    \"documentation\",\n  ]),\n  rationale: z.string().min(1).max(1200),\n  body: z.string().min(1).max(700),\n  path: z.string().min(1),\n  rangeId: z.string().min(1),\n  side: z.enum([\"RIGHT\", \"LEFT\"]),\n  startLine: z.number().int().positive(),\n  endLine: z.number().int().positive(),\n  suggestedFix: z.string().min(1).optional(),\n});\ntype CategorizedFinding = ReviewFinding & {\n  title: string;\n  severity: \"critical\" | \"high\" | \"medium\" | \"low\";\n  category:\n    | \"correctness\"\n    | \"security\"\n    | \"reliability\"\n    | \"performance\"\n    | \"test-coverage\"\n    | \"maintainability\"\n    | \"documentation\";\n  rationale: string;\n};\n\nconst reviewSummarySchema = z.strictObject({\n  headline: z.string().min(1).max(160),\n  changeSummary: z.array(z.string().min(1).max(500)).min(1).max(4),\n  riskLevel: z.enum([\"low\", \"medium\", \"high\"]),\n  riskSummary: z.string().min(1).max(500),\n  reviewerFocus: z.array(z.string().min(1).max(500)).max(4),\n});\n\nconst severityRank = { critical: 0, high: 1, medium: 2, low: 3 } as const;\n\nfunction hasCommentableAnchor(\n  finding: ReviewFinding,\n  manifest: DiffManifest,\n): boolean {\n  const range = manifest.files\n    .find((file) => file.path === finding.path)\n    ?.commentableRanges.find(\n      (candidate) =>\n        candidate.id === finding.rangeId &&\n        candidate.path === finding.path &&\n        candidate.side === finding.side,\n    );\n  return Boolean(\n    range &&\n      finding.startLine <= finding.endLine &&\n      finding.startLine >= range.startLine &&\n      finding.endLine <= range.endLine,\n  );\n}\n\nfunction deduplicateFindings(findings: CategorizedFinding[]): CategorizedFinding[] {\n  const seen = new Set<string>();\n  return findings.filter((finding) => {\n    const key = JSON.stringify([\n      finding.path,\n      finding.rangeId,\n      finding.side,\n      finding.startLine,\n      finding.endLine,\n      finding.body,\n    ]);\n    if (seen.has(key)) {\n      return false;\n    }\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction summaryManifest(manifest: DiffManifest): DefaultReviewSummaryManifest {\n  const files: DefaultReviewSummaryManifest[\"files\"][number][] = [];\n  let serializedCharacters = 0;\n\n  for (const file of manifest.files) {\n    const projected = {\n      path: file.path.slice(0, 1_000),\n      ...(file.previousPath\n        ? { previousPath: file.previousPath.slice(0, 1_000) }\n        : {}),\n      status: file.status,\n      ...(file.language ? { language: file.language.slice(0, 100) } : {}),\n      additions: file.additions,\n      deletions: file.deletions,\n      ...(file.changedSymbols?.length\n        ? {\n            changedSymbols: file.changedSymbols\n              .slice(0, 20)\n              .map((symbol) => symbol.slice(0, 200)),\n          }\n        : {}),\n      ...(file.excludedReason\n        ? { excludedReason: file.excludedReason.slice(0, 500) }\n        : {}),\n    };\n    const projectedCharacters = JSON.stringify(projected).length;\n    if (serializedCharacters + projectedCharacters > 40_000) {\n      continue;\n    }\n    files.push(projected);\n    serializedCharacters += projectedCharacters;\n  }\n\n  return {\n    baseSha: manifest.baseSha,\n    headSha: manifest.headSha,\n    mergeBaseSha: manifest.mergeBaseSha,\n    fileCount: manifest.files.length,\n    omittedFileCount: manifest.files.length - files.length,\n    files,\n  };\n}\n\nfunction escapeInlineCommentHtml(value: string): string {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  pipr.config({\n    publication: {\n      maxInlineComments: 8,\n      autoResolve: {\n        enabled: true,\n        synchronize: true,\n        userReplies: {\n          enabled: true,\n          respondWhenStillValid: true,\n          allowedActors: \"write\",\n        },\n      },\n    },\n  });\n\n  const findingsOutput = pipr.schema({\n    id: \"review/categorized-findings\",\n    schema: z.strictObject({\n      inlineFindings: z.array(categorizedFindingSchema),\n    }),\n  });\n\n  const findingsReviewer = pipr.agent({\n    name: \"findings-reviewer\",\n    model,\n    instructions: \\`\n      Review the change request diff for correctness, security, reliability,\n      performance, test coverage, maintainability, and documentation risks.\n      Assign severity by merge impact: critical for exploitable, data-loss, or\n      widespread outage risks; high for other merge-blocking defects; medium for\n      concrete non-blocking defects; and low for small but actionable issues. Each\n      rationale must connect repository evidence to the defect and its concrete\n      impact. Keep each finding title to one line. Put supporting evidence and\n      reasoning in rationale instead of appending it to the body. Return no more\n      than 20 findings for each diff shard.\n      Never copy secret-looking literals into title, body, rationale, or\n      suggestedFix. Describe only the secret kind and location.\n    \\`,\n    output: findingsOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"10m\",\n    prompt: () => \"Review this change with severity and category metadata.\",\n  });\n\n  const summaryOutput = pipr.schema({\n    id: \"review/rich-summary\",\n    schema: reviewSummarySchema,\n  });\n\n  const summaryReviewer = pipr.agent({\n    name: \"summary-reviewer\",\n    model,\n    instructions: \\`\n      Make the summary maintainer-facing and scannable: one concrete headline,\n      one to four behavior-focused change bullets, a risk level with rationale,\n      and reviewer focus only for useful human follow-up. Use the selected\n      findings as evidence, but do not invent additional defects or copy\n      secret-looking literals into any summary field.\n    \\`,\n    output: summaryOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    timeout: \"10m\",\n    prompt: ({ inlineFindings, manifestSummary }) =>\n      pipr.prompt\\`\n        Summarize this change using the selected findings.\n\n        \\${pipr.section(\"Scoped compressed manifest\", pipr.json(manifestSummary, { maxCharacters: 60_000 }))}\n\n        \\${pipr.section(\"Selected findings\", pipr.json(inlineFindings, { maxCharacters: 60_000 }))}\n      \\`,\n  });\n\n  const task = pipr.task({\n    name: \"review\",\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(findingsReviewer, { manifest });\n      const selectedFindings = deduplicateFindings(\n        result.inlineFindings.filter((finding) => hasCommentableAnchor(finding, manifest)),\n      )\n        .sort((left, right) => severityRank[left.severity] - severityRank[right.severity])\n        .slice(0, 8);\n      const summary = await ctx.pi.run(summaryReviewer, {\n        manifestSummary: summaryManifest(manifest),\n        inlineFindings: selectedFindings,\n      });\n      const inlineFindings: ReviewFinding[] = selectedFindings.map((finding) => {\n        const severity = finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1);\n        const category = finding.category.replaceAll(\"-\", \" \");\n        return {\n          body: [\n            \\`**\\${severity} \\${category}:** \\${escapeInlineCommentHtml(lineText(finding.title))}\\`,\n            \"\",\n            escapeInlineCommentHtml(finding.body),\n            \"\",\n            \"<details>\",\n            \"<summary>Rationale</summary>\",\n            \"\",\n            escapeInlineCommentHtml(finding.rationale),\n            \"\",\n            \"</details>\",\n          ].join(\"\\\\n\"),\n          path: finding.path,\n          rangeId: finding.rangeId,\n          side: finding.side,\n          startLine: finding.startLine,\n          endLine: finding.endLine,\n          ...(finding.suggestedFix ? { suggestedFix: finding.suggestedFix } : {}),\n        };\n      });\n      await ctx.comment({\n        main: [\n          \"## Summary\",\n          \"\",\n          \\`**\\${lineText(summary.headline)}**\\`,\n          \"\",\n          summaryTable(summary),\n          \"\",\n          \"## What Changed\",\n          \"\",\n          bulletList(summary.changeSummary, \"No changed behavior summarized.\"),\n          \"\",\n          \"## Reviewer Focus\",\n          \"\",\n          bulletList(summary.reviewerFocus, \"No special reviewer focus.\"),\n          \"\",\n        ].join(\"\\\\n\"),\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({ pattern: \"@pipr review\", permission: \"write\", task });\n});\n\nfunction summaryTable(summary: ReviewSummary): string {\n  return [\n    \"| Risk | Risk summary |\",\n    \"| --- | --- |\",\n    \\`| \\${labelValue(summary.riskLevel)} | \\${tableCell(\n      summary.riskSummary,\n    )} |\\`,\n  ].join(\"\\\\n\");\n}\n\nfunction bulletList(items: string[], emptyText: string): string {\n  if (items.length === 0) {\n    return emptyText;\n  }\n  return items.map((item) => \\`- \\${lineText(item)}\\`).join(\"\\\\n\");\n}\n\nfunction labelValue(value: string): string {\n  return value.replaceAll(\"-\", \" \").replace(/^./, (char) => char.toUpperCase());\n}\n\nfunction lineText(value: string): string {\n  return value.replace(/\\\\r\\\\n?|\\\\n/g, \" \").trim();\n}\n\nfunction tableCell(value: string): string {\n  return lineText(value).replaceAll(\"|\", \"\\\\\\\\|\");\n}\n`,\n} as const satisfies OfficialInitRecipe;\n","import type { OfficialInitRecipe } from \"./types.js\";\n\nexport const securitySastRecipe = {\n  id: \"security-sast\",\n  requiresChecksPermission: true,\n  title: \"Security SAST\",\n  description: \"Security review with custom severity and category output.\",\n  sourceTools: [\"Semgrep\", \"Snyk\", \"GitHub CodeQL/code scanning\"],\n  configTs: `import { definePipr } from \"@usepipr/sdk\";\nimport type { DiffManifest, ReviewFinding } from \"@usepipr/sdk\";\n\ntype SecuritySummary = {\n  headline: string;\n  riskSummary: string;\n  reviewerFocus: string[];\n};\n\ntype SecurityRisk = {\n  title: string;\n  category: \"auth\" | \"injection\" | \"secret\" | \"crypto\" | \"data-exposure\" | \"other\";\n  severity: \"low\" | \"medium\" | \"high\" | \"critical\";\n  rationale: string;\n  finding: ReviewFinding;\n};\n\ntype SecurityReview = {\n  summary: SecuritySummary;\n  risks: SecurityRisk[];\n  diagramMermaid?: string;\n};\n\nexport default definePipr((pipr) => {\n  const model = pipr.model({\n    provider: \"deepseek\",\n    model: \"deepseek-v4-pro\",\n    apiKey: pipr.secret({ name: \"DEEPSEEK_API_KEY\" }),\n    thinking: \"high\",\n  });\n\n  const securityOutput = pipr.jsonSchema<SecurityReview>({\n    id: \"security/sast-review\",\n    schema: {\n      type: \"object\",\n      additionalProperties: false,\n      required: [\"summary\", \"risks\"],\n      properties: {\n        summary: {\n          type: \"object\",\n          additionalProperties: false,\n          required: [\"headline\", \"riskSummary\", \"reviewerFocus\"],\n          properties: {\n            headline: { type: \"string\" },\n            riskSummary: { type: \"string\" },\n            reviewerFocus: {\n              type: \"array\",\n              items: { type: \"string\" },\n            },\n          },\n        },\n        risks: {\n          type: \"array\",\n          items: {\n            type: \"object\",\n            additionalProperties: false,\n            required: [\"title\", \"category\", \"severity\", \"rationale\", \"finding\"],\n            properties: {\n              title: { type: \"string\" },\n              category: {\n                type: \"string\",\n                enum: [\"auth\", \"injection\", \"secret\", \"crypto\", \"data-exposure\", \"other\"],\n              },\n              severity: { type: \"string\", enum: [\"low\", \"medium\", \"high\", \"critical\"] },\n              rationale: { type: \"string\" },\n              finding: {\n                type: \"object\",\n                additionalProperties: false,\n                required: [\"body\", \"path\", \"rangeId\", \"side\", \"startLine\", \"endLine\"],\n                properties: {\n                  body: { type: \"string\" },\n                  path: { type: \"string\" },\n                  rangeId: { type: \"string\" },\n                  side: { type: \"string\", enum: [\"RIGHT\", \"LEFT\"] },\n                  startLine: { type: \"number\" },\n                  endLine: { type: \"number\" },\n                  suggestedFix: { type: \"string\" },\n                },\n              },\n            },\n          },\n        },\n        diagramMermaid: { type: \"string\" },\n      },\n    },\n  });\n\n  const security = pipr.agent({\n    name: \"security-sast\",\n    model,\n    instructions: \\`\n      Review for exploitable security issues only. Focus on auth bypasses,\n      injection, unsafe deserialization, secret exposure, cryptography misuse,\n      authorization gaps, and data exposure. Require a changed trust boundary or\n      source-to-sink path and anchor every risk to the exact changed range that\n      creates or weakens it. Do not report hypothetical or style-only issues.\n      Make summary maintainer-facing and scannable with a concrete headline,\n      risk rationale, and only useful security follow-up. Set\n      diagramMermaid only when a high or critical risk has a concrete source-to-sink\n      path and a small Mermaid flowchart clarifies it. Do not include Markdown\n      fences in diagramMermaid.\n    \\`,\n    output: securityOutput,\n    tools: pipr.tools.readOnly,\n    retry: { invalidOutput: 1, transientFailure: 1 },\n    prompt: () => pipr.prompt\\`\n      \\${pipr.section(\"Security review policy\", \"Return only risks with a concrete attack path.\")}\n    \\`,\n  });\n\n  const task = pipr.task({\n    name: \"security-sast\",\n    check: { enabled: true, name: \"security-sast\", required: true },\n    async run(ctx) {\n      const manifest = await ctx.change.diffManifest({ compressed: true });\n      const result = await ctx.pi.run(security, { manifest });\n      const risks = commentableSecurityRisks(result.risks, manifest);\n      const droppedRiskCount = result.risks.length - risks.length;\n      const inlineFindings: ReviewFinding[] = risks.map((risk) => risk.finding);\n      const hasHighOrCriticalRisk = risks.some(isHighOrCriticalRisk);\n      if (hasHighOrCriticalRisk) {\n        ctx.check.fail(\"High or critical security risk found.\");\n      } else {\n        ctx.check.pass(\"No high or critical security risks found.\");\n      }\n      await ctx.comment({\n        main: [\n          \"## Summary\",\n          \"\",\n          \\`**\\${result.summary.headline}**\\`,\n          \"\",\n          securityStatusTable(risks),\n          \"\",\n          result.summary.riskSummary,\n          \"\",\n          \"## Reviewer Focus\",\n          \"\",\n          bulletList(result.summary.reviewerFocus, \"No special security follow-up.\"),\n          \"\",\n          \"## Security Risks\",\n          \"\",\n          securityRisksTable(risks),\n          ...(droppedRiskCount > 0 ? [\"\", omittedRisksNote(droppedRiskCount)] : []),\n          ...(risks.length > 0 ? [\"\", riskRationalesBlock(risks)] : []),\n          ...(hasHighOrCriticalRisk && result.diagramMermaid?.trim()\n            ? [\"\", attackPathDiagramBlock(result.diagramMermaid, hasHighOrCriticalRisk)]\n            : []),\n        ].join(\"\\\\n\"),\n        inlineFindings,\n      });\n    },\n  });\n\n  pipr.on.changeRequest({ actions: [\"opened\", \"updated\", \"reopened\", \"ready\"], task });\n  pipr.command({ pattern: \"@pipr security\", permission: \"write\", task });\n});\n\nfunction commentableSecurityRisks(\n  risks: SecurityRisk[],\n  manifest: DiffManifest,\n): SecurityRisk[] {\n  const risksByLocation = new Map<string, SecurityRisk>();\n  for (const risk of risks) {\n    const finding = risk.finding;\n    const validAnchor = manifest.files.some((file) =>\n      file.commentableRanges.some(\n        (range) =>\n          finding.rangeId === range.id &&\n          finding.path === range.path &&\n          finding.side === range.side &&\n          finding.startLine <= finding.endLine &&\n          finding.startLine >= range.startLine &&\n          finding.endLine <= range.endLine,\n      ),\n    );\n    const key = [\n      finding.path,\n      finding.rangeId,\n      finding.side,\n      finding.startLine,\n      finding.endLine,\n      finding.body,\n    ].join(\"\\\\n\");\n    if (!validAnchor) {\n      continue;\n    }\n    const existing = risksByLocation.get(key);\n    if (!existing || securitySeverityRank(risk.severity) > securitySeverityRank(existing.severity)) {\n      risksByLocation.set(key, risk);\n    }\n  }\n  return [...risksByLocation.values()];\n}\n\nfunction omittedRisksNote(count: number): string {\n  const noun = count === 1 ? \"risk\" : \"risks\";\n  return \\`Omitted \\${count} \\${noun} with an invalid or duplicate anchor.\\`;\n}\n\nfunction securityStatusTable(risks: SecurityRisk[]): string {\n  return [\n    \"| Status | Max severity | Risks |\",\n    \"| --- | --- | ---: |\",\n    \\`| \\${risks.some(isHighOrCriticalRisk) ? \"Fail\" : \"Pass\"} | \\${maxSeverity(\n      risks,\n    )} | \\${risks.length} |\\`,\n  ].join(\"\\\\n\");\n}\n\nfunction securityRisksTable(risks: SecurityRisk[]): string {\n  if (risks.length === 0) {\n    return [\n      \"| Severity | Category | Title |\",\n      \"| --- | --- | --- |\",\n      \"| - | - | No security risks found. |\",\n    ].join(\"\\\\n\");\n  }\n  return [\n    \"| Severity | Category | Title |\",\n    \"| --- | --- | --- |\",\n    ...risks.map(\n      (risk) =>\n        \\`| \\${labelValue(risk.severity)} | \\${tableCell(risk.category)} | \\${tableCell(risk.title)} |\\`,\n    ),\n  ].join(\"\\\\n\");\n}\n\nfunction riskRationalesBlock(risks: SecurityRisk[]): string {\n  if (risks.length === 0) {\n    return \"\";\n  }\n  return [\n    \"<details>\",\n    \"<summary>Risk rationales</summary>\",\n    \"\",\n    risks\n      .map((risk, index) =>\n        [\n          \\`### \\${index + 1}. \\${risk.title}\\`,\n          \"\",\n          \\`**Severity:** \\${labelValue(risk.severity)}\\`,\n          \\`**Category:** \\${labelValue(risk.category)}\\`,\n          \"\",\n          risk.rationale,\n        ].join(\"\\\\n\"),\n      )\n      .join(\"\\\\n\\\\n\"),\n    \"\",\n    \"</details>\",\n  ].join(\"\\\\n\");\n}\n\nfunction attackPathDiagramBlock(\n  diagramMermaid: string | undefined,\n  hasConcreteHighOrCriticalRisk: boolean,\n): string {\n  const diagram = diagramMermaid?.trim();\n  if (!diagram || !hasConcreteHighOrCriticalRisk) {\n    return \"\";\n  }\n  const fence = markdownFenceFor(diagram);\n  return [\n    \"<details>\",\n    \"<summary>Attack path diagram</summary>\",\n    \"\",\n    \\`\\${fence}mermaid\\`,\n    diagram,\n    fence,\n    \"\",\n    \"</details>\",\n  ].join(\"\\\\n\");\n}\n\nfunction maxSeverity(risks: SecurityRisk[]): string {\n  const severity = risks.reduce<SecurityRisk[\"severity\"] | undefined>((current, risk) => {\n    if (!current || securitySeverityRank(risk.severity) > securitySeverityRank(current)) {\n      return risk.severity;\n    }\n    return current;\n  }, undefined);\n  return severity ? labelValue(severity) : \"None\";\n}\n\nfunction securitySeverityRank(severity: SecurityRisk[\"severity\"]): number {\n  return [\"low\", \"medium\", \"high\", \"critical\"].indexOf(severity);\n}\n\nfunction isHighOrCriticalRisk(risk: SecurityRisk): boolean {\n  return risk.severity === \"high\" || risk.severity === \"critical\";\n}\n\nfunction bulletList(items: string[], emptyText: string): string {\n  if (items.length === 0) {\n    return emptyText;\n  }\n  return items.map((item) => \\`- \\${lineText(item)}\\`).join(\"\\\\n\");\n}\n\nfunction labelValue(value: string): string {\n  return value.replaceAll(\"-\", \" \").replace(/^./, (char) => char.toUpperCase());\n}\n\nfunction lineText(value: string): string {\n  return value.replaceAll(\"\\\\n\", \" \").trim();\n}\n\nfunction tableCell(value: string): string {\n  return lineText(value).replaceAll(\"|\", \"\\\\\\\\|\");\n}\n\nfunction markdownFenceFor(value: string): string {\n  const longestBacktickRun = Math.max(\n    0,\n    ...[...value.matchAll(/\\`+/g)].map((match) => match[0].length),\n  );\n  return \"\\`\".repeat(Math.max(3, longestBacktickRun + 1));\n}\n`,\n} as const satisfies OfficialInitRecipe;\n","import { bugHunterRecipe } from \"./recipes/bug-hunter.js\";\nimport { changelogDraftRecipe } from \"./recipes/changelog-draft.js\";\nimport { ciTriageCommandRecipe } from \"./recipes/ci-triage-command.js\";\nimport { defaultReviewRecipe } from \"./recipes/default-review.js\";\nimport { dependencyRiskRecipe } from \"./recipes/dependency-risk.js\";\nimport { diffDiagnosticsRecipe } from \"./recipes/diff-diagnostics.js\";\nimport { fixSuggestionsRecipe } from \"./recipes/fix-suggestions.js\";\nimport { interactiveAskRecipe } from \"./recipes/interactive-ask.js\";\nimport { multiAgentReviewRecipe } from \"./recipes/multi-agent-review.js\";\nimport { pluginToolReviewRecipe } from \"./recipes/plugin-tool-review.js\";\nimport { prBriefingRecipe } from \"./recipes/pr-briefing.js\";\nimport { prHygieneRecipe } from \"./recipes/pr-hygiene.js\";\nimport { qualityGateRecipe } from \"./recipes/quality-gate.js\";\nimport { structuredReviewRecipe } from \"./recipes/rich-review.js\";\nimport { securitySastRecipe } from \"./recipes/security-sast.js\";\nimport type {\n  OfficialInitRecipe,\n  OfficialInitRecipeFile,\n  OfficialInitRecipeWorkflowEnvSecret,\n} from \"./recipes/types.js\";\n\nexport const supportedOfficialInitRecipes = [\n  \"default-review\",\n  \"bug-hunter\",\n  \"rich-review\",\n  \"fix-suggestions\",\n  \"security-sast\",\n  \"quality-gate\",\n  \"diff-diagnostics\",\n  \"pr-hygiene\",\n  \"dependency-risk\",\n  \"ci-triage-command\",\n  \"multi-agent-review\",\n  \"plugin-tool-review\",\n  \"pr-briefing\",\n  \"interactive-ask\",\n  \"changelog-draft\",\n] as const;\n\nexport type OfficialInitRecipeId = (typeof supportedOfficialInitRecipes)[number];\nexport type { OfficialInitRecipe, OfficialInitRecipeFile, OfficialInitRecipeWorkflowEnvSecret };\n\nconst officialInitRecipeRegistry = {\n  \"default-review\": defaultReviewRecipe,\n  \"bug-hunter\": bugHunterRecipe,\n  \"rich-review\": structuredReviewRecipe,\n  \"fix-suggestions\": fixSuggestionsRecipe,\n  \"security-sast\": securitySastRecipe,\n  \"quality-gate\": qualityGateRecipe,\n  \"diff-diagnostics\": diffDiagnosticsRecipe,\n  \"pr-hygiene\": prHygieneRecipe,\n  \"dependency-risk\": dependencyRiskRecipe,\n  \"ci-triage-command\": ciTriageCommandRecipe,\n  \"multi-agent-review\": multiAgentReviewRecipe,\n  \"plugin-tool-review\": pluginToolReviewRecipe,\n  \"pr-briefing\": prBriefingRecipe,\n  \"interactive-ask\": interactiveAskRecipe,\n  \"changelog-draft\": changelogDraftRecipe,\n} satisfies Record<OfficialInitRecipeId, OfficialInitRecipe & { id: OfficialInitRecipeId }>;\n\nexport function listOfficialInitRecipes(): OfficialInitRecipe[] {\n  return supportedOfficialInitRecipes.map((id) => officialInitRecipeRegistry[id]);\n}\n\nexport function officialInitRecipeConfigTs(recipe?: string): string {\n  return resolveOfficialInitRecipe(recipe).configTs;\n}\n\nexport function officialInitRecipeFiles(recipe?: string): readonly OfficialInitRecipeFile[] {\n  return resolveOfficialInitRecipe(recipe).files ?? [];\n}\n\nexport function officialInitRecipeWorkflowEnvSecrets(\n  recipe?: string,\n): readonly OfficialInitRecipeWorkflowEnvSecret[] {\n  return resolveOfficialInitRecipe(recipe).workflowEnvSecrets ?? [];\n}\n\nexport function officialInitRecipeRequiresChecksPermission(recipe?: string): boolean {\n  return resolveOfficialInitRecipe(recipe).requiresChecksPermission ?? false;\n}\n\nfunction resolveOfficialInitRecipe(\n  recipe?: string,\n): OfficialInitRecipe & { id: OfficialInitRecipeId } {\n  const id = recipe ?? \"default-review\";\n  if (!isOfficialInitRecipeId(id)) {\n    throw new Error(\n      `Unsupported pipr init recipe '${id}'. Supported recipes: ${supportedOfficialInitRecipes.join(\n        \", \",\n      )}.`,\n    );\n  }\n  return officialInitRecipeRegistry[id];\n}\n\nfunction isOfficialInitRecipeId(recipe: string): recipe is OfficialInitRecipeId {\n  return (supportedOfficialInitRecipes as readonly string[]).includes(recipe);\n}\n","import {\n  officialInitRecipeRequiresChecksPermission,\n  officialInitRecipeWorkflowEnvSecrets,\n} from \"./recipes.js\";\n\nconst defaultWorkflowActionRef = \"somus/pipr@v0.6.0\"; // x-release-please-version\n\nexport type RenderOfficialGithubWorkflowOptions = {\n  relativeConfigDir?: string;\n  recipe?: string;\n  minimal?: boolean;\n  includeReleasePleaseVersionMarker?: boolean;\n};\n\n/** Internal shared renderer for `pipr init` and generated recipe docs. */\nexport function renderOfficialGithubWorkflow(\n  options: RenderOfficialGithubWorkflowOptions = {},\n): string {\n  const relativeConfigDir = options.relativeConfigDir ?? \".pipr\";\n  const lines = [\n    \"name: pipr\",\n    \"\",\n    \"on:\",\n    \"  pull_request:\",\n    \"    types: [opened, synchronize, reopened, ready_for_review]\",\n    \"  issue_comment:\",\n    \"    types: [created]\",\n    \"  pull_request_review_comment:\",\n    \"    types: [created]\",\n    \"\",\n    \"permissions:\",\n    \"  contents: read\",\n    \"  pull-requests: write\",\n    \"  issues: write\",\n  ];\n  if (officialInitRecipeRequiresChecksPermission(options.recipe)) {\n    lines.push(\"  checks: write\");\n  }\n  lines.push(\n    \"\",\n    \"jobs:\",\n    \"  review:\",\n    \"    runs-on: ubuntu-latest\",\n    \"    steps:\",\n    \"      - uses: actions/checkout@v6\",\n    \"        with:\",\n    \"          fetch-depth: 0\",\n  );\n  if (!options.minimal) {\n    lines.push(\n      \"      - uses: actions/cache@v4\",\n      \"        with:\",\n      \"          path: /home/runner/work/_temp/_github_home/.bun/install/cache\",\n      `          key: pipr-bun-${githubExpression(`hashFiles('${relativeConfigDir}/bun.lock')`)}`,\n    );\n  }\n  lines.push(\n    `      - uses: ${defaultWorkflowActionRef}${\n      options.includeReleasePleaseVersionMarker ? \" # x-release-please-version\" : \"\"\n    }`,\n    \"        env:\",\n    `          DEEPSEEK_API_KEY: ${githubExpression(\"secrets.DEEPSEEK_API_KEY\")}`,\n    `          GITHUB_TOKEN: ${githubExpression(\"github.token\")}`,\n  );\n  for (const secret of officialInitRecipeWorkflowEnvSecrets(options.recipe)) {\n    lines.push(`          ${secret.env}: ${githubExpression(`secrets.${secret.secret}`)}`);\n  }\n  if (relativeConfigDir !== \".pipr\") {\n    lines.push(\"        with:\", `          config-dir: ${relativeConfigDir}`);\n  }\n  lines.push(\"\");\n  return lines.join(\"\\n\");\n}\n\nfunction githubExpression(expression: string): string {\n  return `$${[\"{{ \", expression, \" }}\"].join(\"\")}`;\n}\n"],"mappings":";AAEA,MAAa,kBAAkB;CAC7B,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa;EAAC;EAAuB;EAAc;CAA4B;CAC/E,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDZ;;;AC3DA,MAAa,uBAAuB;CAClC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,4BAA4B;CAC1C,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDZ;;;AC5DA,MAAa,wBAAwB;CACnC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,YAAY;CAC1B,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FZ;;;AClGA,MAAa,sBAAsB;CACjC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,MAAM;CACpB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DZ;;;AClEA,MAAa,uBAAuB;CAClC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,UAAU;CACxB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FZ;;;AChGA,MAAa,wBAAwB;CACnC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,WAAW;CACzB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgEZ;;;ACrEA,MAAa,uBAAuB;CAClC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa;EAAC;EAAuB;EAA8B;CAAe;CAClF,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgkBZ;;;ACrkBA,MAAa,uBAAuB;CAClC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,eAAe;CAC7B,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDZ;;;ACrDA,MAAa,yBAAyB;CACpC,IAAI;CACJ,0BAA0B;CAC1B,OAAO;CACP,aAAa;CACb,aAAa;EAAC;EAAY;EAAc;CAA4B;CACpE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsGZ;AC2LA,MAAa,yBAAyB;CACpC,IAAI;CACJ,OAAO;CACP,aACE;CACF,aAAa,CAAC,iBAAiB,iBAAiB;CAChD,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FV,OAAO,CAAC;EAAE,cAAc;EAAgB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAW,CAAC;CAC9D,oBAAoB;EAClB;GAAE,KAAK;GAAyB,QAAQ;EAAwB;EAChE;GAAE,KAAK;GAA2B,QAAQ;EAA0B;EACpE;GAAE,KAAK;GAAgC,QAAQ;EAA+B;EAC9E;GAAE,KAAK;GAAoC,QAAQ;EAAmC;CACxF;CACA,gBAAgB;;;;;;;;;AASlB;;;AC1ZA,MAAa,mBAAmB;CAC9B,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa,CAAC,sBAAsB,yBAAyB;CAC7D,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6LZ;;;AClMA,MAAa,kBAAkB;CAC7B,IAAI;CACJ,0BAA0B;CAC1B,OAAO;CACP,aAAa;CACb,aAAa,CAAC,WAAW;CACzB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuJZ;;;AC7JA,MAAa,oBAAoB;CAC/B,IAAI;CACJ,0BAA0B;CAC1B,OAAO;CACP,aAAa;CACb,aAAa,CAAC,aAAa,MAAM;CACjC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoRZ;;;AC1RA,MAAa,yBAAyB;CACpC,IAAI;CACJ,OAAO;CACP,aAAa;CACb,aAAa;EAAC;EAAc;EAAc;CAAU;CACpD,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiUZ;;;ACtUA,MAAa,qBAAqB;CAChC,IAAI;CACJ,0BAA0B;CAC1B,OAAO;CACP,aAAa;CACb,aAAa;EAAC;EAAW;EAAQ;CAA6B;CAC9D,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8TZ;;;ACjTA,MAAa,+BAA+B;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAKA,MAAM,6BAA6B;CACjC,kBAAkB;CAClB,cAAc;CACd,eAAe;CACf,mBAAmB;CACnB,iBAAiB;CACjB,gBAAgB;CAChB,oBAAoB;CACpB,cAAc;CACd,mBAAmB;CACnB,qBAAqB;CACrB,sBAAsB;CACtB,sBAAsB;CACtB,eAAe;CACf,mBAAmB;CACnB,mBAAmB;AACrB;AAEA,SAAgB,0BAAgD;CAC9D,OAAO,6BAA6B,KAAK,OAAO,2BAA2B,GAAG;AAChF;AAEA,SAAgB,2BAA2B,QAAyB;CAClE,OAAO,0BAA0B,MAAM,CAAC,CAAC;AAC3C;AAEA,SAAgB,wBAAwB,QAAoD;CAC1F,OAAO,0BAA0B,MAAM,CAAC,CAAC,SAAS,CAAC;AACrD;AAEA,SAAgB,qCACd,QACgD;CAChD,OAAO,0BAA0B,MAAM,CAAC,CAAC,sBAAsB,CAAC;AAClE;AAEA,SAAgB,2CAA2C,QAA0B;CACnF,OAAO,0BAA0B,MAAM,CAAC,CAAC,4BAA4B;AACvE;AAEA,SAAS,0BACP,QACmD;CACnD,MAAM,KAAK,UAAU;CACrB,IAAI,CAAC,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACR,iCAAiC,GAAG,wBAAwB,6BAA6B,KACvF,IACF,EAAE,EACJ;CAEF,OAAO,2BAA2B;AACpC;AAEA,SAAS,uBAAuB,QAAgD;CAC9E,OAAQ,6BAAmD,SAAS,MAAM;AAC5E;;;AC7FA,MAAM,2BAA2B;;AAUjC,SAAgB,6BACd,UAA+C,CAAC,GACxC;CACR,MAAM,oBAAoB,QAAQ,qBAAqB;CACvD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CACA,IAAI,2CAA2C,QAAQ,MAAM,GAC3D,MAAM,KAAK,iBAAiB;CAE9B,MAAM,KACJ,IACA,SACA,aACA,8BACA,cACA,qCACA,iBACA,0BACF;CACA,IAAI,CAAC,QAAQ,SACX,MAAM,KACJ,kCACA,iBACA,2EACA,2BAA2B,iBAAiB,cAAc,kBAAkB,YAAY,GAC1F;CAEF,MAAM,KACJ,iBAAiB,2BACf,QAAQ,oCAAoC,gCAAgC,MAE9E,gBACA,+BAA+B,iBAAiB,0BAA0B,KAC1E,2BAA2B,iBAAiB,cAAc,GAC5D;CACA,KAAK,MAAM,UAAU,qCAAqC,QAAQ,MAAM,GACtE,MAAM,KAAK,aAAa,OAAO,IAAI,IAAI,iBAAiB,WAAW,OAAO,QAAQ,GAAG;CAEvF,IAAI,sBAAsB,SACxB,MAAM,KAAK,iBAAiB,yBAAyB,mBAAmB;CAE1E,MAAM,KAAK,EAAE;CACb,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,iBAAiB,YAA4B;CACpD,OAAO,IAAI;EAAC;EAAO;EAAY;CAAK,CAAC,CAAC,KAAK,EAAE;AAC/C"}

package/dist/pi/runtime-tools-extension.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-tools-extension.d.mts","names":[],"sources":["../../src/pi/runtime-tools-extension.ts"],"mappings":";KAmBK;EACH,aAAa,MAAM;;KAGhB;EACH;EACA;EACA;EACA,YAAY;EACZ,UACE,oBACA,iBACA,kBACA,oBACA;IAAQ;QACL,QAAQ;;KAGV;EACH,SAAS;IAAQ;IAAc;;EAC/B;;;iBA2BsB,iBAAiB,IAAI"}
+{"version":3,"file":"runtime-tools-extension.d.mts","names":[],"sources":["../../src/pi/runtime-tools-extension.ts"],"mappings":";KA0BK;EACH,aAAa,MAAM;;KAGhB;EACH;EACA;EACA;EACA,YAAY;EACZ,UACE,oBACA,iBACA,kBACA,oBACA;IAAQ;QACL,QAAQ;;KAGV;EACH,SAAS;IAAQ;IAAc;;EAC/B;;;iBAkDsB,iBAAiB,IAAI"}

package/dist/pi/runtime-tools-extension.mjs

@@ -1,4 +1,4 @@
-import { a as readDiffFromRuntimeData, c as resolveReadAtRefRequest, i as readAtRefParams, l as unavailableReadAtRefResult, n as boundedLineSlice, o as readDiffParams, s as resolveAllowedPath, t as assertNoSymlinkPath } from "../runtime-tools-core-D8_WsbL_.mjs";
+import { a as boundedLineSlice, c as readDeclarationParams, d as resolveAllowedPath, f as resolveDeclarationRequest, h as unavailableReadAtRefResult, i as boundToolResponseContent, l as readDiffFromRuntimeData, m as runAstGrepSearch, n as assertSerializedToolResponseFits, p as resolveReadAtRefRequest, r as astGrepSearchParams, s as readAtRefParams, t as assertNoSymlinkPath, u as readDiffParams } from "../runtime-tools-core-BF8rSeNS.mjs";
 import path from "node:path";
 import { z } from "zod";
 import { compact } from "lodash-es";
@@ -21,6 +21,23 @@ const readableBaseSnapshotSchema = z.looseObject({
 	bytes: z.number().optional(),
 	truncated: z.boolean().optional()
 });
+const readableBaseDeclarationSnapshotSchema = z.looseObject({
+	path: z.string(),
+	ref: z.literal("base"),
+	sourcePath: z.string(),
+	rangeId: z.string(),
+	declaration: z.looseObject({
+		qualifiedName: z.string(),
+		kind: z.string(),
+		startLine: z.number(),
+		endLine: z.number()
+	}),
+	available: z.literal(true),
+	relativePath: z.string(),
+	bytes: z.number().optional(),
+	truncated: z.boolean().optional()
+});
+const runtimeStructuralCapabilitySchema = z.looseObject({ structuralAnalysis: z.looseObject({ available: z.literal(true) }).optional() });
 /** Registers pipr runtime read tools and config-defined custom tools with Pi. */
 function piprRuntimeTools(pi) {
 	const registrations = toolRegistrations();
@@ -38,6 +55,7 @@ function registration(dataPath, register) {
 }
 function registerRuntimeReadTools(pi, dataPath) {
 	const dataRoot = path.dirname(dataPath);
+	const structuralEnabled = runtimeStructuralCapabilitySchema.parse(JSON.parse(readFileSync(dataPath, "utf8"))).structuralAnalysis;
 	pi.registerTool({
 		name: "pipr_read_diff",
 		label: "Read pipr Diff Manifest",
@@ -81,6 +99,70 @@ function registerRuntimeReadTools(pi, dataPath) {
 			return textResult(await readAtRef(dataRoot, data, readAtRefParams(params), cwd));
 		}
 	});
+	if (!structuralEnabled) return;
+	pi.registerTool({
+		name: "pipr_read_declaration",
+		label: "Read enclosing declaration",
+		description: "Read bounded enclosing declaration context for one Diff Manifest path, ref, and range id.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			required: [
+				"path",
+				"ref",
+				"rangeId"
+			],
+			properties: {
+				path: { type: "string" },
+				ref: {
+					type: "string",
+					enum: ["base", "head"]
+				},
+				rangeId: { type: "string" }
+			}
+		},
+		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+			const cwd = typeof ctx?.cwd === "string" ? ctx.cwd : "";
+			const data = await Bun.file(dataPath).json();
+			return textResult(await readDeclaration(dataRoot, data, readDeclarationParams(params), cwd));
+		}
+	});
+	pi.registerTool({
+		name: "pipr_ast_grep",
+		label: "Search repository structure",
+		description: "Search syntax-specific patterns in explicit safe paths in the head workspace.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			required: [
+				"pattern",
+				"language",
+				"paths"
+			],
+			properties: {
+				pattern: {
+					type: "string",
+					maxLength: 4096
+				},
+				language: { type: "string" },
+				paths: {
+					type: "array",
+					minItems: 1,
+					maxItems: 16,
+					items: { type: "string" }
+				}
+			}
+		},
+		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+			const cwd = typeof ctx?.cwd === "string" ? ctx.cwd : "";
+			const data = await Bun.file(dataPath).json();
+			return textResult(await runAstGrepSearch({
+				cwd,
+				params: astGrepSearchParams(params),
+				maxBytes: data.toolResponseMaxBytes
+			}));
+		}
+	});
 }
 function registerCustomTools(pi, dataPath) {
 	const bridgeUrl = customToolBridgeUrl();
@@ -154,7 +236,7 @@ function textResult(value) {
 	return {
 		content: [{
 			type: "text",
-			text: JSON.stringify(value, null, 2)
+			text: JSON.stringify(value)
 		}],
 		details: value
 	};
@@ -165,6 +247,50 @@ async function readAtRef(dataRoot, data, params, cwd) {
 	if (params.ref === "base") return await readBaseSnapshot(dataRoot, data.baseRanges[params.rangeId], params, request);
 	return await readHeadWorkspaceFile(cwd, data.toolResponseMaxBytes, params, request);
 }
+async function readDeclaration(dataRoot, data, params, cwd) {
+	const request = resolveDeclarationRequest(data, params);
+	if (!request.available) return assertSerializedToolResponseFits(request, data.toolResponseMaxBytes, "pipr_read_declaration response limit is too small");
+	if (params.ref === "base") return await readBaseDeclarationSnapshot(dataRoot, data.baseDeclarations?.[params.rangeId], request, data.toolResponseMaxBytes);
+	const target = resolveAllowedPath(cwd, request.sourcePath);
+	await assertNoSymlinkPath(cwd, request.sourcePath);
+	return boundToolResponseContent({
+		...request,
+		declaration: declarationResult(request.declaration),
+		...boundedLineSlice(await Bun.file(target).text(), {
+			startLine: request.declaration.startLine,
+			endLine: request.declaration.endLine
+		}, data.toolResponseMaxBytes)
+	}, data.toolResponseMaxBytes, "pipr_read_declaration response limit is too small");
+}
+async function readBaseDeclarationSnapshot(dataRoot, snapshot, request, maxBytes) {
+	const readable = readableBaseDeclarationSnapshotSchema.safeParse(snapshot);
+	if (!readable.success) {
+		const { declaration: _declaration, ...unavailable } = request;
+		return assertSerializedToolResponseFits({
+			...unavailable,
+			available: false
+		}, maxBytes, "pipr_read_declaration response limit is too small");
+	}
+	return boundToolResponseContent({
+		path: request.path,
+		sourcePath: request.sourcePath,
+		ref: request.ref,
+		rangeId: request.rangeId,
+		declaration: declarationResult(request.declaration),
+		available: true,
+		content: await Bun.file(path.join(dataRoot, readable.data.relativePath)).text(),
+		bytes: readable.data.bytes,
+		truncated: readable.data.truncated
+	}, maxBytes, "pipr_read_declaration response limit is too small");
+}
+function declarationResult(declaration) {
+	return {
+		qualifiedName: declaration.qualifiedName,
+		kind: declaration.kind,
+		startLine: declaration.startLine,
+		endLine: declaration.endLine
+	};
+}
 async function readBaseSnapshot(dataRoot, snapshot, params, request) {
 	const readable = readableBaseSnapshotSchema.safeParse(snapshot);
 	if (!readable.success) return snapshot ?? unavailableReadAtRefResult(request);

package/dist/pi/runtime-tools-extension.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-tools-extension.mjs","names":[],"sources":["../../src/pi/runtime-tools-extension.ts"],"sourcesContent":["// Internal Pi sandbox contract loaded by the Pipr runtime. Not user API.\nimport { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { compact } from \"lodash-es\";\nimport { z } from \"zod\";\nimport {\n  assertNoSymlinkPath,\n  type BaseRangeSnapshot,\n  boundedLineSlice,\n  type ReadAtRefParams,\n  type RuntimeToolData,\n  readAtRefParams,\n  readDiffFromRuntimeData,\n  readDiffParams,\n  resolveAllowedPath,\n  resolveReadAtRefRequest,\n  unavailableReadAtRefResult,\n} from \"./runtime-tools-core.js\";\n\ntype PiExtensionHost = {\n  registerTool(tool: PiTool): void;\n};\n\ntype PiTool = {\n  name: string;\n  label: string;\n  description: string;\n  parameters: Record<string, unknown>;\n  execute: (\n    toolCallId: string,\n    params: unknown,\n    signal?: unknown,\n    onUpdate?: unknown,\n    ctx?: { cwd?: unknown },\n  ) => Promise<ToolResult>;\n};\n\ntype ToolResult = {\n  content: Array<{ type: \"text\"; text: string }>;\n  details: unknown;\n};\n\nconst customToolDataSchema = z.strictObject({\n  tools: z.array(\n    z.strictObject({\n      name: z.string().min(1),\n      description: z.string().optional(),\n    }),\n  ),\n});\n\nconst customToolBridgePayloadSchema = z.record(z.string(), z.unknown());\nconst readableBaseSnapshotSchema = z.looseObject({\n  path: z.string(),\n  ref: z.enum([\"base\", \"head\"]),\n  sourcePath: z.string(),\n  rangeId: z.string(),\n  startLine: z.number(),\n  endLine: z.number(),\n  available: z.literal(true),\n  relativePath: z.string(),\n  bytes: z.number().optional(),\n  truncated: z.boolean().optional(),\n});\n\n/** Registers pipr runtime read tools and config-defined custom tools with Pi. */\nexport default function piprRuntimeTools(pi: PiExtensionHost): void {\n  const registrations = toolRegistrations();\n  if (registrations.length === 0) {\n    throw new Error(\"PIPR_RUNTIME_TOOLS_DATA or PIPR_CUSTOM_TOOLS_DATA is required\");\n  }\n  for (const registration of registrations) {\n    registration.register(pi, registration.dataPath);\n  }\n}\n\nfunction toolRegistrations(): Array<{\n  dataPath: string;\n  register(pi: PiExtensionHost, dataPath: string): void;\n}> {\n  return compact([\n    registration(runtimeDataPath(), registerRuntimeReadTools),\n    registration(customToolsDataPath(), registerCustomTools),\n  ]);\n}\n\nfunction registration(\n  dataPath: string | undefined,\n  register: (pi: PiExtensionHost, dataPath: string) => void,\n) {\n  return dataPath ? { dataPath, register } : undefined;\n}\n\nfunction registerRuntimeReadTools(pi: PiExtensionHost, dataPath: string): void {\n  const dataRoot = path.dirname(dataPath);\n\n  pi.registerTool({\n    name: \"pipr_read_diff\",\n    label: \"Read pipr Diff Manifest\",\n    description: \"Read bounded full Diff Manifest data by path and/or range id.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      properties: {\n        path: { type: \"string\" },\n        rangeId: { type: \"string\" },\n      },\n    },\n    async execute(_toolCallId, params) {\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = readDiffFromRuntimeData(data, readDiffParams(params));\n      return textResult(result);\n    },\n  });\n\n  pi.registerTool({\n    name: \"pipr_read_at_ref\",\n    label: \"Read pipr file at ref\",\n    description: \"Read bounded file content for a Diff Manifest path at base or head.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      required: [\"path\", \"ref\", \"rangeId\"],\n      properties: {\n        path: { type: \"string\" },\n        ref: { type: \"string\", enum: [\"base\", \"head\"] },\n        rangeId: { type: \"string\" },\n      },\n    },\n    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n      const cwd = typeof ctx?.cwd === \"string\" ? ctx.cwd : \"\";\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = await readAtRef(dataRoot, data, readAtRefParams(params), cwd);\n      return textResult(result);\n    },\n  });\n}\n\nfunction registerCustomTools(pi: PiExtensionHost, dataPath: string): void {\n  const bridgeUrl = customToolBridgeUrl();\n  const bridgeToken = customToolBridgeToken();\n  const data = customToolDataSchema.parse(JSON.parse(readFileSync(dataPath, \"utf8\")));\n  for (const tool of data.tools) {\n    pi.registerTool({\n      name: tool.name,\n      label: tool.name,\n      description: tool.description ?? \"pipr custom config tool.\",\n      parameters: {\n        type: \"object\",\n        additionalProperties: true,\n      },\n      async execute(_toolCallId, params) {\n        const result = await callCustomTool(bridgeUrl, bridgeToken, tool.name, params);\n        return textResult(result);\n      },\n    });\n  }\n}\n\nfunction runtimeDataPath(): string | undefined {\n  const dataPath = process.env.PIPR_RUNTIME_TOOLS_DATA;\n  if (!dataPath) {\n    return undefined;\n  }\n  if (!path.isAbsolute(dataPath)) {\n    throw new Error(\"PIPR_RUNTIME_TOOLS_DATA must be an absolute path\");\n  }\n  return dataPath;\n}\n\nfunction customToolsDataPath(): string | undefined {\n  const dataPath = process.env.PIPR_CUSTOM_TOOLS_DATA;\n  if (!dataPath) {\n    return undefined;\n  }\n  if (!path.isAbsolute(dataPath)) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_DATA must be an absolute path\");\n  }\n  return dataPath;\n}\n\nfunction customToolBridgeUrl(): string {\n  const value = process.env.PIPR_CUSTOM_TOOLS_BRIDGE_URL;\n  if (!value) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_BRIDGE_URL is required for pipr custom tools\");\n  }\n  return value;\n}\n\nfunction customToolBridgeToken(): string {\n  const value = process.env.PIPR_CUSTOM_TOOLS_BRIDGE_TOKEN;\n  if (!value) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_BRIDGE_TOKEN is required for pipr custom tools\");\n  }\n  return value;\n}\n\nasync function callCustomTool(\n  bridgeUrl: string,\n  bridgeToken: string,\n  tool: string,\n  params: unknown,\n): Promise<unknown> {\n  const response = await fetch(`${bridgeUrl}/call`, {\n    method: \"POST\",\n    headers: {\n      authorization: `Bearer ${bridgeToken}`,\n      \"content-type\": \"application/json\",\n    },\n    body: JSON.stringify({ tool, params }),\n  });\n  const payload = await parseCustomToolBridgePayload(response, tool);\n  assertCustomToolBridgeOk(response, payload, tool);\n  return Reflect.get(payload, \"result\");\n}\n\nasync function parseCustomToolBridgePayload(\n  response: Response,\n  tool: string,\n): Promise<Record<string, unknown>> {\n  try {\n    return customToolBridgePayloadSchema.parse(await response.json());\n  } catch {\n    throw new Error(`Custom tool '${tool}' returned invalid bridge response`);\n  }\n}\n\nfunction assertCustomToolBridgeOk(\n  response: Response,\n  payload: Record<string, unknown>,\n  tool: string,\n): void {\n  if (!response.ok || Reflect.get(payload, \"ok\") !== true) {\n    const error = Reflect.get(payload, \"error\");\n    throw new Error(typeof error === \"string\" ? error : `Custom tool '${tool}' failed`);\n  }\n}\n\nfunction textResult(value: unknown): ToolResult {\n  return {\n    content: [{ type: \"text\", text: JSON.stringify(value, null, 2) }],\n    details: value,\n  };\n}\n\nasync function readAtRef(\n  dataRoot: string,\n  data: RuntimeToolData,\n  params: ReadAtRefParams,\n  cwd: string,\n): Promise<unknown> {\n  const request = resolveReadAtRefRequest(data.manifest, params);\n  if (!request.window) {\n    return unavailableReadAtRefResult(request);\n  }\n  if (params.ref === \"base\") {\n    return await readBaseSnapshot(dataRoot, data.baseRanges[params.rangeId], params, request);\n  }\n  return await readHeadWorkspaceFile(cwd, data.toolResponseMaxBytes, params, request);\n}\n\nasync function readBaseSnapshot(\n  dataRoot: string,\n  snapshot: BaseRangeSnapshot | undefined,\n  params: ReadAtRefParams,\n  request: ReturnType<typeof resolveReadAtRefRequest>,\n): Promise<unknown> {\n  const readable = readableBaseSnapshotSchema.safeParse(snapshot);\n  if (!readable.success) {\n    return snapshot ?? unavailableReadAtRefResult(request);\n  }\n  const snapshotData = readable.data;\n  return {\n    path: params.path,\n    ref: params.ref,\n    sourcePath: request.sourcePath,\n    rangeId: params.rangeId,\n    startLine: snapshotData.startLine,\n    endLine: snapshotData.endLine,\n    available: true,\n    content: await Bun.file(path.join(dataRoot, snapshotData.relativePath)).text(),\n    bytes: snapshotData.bytes,\n    truncated: snapshotData.truncated,\n  };\n}\n\nasync function readHeadWorkspaceFile(\n  cwd: string,\n  maxBytes: number,\n  params: ReadAtRefParams,\n  request: ReturnType<typeof resolveReadAtRefRequest>,\n): Promise<unknown> {\n  if (!request.window) {\n    return unavailableReadAtRefResult(request);\n  }\n  const target = resolveAllowedPath(cwd, request.sourcePath);\n  await assertNoSymlinkPath(cwd, request.sourcePath);\n  return {\n    path: params.path,\n    ref: params.ref,\n    sourcePath: request.sourcePath,\n    rangeId: params.rangeId,\n    startLine: request.window.startLine,\n    endLine: request.window.endLine,\n    ...boundedLineSlice(await Bun.file(target).text(), request.window, maxBytes),\n  };\n}\n"],"mappings":";;;;;;AA0CA,MAAM,uBAAuB,EAAE,aAAa,EAC1C,OAAO,EAAE,MACP,EAAE,aAAa;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH,EACF,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACtE,MAAM,6BAA6B,EAAE,YAAY;CAC/C,MAAM,EAAE,OAAO;CACf,KAAK,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;CAC5B,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,QAAQ,IAAI;CACzB,cAAc,EAAE,OAAO;CACvB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;AAClC,CAAC;;AAGD,SAAwB,iBAAiB,IAA2B;CAClE,MAAM,gBAAgB,kBAAkB;CACxC,IAAI,cAAc,WAAW,GAC3B,MAAM,IAAI,MAAM,+DAA+D;CAEjF,KAAK,MAAM,gBAAgB,eACzB,aAAa,SAAS,IAAI,aAAa,QAAQ;AAEnD;AAEA,SAAS,oBAGN;CACD,OAAO,QAAQ,CACb,aAAa,gBAAgB,GAAG,wBAAwB,GACxD,aAAa,oBAAoB,GAAG,mBAAmB,CACzD,CAAC;AACH;AAEA,SAAS,aACP,UACA,UACA;CACA,OAAO,WAAW;EAAE;EAAU;CAAS,IAAI,KAAA;AAC7C;AAEA,SAAS,yBAAyB,IAAqB,UAAwB;CAC7E,MAAM,WAAW,KAAK,QAAQ,QAAQ;CAEtC,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aAAa;EACb,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,YAAY;IACV,MAAM,EAAE,MAAM,SAAS;IACvB,SAAS,EAAE,MAAM,SAAS;GAC5B;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ;GAGjC,OAAO,WADQ,wBAAwB,MADnB,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK,GACC,eAAe,MAAM,CAC3C,CAAC;EAC1B;CACF,CAAC;CAED,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aAAa;EACb,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,UAAU;IAAC;IAAQ;IAAO;GAAS;GACnC,YAAY;IACV,MAAM,EAAE,MAAM,SAAS;IACvB,KAAK;KAAE,MAAM;KAAU,MAAM,CAAC,QAAQ,MAAM;IAAE;IAC9C,SAAS,EAAE,MAAM,SAAS;GAC5B;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ,SAAS,WAAW,KAAK;GAC1D,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;GACrD,MAAM,OAAQ,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK;GAE5C,OAAO,WAAW,MADG,UAAU,UAAU,MAAM,gBAAgB,MAAM,GAAG,GAAG,CACnD;EAC1B;CACF,CAAC;AACH;AAEA,SAAS,oBAAoB,IAAqB,UAAwB;CACxE,MAAM,YAAY,oBAAoB;CACtC,MAAM,cAAc,sBAAsB;CAC1C,MAAM,OAAO,qBAAqB,MAAM,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC,CAAC;CAClF,KAAK,MAAM,QAAQ,KAAK,OACtB,GAAG,aAAa;EACd,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa,KAAK,eAAe;EACjC,YAAY;GACV,MAAM;GACN,sBAAsB;EACxB;EACA,MAAM,QAAQ,aAAa,QAAQ;GAEjC,OAAO,WAAW,MADG,eAAe,WAAW,aAAa,KAAK,MAAM,MAAM,CACrD;EAC1B;CACF,CAAC;AAEL;AAEA,SAAS,kBAAsC;CAC7C,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,CAAC,UACH;CAEF,IAAI,CAAC,KAAK,WAAW,QAAQ,GAC3B,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,SAAS,sBAA0C;CACjD,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,CAAC,UACH;CAEF,IAAI,CAAC,KAAK,WAAW,QAAQ,GAC3B,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO;AACT;AAEA,SAAS,sBAA8B;CACrC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,wBAAgC;CACvC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;AACT;AAEA,eAAe,eACb,WACA,aACA,MACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,QAAQ;EAChD,QAAQ;EACR,SAAS;GACP,eAAe,UAAU;GACzB,gBAAgB;EAClB;EACA,MAAM,KAAK,UAAU;GAAE;GAAM;EAAO,CAAC;CACvC,CAAC;CACD,MAAM,UAAU,MAAM,6BAA6B,UAAU,IAAI;CACjE,yBAAyB,UAAU,SAAS,IAAI;CAChD,OAAO,QAAQ,IAAI,SAAS,QAAQ;AACtC;AAEA,eAAe,6BACb,UACA,MACkC;CAClC,IAAI;EACF,OAAO,8BAA8B,MAAM,MAAM,SAAS,KAAK,CAAC;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,gBAAgB,KAAK,mCAAmC;CAC1E;AACF;AAEA,SAAS,yBACP,UACA,SACA,MACM;CACN,IAAI,CAAC,SAAS,MAAM,QAAQ,IAAI,SAAS,IAAI,MAAM,MAAM;EACvD,MAAM,QAAQ,QAAQ,IAAI,SAAS,OAAO;EAC1C,MAAM,IAAI,MAAM,OAAO,UAAU,WAAW,QAAQ,gBAAgB,KAAK,SAAS;CACpF;AACF;AAEA,SAAS,WAAW,OAA4B;CAC9C,OAAO;EACL,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC;EAAE,CAAC;EAChE,SAAS;CACX;AACF;AAEA,eAAe,UACb,UACA,MACA,QACA,KACkB;CAClB,MAAM,UAAU,wBAAwB,KAAK,UAAU,MAAM;CAC7D,IAAI,CAAC,QAAQ,QACX,OAAO,2BAA2B,OAAO;CAE3C,IAAI,OAAO,QAAQ,QACjB,OAAO,MAAM,iBAAiB,UAAU,KAAK,WAAW,OAAO,UAAU,QAAQ,OAAO;CAE1F,OAAO,MAAM,sBAAsB,KAAK,KAAK,sBAAsB,QAAQ,OAAO;AACpF;AAEA,eAAe,iBACb,UACA,UACA,QACA,SACkB;CAClB,MAAM,WAAW,2BAA2B,UAAU,QAAQ;CAC9D,IAAI,CAAC,SAAS,SACZ,OAAO,YAAY,2BAA2B,OAAO;CAEvD,MAAM,eAAe,SAAS;CAC9B,OAAO;EACL,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,YAAY,QAAQ;EACpB,SAAS,OAAO;EAChB,WAAW,aAAa;EACxB,SAAS,aAAa;EACtB,WAAW;EACX,SAAS,MAAM,IAAI,KAAK,KAAK,KAAK,UAAU,aAAa,YAAY,CAAC,CAAC,CAAC,KAAK;EAC7E,OAAO,aAAa;EACpB,WAAW,aAAa;CAC1B;AACF;AAEA,eAAe,sBACb,KACA,UACA,QACA,SACkB;CAClB,IAAI,CAAC,QAAQ,QACX,OAAO,2BAA2B,OAAO;CAE3C,MAAM,SAAS,mBAAmB,KAAK,QAAQ,UAAU;CACzD,MAAM,oBAAoB,KAAK,QAAQ,UAAU;CACjD,OAAO;EACL,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,YAAY,QAAQ;EACpB,SAAS,OAAO;EAChB,WAAW,QAAQ,OAAO;EAC1B,SAAS,QAAQ,OAAO;EACxB,GAAG,iBAAiB,MAAM,IAAI,KAAK,MAAM,CAAC,CAAC,KAAK,GAAG,QAAQ,QAAQ,QAAQ;CAC7E;AACF"}
+{"version":3,"file":"runtime-tools-extension.mjs","names":[],"sources":["../../src/pi/runtime-tools-extension.ts"],"sourcesContent":["// Internal Pi sandbox contract loaded by the Pipr runtime. Not user API.\nimport { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { compact } from \"lodash-es\";\nimport { z } from \"zod\";\nimport {\n  assertNoSymlinkPath,\n  assertSerializedToolResponseFits,\n  astGrepSearchParams,\n  type BaseDeclarationSnapshot,\n  type BaseRangeSnapshot,\n  boundedLineSlice,\n  boundToolResponseContent,\n  type ReadAtRefParams,\n  type RuntimeToolData,\n  readAtRefParams,\n  readDeclarationParams,\n  readDiffFromRuntimeData,\n  readDiffParams,\n  resolveAllowedPath,\n  resolveDeclarationRequest,\n  resolveReadAtRefRequest,\n  runAstGrepSearch,\n  unavailableReadAtRefResult,\n} from \"./runtime-tools-core.js\";\n\ntype PiExtensionHost = {\n  registerTool(tool: PiTool): void;\n};\n\ntype PiTool = {\n  name: string;\n  label: string;\n  description: string;\n  parameters: Record<string, unknown>;\n  execute: (\n    toolCallId: string,\n    params: unknown,\n    signal?: unknown,\n    onUpdate?: unknown,\n    ctx?: { cwd?: unknown },\n  ) => Promise<ToolResult>;\n};\n\ntype ToolResult = {\n  content: Array<{ type: \"text\"; text: string }>;\n  details: unknown;\n};\n\nconst customToolDataSchema = z.strictObject({\n  tools: z.array(\n    z.strictObject({\n      name: z.string().min(1),\n      description: z.string().optional(),\n    }),\n  ),\n});\n\nconst customToolBridgePayloadSchema = z.record(z.string(), z.unknown());\nconst readableBaseSnapshotSchema = z.looseObject({\n  path: z.string(),\n  ref: z.enum([\"base\", \"head\"]),\n  sourcePath: z.string(),\n  rangeId: z.string(),\n  startLine: z.number(),\n  endLine: z.number(),\n  available: z.literal(true),\n  relativePath: z.string(),\n  bytes: z.number().optional(),\n  truncated: z.boolean().optional(),\n});\nconst readableBaseDeclarationSnapshotSchema = z.looseObject({\n  path: z.string(),\n  ref: z.literal(\"base\"),\n  sourcePath: z.string(),\n  rangeId: z.string(),\n  declaration: z.looseObject({\n    qualifiedName: z.string(),\n    kind: z.string(),\n    startLine: z.number(),\n    endLine: z.number(),\n  }),\n  available: z.literal(true),\n  relativePath: z.string(),\n  bytes: z.number().optional(),\n  truncated: z.boolean().optional(),\n});\nconst runtimeStructuralCapabilitySchema = z.looseObject({\n  structuralAnalysis: z\n    .looseObject({\n      available: z.literal(true),\n    })\n    .optional(),\n});\n\n/** Registers pipr runtime read tools and config-defined custom tools with Pi. */\nexport default function piprRuntimeTools(pi: PiExtensionHost): void {\n  const registrations = toolRegistrations();\n  if (registrations.length === 0) {\n    throw new Error(\"PIPR_RUNTIME_TOOLS_DATA or PIPR_CUSTOM_TOOLS_DATA is required\");\n  }\n  for (const registration of registrations) {\n    registration.register(pi, registration.dataPath);\n  }\n}\n\nfunction toolRegistrations(): Array<{\n  dataPath: string;\n  register(pi: PiExtensionHost, dataPath: string): void;\n}> {\n  return compact([\n    registration(runtimeDataPath(), registerRuntimeReadTools),\n    registration(customToolsDataPath(), registerCustomTools),\n  ]);\n}\n\nfunction registration(\n  dataPath: string | undefined,\n  register: (pi: PiExtensionHost, dataPath: string) => void,\n) {\n  return dataPath ? { dataPath, register } : undefined;\n}\n\nfunction registerRuntimeReadTools(pi: PiExtensionHost, dataPath: string): void {\n  const dataRoot = path.dirname(dataPath);\n  const structuralEnabled = runtimeStructuralCapabilitySchema.parse(\n    JSON.parse(readFileSync(dataPath, \"utf8\")),\n  ).structuralAnalysis;\n\n  pi.registerTool({\n    name: \"pipr_read_diff\",\n    label: \"Read pipr Diff Manifest\",\n    description: \"Read bounded full Diff Manifest data by path and/or range id.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      properties: {\n        path: { type: \"string\" },\n        rangeId: { type: \"string\" },\n      },\n    },\n    async execute(_toolCallId, params) {\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = readDiffFromRuntimeData(data, readDiffParams(params));\n      return textResult(result);\n    },\n  });\n\n  pi.registerTool({\n    name: \"pipr_read_at_ref\",\n    label: \"Read pipr file at ref\",\n    description: \"Read bounded file content for a Diff Manifest path at base or head.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      required: [\"path\", \"ref\", \"rangeId\"],\n      properties: {\n        path: { type: \"string\" },\n        ref: { type: \"string\", enum: [\"base\", \"head\"] },\n        rangeId: { type: \"string\" },\n      },\n    },\n    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n      const cwd = typeof ctx?.cwd === \"string\" ? ctx.cwd : \"\";\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = await readAtRef(dataRoot, data, readAtRefParams(params), cwd);\n      return textResult(result);\n    },\n  });\n\n  if (!structuralEnabled) {\n    return;\n  }\n\n  pi.registerTool({\n    name: \"pipr_read_declaration\",\n    label: \"Read enclosing declaration\",\n    description:\n      \"Read bounded enclosing declaration context for one Diff Manifest path, ref, and range id.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      required: [\"path\", \"ref\", \"rangeId\"],\n      properties: {\n        path: { type: \"string\" },\n        ref: { type: \"string\", enum: [\"base\", \"head\"] },\n        rangeId: { type: \"string\" },\n      },\n    },\n    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n      const cwd = typeof ctx?.cwd === \"string\" ? ctx.cwd : \"\";\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = await readDeclaration(dataRoot, data, readDeclarationParams(params), cwd);\n      return textResult(result);\n    },\n  });\n\n  pi.registerTool({\n    name: \"pipr_ast_grep\",\n    label: \"Search repository structure\",\n    description: \"Search syntax-specific patterns in explicit safe paths in the head workspace.\",\n    parameters: {\n      type: \"object\",\n      additionalProperties: false,\n      required: [\"pattern\", \"language\", \"paths\"],\n      properties: {\n        pattern: { type: \"string\", maxLength: 4096 },\n        language: { type: \"string\" },\n        paths: {\n          type: \"array\",\n          minItems: 1,\n          maxItems: 16,\n          items: { type: \"string\" },\n        },\n      },\n    },\n    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n      const cwd = typeof ctx?.cwd === \"string\" ? ctx.cwd : \"\";\n      const data = (await Bun.file(dataPath).json()) as RuntimeToolData;\n      const result = await runAstGrepSearch({\n        cwd,\n        params: astGrepSearchParams(params),\n        maxBytes: data.toolResponseMaxBytes,\n      });\n      return textResult(result);\n    },\n  });\n}\n\nfunction registerCustomTools(pi: PiExtensionHost, dataPath: string): void {\n  const bridgeUrl = customToolBridgeUrl();\n  const bridgeToken = customToolBridgeToken();\n  const data = customToolDataSchema.parse(JSON.parse(readFileSync(dataPath, \"utf8\")));\n  for (const tool of data.tools) {\n    pi.registerTool({\n      name: tool.name,\n      label: tool.name,\n      description: tool.description ?? \"pipr custom config tool.\",\n      parameters: {\n        type: \"object\",\n        additionalProperties: true,\n      },\n      async execute(_toolCallId, params) {\n        const result = await callCustomTool(bridgeUrl, bridgeToken, tool.name, params);\n        return textResult(result);\n      },\n    });\n  }\n}\n\nfunction runtimeDataPath(): string | undefined {\n  const dataPath = process.env.PIPR_RUNTIME_TOOLS_DATA;\n  if (!dataPath) {\n    return undefined;\n  }\n  if (!path.isAbsolute(dataPath)) {\n    throw new Error(\"PIPR_RUNTIME_TOOLS_DATA must be an absolute path\");\n  }\n  return dataPath;\n}\n\nfunction customToolsDataPath(): string | undefined {\n  const dataPath = process.env.PIPR_CUSTOM_TOOLS_DATA;\n  if (!dataPath) {\n    return undefined;\n  }\n  if (!path.isAbsolute(dataPath)) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_DATA must be an absolute path\");\n  }\n  return dataPath;\n}\n\nfunction customToolBridgeUrl(): string {\n  const value = process.env.PIPR_CUSTOM_TOOLS_BRIDGE_URL;\n  if (!value) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_BRIDGE_URL is required for pipr custom tools\");\n  }\n  return value;\n}\n\nfunction customToolBridgeToken(): string {\n  const value = process.env.PIPR_CUSTOM_TOOLS_BRIDGE_TOKEN;\n  if (!value) {\n    throw new Error(\"PIPR_CUSTOM_TOOLS_BRIDGE_TOKEN is required for pipr custom tools\");\n  }\n  return value;\n}\n\nasync function callCustomTool(\n  bridgeUrl: string,\n  bridgeToken: string,\n  tool: string,\n  params: unknown,\n): Promise<unknown> {\n  const response = await fetch(`${bridgeUrl}/call`, {\n    method: \"POST\",\n    headers: {\n      authorization: `Bearer ${bridgeToken}`,\n      \"content-type\": \"application/json\",\n    },\n    body: JSON.stringify({ tool, params }),\n  });\n  const payload = await parseCustomToolBridgePayload(response, tool);\n  assertCustomToolBridgeOk(response, payload, tool);\n  return Reflect.get(payload, \"result\");\n}\n\nasync function parseCustomToolBridgePayload(\n  response: Response,\n  tool: string,\n): Promise<Record<string, unknown>> {\n  try {\n    return customToolBridgePayloadSchema.parse(await response.json());\n  } catch {\n    throw new Error(`Custom tool '${tool}' returned invalid bridge response`);\n  }\n}\n\nfunction assertCustomToolBridgeOk(\n  response: Response,\n  payload: Record<string, unknown>,\n  tool: string,\n): void {\n  if (!response.ok || Reflect.get(payload, \"ok\") !== true) {\n    const error = Reflect.get(payload, \"error\");\n    throw new Error(typeof error === \"string\" ? error : `Custom tool '${tool}' failed`);\n  }\n}\n\nfunction textResult(value: unknown): ToolResult {\n  return {\n    content: [{ type: \"text\", text: JSON.stringify(value) }],\n    details: value,\n  };\n}\n\nasync function readAtRef(\n  dataRoot: string,\n  data: RuntimeToolData,\n  params: ReadAtRefParams,\n  cwd: string,\n): Promise<unknown> {\n  const request = resolveReadAtRefRequest(data.manifest, params);\n  if (!request.window) {\n    return unavailableReadAtRefResult(request);\n  }\n  if (params.ref === \"base\") {\n    return await readBaseSnapshot(dataRoot, data.baseRanges[params.rangeId], params, request);\n  }\n  return await readHeadWorkspaceFile(cwd, data.toolResponseMaxBytes, params, request);\n}\n\nasync function readDeclaration(\n  dataRoot: string,\n  data: RuntimeToolData,\n  params: ReturnType<typeof readDeclarationParams>,\n  cwd: string,\n): Promise<unknown> {\n  const request = resolveDeclarationRequest(data, params);\n  if (!request.available) {\n    return assertSerializedToolResponseFits(\n      request,\n      data.toolResponseMaxBytes,\n      \"pipr_read_declaration response limit is too small\",\n    );\n  }\n  if (params.ref === \"base\") {\n    return await readBaseDeclarationSnapshot(\n      dataRoot,\n      data.baseDeclarations?.[params.rangeId],\n      request,\n      data.toolResponseMaxBytes,\n    );\n  }\n  const target = resolveAllowedPath(cwd, request.sourcePath);\n  await assertNoSymlinkPath(cwd, request.sourcePath);\n  return boundToolResponseContent(\n    {\n      ...request,\n      declaration: declarationResult(request.declaration),\n      ...boundedLineSlice(\n        await Bun.file(target).text(),\n        {\n          startLine: request.declaration.startLine,\n          endLine: request.declaration.endLine,\n        },\n        data.toolResponseMaxBytes,\n      ),\n    },\n    data.toolResponseMaxBytes,\n    \"pipr_read_declaration response limit is too small\",\n  );\n}\n\nasync function readBaseDeclarationSnapshot(\n  dataRoot: string,\n  snapshot: BaseDeclarationSnapshot | undefined,\n  request: Extract<ReturnType<typeof resolveDeclarationRequest>, { available: true }>,\n  maxBytes: number,\n): Promise<unknown> {\n  const readable = readableBaseDeclarationSnapshotSchema.safeParse(snapshot);\n  if (!readable.success) {\n    const { declaration: _declaration, ...unavailable } = request;\n    return assertSerializedToolResponseFits(\n      { ...unavailable, available: false },\n      maxBytes,\n      \"pipr_read_declaration response limit is too small\",\n    );\n  }\n  return boundToolResponseContent(\n    {\n      path: request.path,\n      sourcePath: request.sourcePath,\n      ref: request.ref,\n      rangeId: request.rangeId,\n      declaration: declarationResult(request.declaration),\n      available: true,\n      content: await Bun.file(path.join(dataRoot, readable.data.relativePath)).text(),\n      bytes: readable.data.bytes,\n      truncated: readable.data.truncated,\n    },\n    maxBytes,\n    \"pipr_read_declaration response limit is too small\",\n  );\n}\n\nfunction declarationResult(declaration: {\n  qualifiedName: string;\n  kind: string;\n  startLine: number;\n  endLine: number;\n}) {\n  return {\n    qualifiedName: declaration.qualifiedName,\n    kind: declaration.kind,\n    startLine: declaration.startLine,\n    endLine: declaration.endLine,\n  };\n}\n\nasync function readBaseSnapshot(\n  dataRoot: string,\n  snapshot: BaseRangeSnapshot | undefined,\n  params: ReadAtRefParams,\n  request: ReturnType<typeof resolveReadAtRefRequest>,\n): Promise<unknown> {\n  const readable = readableBaseSnapshotSchema.safeParse(snapshot);\n  if (!readable.success) {\n    return snapshot ?? unavailableReadAtRefResult(request);\n  }\n  const snapshotData = readable.data;\n  return {\n    path: params.path,\n    ref: params.ref,\n    sourcePath: request.sourcePath,\n    rangeId: params.rangeId,\n    startLine: snapshotData.startLine,\n    endLine: snapshotData.endLine,\n    available: true,\n    content: await Bun.file(path.join(dataRoot, snapshotData.relativePath)).text(),\n    bytes: snapshotData.bytes,\n    truncated: snapshotData.truncated,\n  };\n}\n\nasync function readHeadWorkspaceFile(\n  cwd: string,\n  maxBytes: number,\n  params: ReadAtRefParams,\n  request: ReturnType<typeof resolveReadAtRefRequest>,\n): Promise<unknown> {\n  if (!request.window) {\n    return unavailableReadAtRefResult(request);\n  }\n  const target = resolveAllowedPath(cwd, request.sourcePath);\n  await assertNoSymlinkPath(cwd, request.sourcePath);\n  return {\n    path: params.path,\n    ref: params.ref,\n    sourcePath: request.sourcePath,\n    rangeId: params.rangeId,\n    startLine: request.window.startLine,\n    endLine: request.window.endLine,\n    ...boundedLineSlice(await Bun.file(target).text(), request.window, maxBytes),\n  };\n}\n"],"mappings":";;;;;;AAiDA,MAAM,uBAAuB,EAAE,aAAa,EAC1C,OAAO,EAAE,MACP,EAAE,aAAa;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC,CACH,EACF,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AACtE,MAAM,6BAA6B,EAAE,YAAY;CAC/C,MAAM,EAAE,OAAO;CACf,KAAK,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;CAC5B,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,QAAQ,IAAI;CACzB,cAAc,EAAE,OAAO;CACvB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;AAClC,CAAC;AACD,MAAM,wCAAwC,EAAE,YAAY;CAC1D,MAAM,EAAE,OAAO;CACf,KAAK,EAAE,QAAQ,MAAM;CACrB,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO;CAClB,aAAa,EAAE,YAAY;EACzB,eAAe,EAAE,OAAO;EACxB,MAAM,EAAE,OAAO;EACf,WAAW,EAAE,OAAO;EACpB,SAAS,EAAE,OAAO;CACpB,CAAC;CACD,WAAW,EAAE,QAAQ,IAAI;CACzB,cAAc,EAAE,OAAO;CACvB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS;AAClC,CAAC;AACD,MAAM,oCAAoC,EAAE,YAAY,EACtD,oBAAoB,EACjB,YAAY,EACX,WAAW,EAAE,QAAQ,IAAI,EAC3B,CAAC,CAAC,CACD,SAAS,EACd,CAAC;;AAGD,SAAwB,iBAAiB,IAA2B;CAClE,MAAM,gBAAgB,kBAAkB;CACxC,IAAI,cAAc,WAAW,GAC3B,MAAM,IAAI,MAAM,+DAA+D;CAEjF,KAAK,MAAM,gBAAgB,eACzB,aAAa,SAAS,IAAI,aAAa,QAAQ;AAEnD;AAEA,SAAS,oBAGN;CACD,OAAO,QAAQ,CACb,aAAa,gBAAgB,GAAG,wBAAwB,GACxD,aAAa,oBAAoB,GAAG,mBAAmB,CACzD,CAAC;AACH;AAEA,SAAS,aACP,UACA,UACA;CACA,OAAO,WAAW;EAAE;EAAU;CAAS,IAAI,KAAA;AAC7C;AAEA,SAAS,yBAAyB,IAAqB,UAAwB;CAC7E,MAAM,WAAW,KAAK,QAAQ,QAAQ;CACtC,MAAM,oBAAoB,kCAAkC,MAC1D,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC,CAC3C,CAAC,CAAC;CAEF,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aAAa;EACb,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,YAAY;IACV,MAAM,EAAE,MAAM,SAAS;IACvB,SAAS,EAAE,MAAM,SAAS;GAC5B;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ;GAGjC,OAAO,WADQ,wBAAwB,MADnB,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK,GACC,eAAe,MAAM,CAC3C,CAAC;EAC1B;CACF,CAAC;CAED,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aAAa;EACb,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,UAAU;IAAC;IAAQ;IAAO;GAAS;GACnC,YAAY;IACV,MAAM,EAAE,MAAM,SAAS;IACvB,KAAK;KAAE,MAAM;KAAU,MAAM,CAAC,QAAQ,MAAM;IAAE;IAC9C,SAAS,EAAE,MAAM,SAAS;GAC5B;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ,SAAS,WAAW,KAAK;GAC1D,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;GACrD,MAAM,OAAQ,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK;GAE5C,OAAO,WAAW,MADG,UAAU,UAAU,MAAM,gBAAgB,MAAM,GAAG,GAAG,CACnD;EAC1B;CACF,CAAC;CAED,IAAI,CAAC,mBACH;CAGF,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aACE;EACF,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,UAAU;IAAC;IAAQ;IAAO;GAAS;GACnC,YAAY;IACV,MAAM,EAAE,MAAM,SAAS;IACvB,KAAK;KAAE,MAAM;KAAU,MAAM,CAAC,QAAQ,MAAM;IAAE;IAC9C,SAAS,EAAE,MAAM,SAAS;GAC5B;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ,SAAS,WAAW,KAAK;GAC1D,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;GACrD,MAAM,OAAQ,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK;GAE5C,OAAO,WAAW,MADG,gBAAgB,UAAU,MAAM,sBAAsB,MAAM,GAAG,GAAG,CAC/D;EAC1B;CACF,CAAC;CAED,GAAG,aAAa;EACd,MAAM;EACN,OAAO;EACP,aAAa;EACb,YAAY;GACV,MAAM;GACN,sBAAsB;GACtB,UAAU;IAAC;IAAW;IAAY;GAAO;GACzC,YAAY;IACV,SAAS;KAAE,MAAM;KAAU,WAAW;IAAK;IAC3C,UAAU,EAAE,MAAM,SAAS;IAC3B,OAAO;KACL,MAAM;KACN,UAAU;KACV,UAAU;KACV,OAAO,EAAE,MAAM,SAAS;IAC1B;GACF;EACF;EACA,MAAM,QAAQ,aAAa,QAAQ,SAAS,WAAW,KAAK;GAC1D,MAAM,MAAM,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;GACrD,MAAM,OAAQ,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC,KAAK;GAM5C,OAAO,WAAW,MALG,iBAAiB;IACpC;IACA,QAAQ,oBAAoB,MAAM;IAClC,UAAU,KAAK;GACjB,CAAC,CACuB;EAC1B;CACF,CAAC;AACH;AAEA,SAAS,oBAAoB,IAAqB,UAAwB;CACxE,MAAM,YAAY,oBAAoB;CACtC,MAAM,cAAc,sBAAsB;CAC1C,MAAM,OAAO,qBAAqB,MAAM,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC,CAAC;CAClF,KAAK,MAAM,QAAQ,KAAK,OACtB,GAAG,aAAa;EACd,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,aAAa,KAAK,eAAe;EACjC,YAAY;GACV,MAAM;GACN,sBAAsB;EACxB;EACA,MAAM,QAAQ,aAAa,QAAQ;GAEjC,OAAO,WAAW,MADG,eAAe,WAAW,aAAa,KAAK,MAAM,MAAM,CACrD;EAC1B;CACF,CAAC;AAEL;AAEA,SAAS,kBAAsC;CAC7C,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,CAAC,UACH;CAEF,IAAI,CAAC,KAAK,WAAW,QAAQ,GAC3B,MAAM,IAAI,MAAM,kDAAkD;CAEpE,OAAO;AACT;AAEA,SAAS,sBAA0C;CACjD,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,CAAC,UACH;CAEF,IAAI,CAAC,KAAK,WAAW,QAAQ,GAC3B,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO;AACT;AAEA,SAAS,sBAA8B;CACrC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO;AACT;AAEA,SAAS,wBAAgC;CACvC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO;AACT;AAEA,eAAe,eACb,WACA,aACA,MACA,QACkB;CAClB,MAAM,WAAW,MAAM,MAAM,GAAG,UAAU,QAAQ;EAChD,QAAQ;EACR,SAAS;GACP,eAAe,UAAU;GACzB,gBAAgB;EAClB;EACA,MAAM,KAAK,UAAU;GAAE;GAAM;EAAO,CAAC;CACvC,CAAC;CACD,MAAM,UAAU,MAAM,6BAA6B,UAAU,IAAI;CACjE,yBAAyB,UAAU,SAAS,IAAI;CAChD,OAAO,QAAQ,IAAI,SAAS,QAAQ;AACtC;AAEA,eAAe,6BACb,UACA,MACkC;CAClC,IAAI;EACF,OAAO,8BAA8B,MAAM,MAAM,SAAS,KAAK,CAAC;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,gBAAgB,KAAK,mCAAmC;CAC1E;AACF;AAEA,SAAS,yBACP,UACA,SACA,MACM;CACN,IAAI,CAAC,SAAS,MAAM,QAAQ,IAAI,SAAS,IAAI,MAAM,MAAM;EACvD,MAAM,QAAQ,QAAQ,IAAI,SAAS,OAAO;EAC1C,MAAM,IAAI,MAAM,OAAO,UAAU,WAAW,QAAQ,gBAAgB,KAAK,SAAS;CACpF;AACF;AAEA,SAAS,WAAW,OAA4B;CAC9C,OAAO;EACL,SAAS,CAAC;GAAE,MAAM;GAAQ,MAAM,KAAK,UAAU,KAAK;EAAE,CAAC;EACvD,SAAS;CACX;AACF;AAEA,eAAe,UACb,UACA,MACA,QACA,KACkB;CAClB,MAAM,UAAU,wBAAwB,KAAK,UAAU,MAAM;CAC7D,IAAI,CAAC,QAAQ,QACX,OAAO,2BAA2B,OAAO;CAE3C,IAAI,OAAO,QAAQ,QACjB,OAAO,MAAM,iBAAiB,UAAU,KAAK,WAAW,OAAO,UAAU,QAAQ,OAAO;CAE1F,OAAO,MAAM,sBAAsB,KAAK,KAAK,sBAAsB,QAAQ,OAAO;AACpF;AAEA,eAAe,gBACb,UACA,MACA,QACA,KACkB;CAClB,MAAM,UAAU,0BAA0B,MAAM,MAAM;CACtD,IAAI,CAAC,QAAQ,WACX,OAAO,iCACL,SACA,KAAK,sBACL,mDACF;CAEF,IAAI,OAAO,QAAQ,QACjB,OAAO,MAAM,4BACX,UACA,KAAK,mBAAmB,OAAO,UAC/B,SACA,KAAK,oBACP;CAEF,MAAM,SAAS,mBAAmB,KAAK,QAAQ,UAAU;CACzD,MAAM,oBAAoB,KAAK,QAAQ,UAAU;CACjD,OAAO,yBACL;EACE,GAAG;EACH,aAAa,kBAAkB,QAAQ,WAAW;EAClD,GAAG,iBACD,MAAM,IAAI,KAAK,MAAM,CAAC,CAAC,KAAK,GAC5B;GACE,WAAW,QAAQ,YAAY;GAC/B,SAAS,QAAQ,YAAY;EAC/B,GACA,KAAK,oBACP;CACF,GACA,KAAK,sBACL,mDACF;AACF;AAEA,eAAe,4BACb,UACA,UACA,SACA,UACkB;CAClB,MAAM,WAAW,sCAAsC,UAAU,QAAQ;CACzE,IAAI,CAAC,SAAS,SAAS;EACrB,MAAM,EAAE,aAAa,cAAc,GAAG,gBAAgB;EACtD,OAAO,iCACL;GAAE,GAAG;GAAa,WAAW;EAAM,GACnC,UACA,mDACF;CACF;CACA,OAAO,yBACL;EACE,MAAM,QAAQ;EACd,YAAY,QAAQ;EACpB,KAAK,QAAQ;EACb,SAAS,QAAQ;EACjB,aAAa,kBAAkB,QAAQ,WAAW;EAClD,WAAW;EACX,SAAS,MAAM,IAAI,KAAK,KAAK,KAAK,UAAU,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK;EAC9E,OAAO,SAAS,KAAK;EACrB,WAAW,SAAS,KAAK;CAC3B,GACA,UACA,mDACF;AACF;AAEA,SAAS,kBAAkB,aAKxB;CACD,OAAO;EACL,eAAe,YAAY;EAC3B,MAAM,YAAY;EAClB,WAAW,YAAY;EACvB,SAAS,YAAY;CACvB;AACF;AAEA,eAAe,iBACb,UACA,UACA,QACA,SACkB;CAClB,MAAM,WAAW,2BAA2B,UAAU,QAAQ;CAC9D,IAAI,CAAC,SAAS,SACZ,OAAO,YAAY,2BAA2B,OAAO;CAEvD,MAAM,eAAe,SAAS;CAC9B,OAAO;EACL,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,YAAY,QAAQ;EACpB,SAAS,OAAO;EAChB,WAAW,aAAa;EACxB,SAAS,aAAa;EACtB,WAAW;EACX,SAAS,MAAM,IAAI,KAAK,KAAK,KAAK,UAAU,aAAa,YAAY,CAAC,CAAC,CAAC,KAAK;EAC7E,OAAO,aAAa;EACpB,WAAW,aAAa;CAC1B;AACF;AAEA,eAAe,sBACb,KACA,UACA,QACA,SACkB;CAClB,IAAI,CAAC,QAAQ,QACX,OAAO,2BAA2B,OAAO;CAE3C,MAAM,SAAS,mBAAmB,KAAK,QAAQ,UAAU;CACzD,MAAM,oBAAoB,KAAK,QAAQ,UAAU;CACjD,OAAO;EACL,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,YAAY,QAAQ;EACpB,SAAS,OAAO;EAChB,WAAW,QAAQ,OAAO;EAC1B,SAAS,QAAQ,OAAO;EACxB,GAAG,iBAAiB,MAAM,IAAI,KAAK,MAAM,CAAC,CAAC,KAAK,GAAG,QAAQ,QAAQ,QAAQ;CAC7E;AACF"}

package/dist/{recipes-w72EpAOi.d.mts → recipes-C1kxJCgQ.d.mts}

@@ -15,6 +15,7 @@ type OfficialInitRecipe = {
   configTs: string;
   files?: readonly OfficialInitRecipeFile[];
   workflowEnvSecrets?: readonly OfficialInitRecipeWorkflowEnvSecret[];
+  requiresChecksPermission?: boolean;
   docsDetailsMdx?: string;
 };
 //#endregion
@@ -24,4 +25,4 @@ type OfficialInitRecipeId = (typeof supportedOfficialInitRecipes)[number];
 declare function listOfficialInitRecipes(): OfficialInitRecipe[];
 //#endregion
 export { OfficialInitRecipeFile as a, OfficialInitRecipe as i, listOfficialInitRecipes as n, supportedOfficialInitRecipes as r, OfficialInitRecipeId as t };
-//# sourceMappingURL=recipes-w72EpAOi.d.mts.map
+//# sourceMappingURL=recipes-C1kxJCgQ.d.mts.map

package/dist/recipes-C1kxJCgQ.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipes-C1kxJCgQ.d.mts","names":[],"sources":["../src/config/recipes/types.ts","../src/config/recipes.ts"],"mappings":";KAAY;EACV;EACA;;KAGU;EACV;EACA;;KAGU;EACV;EACA;EACA;EACA;EACA;EACA,iBAAiB;EACjB,8BAA8B;EAC9B;EACA;;;;cCEW;KAkBD,+BAA+B;iBAqB3B,2BAA2B"}