clud-bug 0.6.34 → 0.7.0-rc.11

package/dist/core/auto-resolve.d.ts

@@ -0,0 +1,235 @@
+import type { Severity } from './inline-threads.js';
+/** Configuration for `autoResolve` in `.clud-bug.json`. */
+export interface AutoResolveConfig {
+    /**
+     * Which mode the install opted into.
+     * - 'verified' (default): call the verifier per thread.
+     * - 'off': do nothing — all threads stay open, no verifier calls.
+     */
+    mode: 'verified' | 'off';
+    /**
+     * Action to take when the verifier returns UNCERTAIN + the original
+     * finding was 🔴 critical.
+     *
+     * - 'request_changes' (default): keep open + flag REQUEST_CHANGES.
+     * - 'leave_open': keep open with a milder marker, no escalation.
+     */
+    uncertain_critical_action: 'request_changes' | 'leave_open';
+}
+export declare const DEFAULT_AUTO_RESOLVE_CONFIG: AutoResolveConfig;
+/**
+ * One open thread from a prior review pass, plus enough state to verify
+ * it. The CLI verb hands these to `runAutoResolve` after parsing the
+ * GraphQL response + the bot's comment-body markers.
+ */
+export interface PriorThread {
+    /** GitHub review-thread node ID (GraphQL ID). Used to resolve the thread. */
+    threadId: string;
+    /** The prior finding the thread anchors. */
+    finding: PriorFinding;
+    /** Code at the finding anchor BEFORE the fix-push. */
+    codeBefore: string;
+    /** Code at the finding anchor AFTER the fix-push. */
+    codeAfter: string;
+    /** Diff hunk at the anchor (optional). */
+    diffAtAnchor?: string;
+}
+/**
+ * The minimal shape `applyResolutionRules` + the verifier need to
+ * describe a prior finding. The CLI reconstructs this from
+ * `parseThreadBody(comment.body)` + the GraphQL `path`/`line` fields.
+ */
+export interface PriorFinding {
+    severity: Severity;
+    /** The summary line + (optional) reasoning, joined for the verifier prompt. */
+    body: string;
+    /** The skill slug that raised the finding. */
+    skill: string;
+    /** Repo-relative path. */
+    file: string;
+    /** Optional 1-indexed line number. */
+    line?: number;
+}
+/** What the CLI verb should do with the thread. */
+export type ThreadAction = {
+    kind: 'resolve';
+    markerBody: string;
+    verdict: VerifyOutcome;
+} | {
+    kind: 'keep_open';
+    markerBody: string;
+    verdict: VerifyOutcome;
+} | {
+    kind: 'keep_open_request_changes';
+    markerBody: string;
+    verdict: VerifyOutcome;
+    /** True when triggered by UNCERTAIN+🔴 escalation. */
+    escalated: boolean;
+} | {
+    kind: 'skipped';
+    reason: 'off';
+    thread?: PriorThread;
+};
+/** Verdict shape — re-exported from resolve-verifier for ergonomics. */
+export interface VerifyOutcome {
+    verdict: 'ADDRESSED' | 'NOT_ADDRESSED' | 'UNCERTAIN';
+    rationale: string;
+    source: 'model' | 'api-error';
+}
+export interface AutoResolveInput {
+    /** Open threads from prior review passes. May be empty. */
+    priorThreads: PriorThread[];
+    /** Resolved config (after precedence merge). */
+    config: AutoResolveConfig;
+    /**
+     * Whether the caller can actually resolve threads (a dedicated PAT is
+     * present). Drives the addressed-marker wording: PAT → "Auto-resolved";
+     * no-PAT → "Verified fixed — not auto-closed". Defaults to true (the App
+     * path / unit tests, where the App token can resolve).
+     */
+    canResolve?: boolean;
+    /** Verifier callback. Tests inject a stub; CLI provides real Anthropic-call fn. */
+    verifier: (args: {
+        finding: PriorFinding;
+        codeBefore: string;
+        codeAfter: string;
+        diffAtAnchor?: string;
+    }) => Promise<VerifyOutcome>;
+}
+export interface AutoResolveResult {
+    /** One action per input thread, in input order. */
+    actions: ThreadAction[];
+    /** Total verifier calls made. */
+    verifierCallCount: number;
+    /**
+     * True when any action is `keep_open_request_changes`. The CLI verb /
+     * workflow uses this to decide whether to flip the formal review to
+     * REQUEST_CHANGES (one transition covers all flagged threads).
+     */
+    shouldRequestChanges: boolean;
+}
+/**
+ * Reads `autoResolve` from a `.clud-bug.json` payload + merges with
+ * built-in defaults. Returns a fully-resolved `AutoResolveConfig`.
+ *
+ * Unknown fields tolerated (forward compat). Invalid values fall back
+ * to the default for that key + log a warning. NEVER throws — a
+ * config-validation throw on the fix-push hot path would degrade the
+ * whole step to a fail.
+ */
+export declare function resolveAutoResolveConfig(raw: unknown, onWarn?: (msg: string) => void): AutoResolveConfig;
+/**
+ * Convenience: extracts the `autoResolve` block from a top-level
+ * `.clud-bug.json` config blob.
+ */
+export declare function readAutoResolveConfigFromCludBug(config: {
+    autoResolve?: unknown;
+} | null | undefined, onWarn?: (msg: string) => void): AutoResolveConfig;
+/**
+ * For each prior thread, call the injected verifier + apply the
+ * resolution rules. Returns one action per input thread, plus
+ * aggregate stats.
+ *
+ * The CLI verb executes the returned actions (GraphQL mutations);
+ * this function is pure modulo the verifier callback.
+ */
+export declare function runAutoResolve(input: AutoResolveInput): Promise<AutoResolveResult>;
+/**
+ * Maps a verifier verdict + the thread context to the action the CLI
+ * verb should take. Pure function, no I/O.
+ *
+ * Resolution table:
+ *   ADDRESSED, any         → resolve, "Auto-resolved (verified)"
+ *   NOT_ADDRESSED, 🔴      → keep_open_request_changes (escalated=false)
+ *   NOT_ADDRESSED, 🟡      → keep_open, "Re-review found this still applies"
+ *   UNCERTAIN, 🔴, request → keep_open_request_changes (escalated=true)
+ *   UNCERTAIN, 🔴, leave   → keep_open, "Auto-resolve uncertain — human review recommended"
+ *   UNCERTAIN, 🟡          → keep_open, "human review recommended"
+ */
+export declare function applyResolutionRules(args: {
+    thread: PriorThread;
+    verdict: VerifyOutcome;
+    config: AutoResolveConfig;
+    /** Whether the resolve mutation is available (PAT present). Defaults true. */
+    canResolve?: boolean;
+}): ThreadAction;
+type AutoResolveMarkerInput = {
+    kind: 'verified-addressed';
+    rationale?: string;
+    resolved?: boolean;
+} | {
+    kind: 'verified-not-addressed';
+    rationale?: string;
+} | {
+    kind: 'verified-uncertain';
+    rationale?: string;
+    severity: Severity;
+};
+/**
+ * Renders the comment body the CLI verb posts as a reply on the
+ * thread before resolving (or alongside keep-open). Wording mirrors
+ * the App's `renderAutoResolveMarker` so both consumers emit a
+ * uniform audit trail.
+ */
+export declare function renderAutoResolveMarker(input: AutoResolveMarkerInput): string;
+/** Which token the resolve mutation should use, and whether it's a dedicated PAT. */
+export interface ResolveAuth {
+    token: string;
+    source: 'pat' | 'gh_token';
+    hasDedicatedPat: boolean;
+}
+/**
+ * Picks the token for the `resolveReviewThread` GraphQL mutation. A dedicated
+ * fine-grained PAT (`CLUD_BUG_RESOLVE_PAT`, or the `RESOLVE_PAT` alias) is
+ * preferred — the Actions `GITHUB_TOKEN` can't resolve review threads
+ * ("Resource not accessible by integration"). With no PAT the verb keeps using
+ * `GH_TOKEN` for the other gh calls and skips the resolve mutation entirely.
+ *
+ * Empty / whitespace-only values are treated as absent — GitHub renders an
+ * unset secret as the empty string, so `CLUD_BUG_RESOLVE_PAT=''` must NOT
+ * shadow a hand-set `RESOLVE_PAT` alias.
+ */
+export declare function selectResolveAuth(env: {
+    CLUD_BUG_RESOLVE_PAT?: string;
+    RESOLVE_PAT?: string;
+    GH_TOKEN?: string;
+}): ResolveAuth;
+/** Verifier verdict, as embedded in the idempotency marker. */
+export type ResolveVerdict = 'ADDRESSED' | 'NOT_ADDRESSED' | 'UNCERTAIN';
+/**
+ * Hidden HTML-comment marker appended to each auto-resolve reply so a later
+ * fix-push can tell whether it already replied to this thread for the current
+ * (verdict, anchor) — making the reply idempotent instead of one-per-push.
+ */
+export declare function renderResolveMarkerTag(verdict: ResolveVerdict, sig: string): string;
+/** Parses the hidden marker out of a comment body. Null when absent / malformed. */
+export declare function parseResolveMarkerTag(body: string): {
+    verdict: ResolveVerdict;
+    sig: string;
+} | null;
+/**
+ * 8-hex-char signature of a finding's post-fix anchor. Stable while the anchor
+ * is unchanged, changes when `codeAfter` changes — lets the verb skip
+ * re-verifying + re-replying to a thread whose anchor hasn't moved.
+ */
+export declare function anchorSignature(finding: {
+    file?: string;
+    line?: number;
+}, codeAfter: string): string;
+/**
+ * Scans a thread's comments (oldest→newest, as GraphQL returns them) for the
+ * most-recent bot-authored reply carrying a resolve marker. Returns its
+ * `{verdict, sig}` or null. Only bot-authored comments count, so a user pasting
+ * a marker can't spoof the idempotency state.
+ */
+export declare function latestResolveMarker(comments: Array<{
+    author?: {
+        login?: string | null;
+    } | null;
+    body?: string | null;
+} | null | undefined>, botAuthors: Set<string>): {
+    verdict: ResolveVerdict;
+    sig: string;
+} | null;
+export {};
+//# sourceMappingURL=auto-resolve.d.ts.map

package/dist/core/auto-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-resolve.d.ts","sourceRoot":"","sources":["../../src/core/auto-resolve.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAMpD,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,UAAU,GAAG,KAAK,CAAC;IACzB;;;;;;OAMG;IACH,yBAAyB,EAAE,iBAAiB,GAAG,YAAY,CAAC;CAC7D;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAGzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,YAAY,CAAC;IACtB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mDAAmD;AACnD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACjE;IACE,IAAI,EAAE,2BAA2B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;CACpB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEN,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mFAAmF;IACnF,QAAQ,EAAE,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,YAAY,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,iCAAiC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,GACvC,iBAAiB,CAmCnB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACpD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC7B,iBAAiB,CAGnB;AAMD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,YAAY,CAmDf;AAMD,KAAK,sBAAsB,GACvB;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAuB7E;AAMD,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,WAAW,CAOd;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;AAKzE;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,SAAS,EAAE,MAAM,GAChB,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,KAAK,CACb;IAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,CACvF,EACD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAUjD"}

package/dist/core/auto-resolve.js

@@ -0,0 +1,293 @@
+// Wave 5b — D.2.6 auto-resolve fidelity, npm-workflow flavor.
+//
+// On every fix-push (`pull_request.synchronize`), for each open thread
+// posted by the bot on a prior pass, decide whether the new commit
+// addressed the original concern, and act accordingly:
+//
+//   ADDRESSED      → resolve the thread + post "Auto-resolved (verified)"
+//   NOT_ADDRESSED  → keep open + post "Re-review found this still applies"
+//                    + flag REQUEST_CHANGES intent if 🔴 critical
+//   UNCERTAIN + 🟡 → keep open + post "human review recommended"
+//   UNCERTAIN + 🔴 → keep open + flag REQUEST_CHANGES + escalate. NEVER dismiss.
+//
+// This module owns the pure rule tables + config merge + marker
+// rendering. The CLI verb in `src/cli/main.ts::runResolveThreads` owns
+// the IO: fetching threads via `gh api graphql`, calling Anthropic
+// Messages API for the verifier, applying these actions via REST/
+// GraphQL mutations.
+//
+// Ported from `clud-bug-app/lib/auto-resolve.ts` (and the marker
+// helpers from `clud-bug-app/lib/comment.ts`). Differences from the
+// App impl:
+//   - DROP `aggregateMultiPassVerdicts` — OSS workflow is single-pass.
+//   - DROP heuristic fallback (`heuristicAction`) — OSS supports only
+//     `mode: 'verified' | 'off'` for now; heuristic adds complexity
+//     without a customer ask. Future Wave 5c can add it back if the
+//     App migrates to consume from core.
+//   - DROP per-PR budget gate — OSS workflow uses the customer's own
+//     `ANTHROPIC_API_KEY`; spend-cap is their concern, not ours.
+import { createHash } from 'node:crypto';
+export const DEFAULT_AUTO_RESOLVE_CONFIG = {
+    mode: 'verified',
+    uncertain_critical_action: 'request_changes',
+};
+// ---------------------------------------------------------------------------
+// Config resolution
+// ---------------------------------------------------------------------------
+/**
+ * Reads `autoResolve` from a `.clud-bug.json` payload + merges with
+ * built-in defaults. Returns a fully-resolved `AutoResolveConfig`.
+ *
+ * Unknown fields tolerated (forward compat). Invalid values fall back
+ * to the default for that key + log a warning. NEVER throws — a
+ * config-validation throw on the fix-push hot path would degrade the
+ * whole step to a fail.
+ */
+export function resolveAutoResolveConfig(raw, onWarn = () => { }) {
+    const defaults = DEFAULT_AUTO_RESOLVE_CONFIG;
+    if (!raw || typeof raw !== 'object')
+        return defaults;
+    const obj = raw;
+    let mode = defaults.mode;
+    if (typeof obj.mode === 'string') {
+        if (obj.mode === 'verified' || obj.mode === 'off') {
+            mode = obj.mode;
+        }
+        else {
+            onWarn(`autoResolve.mode = ${JSON.stringify(obj.mode)} is invalid; falling back to "${defaults.mode}". Valid: verified, off.`);
+        }
+    }
+    let uncertainCritical = defaults.uncertain_critical_action;
+    if (typeof obj.uncertain_critical_action === 'string') {
+        if (obj.uncertain_critical_action === 'request_changes' ||
+            obj.uncertain_critical_action === 'leave_open') {
+            uncertainCritical = obj.uncertain_critical_action;
+        }
+        else {
+            onWarn(`autoResolve.uncertain_critical_action = ${JSON.stringify(obj.uncertain_critical_action)} is invalid; falling back to "${defaults.uncertain_critical_action}".`);
+        }
+    }
+    return {
+        mode,
+        uncertain_critical_action: uncertainCritical,
+    };
+}
+/**
+ * Convenience: extracts the `autoResolve` block from a top-level
+ * `.clud-bug.json` config blob.
+ */
+export function readAutoResolveConfigFromCludBug(config, onWarn) {
+    if (!config)
+        return DEFAULT_AUTO_RESOLVE_CONFIG;
+    return resolveAutoResolveConfig(config.autoResolve, onWarn);
+}
+// ---------------------------------------------------------------------------
+// Main entry point — pure orchestration with injected verifier
+// ---------------------------------------------------------------------------
+/**
+ * For each prior thread, call the injected verifier + apply the
+ * resolution rules. Returns one action per input thread, plus
+ * aggregate stats.
+ *
+ * The CLI verb executes the returned actions (GraphQL mutations);
+ * this function is pure modulo the verifier callback.
+ */
+export async function runAutoResolve(input) {
+    if (input.config.mode === 'off') {
+        return {
+            actions: input.priorThreads.map((thread) => ({
+                kind: 'skipped',
+                reason: 'off',
+                thread,
+            })),
+            verifierCallCount: 0,
+            shouldRequestChanges: false,
+        };
+    }
+    const actions = [];
+    let verifierCallCount = 0;
+    let shouldRequestChanges = false;
+    for (const thread of input.priorThreads) {
+        // Conditionally include `diffAtAnchor` only when present so the
+        // narrowed `verifier` callback type (which forbids `undefined`
+        // under `exactOptionalPropertyTypes`) stays satisfied.
+        const verifierArgs = {
+            finding: thread.finding,
+            codeBefore: thread.codeBefore,
+            codeAfter: thread.codeAfter,
+            ...(thread.diffAtAnchor !== undefined
+                ? { diffAtAnchor: thread.diffAtAnchor }
+                : {}),
+        };
+        const verdict = await input.verifier(verifierArgs);
+        verifierCallCount++;
+        const action = applyResolutionRules({
+            thread,
+            verdict,
+            config: input.config,
+            canResolve: input.canResolve !== false,
+        });
+        actions.push(action);
+        if (action.kind === 'keep_open_request_changes')
+            shouldRequestChanges = true;
+    }
+    return { actions, verifierCallCount, shouldRequestChanges };
+}
+// ---------------------------------------------------------------------------
+// Rule table — pure function from (verdict, finding, config) → action
+// ---------------------------------------------------------------------------
+/**
+ * Maps a verifier verdict + the thread context to the action the CLI
+ * verb should take. Pure function, no I/O.
+ *
+ * Resolution table:
+ *   ADDRESSED, any         → resolve, "Auto-resolved (verified)"
+ *   NOT_ADDRESSED, 🔴      → keep_open_request_changes (escalated=false)
+ *   NOT_ADDRESSED, 🟡      → keep_open, "Re-review found this still applies"
+ *   UNCERTAIN, 🔴, request → keep_open_request_changes (escalated=true)
+ *   UNCERTAIN, 🔴, leave   → keep_open, "Auto-resolve uncertain — human review recommended"
+ *   UNCERTAIN, 🟡          → keep_open, "human review recommended"
+ */
+export function applyResolutionRules(args) {
+    const { verdict, thread, config } = args;
+    const canResolve = args.canResolve !== false;
+    const severity = thread.finding.severity;
+    if (verdict.verdict === 'ADDRESSED') {
+        return {
+            kind: 'resolve',
+            markerBody: renderAutoResolveMarker({
+                kind: 'verified-addressed',
+                rationale: verdict.rationale,
+                resolved: canResolve,
+            }),
+            verdict,
+        };
+    }
+    if (verdict.verdict === 'NOT_ADDRESSED') {
+        const markerBody = renderAutoResolveMarker({
+            kind: 'verified-not-addressed',
+            rationale: verdict.rationale,
+        });
+        if (severity === 'critical') {
+            return {
+                kind: 'keep_open_request_changes',
+                markerBody,
+                verdict,
+                escalated: false,
+            };
+        }
+        return { kind: 'keep_open', markerBody, verdict };
+    }
+    // UNCERTAIN.
+    const markerBody = renderAutoResolveMarker({
+        kind: 'verified-uncertain',
+        rationale: verdict.rationale,
+        severity,
+    });
+    if (severity === 'critical' &&
+        config.uncertain_critical_action === 'request_changes') {
+        return {
+            kind: 'keep_open_request_changes',
+            markerBody,
+            verdict,
+            escalated: true,
+        };
+    }
+    return { kind: 'keep_open', markerBody, verdict };
+}
+/**
+ * Renders the comment body the CLI verb posts as a reply on the
+ * thread before resolving (or alongside keep-open). Wording mirrors
+ * the App's `renderAutoResolveMarker` so both consumers emit a
+ * uniform audit trail.
+ */
+export function renderAutoResolveMarker(input) {
+    const tail = input.rationale ? `: ${input.rationale.trim()}` : '.';
+    switch (input.kind) {
+        case 'verified-addressed':
+            // No PAT → we did NOT resolve the thread, so don't claim "Auto-resolved".
+            // Post an accurate "verified fixed" badge + the manual-Resolve hint.
+            if (input.resolved === false) {
+                return (`**✅ Verified fixed — not auto-closed**${tail} ` +
+                    `_The Actions \`GITHUB_TOKEN\` can't resolve review threads; click ` +
+                    `**Resolve conversation** to dismiss, or add a \`CLUD_BUG_RESOLVE_PAT\` ` +
+                    `secret to auto-close (see README)._`);
+            }
+            return `**✓ Auto-resolved (verified by D.2.6 fix-check)**${tail}`;
+        case 'verified-not-addressed':
+            return `**❌ Re-review found this still applies**${tail}`;
+        case 'verified-uncertain':
+            if (input.severity === 'critical') {
+                return `**⚠ Auto-resolve uncertain on a 🔴 critical — escalated, never silently dismissed**${tail}`;
+            }
+            return `**⚠ Auto-resolve uncertain — human review recommended**${tail}`;
+    }
+}
+/**
+ * Picks the token for the `resolveReviewThread` GraphQL mutation. A dedicated
+ * fine-grained PAT (`CLUD_BUG_RESOLVE_PAT`, or the `RESOLVE_PAT` alias) is
+ * preferred — the Actions `GITHUB_TOKEN` can't resolve review threads
+ * ("Resource not accessible by integration"). With no PAT the verb keeps using
+ * `GH_TOKEN` for the other gh calls and skips the resolve mutation entirely.
+ *
+ * Empty / whitespace-only values are treated as absent — GitHub renders an
+ * unset secret as the empty string, so `CLUD_BUG_RESOLVE_PAT=''` must NOT
+ * shadow a hand-set `RESOLVE_PAT` alias.
+ */
+export function selectResolveAuth(env) {
+    const pat = [env.CLUD_BUG_RESOLVE_PAT, env.RESOLVE_PAT]
+        .map((v) => (v ?? '').trim())
+        .find((v) => v !== '') ?? '';
+    if (pat)
+        return { token: pat, source: 'pat', hasDedicatedPat: true };
+    return { token: (env.GH_TOKEN ?? '').trim(), source: 'gh_token', hasDedicatedPat: false };
+}
+const RESOLVE_MARKER_RE = /<!--\s*clud-bug-resolve\s+v=(ADDRESSED|NOT_ADDRESSED|UNCERTAIN)\s+sig=([a-f0-9]{16})\s*-->/;
+/**
+ * Hidden HTML-comment marker appended to each auto-resolve reply so a later
+ * fix-push can tell whether it already replied to this thread for the current
+ * (verdict, anchor) — making the reply idempotent instead of one-per-push.
+ */
+export function renderResolveMarkerTag(verdict, sig) {
+    return `<!-- clud-bug-resolve v=${verdict} sig=${sig} -->`;
+}
+/** Parses the hidden marker out of a comment body. Null when absent / malformed. */
+export function parseResolveMarkerTag(body) {
+    const m = body.match(RESOLVE_MARKER_RE);
+    if (!m || m[1] === undefined || m[2] === undefined)
+        return null;
+    return { verdict: m[1], sig: m[2] };
+}
+/**
+ * 8-hex-char signature of a finding's post-fix anchor. Stable while the anchor
+ * is unchanged, changes when `codeAfter` changes — lets the verb skip
+ * re-verifying + re-replying to a thread whose anchor hasn't moved.
+ */
+export function anchorSignature(finding, codeAfter) {
+    const file = finding.file ?? '<no-file>';
+    const line = finding.line ?? 0;
+    // 16 hex chars (64-bit), matching `findingId`'s convention — wide enough
+    // that a collision can't suppress a re-review marker.
+    return createHash('sha256').update(`${file}:${line}:${codeAfter}`).digest('hex').slice(0, 16);
+}
+/**
+ * Scans a thread's comments (oldest→newest, as GraphQL returns them) for the
+ * most-recent bot-authored reply carrying a resolve marker. Returns its
+ * `{verdict, sig}` or null. Only bot-authored comments count, so a user pasting
+ * a marker can't spoof the idempotency state.
+ */
+export function latestResolveMarker(comments, botAuthors) {
+    let latest = null;
+    for (const c of comments) {
+        if (!c)
+            continue;
+        const login = c.author?.login ?? '';
+        if (!botAuthors.has(login))
+            continue;
+        const tag = parseResolveMarkerTag(c.body ?? '');
+        if (tag)
+            latest = tag;
+    }
+    return latest;
+}
+//# sourceMappingURL=auto-resolve.js.map

package/dist/core/auto-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-resolve.js","sourceRoot":"","sources":["../../src/core/auto-resolve.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,kEAAkE;AAClE,iEAAiE;AACjE,iFAAiF;AACjF,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,kEAAkE;AAClE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,YAAY;AACZ,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,yCAAyC;AACzC,qEAAqE;AACrE,iEAAiE;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,IAAI,EAAE,UAAU;IAChB,yBAAyB,EAAE,iBAAiB;CAC7C,CAAC;AA+FF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,SAAgC,GAAG,EAAE,GAAE,CAAC;IAExC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;IAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,IAAI,GAA8B,QAAQ,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAClD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,IAAI,0BAA0B,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GACnB,QAAQ,CAAC,yBAAyB,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;QACtD,IACE,GAAG,CAAC,yBAAyB,KAAK,iBAAiB;YACnD,GAAG,CAAC,yBAAyB,KAAK,YAAY,EAC9C,CAAC;YACD,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,CACJ,2CAA2C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,CAAC,iCAAiC,QAAQ,CAAC,yBAAyB,IAAI,CAChK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,yBAAyB,EAAE,iBAAiB;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAoD,EACpD,MAA8B;IAE9B,IAAI,CAAC,MAAM;QAAE,OAAO,2BAA2B,CAAC;IAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAuB;IAEvB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3C,IAAI,EAAE,SAAkB;gBACxB,MAAM,EAAE,KAAc;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,iBAAiB,EAAE,CAAC;YACpB,oBAAoB,EAAE,KAAK;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACxC,gEAAgE;QAChE,+DAA+D;QAC/D,uDAAuD;QACvD,MAAM,YAAY,GAAyC;YACzD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,iBAAiB,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,2BAA2B;YAAE,oBAAoB,GAAG,IAAI,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAMpC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEzC,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,uBAAuB,CAAC;gBAClC,IAAI,EAAE,oBAAoB;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,OAAO;SACR,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,uBAAuB,CAAC;YACzC,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,2BAA2B;gBACjC,UAAU;gBACV,OAAO;gBACP,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,aAAa;IACb,MAAM,UAAU,GAAG,uBAAuB,CAAC;QACzC,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ;KACT,CAAC,CAAC;IACH,IACE,QAAQ,KAAK,UAAU;QACvB,MAAM,CAAC,yBAAyB,KAAK,iBAAiB,EACtD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,UAAU;YACV,OAAO;YACP,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,oBAAoB;YACvB,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,CACL,yCAAyC,IAAI,GAAG;oBAChD,oEAAoE;oBACpE,yEAAyE;oBACzE,qCAAqC,CACtC,CAAC;YACJ,CAAC;YACD,OAAO,oDAAoD,IAAI,EAAE,CAAC;QACpE,KAAK,wBAAwB;YAC3B,OAAO,2CAA2C,IAAI,EAAE,CAAC;QAC3D,KAAK,oBAAoB;YACvB,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,sFAAsF,IAAI,EAAE,CAAC;YACtG,CAAC;YACD,OAAO,0DAA0D,IAAI,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAIjC;IACC,MAAM,GAAG,GACP,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,WAAW,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC5F,CAAC;AAKD,MAAM,iBAAiB,GACrB,4FAA4F,CAAC;AAE/F;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAuB,EAAE,GAAW;IACzE,OAAO,2BAA2B,OAAO,QAAQ,GAAG,MAAM,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CACnC,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAyC,EACzC,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;IAC/B,yEAAyE;IACzE,sDAAsD;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAEC,EACD,UAAuB;IAEvB,IAAI,MAAM,GAAoD,IAAI,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,MAAM,GAAG,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}