diffninja 0.3.2 → 0.4.0

package/dist/review/html.js

@@ -1,5 +1,6 @@
+import { hiddenControlsIn } from "./hidden-characters.js";
 import { verdictOf } from "./questions.js";
-import { factQuestionsFor } from "./change-facts.js";
+import { factQuestionsFor, unreadCause } from "./change-facts.js";
 import { renderCallFlows, CALL_FLOW_STYLES, CALL_FLOW_SCRIPT } from "./call-flow-html.js";
 import { renderBrief, BRIEF_STYLES } from "./evidence-html.js";
 import { renderBusinessView, BUSINESS_STYLES } from "./process-html.js";
@@ -246,12 +247,17 @@ function renderHeader(report) {
         `<p class="meta">Files changed · <span class="mono">${escapeHtml(report.source)}</span></p>`,
         scope === "" ? "" : `<p class="meta">${escapeHtml(scope)}</p>`,
         `<p class="mode-note">${mode}</p>`,
+        report.updateNotice === undefined ? "" : renderUpdateNotice(report.updateNotice),
         renderLegend(),
         "</header>",
     ]
         .filter((part) => part !== "")
         .join("\n");
 }
+/** One line, above the legend: a newer diffninja exists and the command that installs it. */
+function renderUpdateNotice(notice) {
+    return `<p class="update-notice" role="status">diffninja ${escapeHtml(notice.latest)} is available (you have ${escapeHtml(notice.current)}). Update by running <code>${escapeHtml(notice.command)}</code> in a terminal, then restart your agent.</p>`;
+}
 /** One color line, no jargon. Counting is left to the filter chips. */
 function renderLegend() {
     const keys = STATUS_ORDER.map((status) => `<span class="key"><span class="dot dot-${status}" aria-hidden="true"></span>${escapeHtml(`${STATUS_LABEL[status]}: ${STATUS_HINT[status]}`)}</span>`).join("");
@@ -458,7 +464,7 @@ function renderFacts(item) {
     const notes = [];
     let list = "";
     if (facts.language === null) {
-        notes.push("diffninja does not read this file type, so no facts were established. Read this hunk yourself.");
+        notes.push(`diffninja does not read ${unreadCause(item.file)}, so no facts were established. Read this hunk yourself.`);
     }
     else {
         list = factQuestionsFor(facts.language).map((question) => {
@@ -552,7 +558,7 @@ function renderDiff(diff) {
         .map((row) => `<span class="ln ln-${row.kind}">` +
         `<span class="old-no" aria-hidden="true">${row.oldNo === null ? "" : String(row.oldNo)}</span>` +
         `<span class="new-no" aria-hidden="true">${row.newNo === null ? "" : String(row.newNo)}</span>` +
-        `<span class="code">${escapeHtml(row.text)}</span>` +
+        `<span class="code${hiddenControlsIn(row.text).length > 0 ? " code-hidden" : ""}">${escapeHtml(row.text)}</span>` +
         "</span>")
         .join("");
     return [
@@ -957,6 +963,7 @@ a { color: var(--teal); }
   position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0;
   overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0;
 }
+.update-notice { padding: 8px 12px; border-left: 3px solid var(--warn); background: var(--warn-bg); border-radius: 4px; font-size: 14px; }
 .masthead {
   display: flex;
   flex-direction: column;
@@ -1147,6 +1154,7 @@ pre.diff {
   user-select: none;
 }
 .code { padding: 0 14px; }
+.code-hidden { outline: 1px solid var(--warn); outline-offset: -1px; background: var(--warn-bg); }
 .ln-add > .code { color: var(--add); }
 .ln-del > .code { color: var(--del); }
 .ln-add > .code, .ln-add > .old-no, .ln-add > .new-no { background: var(--add-bg); }

package/dist/review/input.js

@@ -1,3 +1,4 @@
+import { resolveExecutable } from "../executables.js";
 import { execFileSync } from "node:child_process";
 function pathName(raw) {
     const value = raw.split("\t")[0];
@@ -103,11 +104,13 @@ export function parseDiff(text) {
         throw new Error("No reviewable changes found in input.");
     return units;
 }
+/** A git command that has not answered in this long (a dead network share) is stopped, not waited for forever. */
+const GIT_TIMEOUT_MS = 120_000;
 export function resolveCommit(cwd, ref) {
-    return execFileSync("git", ["--no-replace-objects", "rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], { cwd, encoding: "utf8" }).trim();
+    return execFileSync(resolveExecutable("git"), ["--no-replace-objects", "rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`], { cwd, encoding: "utf8", timeout: GIT_TIMEOUT_MS }).trim();
 }
 export function gitDiff(cwd, from, to) {
     const base = resolveCommit(cwd, from), head = resolveCommit(cwd, to);
-    const diff = execFileSync("git", ["--no-replace-objects", "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--unified=5", base, head, "--"], { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+    const diff = execFileSync(resolveExecutable("git"), ["--no-replace-objects", "-c", "core.quotePath=false", "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--unified=5", base, head, "--"], { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024, timeout: GIT_TIMEOUT_MS });
     return { diff, from: base, to: head };
 }

package/dist/review/intent.d.ts

@@ -1,4 +1,11 @@
 import type { IntentCrossCheck, PullRequestIntent, ReviewAgendaEntry, AutomaticFinding } from "./evidence-types.js";
 import type { ReviewUnit } from "./types.js";
+/**
+ * Whether a line opens an HTML comment and then, on the same line, matches `after`: the regex
+ * `<!--.*after` in linear time. That regex rescanned the rest of the line from every `<!--`, so
+ * a pull request body of 65,000 characters of them took seconds. `.` stops at a line terminator, so
+ * each terminator-free stretch is read from its first `<!--`, which leaves the most text to match.
+ */
+export declare function commentThen(line: string, after: RegExp): boolean;
 /** Links are discovery aids, never a semantic entailment or a passing test. */
 export declare function crossCheckIntent(pr: PullRequestIntent | undefined, units: readonly ReviewUnit[], agenda: readonly ReviewAgendaEntry[], findings: readonly AutomaticFinding[]): IntentCrossCheck;

package/dist/review/intent.js

@@ -2,6 +2,28 @@ const STOP_WORDS = Object.fromEntries("a about after all also an and any are as
 function terms(text) {
     return new Set(text.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().match(/[a-z][a-z0-9]+/g)?.filter(word => !Object.hasOwn(STOP_WORDS, word)).map(word => word.replace(/(?:ing|ies|s)$/u, "")).filter(word => word.length > 2) ?? []);
 }
+/**
+ * Statements read from a pull request's text. The text is written by whoever
+ * opened the pull request: a 65,000-character body of short lines produced
+ * 10,874 claims, a 2.25 MB result and one comparison against every hunk each.
+ */
+const MAX_CLAIMS = 100;
+/**
+ * Whether a line opens an HTML comment and then, on the same line, matches `after`: the regex
+ * `<!--.*after` in linear time. That regex rescanned the rest of the line from every `<!--`, so
+ * a pull request body of 65,000 characters of them took seconds. `.` stops at a line terminator, so
+ * each terminator-free stretch is read from its first `<!--`, which leaves the most text to match.
+ */
+export function commentThen(line, after) {
+    for (const stretch of line.split(/[\r\u2028\u2029]/u)) {
+        const open = stretch.indexOf("<!--");
+        if (open !== -1 && after.test(stretch.slice(open + 4)))
+            return true;
+    }
+    return false;
+}
+const GENERATED_COMMENT = /auto-generated|release notes/iu;
+const END_OF_GENERATED = /end of auto-generated/iu;
 /** Keep author claims separate from generated release notes; never execute PR text. */
 function statements(pr) {
     const claims = [];
@@ -12,9 +34,9 @@ function statements(pr) {
     let comment = false;
     let relevant = true;
     for (const raw of pr.body.split(/\r?\n/u)) {
-        if (/<!--.*(?:auto-generated|release notes)/iu.test(raw))
+        if (commentThen(raw, GENERATED_COMMENT))
             generatedComment = true;
-        if (/<!--.*end of auto-generated/iu.test(raw)) {
+        if (commentThen(raw, END_OF_GENERATED)) {
             generatedComment = false;
             generatedHeadingDepth = undefined;
             continue;
@@ -53,7 +75,7 @@ export function crossCheckIntent(pr, units, agenda, findings) {
             obligations: ["Provide the expected behavior, including failure and boundary cases. No intended outcome was inferred from the diff."],
         };
     const indexed = units.map(unit => ({ unit, terms: terms(unit.file + "\n" + unit.diff.split("\n").filter(line => line.startsWith("+")).join("\n")) }));
-    const claims = statements(pr).map(claim => {
+    const claims = statements(pr).slice(0, MAX_CLAIMS).map(claim => {
         const wanted = [...terms(claim.text)];
         const matches = indexed.map(({ unit, terms: actual }) => ({ unit, count: wanted.reduce((count, term) => count + (actual.has(term) ? 1 : 0), 0) }))
             .filter(({ count }) => count >= Math.min(2, wanted.length) && wanted.length > 0)

package/dist/review/markdown.js

@@ -55,6 +55,14 @@ const tokensSchema = z.array(tokenSchema);
 const MAX_DEPTH = 12;
 /** Nodes one description may become; past this the rest is named, not rendered. */
 const MAX_NODES = 50_000;
+/**
+ * The longest description that is lexed. Emphasis resolution in `marked` is
+ * quadratic on some short repeated patterns (`_a*` repeated: 16,000 characters
+ * took 1.3 s, 65,000 took 19 s, with the whole single-threaded server waiting),
+ * so a longer body is shown as plain text instead, which the page already does
+ * for a body past the node budget.
+ */
+const MAX_SOURCE_CHARS = 12_000;
 const NAMED_ENTITIES = new Map([
     ["amp", "&"], ["lt", "<"], ["gt", ">"], ["quot", "\""], ["apos", "'"], ["nbsp", "\u00a0"],
     ["copy", "\u00a9"], ["reg", "\u00ae"], ["trade", "\u2122"], ["hellip", "\u2026"], ["mdash", "\u2014"],
@@ -324,6 +332,9 @@ let cached;
 export function markdownBlocks(source) {
     if (cached !== undefined && cached.source === source)
         return cached.parsed;
+    // Past the cap the beginning is kept as plain text, never lexed: `truncated` tells the page to show the body as text.
+    if (source.length > MAX_SOURCE_CHARS)
+        return { blocks: [{ t: "para", c: [textNode(source.slice(0, MAX_SOURCE_CHARS))] }], truncated: true };
     let parsed;
     try {
         const budget = new Budget();

package/dist/review/mcp-cli.js

@@ -1,10 +1,13 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createReviewServer } from "./mcp.js";
+import { updateLookupFromEnv } from "./update-check.js";
 try {
     if (process.argv.length > 2)
         throw new Error("diffninja-mcp accepts no arguments. Configure it as a stdio MCP server; pass inputs to review_diff.");
-    const server = createReviewServer();
+    // Update notices are off unless DIFFNINJA_UPDATE_CHECK=1; nothing else asks the network for anything.
+    const latestVersion = updateLookupFromEnv();
+    const server = createReviewServer(latestVersion === undefined ? {} : { latestVersion });
     // Closing the connection is what closes its connected review pages, and this
     // transport cannot tell that the client hung up its end of the pipe, so EOF
     // here is what ends the session. A signal still terminates the process the

package/dist/review/mcp.d.ts

@@ -1,4 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type LatestVersion } from "./update-check.js";
 export interface AnalysisScope {
     readonly source: "repository" | "patch";
     readonly note: string;
@@ -9,4 +10,9 @@ export interface AnalysisScope {
  * link before anything is loaded, and `static` never navigates a link it finds
  * inside a diff.
  */
-export declare function createReviewServer(): McpServer;
+/** Options only the executable sets: the library never reaches the network on its own. */
+export interface ReviewServerOptions {
+    /** Looks up the newest published diffninja version; leave out to never check. */
+    readonly latestVersion?: LatestVersion;
+}
+export declare function createReviewServer(options?: ReviewServerOptions): McpServer;