hq-jr 0.1.0

package/dist/index.js

@@ -0,0 +1,827 @@
+import { checkAiHealth, runTriage, runDeepReview } from "./services/ai.js";
+import { parseUnifiedDiff, isLineInDiff } from "./services/diff-parser.js";
+import { packageReviewContext } from "./services/context-packager.js";
+import { replyToDiscussion } from "./services/discussion.js";
+import { getPreviousReviewContext, getReviewCommentThread } from "./services/review-memory.js";
+import { executeRemediation } from "./services/remediation.js";
+import { scrubSecrets } from "./services/scrubber.js";
+import { addRemediationCommit, hasRemediationCommit, acquireRunLock, releaseRunLock } from "./services/db.js";
+import { executeSandboxCheckRun } from "./services/sandbox-runner.js";
+export default (app, { getRouter } = {}) => {
+    process.on("unhandledRejection", (reason) => {
+        app.log.warn({ reason }, "Handled unhandledRejection to ensure daemon stability");
+    });
+    process.on("uncaughtException", (error) => {
+        app.log.error({ error }, "Fatal uncaughtException in worker process");
+    });
+    app.log.info("hq-jr code reviewer initialized with Vertex AI ADC");
+    // Expose health check endpoint on the Probot Express router
+    if (getRouter) {
+        const router = getRouter();
+        router.get("/healthz", async (_req, res) => {
+            const aiHealth = await checkAiHealth();
+            const healthy = aiHealth.status === "ok";
+            res.status(healthy ? 200 : 503).json({
+                status: healthy ? "healthy" : "unhealthy",
+                uptimeSeconds: process.uptime(),
+                vertexAi: aiHealth,
+            });
+        });
+    }
+    async function runPullRequestReview(params) {
+        const { octokit, owner, repoName, pullNumber, pr } = params;
+        // Do not review PRs that are already closed or merged
+        if (pr.state === "closed" || pr.merged || pr.merged_at) {
+            app.log.info({ pullNumber }, "PR is closed or already merged. Skipping review.");
+            return;
+        }
+        // Do not review commits created by hq-jr autonomous remediation
+        if (hasRemediationCommit(pr.head.sha)) {
+            app.log.info({ pullNumber, sha: pr.head.sha }, "Commit was generated by hq-jr remediation. Skipping self-review.");
+            return;
+        }
+        const runKey = `${owner}/${repoName}#${pullNumber}`;
+        const acquired = acquireRunLock({
+            runKey,
+            owner,
+            repo: repoName,
+            pullNumber,
+            headSha: pr.head.sha,
+        });
+        if (!acquired) {
+            app.log.warn({ runKey, headSha: pr.head.sha }, "Review run already active for pull request. Skipping duplicate event.");
+            return;
+        }
+        app.log.info({ pullNumber, repo: `${owner}/${repoName}` }, "Starting automated code review");
+        let checkRun = null;
+        try {
+            // 1. Create or update Check Run: in_progress
+            try {
+                checkRun = await octokit.checks.create({
+                    owner,
+                    repo: repoName,
+                    name: "hq-jr AI Code Review",
+                    head_sha: pr.head.sha,
+                    status: "in_progress",
+                    started_at: new Date().toISOString(),
+                    output: {
+                        title: "Analyzing Pull Request",
+                        summary: "Fetching pull request diff and performing Tier 1 triage...",
+                    },
+                });
+            }
+            catch (checkErr) {
+                app.log.warn({ checkErr }, "Failed to create GitHub check run, proceeding with review");
+            }
+            // 2. Fetch PR diff
+            const diffResponse = await octokit.pulls.get({
+                owner,
+                repo: repoName,
+                pull_number: pullNumber,
+                mediaType: {
+                    format: "diff",
+                },
+            });
+            // 3. Parse diff and build context package
+            const diffText = diffResponse.data;
+            const parsedDiff = parseUnifiedDiff(diffText);
+            const totalHunks = parsedDiff.files.reduce((sum, f) => sum + f.hunks.length, 0);
+            if (parsedDiff.files.length === 0 || totalHunks === 0) {
+                if (checkRun?.data?.id) {
+                    await octokit.checks.update({
+                        owner,
+                        repo: repoName,
+                        check_run_id: checkRun.data.id,
+                        status: "completed",
+                        conclusion: "neutral",
+                        output: {
+                            title: "No Code Changes Detected",
+                            summary: "Pull request contains no textual diff or code hunks to analyze (e.g. pure file mode changes or binary assets).",
+                        },
+                    });
+                }
+                return;
+            }
+            const contextPackage = packageReviewContext(parsedDiff);
+            if (contextPackage.itemsToReview.length === 0) {
+                app.log.info({ pullNumber }, "All modified files excluded by noise filters. Bypassing review.");
+                if (checkRun?.data?.id) {
+                    await octokit.checks.update({
+                        owner,
+                        repo: repoName,
+                        check_run_id: checkRun.data.id,
+                        status: "completed",
+                        conclusion: "success",
+                        output: {
+                            title: "Triage Passed: Excluded Files Only",
+                            summary: `Modified files were identified as non-reviewable artifacts (lockfiles, documentation, generated bundles):\n\n${contextPackage.ignoredItems.map((i) => `- \`${i.path}\`: ${i.reason}`).join("\n")}`,
+                        },
+                    });
+                }
+                return;
+            }
+            // 4. Tier 1: Triage with Gemini 3.8 Flash
+            app.log.info({ pullNumber, filesCount: contextPackage.itemsToReview.length }, "Executing Tier 1 triage");
+            const triage = await runTriage(contextPackage.promptPayload);
+            const filesToReview = triage.files.filter((f) => f.shouldReview);
+            if (filesToReview.length === 0) {
+                app.log.info({ pullNumber }, "All files classified as low risk. Review complete.");
+                if (checkRun?.data?.id) {
+                    await octokit.checks.update({
+                        owner,
+                        repo: repoName,
+                        check_run_id: checkRun.data.id,
+                        status: "completed",
+                        conclusion: "success",
+                        output: {
+                            title: "Triage Passed: Low Risk Changes",
+                            summary: `### Review Summary\n\n${triage.summary}\n\nAll modified files are low risk or auto-generated. Deep review bypassed.`,
+                        },
+                    });
+                }
+                return;
+            }
+            // 5. Tier 2: Deep Semantic Analysis with Gemini 3.8 Flash (High Thinking)
+            app.log.info({ pullNumber, count: filesToReview.length }, "Executing Tier 2 deep review");
+            // Retrieve previous review memory if hq-jr has audited this PR before
+            const previousReview = await getPreviousReviewContext({
+                octokit,
+                owner,
+                repo: repoName,
+                pullNumber,
+            });
+            if (previousReview) {
+                app.log.info({
+                    pullNumber,
+                    prevReviewId: previousReview.reviewId,
+                    prevCommitSha: previousReview.lastCommitSha.slice(0, 7),
+                    openIssuesCount: previousReview.openIssues.length,
+                }, "Incorporating prior review context for incremental verification");
+            }
+            const reviewPrompt = `Pull Request: #${pullNumber} - ${pr.title}
+Author: ${pr.user?.login}
+Description:
+${pr.body || "No description provided."}
+
+Files requiring deep review:
+${filesToReview.map((f) => `- ${f.path} (Risk: ${f.risk}, Reason: ${f.reason})`).join("\n")}
+
+${contextPackage.promptPayload}
+`;
+            const review = await runDeepReview(reviewPrompt, { previousReview });
+            // 6. Post inline review comments via Octokit REST (with line anchor validation)
+            const normalizePath = (p) => p.replace(/^[./]+/, "").replace(/\\/g, "/");
+            const fileMap = new Map();
+            for (const f of parsedDiff.files) {
+                if (f.newPath)
+                    fileMap.set(normalizePath(f.newPath), f);
+                if (f.oldPath)
+                    fileMap.set(normalizePath(f.oldPath), f);
+            }
+            const validComments = [];
+            const orphanComments = [];
+            for (const c of review.comments) {
+                const normPath = normalizePath(c.path);
+                let body = `### [${c.category}] ${c.title}\n\n${c.body}`;
+                if (c.suggestedPatch) {
+                    body += `\n\n\`\`\`suggestion\n${c.suggestedPatch}\n\`\`\``;
+                }
+                const matchedFile = fileMap.get(normPath);
+                const effectiveSide = matchedFile?.isDeleted ? "LEFT" : c.side;
+                if (matchedFile &&
+                    !matchedFile.isSubmodule &&
+                    !matchedFile.isBinary &&
+                    isLineInDiff(matchedFile, c.line, effectiveSide)) {
+                    validComments.push({
+                        path: matchedFile.newPath || matchedFile.oldPath,
+                        line: c.line,
+                        side: effectiveSide,
+                        body,
+                    });
+                }
+                else {
+                    let orphanBody = `- **${normPath}:${c.line}** [${c.severity}]: ${c.title}\n  ${c.body}`;
+                    if (c.suggestedPatch) {
+                        orphanBody += `\n  \`\`\`\n  ${c.suggestedPatch}\n  \`\`\``;
+                    }
+                    orphanComments.push(orphanBody);
+                }
+            }
+            let reviewBody = `## hq-jr Automated Code Review\n\n${review.summary}\n\n**Verdict:** \`${review.verdict}\``;
+            if (review.resolvedPriorIssues && review.resolvedPriorIssues.length > 0) {
+                reviewBody += `\n\n### ✅ Resolved Issues from Prior Review\n${review.resolvedPriorIssues.map((i) => `- ${i}`).join("\n")}`;
+            }
+            if (review.unresolvedPriorIssues && review.unresolvedPriorIssues.length > 0) {
+                reviewBody += `\n\n### ⚠️ Remaining Open Issues from Prior Review\n${review.unresolvedPriorIssues.map((i) => `- ${i}`).join("\n")}`;
+            }
+            if (orphanComments.length > 0) {
+                reviewBody += `\n\n### Additional File Observations (Outside Modified Diff Lines)\n${orphanComments.join("\n")}`;
+            }
+            if (validComments.length > 0 || orphanComments.length > 0 || previousReview) {
+                try {
+                    await octokit.pulls.createReview({
+                        owner,
+                        repo: repoName,
+                        pull_number: pullNumber,
+                        commit_id: pr.head.sha,
+                        event: review.verdict === "REQUEST_CHANGES" ? "REQUEST_CHANGES" : "COMMENT",
+                        body: reviewBody,
+                        comments: validComments,
+                    });
+                }
+                catch (reviewErr) {
+                    if (reviewErr?.status === 422 && validComments.length > 0) {
+                        app.log.warn({ reviewErr: reviewErr.message }, "Inline comment position rejected by GitHub (HTTP 422). Falling back to review summary.");
+                        let fallbackBody = reviewBody + "\n\n### Inline Comments (Attached as Summary due to diff positioning):\n";
+                        for (const vc of validComments) {
+                            fallbackBody += `\n- **${vc.path}:${vc.line}** (${vc.side}):\n${vc.body}\n`;
+                        }
+                        await octokit.pulls.createReview({
+                            owner,
+                            repo: repoName,
+                            pull_number: pullNumber,
+                            commit_id: pr.head.sha,
+                            event: review.verdict === "REQUEST_CHANGES" ? "REQUEST_CHANGES" : "COMMENT",
+                            body: fallbackBody,
+                        });
+                    }
+                    else {
+                        throw reviewErr;
+                    }
+                }
+            }
+            // 7. Complete Check Run
+            if (checkRun?.data?.id) {
+                const conclusion = review.verdict === "REQUEST_CHANGES"
+                    ? "failure"
+                    : review.verdict === "APPROVE"
+                        ? "success"
+                        : "neutral";
+                await octokit.checks.update({
+                    owner,
+                    repo: repoName,
+                    check_run_id: checkRun.data.id,
+                    status: "completed",
+                    conclusion,
+                    output: {
+                        title: `Review Completed: ${review.verdict}`,
+                        summary: `### Summary\n\n${review.summary}\n\nFound **${review.comments.length}** observation(s).`,
+                    },
+                });
+            }
+            // 8. Tier 3: Trigger asynchronous sandbox check run if requested by deep review
+            if (review.requiresSandboxVerification) {
+                const goal = review.verificationGoal || "Verify flagged critical issues in isolated container sandbox";
+                app.log.info({ pullNumber, goal }, "Triggering Tier 3 asynchronous sandbox check run");
+                executeSandboxCheckRun({
+                    octokit,
+                    owner,
+                    repo: repoName,
+                    pullNumber,
+                    headSha: pr.head.sha,
+                    branch: pr.head.ref || "main",
+                    verificationGoal: goal,
+                    modifiedFiles: parsedDiff.files.map((f) => f.newPath || f.oldPath),
+                    probes: review.sandboxProbes,
+                }).catch((sandboxErr) => {
+                    app.log.warn({ sandboxErr, pullNumber }, "Async sandbox verification check run encountered error");
+                });
+            }
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            app.log.error({ err, pullNumber }, "Error processing review");
+            if (checkRun?.data?.id) {
+                try {
+                    await octokit.checks.update({
+                        owner,
+                        repo: repoName,
+                        check_run_id: checkRun.data.id,
+                        status: "completed",
+                        conclusion: "failure",
+                        output: {
+                            title: "Review Failed",
+                            summary: `Automated review encountered an error: ${errorMsg}`,
+                        },
+                    });
+                }
+                catch (updateErr) {
+                    app.log.warn({ updateErr }, "Failed to update check run conclusion on error");
+                }
+            }
+        }
+        finally {
+            releaseRunLock(runKey);
+        }
+    }
+    // Handle pull request events
+    app.on(["pull_request.opened", "pull_request.synchronize", "pull_request.reopened"], async (context) => {
+        const { pull_request: pr, repository: repo, sender } = context.payload;
+        // 1. Never review PR actions triggered by the bot itself or other automated systems
+        if (sender?.type === "Bot" ||
+            sender?.login?.includes("hq-jr") ||
+            sender?.login?.endsWith("[bot]")) {
+            app.log.info({ pullNumber: pr.number, sender: sender?.login }, "Ignoring pull_request event triggered by bot self-action");
+            return;
+        }
+        // 2. Never review PRs that are already merged or closed
+        if (pr.state === "closed" || pr.merged || pr.merged_at) {
+            app.log.info({ pullNumber: pr.number }, "Ignoring pull_request event for closed or merged pull request");
+            return;
+        }
+        // 3. Never review commits generated by hq-jr autonomous remediation
+        if (hasRemediationCommit(pr.head.sha)) {
+            app.log.info({ pullNumber: pr.number, sha: pr.head.sha }, "Ignoring pull_request event for hq-jr remediation commit");
+            return;
+        }
+        await runPullRequestReview({
+            octokit: context.octokit,
+            owner: repo.owner.login,
+            repoName: repo.name,
+            pullNumber: pr.number,
+            pr,
+        });
+    });
+    // Handle interactive developer discussions and @hq-jr mentions
+    app.on("pull_request_review_comment.created", async (context) => {
+        const comment = context.payload.comment;
+        const user = comment.user;
+        // Do not respond to self or other bot comments
+        if (user.type === "Bot" || user.login.endsWith("[bot]")) {
+            return;
+        }
+        const body = comment.body.trim();
+        const mentionsBot = body.includes("@hq-jr") || body.includes("@hq-jr[bot]");
+        const isReply = Boolean(comment.in_reply_to_id);
+        if (!mentionsBot && !isReply) {
+            return;
+        }
+        try {
+            const threadHistory = await getReviewCommentThread({
+                octokit: context.octokit,
+                owner: context.payload.repository.owner.login,
+                repo: context.payload.repository.name,
+                pullNumber: context.payload.pull_request.number,
+                commentId: comment.id,
+                inReplyToId: comment.in_reply_to_id,
+            });
+            // Avoid thread hijacking: if not explicitly mentioned, only respond if hq-jr is an existing participant in thread
+            if (!mentionsBot && isReply) {
+                const involvesBot = threadHistory.some((t) => t.isBot || t.author.includes("hq-jr"));
+                if (!involvesBot) {
+                    return;
+                }
+            }
+            let originalComment;
+            if (threadHistory.length > 0) {
+                originalComment = threadHistory[0].body;
+            }
+            else if (comment.in_reply_to_id) {
+                const parent = await context.octokit.pulls.getReviewComment({
+                    owner: context.payload.repository.owner.login,
+                    repo: context.payload.repository.name,
+                    comment_id: comment.in_reply_to_id,
+                });
+                originalComment = parent.data.body;
+            }
+            app.log.info({ commentId: comment.id, user: user.login, threadTurns: threadHistory.length }, "Responding to discussion comment with full thread context");
+            const reply = await replyToDiscussion({
+                filePath: comment.path,
+                diffHunk: comment.diff_hunk,
+                originalComment,
+                threadHistory,
+                userQuery: body,
+                authorLogin: user.login,
+                commitSha: comment.commit_id,
+            });
+            await context.octokit.pulls.createReplyForReviewComment({
+                owner: context.payload.repository.owner.login,
+                repo: context.payload.repository.name,
+                pull_number: context.payload.pull_request.number,
+                comment_id: comment.id,
+                body: reply,
+            });
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            app.log.error({ err, commentId: comment.id }, "Failed to reply to discussion comment");
+            await context.octokit.pulls.createReplyForReviewComment({
+                owner: context.payload.repository.owner.login,
+                repo: context.payload.repository.name,
+                pull_number: context.payload.pull_request.number,
+                comment_id: comment.id,
+                body: `*hq-jr encountered an issue analyzing this thread: ${errorMsg}*`,
+            });
+        }
+    });
+    // Handle PR conversation comments mentioning @hq-jr
+    app.on("issue_comment.created", async (context) => {
+        // Only handle comments on pull requests
+        if (!context.payload.issue.pull_request) {
+            return;
+        }
+        const comment = context.payload.comment;
+        const user = comment.user;
+        // Do not respond to self or other bot comments
+        if (user.type === "Bot" || user.login.endsWith("[bot]")) {
+            return;
+        }
+        const body = comment.body.trim();
+        const mentionsBot = body.includes("@hq-jr") || body.includes("@hq-jr[bot]");
+        if (!mentionsBot) {
+            return;
+        }
+        const owner = context.payload.repository.owner.login;
+        const repoName = context.payload.repository.name;
+        const pullNumber = context.payload.issue.number;
+        app.log.info({ pullNumber, user: user.login }, "Responding to main PR thread comment mentioning @hq-jr");
+        try {
+            const lower = body.toLowerCase();
+            const isRemediateCommand = lower.includes("fix") ||
+                lower.includes("patch") ||
+                lower.includes("remediate") ||
+                lower.includes("resolve");
+            if (isRemediateCommand) {
+                // Enforce RBAC: Verify commenter has write or admin permissions to repo
+                let hasWrite = false;
+                try {
+                    const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
+                        owner,
+                        repo: repoName,
+                        username: user.login,
+                    });
+                    hasWrite = perm.permission === "admin" || perm.permission === "write";
+                }
+                catch (permErr) {
+                    app.log.warn({ permErr, user: user.login }, "Failed to verify collaborator permissions; failing closed");
+                }
+                if (!hasWrite) {
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can trigger automated remediation or merging.`,
+                    });
+                    return;
+                }
+                app.log.info({ pullNumber, user: user.login }, "Triggering autonomous remediation from comment");
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: `🛠️ **hq-jr** received remediation request from @${user.login}. Fetching prior audit findings, synthesizing code fixes with High Thinking, and generating remediation branch/commit...`,
+                });
+                const prResponse = await context.octokit.pulls.get({
+                    owner,
+                    repo: repoName,
+                    pull_number: pullNumber,
+                });
+                const prevReview = await getPreviousReviewContext({
+                    octokit: context.octokit,
+                    owner,
+                    repo: repoName,
+                    pullNumber,
+                });
+                if (!prevReview || prevReview.openIssues.length === 0) {
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `⚠️ **hq-jr** could not find any open review issues to remediate. Run \`@hq-jr review\` first to audit the PR.`,
+                    });
+                    return;
+                }
+                const hasNegativeMerge = /\b(?:do not|don't|no|never)\s+merge\b/i.test(body);
+                const hasExplicitMergeCommand = /\b(?:and\s+merge|auto-?merge)\b/i.test(body);
+                const autoMerge = hasExplicitMergeCommand && !hasNegativeMerge;
+                const result = await executeRemediation({
+                    octokit: context.octokit,
+                    owner,
+                    repo: repoName,
+                    pullNumber,
+                    pr: prResponse.data,
+                    issues: prevReview.openIssues,
+                    autoMerge,
+                });
+                let commentBody = `### 🛠️ hq-jr Remediation Report\n\n${result.message}\n\n`;
+                if (result.filesModified.length > 0) {
+                    commentBody += `**Files Modified:**\n${result.filesModified.map((f) => `- \`${f}\``).join("\n")}\n\n`;
+                }
+                if (result.commitSha) {
+                    addRemediationCommit(result.commitSha);
+                    commentBody += `**Commit SHA:** \`${result.commitSha.slice(0, 7)}\`\n`;
+                }
+                if (result.prUrl) {
+                    commentBody += `**Remediation PR:** ${result.prUrl}\n`;
+                }
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: commentBody,
+                });
+                return;
+            }
+            const isReviewCommand = lower.includes("review") ||
+                lower.includes("audit") ||
+                lower.includes("scan") ||
+                lower.includes("diff");
+            if (isReviewCommand) {
+                app.log.info({ pullNumber, user: user.login }, "Triggering full PR review from comment command");
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: `🤖 **hq-jr** received review command from @${user.login}. Starting automated code review with High Thinking — line-by-line diff comments will appear directly under **Files changed**...`,
+                });
+                const prResponse = await context.octokit.pulls.get({
+                    owner,
+                    repo: repoName,
+                    pull_number: pullNumber,
+                });
+                await runPullRequestReview({
+                    octokit: context.octokit,
+                    owner,
+                    repoName,
+                    pullNumber,
+                    pr: prResponse.data,
+                });
+                return;
+            }
+            const hasNegativeMerge = /\b(?:do not|don't|no|never)\s+merge\b/i.test(body);
+            const isMergeOnlyCommand = /\b(?:merge(?:\s+it|\s+this)?|auto-?merge)\b/i.test(body) &&
+                !hasNegativeMerge;
+            if (isMergeOnlyCommand) {
+                let hasWrite = false;
+                try {
+                    const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
+                        owner,
+                        repo: repoName,
+                        username: user.login,
+                    });
+                    hasWrite = perm.permission === "admin" || perm.permission === "write";
+                }
+                catch (permErr) {
+                    app.log.warn({ permErr, user: user.login }, "Failed to verify collaborator permissions for merge; failing closed");
+                }
+                if (!hasWrite) {
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can merge pull requests.`,
+                    });
+                    return;
+                }
+                const prResponse = await context.octokit.pulls.get({
+                    owner,
+                    repo: repoName,
+                    pull_number: pullNumber,
+                });
+                const pr = prResponse.data;
+                let closedIssueNotice = "";
+                if (lower.includes("close") && (lower.includes("issue") || lower.includes("it"))) {
+                    const issueMatch = body.match(/#(\d+)/) || (pr.body || "").match(/(?:closes|fixes|resolves)\s+#(\d+)/i);
+                    if (issueMatch) {
+                        const linkedIssueNum = parseInt(issueMatch[1], 10);
+                        try {
+                            await context.octokit.issues.update({
+                                owner,
+                                repo: repoName,
+                                issue_number: linkedIssueNum,
+                                state: "closed",
+                            });
+                            closedIssueNotice = ` and closed linked issue #${linkedIssueNum}`;
+                        }
+                        catch (closeErr) {
+                            app.log.warn({ closeErr, linkedIssueNum }, "Could not close linked issue");
+                        }
+                    }
+                }
+                try {
+                    await context.octokit.pulls.merge({
+                        owner,
+                        repo: repoName,
+                        pull_number: pullNumber,
+                        merge_method: "squash",
+                    });
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `✅ **Merged:** Successfully merged Pull Request #${pullNumber} (squash)${closedIssueNotice} upon request by @${user.login}.`,
+                    });
+                }
+                catch (mergeErr) {
+                    const errorMsg = mergeErr instanceof Error ? mergeErr.message : String(mergeErr);
+                    app.log.warn({ mergeErr, pullNumber }, "Direct merge failed, attempting GraphQL auto-merge");
+                    try {
+                        const gqlResult = await context.octokit.graphql(`query ($owner: String!, $repo: String!, $prNumber: Int!) {
+                 repository(owner: $owner, name: $repo) {
+                   pullRequest(number: $prNumber) {
+                     id
+                   }
+                 }
+               }`, { owner, repo: repoName, prNumber: pullNumber });
+                        if (gqlResult.repository?.pullRequest?.id) {
+                            await context.octokit.graphql(`mutation ($input: EnablePullRequestAutoMergeInput!) {
+                   enablePullRequestAutoMerge(input: $input) {
+                     pullRequest {
+                       number
+                     }
+                   }
+                 }`, {
+                                input: {
+                                    pullRequestId: gqlResult.repository.pullRequest.id,
+                                    mergeMethod: "SQUASH",
+                                },
+                            });
+                            await context.octokit.issues.createComment({
+                                owner,
+                                repo: repoName,
+                                issue_number: pullNumber,
+                                body: `🔄 **Auto-Merge Enabled:** Direct merge could not complete immediately (${errorMsg}). Auto-merge has been armed for PR #${pullNumber}${closedIssueNotice} upon request by @${user.login}.`,
+                            });
+                            return;
+                        }
+                    }
+                    catch (gqlErr) {
+                        app.log.warn({ gqlErr }, "GraphQL auto-merge also failed");
+                    }
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `⚠️ **Merge Blocked:** Could not merge PR #${pullNumber}: ${errorMsg}. Please ensure all required check runs are passing and mergeable state is clean.`,
+                    });
+                }
+                return;
+            }
+            // Fetch PR diff for context
+            const diffResponse = await context.octokit.pulls.get({
+                owner,
+                repo: repoName,
+                pull_number: pullNumber,
+                mediaType: {
+                    format: "diff",
+                },
+            });
+            const diffText = diffResponse.data;
+            const reply = await replyToDiscussion({
+                filePath: `Pull Request #${pullNumber}`,
+                diffHunk: scrubSecrets(diffText.slice(0, 15000)).scrubbed,
+                userQuery: scrubSecrets(body).scrubbed,
+                authorLogin: user.login,
+            });
+            await context.octokit.issues.createComment({
+                owner,
+                repo: repoName,
+                issue_number: pullNumber,
+                body: reply,
+            });
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            app.log.error({ err, pullNumber }, "Failed to reply to PR issue comment");
+            await context.octokit.issues.createComment({
+                owner,
+                repo: repoName,
+                issue_number: pullNumber,
+                body: `*hq-jr encountered an issue analyzing this thread: ${errorMsg}*`,
+            });
+        }
+    });
+    // Handle re-requesting review from Checks UI
+    app.on("check_run.rerequested", async (context) => {
+        const checkRun = context.payload.check_run;
+        const pullRequests = checkRun.pull_requests;
+        if (!pullRequests || pullRequests.length === 0) {
+            app.log.info("No pull requests attached to re-requested check run");
+            return;
+        }
+        const prRef = pullRequests[0];
+        const owner = context.payload.repository.owner.login;
+        const repoName = context.payload.repository.name;
+        app.log.info({ pullNumber: prRef.number, checkRunId: checkRun.id }, "Check run re-requested by developer");
+        const prResponse = await context.octokit.pulls.get({
+            owner,
+            repo: repoName,
+            pull_number: prRef.number,
+        });
+        await runPullRequestReview({
+            octokit: context.octokit,
+            owner,
+            repoName,
+            pullNumber: prRef.number,
+            pr: prResponse.data,
+        });
+    });
+    // Handle Check Run action buttons (e.g. Commit Repro Test)
+    app.on("check_run.requested_action", async (context) => {
+        const { check_run: checkRun, requested_action: requestedAction } = context.payload;
+        const identifier = requestedAction.identifier;
+        const owner = context.payload.repository.owner.login;
+        const repoName = context.payload.repository.name;
+        const sender = context.payload.sender.login;
+        if (identifier === "commit_repro_test") {
+            let hasWrite = false;
+            try {
+                const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
+                    owner,
+                    repo: repoName,
+                    username: sender,
+                });
+                hasWrite = perm.permission === "admin" || perm.permission === "write";
+            }
+            catch (permErr) {
+                app.log.warn({ permErr, sender }, "Failed to verify collaborator permissions for check action; failing closed");
+            }
+            const pullRequests = checkRun.pull_requests;
+            if (!pullRequests || pullRequests.length === 0) {
+                app.log.warn({ checkRunId: checkRun.id }, "No pull request attached to check run action");
+                return;
+            }
+            const pullNumber = pullRequests[0].number;
+            if (!hasWrite) {
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can commit reproduction tests.`,
+                });
+                return;
+            }
+            const prResponse = await context.octokit.pulls.get({
+                owner,
+                repo: repoName,
+                pull_number: pullNumber,
+            });
+            const pr = prResponse.data;
+            const targetBranch = pr.head.ref;
+            const outputText = checkRun.output?.summary || "";
+            const testCodeMatch = outputText.match(/```(?:rust|typescript|javascript|python)?\s*([\s\S]*?)```/);
+            const testCode = testCodeMatch ? testCodeMatch[1].trim() : null;
+            if (!testCode) {
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: `⚠️ **hq-jr** could not extract a synthesized reproduction test from this check run output.`,
+                });
+                return;
+            }
+            const isRust = outputText.includes("cargo") || outputText.includes(".rs");
+            const isPython = outputText.includes("pytest") || outputText.includes(".py");
+            const testFileName = isRust
+                ? `tests/repro_issue_${pullNumber}.rs`
+                : isPython
+                    ? `tests/test_repro_issue_${pullNumber}.py`
+                    : `tests/repro_issue_${pullNumber}.test.ts`;
+            const { data: blob } = await context.octokit.git.createBlob({
+                owner,
+                repo: repoName,
+                content: Buffer.from(testCode).toString("base64"),
+                encoding: "base64",
+            });
+            const { data: baseCommit } = await context.octokit.git.getCommit({
+                owner,
+                repo: repoName,
+                commit_sha: pr.head.sha,
+            });
+            const { data: newTree } = await context.octokit.git.createTree({
+                owner,
+                repo: repoName,
+                base_tree: baseCommit.tree.sha,
+                tree: [
+                    {
+                        path: testFileName,
+                        mode: "100644",
+                        type: "blob",
+                        sha: blob.sha,
+                    },
+                ],
+            });
+            const { data: newCommit } = await context.octokit.git.createCommit({
+                owner,
+                repo: repoName,
+                message: `test: add synthesized adversarial reproduction test for PR #${pullNumber} [skip ci]`,
+                tree: newTree.sha,
+                parents: [pr.head.sha],
+            });
+            addRemediationCommit(newCommit.sha);
+            await context.octokit.git.updateRef({
+                owner,
+                repo: repoName,
+                ref: `heads/${targetBranch}`,
+                sha: newCommit.sha,
+            });
+            await context.octokit.issues.createComment({
+                owner,
+                repo: repoName,
+                issue_number: pullNumber,
+                body: `✅ **Reproduction Test Committed:** \`${testFileName}\` has been committed directly to branch \`${targetBranch}\` (Commit: \`${newCommit.sha.slice(0, 7)}\`) by @${sender}.`,
+            });
+        }
+    });
+};
+//# sourceMappingURL=index.js.map