limn-review 0.1.123

package/dist/github/commit-checks.js

@@ -0,0 +1,105 @@
+import { checkRunsFrom } from '../sync/upsert.js';
+import { getGraphqlClientFor, ghRestGetFor, graphqlTolerant, isRateLimitError } from './client.js';
+import { isLimited, noteLimited } from './rate-budget.js';
+const SHA_RE = /^[0-9a-fA-F]{7,64}$/;
+export const COMMIT_CHECKS_QUERY = /* GraphQL */ `
+  query CommitChecks($owner: String!, $name: String!, $oid: GitObjectID!) {
+    repository(owner: $owner, name: $name) {
+      object(oid: $oid) {
+        __typename
+        ... on Commit {
+          oid
+          statusCheckRollup {
+            state
+            contexts(first: 100) {
+              nodes {
+                __typename
+                ... on CheckRun {
+                  name
+                  status
+                  conclusion
+                  detailsUrl
+                }
+                ... on StatusContext {
+                  context
+                  state
+                  targetUrl
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+/** The checks on one commit. Never throws. */
+export async function fetchCommitChecks(token, args) {
+    if (!SHA_RE.test(args.sha))
+        return { ok: false, reason: 'bad_sha' };
+    if (args.accountId != null && isLimited(args.accountId))
+        return { ok: false, reason: 'rate_limited' };
+    try {
+        let partial = false;
+        const data = await graphqlTolerant(getGraphqlClientFor(token), COMMIT_CHECKS_QUERY, { owner: args.owner, name: args.name, oid: args.sha }, () => {
+            partial = true;
+        });
+        const obj = data?.repository?.object ?? null;
+        if (!obj || obj.__typename !== 'Commit')
+            return { ok: false, reason: 'not_found' };
+        const rollup = obj.statusCheckRollup ?? null;
+        // ⚠ A PARTIAL answer is not "no checks": a token that cannot read checks (a GitHub App without
+        // checks:read) gets the rollup NULLED with an error beside it. Only a clean null means none.
+        if (rollup == null)
+            return partial ? { ok: false, reason: 'no_check_access' } : { ok: true, rollupState: null, checks: [] };
+        if (rollup.contexts == null && partial)
+            return { ok: false, reason: 'no_check_access' };
+        const nodes = (rollup.contexts?.nodes ?? []).filter((n) => n != null);
+        const checks = checkRunsFrom({
+            oid: obj.oid ?? args.sha,
+            statusCheckRollup: { state: rollup.state ?? '', contexts: { nodes } },
+        });
+        return { ok: true, rollupState: rollup.state ?? null, checks };
+    }
+    catch (err) {
+        const rl = isRateLimitError(err);
+        if (rl.limited) {
+            if (args.accountId != null)
+                noteLimited(args.accountId, rl.resumeAt);
+            return { ok: false, reason: 'rate_limited' };
+        }
+        return { ok: false, reason: 'error' };
+    }
+}
+/**
+ * The name of the FIRST failed step of a GitHub Actions job, from GitHub's own step list
+ * (`GET /repos/{o}/{r}/actions/jobs/{id}`). null when none failed by GitHub's record, or on any
+ * error. Never throws.
+ */
+export async function fetchActionsJobFailedStep(token, args) {
+    if (!Number.isSafeInteger(args.jobId) || args.jobId <= 0)
+        return null;
+    if (args.accountId != null && isLimited(args.accountId))
+        return null;
+    try {
+        const job = await ghRestGetFor(token, `/repos/${args.owner}/${args.name}/actions/jobs/${args.jobId}`);
+        return failedStepName(job);
+    }
+    catch (err) {
+        const rl = isRateLimitError(err);
+        if (rl.limited && args.accountId != null)
+            noteLimited(args.accountId, rl.resumeAt);
+        return null;
+    }
+}
+const FAILED_STEP = new Set(['failure', 'timed_out', 'startup_failure']);
+/** Pure: the first failed step of a REST job payload (by step number). Exported for tests. */
+export function failedStepName(job) {
+    const steps = Array.isArray(job?.steps) ? job.steps : [];
+    const failed = steps
+        .filter((s) => typeof s?.conclusion === 'string' && FAILED_STEP.has(s.conclusion))
+        .sort((a, b) => (Number(a.number) || 0) - (Number(b.number) || 0));
+    const name = failed[0]?.name;
+    return typeof name === 'string' && name.trim() ? name.trim() : null;
+}
+//# sourceMappingURL=commit-checks.js.map

package/dist/github/compare.js

@@ -0,0 +1,110 @@
+// Two-sha COMPARE primitive (CORE). One REST call to
+// `GET /repos/{owner}/{name}/compare/{base}...{head}` returning the per-file unified patches
+// between two commits, optionally narrowed to a set of paths.
+//
+// WHY IT LIVES IN CORE. Every diff primitive does, by standing policy (see the PreparedReview
+// note in src/pro/contract.ts): the plugin holds no GitHub token and must never assemble
+// patches itself. This module is the one the `addressed` annotation is grounded on — "what
+// actually changed between the commit the thread was last discussed at and the PR head" — and
+// it is reached from the plugin through `ProContext.github.fetchCompareDiff`.
+//
+// IT NEVER THROWS. A missing/forbidden/rate-limited compare must degrade the judgement that
+// asked for it to "no diff evidence available", never turn a working feature into an error.
+// Every failure comes back as `{ ok: false, reason }`.
+//
+// KNOWN GITHUB LIMITS, all modelled rather than hidden:
+//   * `files[]` is capped at 300 entries — past that a path's ABSENCE is not proof it was
+//     untouched, hence `filesTruncated`;
+//   * `patch` is OMITTED for binary and oversized files (the entry still appears with its
+//     add/delete counts), hence a `null` patch with a real `status`;
+//   * a sha that has been force-pushed away 404s — an ordinary outcome, not an error;
+//   * 403/429 are classified through `isRateLimitError` (the SEPARATE classifier — do NOT
+//     widen `isRetryableGithubError`, whose 403/429 exclusion is pinned by a test) and fed to
+//     the per-account budget so the rest of the process backs off too.
+import { ghRestGetFor, isRateLimitError, withGithubRetry } from './client.js';
+import { noteLimited } from './rate-budget.js';
+/** Per-file clamp on the returned patch. A grounding hunk, not a whole-file dump. */
+export const DEFAULT_MAX_PATCH_CHARS = 20_000;
+/** GitHub's own ceiling on `files[]` in one compare response. */
+const GITHUB_COMPARE_FILE_CAP = 300;
+/** Shas arrive from stored data; keep them out of the URL path unless they look like shas. */
+const SHA_RE = /^[0-9a-fA-F]{7,64}$/;
+const asString = (v) => (typeof v === 'string' ? v : null);
+const asCount = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+function empty(baseSha, headSha, reason, ok) {
+    return { ok, baseSha, headSha, files: [], filesChanged: 0, filesTruncated: false, reason };
+}
+function statusOf(err) {
+    const s = err?.status;
+    return typeof s === 'number' ? s : null;
+}
+/**
+ * The per-file patches between two commits of one repo.
+ *
+ * `paths` narrows the RESULT, not the request — GitHub's compare endpoint has no server-side
+ * path filter, so the whole file list comes back either way and is filtered here. That is also
+ * why one call covers every path a caller cares about: coalesce by (baseSha, headSha) rather
+ * than issuing one request per file.
+ *
+ * A file that was RENAMED matches on either name, so a thread anchored to the old path still
+ * finds its change.
+ */
+export async function fetchCompareDiff(token, args) {
+    const { owner, name, baseSha, headSha } = args;
+    const maxPatchChars = args.maxPatchChars ?? DEFAULT_MAX_PATCH_CHARS;
+    if (!SHA_RE.test(baseSha) || !SHA_RE.test(headSha)) {
+        return empty(baseSha, headSha, 'bad_sha', false);
+    }
+    // Nothing can have changed between a commit and itself — and a request would still cost a
+    // point of GitHub quota to say so.
+    if (baseSha === headSha)
+        return empty(baseSha, headSha, 'identical', true);
+    let raw;
+    try {
+        raw = await withGithubRetry(() => ghRestGetFor(token, `/repos/${owner}/${name}/compare/${baseSha}...${headSha}`));
+    }
+    catch (err) {
+        const rl = isRateLimitError(err);
+        if (rl.limited) {
+            if (args.accountId != null)
+                noteLimited(args.accountId, rl.resumeAt);
+            return empty(baseSha, headSha, 'rate_limited', false);
+        }
+        const status = statusOf(err);
+        const reason = status === 404 ? 'not_found' : status === 403 ? 'forbidden' : 'error';
+        return empty(baseSha, headSha, reason, false);
+    }
+    const all = Array.isArray(raw.files) ? raw.files : [];
+    const want = args.paths != null ? new Set(args.paths) : null;
+    const files = [];
+    for (const f of all) {
+        const path = asString(f.filename);
+        if (path == null)
+            continue;
+        const previousPath = asString(f.previous_filename);
+        if (want != null && !want.has(path) && !(previousPath != null && want.has(previousPath))) {
+            continue;
+        }
+        const patchRaw = asString(f.patch);
+        const patchTruncated = patchRaw != null && patchRaw.length > maxPatchChars;
+        files.push({
+            path,
+            previousPath,
+            status: asString(f.status) ?? 'modified',
+            additions: asCount(f.additions),
+            deletions: asCount(f.deletions),
+            patch: patchRaw == null ? null : patchTruncated ? patchRaw.slice(0, maxPatchChars) : patchRaw,
+            patchTruncated,
+        });
+    }
+    return {
+        ok: true,
+        baseSha,
+        headSha,
+        files,
+        filesChanged: all.length,
+        filesTruncated: all.length >= GITHUB_COMPARE_FILE_CAP,
+        reason: null,
+    };
+}
+//# sourceMappingURL=compare.js.map

package/dist/github/diff-anchor.js

@@ -0,0 +1,227 @@
+// Pure unified-diff anchoring helpers, shared between the Claude-review posting
+// path (review/post-review.ts) and the on-demand Changes-tab / inline-comment
+// path (the PR write actions). All functions here are side-effect-free string
+// parsers — no GitHub I/O, no DB — so they're trivially testable and reusable.
+export const HUNK_RE = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+// Parse a unified diff into per-file maps of addable line numbers. We track the
+// new-file line counter (RIGHT) and old-file line counter (LEFT) as we walk each
+// hunk: context lines advance both, `+` advances RIGHT, `-` advances LEFT.
+export function buildAnchorIndex(diff) {
+    const index = new Map();
+    let current = null;
+    let newLine = 0;
+    let oldLine = 0;
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('diff --git')) {
+            current = null;
+            continue;
+        }
+        // `+++ b/path` names the new-side file; strip the `b/` prefix. GitHub keys
+        // comments by this path. `/dev/null` (deletions) yields no anchors.
+        if (raw.startsWith('+++ ')) {
+            const path = parseDiffPath(raw.slice(4));
+            if (path) {
+                current = {
+                    right: new Set(),
+                    left: new Set(),
+                    firstAdded: null,
+                    firstRemoved: null,
+                };
+                index.set(path, current);
+            }
+            else {
+                current = null;
+            }
+            continue;
+        }
+        if (raw.startsWith('--- '))
+            continue;
+        const hunk = HUNK_RE.exec(raw);
+        if (hunk) {
+            oldLine = Number(hunk[1]);
+            newLine = Number(hunk[2]);
+            continue;
+        }
+        if (!current)
+            continue;
+        const marker = raw[0];
+        if (marker === '+') {
+            current.right.add(newLine);
+            if (current.firstAdded == null)
+                current.firstAdded = newLine;
+            newLine += 1;
+        }
+        else if (marker === '-') {
+            current.left.add(oldLine);
+            if (current.firstRemoved == null)
+                current.firstRemoved = oldLine;
+            oldLine += 1;
+        }
+        else if (marker === ' ') {
+            current.right.add(newLine);
+            current.left.add(oldLine);
+            newLine += 1;
+            oldLine += 1;
+        }
+        // `` and blank trailing lines advance nothing.
+    }
+    return index;
+}
+// Parse a SINGLE GitHub REST per-file patch into its FileAnchors. REST per-file
+// patches (from `GET /pulls/{n}/files`) are header-LESS — they start straight at
+// the first `@@ … @@` hunk, with no `diff --git` / `+++ b/path` line that
+// `buildAnchorIndex` keys on. We synthesize that `+++ b/<filename>` header so the
+// shared walker produces an index, then pull the one entry back out.
+//
+// A null/empty patch (binary files, or files with no textual diff) yields empty
+// anchor sets so callers treat every line as unanchorable.
+export function buildFileAnchors(filename, patch) {
+    const empty = {
+        right: new Set(),
+        left: new Set(),
+        firstAdded: null,
+        firstRemoved: null,
+    };
+    if (!patch)
+        return empty;
+    const synthesized = `+++ b/${filename}\n${patch}`;
+    // The synthesized diff has exactly one file, so take the sole entry rather than
+    // looking it up by `filename` — buildAnchorIndex may trim the key, which would
+    // miss for a filename with surrounding whitespace.
+    const [only] = buildAnchorIndex(synthesized).values();
+    return only ?? empty;
+}
+// `+++ b/src/foo.ts` → `src/foo.ts`; `+++ /dev/null` → null. Trailing tab-info
+// (rename/mode) is already excluded by GitHub's diff format on this line.
+function parseDiffPath(rest) {
+    const trimmed = rest.trim();
+    if (trimmed === '/dev/null')
+        return null;
+    return trimmed.startsWith('b/') ? trimmed.slice(2) : trimmed;
+}
+// Split a unified diff into per-file segments (each starting at a `diff --git`
+// header). The path prefers the new-side (`+++ b/…`) name, falling back to the
+// header. Used to drop noise files before the agent sees the diff.
+export function splitDiffByFile(diff) {
+    const segments = [];
+    let curLines = [];
+    let curPath = null;
+    const flush = () => {
+        if (curLines.length > 0 && curPath) {
+            segments.push({ path: curPath, text: curLines.join('\n') });
+        }
+        curLines = [];
+        curPath = null;
+    };
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            flush();
+            curLines = [line];
+            curPath = parseGitHeaderPath(line);
+        }
+        else {
+            if (line.startsWith('+++ ')) {
+                const p = parseDiffPath(line.slice(4));
+                if (p)
+                    curPath = p;
+            }
+            curLines.push(line);
+        }
+    }
+    flush();
+    return segments;
+}
+// `diff --git a/foo b/foo` → `foo` (new path). Null if unparseable.
+function parseGitHeaderPath(line) {
+    const m = /^diff --git a\/(.+) b\/(.+)$/.exec(line);
+    return m ? (m[2] ?? null) : null;
+}
+// A finding is anchorable inline only if its (path, line, side) lands on an
+// addable diff line for that side.
+export function isFindingAnchored(index, path, line, side) {
+    if (line == null)
+        return false;
+    const anchors = index.get(path);
+    if (!anchors)
+        return false;
+    return side === 'LEFT' ? anchors.left.has(line) : anchors.right.has(line);
+}
+// Where to anchor a finding whose own (line, side) isn't addable: the file's
+// FIRST added line (RIGHT), preferred over its first removed line (LEFT). null
+// when the file isn't in the diff at all (nothing to attach to → stays skipped).
+export function fallbackAnchor(index, path) {
+    const anchors = index.get(path);
+    if (!anchors)
+        return null;
+    if (anchors.firstAdded != null)
+        return { line: anchors.firstAdded, side: 'RIGHT' };
+    if (anchors.firstRemoved != null)
+        return { line: anchors.firstRemoved, side: 'LEFT' };
+    return null;
+}
+// Extract a small unified-diff window around a finding's (path, line, side), to
+// show the covered code in context. Walks the diff like buildAnchorIndex,
+// tracking new/old line counters, then slices ±ctx body lines around the match
+// and prepends the containing hunk header. Returns null if the line isn't found.
+export function extractHunk(diff, path, line, side, ctx = 3) {
+    if (line == null)
+        return null;
+    let inFile = false;
+    let newLine = 0;
+    let oldLine = 0;
+    let hunkHeader = '';
+    let targetHunkHeader = '';
+    const body = [];
+    let targetIdx = -1;
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('diff --git')) {
+            inFile = false;
+            continue;
+        }
+        if (raw.startsWith('+++ ')) {
+            inFile = parseDiffPath(raw.slice(4)) === path;
+            continue;
+        }
+        if (raw.startsWith('--- '))
+            continue;
+        if (!inFile)
+            continue;
+        const hunk = HUNK_RE.exec(raw);
+        if (hunk) {
+            oldLine = Number(hunk[1]);
+            newLine = Number(hunk[2]);
+            hunkHeader = raw;
+            continue;
+        }
+        const marker = raw[0];
+        let matches = false;
+        if (marker === '+')
+            matches = side === 'RIGHT' && newLine === line;
+        else if (marker === '-')
+            matches = side === 'LEFT' && oldLine === line;
+        else if (marker === ' ') {
+            matches =
+                (side === 'RIGHT' && newLine === line) ||
+                    (side === 'LEFT' && oldLine === line);
+        }
+        body.push(raw);
+        if (matches && targetIdx === -1) {
+            targetIdx = body.length - 1;
+            targetHunkHeader = hunkHeader;
+        }
+        if (marker === '+')
+            newLine += 1;
+        else if (marker === '-')
+            oldLine += 1;
+        else if (marker === ' ') {
+            newLine += 1;
+            oldLine += 1;
+        }
+    }
+    if (targetIdx === -1)
+        return null;
+    const start = Math.max(0, targetIdx - ctx);
+    const end = Math.min(body.length, targetIdx + ctx + 1);
+    return [targetHunkHeader, ...body.slice(start, end)].filter(Boolean).join('\n');
+}
+//# sourceMappingURL=diff-anchor.js.map