limn-review 0.1.123

package/dist/coding/agent.js

@@ -0,0 +1,288 @@
+import { claudeExecutableOptions, loadAgentSdk } from '../ai/runtime.js';
+import { config } from '../config.js';
+import { getAccessToken } from '../auth/account.js';
+import { applyClaudeReviewAuth } from '../review/auth.js';
+import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from '../review/clone-manager.js';
+import { sdkModelOptions } from '../review/model-options.js';
+import { estimateCostUsd } from '../review/pricing.js';
+import { recordUsage, sumModelUsage, sumUsageMap, } from '../review/usage.js';
+import { submitFixShape } from './schema.js';
+import { captureWorktreeDiff } from './git.js';
+import { describeAssistantBlocks } from './activity.js';
+// The WRITE tool surface for the fixer: Read/Glob/Grep to explore, Write/Edit/MultiEdit to
+// make the change, and the submit_fix MCP tool for the prose summary. NO SHELL.
+//
+// ---- Bash is deliberately ABSENT (this used to include it) ----
+//
+// Two independent reasons, either sufficient on its own.
+//
+// SAFETY — the argument the comment above `WORKTREE_TOOLS` in review/agent.ts already makes at
+// length, for the identical input shape. Everything this agent reads (the PR title, the description, the diff, the review
+// comments — and on the `'comments'` seed, NOTHING BUT review comments) was written by whoever
+// opened the pull request. Pair that with `permissionMode:'bypassPermissions'` and
+// `settingSources:[]` below, which is to say nothing else was constraining the shell either, and
+// a stranger's PR text becomes a remote-code-execution path on the developer's own machine. The
+// blocklist that used to sit here — `Bash(rm *)`, `Bash(sudo *)`, `Bash(git push *)`,
+// `Bash(git commit *)`, `Bash(git config *)` — stopped five literal prefixes and nothing else:
+// "A blocklist cannot enumerate the badness of a shell."
+//
+// ⚠ THOSE `Bash(git …)` ENTRIES WERE ALSO THE MECHANICAL HALF OF "THE HOST OWNS THE COMMIT, NOT
+// THE AGENT", and that rule is unchanged — a denied shell cannot run git at all, so a bare
+// 'Bash' guarantees it strictly harder. What is gone is the grep-able evidence, so it is written
+// here instead: the agent leaves its edits in the working tree, `captureWorktreeDiff` turns them
+// into a patch, and coding/git-ops.ts commits and pushes THAT — after the reader picks a target.
+// The prompt still says it too (WORKTREE_RULES in the plugin's ai-fix/prompts.ts).
+//
+// SPEED — the shell's real use here was running builds and tests, and nothing downstream ever
+// read the answer: runCodingAgent's success criterion is a captured diff under
+// `aiFixPatchMaxBytes`, and no column on the fix row records whether anything was verified. The
+// cost was real: a suite runs against `aiFixMaxTurns` (40) and `aiFixBudgetUsd` ($5) with NO
+// wall-clock limit, returns its output as a tool_result billed as input on the next turn, and
+// holds the single global job slot (MAX_CONCURRENT = 1, packages/pro/src/ai-fix/manager.ts) that
+// every other account's fix queues behind.
+//
+// ⚠ What this costs, stated plainly: a fix that wanted a codegen step, a formatter, or `git log`
+// for context must now write the edit by hand or decline. That is the accepted trade — Claude
+// Review made the identical one. The way back is a container/VM boundary, or `canUseTool` under a
+// non-bypass permission mode — NOT re-adding 'Bash' with a longer blocklist.
+const FIX_TOOLS = [
+    'Read',
+    'Glob',
+    'Grep',
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'mcp__fix__submit_fix',
+];
+// Denied OUTRIGHT rather than by command pattern, for the reasons above. Belt and braces: Bash is
+// also absent from the allow list, so there are two independent reasons it cannot run.
+const DISALLOWED_TOOLS = ['Bash', 'NotebookEdit'];
+// Per-model effort + thinking options: ONE table in review/model-options.ts, shared with the
+// review agent (Haiku 4.5 rejects `effort`; Opus 5.5 gets explicit adaptive thinking and 400s on
+// disabled thinking / a thinking budget / a forced tool_choice, none of which is sent here).
+const ACTIVITY_LOG_CAP = 25;
+function emptyUsage() {
+    return {
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+    };
+}
+/**
+ * The Claude Agent SDK run core behind the fixer (runCodingAgent): it OWNS the sandbox
+ * config (`permissionMode:'bypassPermissions'`, `settingSources:[]`, budget/turn caps,
+ * whitelisted tools) and streams activity, but knows nothing about worktree prep, diff
+ * capture, or git — the caller owns those. (It also used to run AI Fix's agentic conflict
+ * resolver; that path was removed with the rest of AI Fix's trunk reconciliation.)
+ *
+ * Auth: prefers the ambient Claude session, else falls back to the user's local BYO
+ * Anthropic key — the SAME advanced-AI credential policy as Claude Review
+ * (applyClaudeReviewAuth), restored in `finally`. AI-Fix jobs are concurrency 1; the env
+ * mutation only bites when there's no ambient auth (a BYO-key-only setup), where it and a
+ * concurrent review would set the identical key.
+ */
+export async function runAgentInWorktree(opts) {
+    const model = opts.model;
+    const usageByUuid = new Map();
+    let result = null;
+    const maxTurns = opts.maxTurns;
+    // 'worktree' ⇒ config.reviewEffort, exactly the effort this path always used.
+    const modelOptions = sdkModelOptions(model, 'worktree');
+    // Advanced-AI credential: ambient session preferred, else the local BYO key. Restored below.
+    const restoreEnv = applyClaudeReviewAuth(true);
+    try {
+        // From the AI runtime (ai/runtime.ts) — downloaded on first use for an npm install.
+        const { query } = await loadAgentSdk();
+        const q = query({
+            prompt: opts.prompt,
+            options: {
+                model,
+                ...modelOptions,
+                ...(opts.systemPrompt ? { systemPrompt: opts.systemPrompt } : {}),
+                cwd: opts.worktreePath,
+                permissionMode: 'bypassPermissions',
+                allowedTools: opts.allowedTools,
+                disallowedTools: opts.disallowedTools,
+                maxTurns,
+                maxBudgetUsd: opts.maxBudgetUsd,
+                settingSources: [],
+                mcpServers: opts.mcpServers,
+                abortController: opts.abortController,
+                // LIMN_CLAUDE_PATH → the user's own `claude` instead of the SDK's bundled binary.
+                ...claudeExecutableOptions(),
+            },
+        });
+        const activity = [];
+        const pushActivity = (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            activity.push(trimmed);
+            if (activity.length > ACTIVITY_LOG_CAP)
+                activity.shift();
+        };
+        for await (const message of q) {
+            if (message.type === 'assistant') {
+                try {
+                    recordUsage(usageByUuid, message);
+                }
+                catch {
+                    /* usage shape varies — never let it break the run */
+                }
+                try {
+                    for (const line of describeAssistantBlocks(message))
+                        pushActivity(line);
+                }
+                catch {
+                    /* never let progress derivation break the run */
+                }
+                const live = sumUsageMap(usageByUuid);
+                opts.onActivity?.([...activity], {
+                    ...live,
+                    estCostUsd: estimateCostUsd(model, live),
+                });
+            }
+            else if (message.type === 'result') {
+                result = message;
+            }
+        }
+        if (opts.abortController.signal.aborted) {
+            return {
+                result,
+                usage: emptyUsage(),
+                costUsd: null,
+                numTurns: null,
+                aborted: true,
+            };
+        }
+        const usage = sumModelUsage(result) ?? sumUsageMap(usageByUuid);
+        const hasUsage = usage.inputTokens + usage.outputTokens + usage.cacheReadTokens > 0;
+        const costUsd = result?.total_cost_usd ?? (hasUsage ? estimateCostUsd(model, usage) : null);
+        return {
+            result,
+            usage: {
+                inputTokens: usage.inputTokens,
+                outputTokens: usage.outputTokens,
+                cacheReadTokens: usage.cacheReadTokens,
+                cacheCreationTokens: usage.cacheCreationTokens,
+            },
+            costUsd,
+            numTurns: result?.num_turns ?? null,
+            aborted: false,
+        };
+    }
+    finally {
+        restoreEnv();
+    }
+}
+/**
+ * Run the write-capable coding agent against a PR's head in an ephemeral worktree and
+ * return the captured changeset (a binary-safe unified diff) + a prose summary. This
+ * is the implementation behind ctx.coding.generateFix; it owns the worktree prep +
+ * diff capture + teardown, and delegates the sandboxed SDK run to runAgentInWorktree.
+ * Never commits or pushes — the host's git-ops does that later from the STORED patch.
+ */
+export async function runCodingAgent(args) {
+    const { owner, name, prNumber, baseSha, abortController, onProgress } = args;
+    const model = args.model;
+    const token = await getAccessToken(args.accountId);
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        onProgress({ phase: 'cloning' });
+        ({ repoCloneDir, worktreePath } = await prepWorktree(owner, name, prNumber, baseSha, token));
+        const { createSdkMcpServer, tool } = await loadAgentSdk();
+        const fixShape = await submitFixShape();
+        let captured = null;
+        const server = createSdkMcpServer({
+            name: 'fix',
+            version: '1.0.0',
+            tools: [
+                tool('submit_fix', 'Report the fix you applied. Call this EXACTLY once, at the very end, after editing files.', fixShape, async (a) => {
+                    const p = a;
+                    captured = {
+                        summary: p.summary,
+                        commitMessage: p.commitMessage,
+                        // Passed through verbatim; the AI Fix manager validates refs + clips text.
+                        changes: p.changes,
+                        unaddressed: p.unaddressed,
+                    };
+                    return { content: [{ type: 'text', text: 'Fix recorded.' }] };
+                }),
+            ],
+        });
+        onProgress({ phase: 'fixing' });
+        const outcome = await runAgentInWorktree({
+            worktreePath,
+            model,
+            systemPrompt: args.systemPrompt,
+            prompt: args.prompt,
+            allowedTools: FIX_TOOLS,
+            disallowedTools: DISALLOWED_TOOLS,
+            mcpServers: { fix: server },
+            maxTurns: args.maxTurns ?? config.aiFixMaxTurns,
+            maxBudgetUsd: args.maxBudgetUsd ?? config.aiFixBudgetUsd,
+            abortController,
+            onActivity: (activity, usage) => onProgress({ phase: 'fixing', recentActivity: activity, usage }),
+        });
+        // A user cancel aborts the SDK iterator; surface a clean aborted result (the
+        // manager marks the row cancelled — no worktree changes are captured).
+        if (outcome.aborted || abortController.signal.aborted) {
+            return {
+                summary: '',
+                commitMessage: '',
+                patch: '',
+                filesChanged: [],
+                baseSha,
+                usage: emptyUsage(),
+                costUsd: null,
+                numTurns: null,
+                aborted: true,
+            };
+        }
+        onProgress({ phase: 'capturing' });
+        const { patch, filesChanged } = await captureWorktreeDiff(worktreePath);
+        if (patch.length > config.aiFixPatchMaxBytes) {
+            throw new Error(`fix patch too large (${patch.length} bytes > ${config.aiFixPatchMaxBytes})`);
+        }
+        // A cast so the closure-assigned `captured` reads back as its declared union.
+        // (TS flow-narrows it to `null` because its only assignment is inside the tool
+        // callback, which it can't prove ran — a plain annotation wouldn't break that.)
+        const fix = captured;
+        return {
+            summary: fix?.summary ??
+                (filesChanged.length
+                    ? `Applied changes to ${filesChanged.length} file(s).`
+                    : 'The agent made no changes.'),
+            commitMessage: fix?.commitMessage ?? 'AI fix',
+            // Absent when the agent never called submit_fix (or reported neither list).
+            report: fix && (fix.changes || fix.unaddressed)
+                ? { changes: fix.changes, unaddressed: fix.unaddressed }
+                : undefined,
+            patch,
+            filesChanged,
+            baseSha,
+            usage: outcome.usage,
+            costUsd: outcome.costUsd,
+            numTurns: outcome.numTurns,
+            aborted: false,
+        };
+    }
+    finally {
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(owner, name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+//# sourceMappingURL=agent.js.map

package/dist/coding/ai-fix/auto-fix.js

@@ -0,0 +1,212 @@
+// AUTO FIX — after an AUTO Claude review succeeds on the reader's OWN pull request, start ONE
+// review-seeded AI Fix (CORE, free, local-only, like the rest of the agentic surface).
+//
+// THE GATE, in order (the first that fails decides; every skip is logged and kept in memory for the
+// Claude Review tab's one line, `autoFixOutcomeFor`):
+//   0. the PR's author IS the account's own GitHub user (pull_requests.author_id → users.github_login
+//      vs accounts.github_login, case-insensitive). Anyone else's PR: nothing happens and nothing is
+//      recorded — fixing someone else's branch is never automatic;
+//   1. `nothing_to_fix`  — the review's seed is empty (the same refusal as the button's NothingToFix);
+//   2. `head_moved`      — the PR's synced head is no longer the reviewed one (the next review decides);
+//   3. `fix_in_progress` — a fix for this PR (auto or manual) is queued or running;
+//   4. `fix_waiting`     — a finished fix with changes, never pushed, sits on the PR's CURRENT head
+//                          (the synced head, the REVIEWED head, or — only when an unpushed fix sits
+//                          on neither — the LIVE head, so a lagging sync cannot hide one);
+//   5. `cap`             — AUTO_FIX_DAILY_CAP auto fixes already started on this PR in the last 24h;
+//   6. `already_tried`   — the latest auto fix AT THIS HEAD reported every item this review would
+//                          send as not addressed (nobody has pushed since, so nothing changed).
+// Then `startReviewFix(…, trigger: 'auto')` — the same queue, slot and worktree as the button.
+//
+// ⚠ NOTHING IS PUSHED. A fix waits for a person's Push like any other.
+// ⚠ LOOP SAFETY. A pushed fix makes a new head, which earns an auto re-review, which may earn
+// another fix. The chain needs a PERSON pressing Push at every turn (an unpushed fix blocks the next
+// one, rule 4), and is bounded anyway by rule 5. Rule 6 stops the one loop that needs no push: a
+// fix that changed nothing, re-tried at the same head on every comment-triggered review. Item
+// identity across reviews is (kind, thread / story index, path, title) — a finding re-worded by a
+// later review counts as new, so rule 6 can miss it; rule 5 still bounds it.
+// ⚠ Never throws: an auto fix failing must never touch the review.
+import { and, desc, eq, gte } from 'drizzle-orm';
+import { AUTO_FIX_DAILY_CAP, CLAUDE_REVIEW_MODELS, DEFAULT_AI_FIX_MODEL, } from '../../shared/index.js';
+import { isFixRunning, loadReviewSeed, startReviewFix } from './manager.js';
+import { parseChangeReport, parseReviewItems } from './persist.js';
+import { getFixPrContext } from './pr-context.js';
+// At most AUTO_FIX_DAILY_CAP (shared) AUTO fixes per PR in any rolling AUTO_FIX_WINDOW_MS.
+export { AUTO_FIX_DAILY_CAP };
+export const AUTO_FIX_WINDOW_MS = 24 * 60 * 60 * 1000;
+// reviewId → the outcome, with its owner. Bounded: the oldest entry goes first.
+const OUTCOMES_MAX = 500;
+const outcomes = new Map();
+function record(accountId, outcome) {
+    outcomes.delete(outcome.reviewId);
+    outcomes.set(outcome.reviewId, { accountId, outcome });
+    while (outcomes.size > OUTCOMES_MAX) {
+        const first = outcomes.keys().next().value;
+        if (first === undefined)
+            break;
+        outcomes.delete(first);
+    }
+}
+/** The recorded auto-fix outcome of one review, for its owner only. */
+export function autoFixOutcomeFor(reviewId, accountId) {
+    const o = outcomes.get(reviewId);
+    return o && o.accountId === accountId ? o.outcome : null;
+}
+/** Test hook. */
+export function _resetAutoFixForTest() {
+    outcomes.clear();
+}
+/** Is the PR's author the account's own GitHub user? Unknown on either side ⇒ false. */
+export async function prAuthorIsAccount(ctx, accountId, prId) {
+    const { pullRequests: prs, users, accounts } = ctx.schema;
+    const [author, account] = await Promise.all([
+        ctx.db
+            .select({ login: users.githubLogin })
+            .from(prs)
+            .innerJoin(users, eq(users.id, prs.authorId))
+            .where(and(eq(prs.id, prId), eq(prs.accountId, accountId)))
+            .limit(1)
+            .execute(),
+        ctx.db
+            .select({ login: accounts.githubLogin })
+            .from(accounts)
+            .where(eq(accounts.id, accountId))
+            .limit(1)
+            .execute(),
+    ]);
+    const a = author[0]?.login;
+    const b = account[0]?.login;
+    return !!a && !!b && a.toLowerCase() === b.toLowerCase();
+}
+/** One review item's identity ACROSS reviews (refs and finding ids are per review). */
+export function autoFixItemKey(i) {
+    const kind = i.kind === 'earlier_finding' ? 'finding' : i.kind;
+    return [
+        kind,
+        i.threadId ?? '',
+        i.ticketIndex ?? '',
+        i.path ?? '',
+        i.title.trim().replace(/\s+/g, ' ').toLowerCase(),
+    ].join('|');
+}
+const toMs = (v) => v == null ? 0 : v instanceof Date ? v.getTime() : Number(v) * (Number(v) < 1e12 ? 1000 : 1);
+/** One `GET /pulls/{n}`. Never throws (a failed read is "unknown", never "no fix waiting"). */
+async function liveHeadSha(ctx, accountId, prId) {
+    try {
+        const pr = await getFixPrContext(ctx, accountId, prId);
+        if (!pr)
+            return null;
+        return (await ctx.github.fetchPrHeadInfo(accountId, pr.owner, pr.name, pr.number)).headSha ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+const defaultDeps = { startReviewFix, loadReviewSeed, isFixRunning, liveHeadSha };
+/**
+ * Called once per SUCCEEDED auto review (manager.ts). Returns what it did; never throws.
+ */
+export async function maybeStartAutoFix(ctx, input, deps = defaultDeps, nowMs = Date.now()) {
+    const { accountId, prId, reviewId } = input;
+    const skip = (reason) => {
+        const outcome = { reviewId, status: 'skipped', reason };
+        record(accountId, outcome);
+        ctx.log.info(`auto fix pr ${prId} (review ${reviewId}) skipped: ${reason}`);
+        return outcome;
+    };
+    try {
+        if (!(await prAuthorIsAccount(ctx, accountId, prId)))
+            return { status: 'not_own' };
+        const loaded = await deps.loadReviewSeed(ctx, { accountId, prId, reviewId });
+        if (!loaded)
+            return skip('not_started');
+        if (loaded.seed.sentRefs.length === 0)
+            return skip('nothing_to_fix');
+        const { pullRequests: prs, aiFixes: af } = ctx.schema;
+        const prRow = (await ctx.db
+            .select({ headSha: prs.headSha })
+            .from(prs)
+            .where(and(eq(prs.id, prId), eq(prs.accountId, accountId)))
+            .limit(1)
+            .execute())[0];
+        const head = prRow?.headSha ?? null;
+        if (head && head !== loaded.review.headSha)
+            return skip('head_moved');
+        // The manager's in-memory claim is the authority (a queued/running ROW it no longer holds is an
+        // orphan the next boot reconciles).
+        if (deps.isFixRunning(prId))
+            return skip('fix_in_progress');
+        const fixes = (await ctx.db
+            .select({
+            id: af.id,
+            status: af.status,
+            baseSha: af.baseSha,
+            patch: af.patch,
+            pushedAt: af.pushedAt,
+            trigger: af.trigger,
+            createdAt: af.createdAt,
+            reviewItems: af.reviewItems,
+            changeReport: af.changeReport,
+        })
+            .from(af)
+            .where(and(eq(af.accountId, accountId), eq(af.prId, prId)))
+            .orderBy(desc(af.id))
+            .execute());
+        // "Nobody has pushed since": the fix was built on the head the PR still has. The SYNCED head
+        // can lag (or be unsynced) while the fixer builds on the LIVE head, so the reviewed head counts
+        // too, and the live head is asked for — once, only when an unpushed fix sits on neither.
+        const heads = new Set();
+        if (head)
+            heads.add(head);
+        if (loaded.review.headSha)
+            heads.add(loaded.review.headSha);
+        const atHead = (f) => heads.has(f.baseSha);
+        const waiting = fixes.filter((f) => f.status === 'succeeded' && f.pushedAt == null && (f.patch ?? '').trim() !== '');
+        if (waiting.length > 0 && !waiting.some(atHead) && deps.liveHeadSha) {
+            const live = await deps.liveHeadSha(ctx, accountId, prId);
+            if (live)
+                heads.add(live);
+        }
+        if (waiting.some(atHead))
+            return skip('fix_waiting');
+        const since = nowMs - AUTO_FIX_WINDOW_MS;
+        const recentAuto = fixes.filter((f) => f.trigger === 'auto' && toMs(f.createdAt) >= since);
+        if (recentAuto.length >= AUTO_FIX_DAILY_CAP)
+            return skip('cap');
+        // Rule 6: the latest auto fix at this head said "not addressed" to everything we would send.
+        const lastAutoHere = fixes.find((f) => f.trigger === 'auto' && f.status === 'succeeded' && atHead(f));
+        if (lastAutoHere) {
+            const items = parseReviewItems(lastAutoHere.reviewItems) ?? [];
+            const report = parseChangeReport(lastAutoHere.changeReport);
+            const byRef = new Map(items.map((i) => [i.ref, i]));
+            const refused = new Set((report?.unaddressed ?? []).flatMap((u) => {
+                const i = byRef.get(u.ref);
+                return i ? [autoFixItemKey(i)] : [];
+            }));
+            const sent = new Set(loaded.seed.sentRefs);
+            const now = loaded.seed.items.filter((i) => sent.has(i.ref)).map(autoFixItemKey);
+            if (now.length > 0 && now.every((k) => refused.has(k)))
+                return skip('already_tried');
+        }
+        const model = CLAUDE_REVIEW_MODELS.includes(loaded.review.model)
+            ? loaded.review.model
+            : DEFAULT_AI_FIX_MODEL;
+        const r = await deps.startReviewFix(ctx, { accountId, prId, reviewId, model, trigger: 'auto' });
+        if (r.status === 'queued') {
+            const outcome = { reviewId, status: 'started', fixId: r.fixId };
+            record(accountId, outcome);
+            ctx.log.info(`auto fix pr ${prId} (review ${reviewId}) started: fix ${r.fixId}`);
+            return outcome;
+        }
+        if (r.status === 'nothing_to_fix')
+            return skip('nothing_to_fix');
+        if (r.status === 'already_running')
+            return skip('fix_in_progress');
+        ctx.log.info(`auto fix pr ${prId} (review ${reviewId}) not started: ${r.status}`);
+        return skip('not_started');
+    }
+    catch (err) {
+        ctx.log.warn(`auto fix pr ${prId} (review ${reviewId}) failed to start: ${err instanceof Error ? err.message : String(err)}`);
+        return skip('not_started');
+    }
+}
+//# sourceMappingURL=auto-fix.js.map