limn-review 0.1.123

package/dist/db/blast-radius-query.js

@@ -0,0 +1,36 @@
+import { and, eq } from 'drizzle-orm';
+import { db, schema } from './client.js';
+import { blastSignalsFor } from './blast-radius.js';
+import { hubReadingFor, loadRepoCoupling } from './file-coupling.js';
+// The one-PR blast-radius read, for the Pro `impact` annotation's grounding (ctx.queries
+// .getBlastSignals). Deliberately NOT in queries.ts: that file contains literal NUL bytes around
+// offset 132k, so `rg`/`grep` silently under-report matches in it, and a seam the plugin depends
+// on should be greppable.
+//
+// ⚠ OWNERSHIP-SCOPED, and the scope is on the PR row itself (`pullRequests.accountId`), not a
+// join to repos — an id from a request body reaching a foreign PR here would let a caller spend
+// their own credits describing someone else's diff. A foreign or unknown id resolves to null and
+// the caller 404s, the same rule every id-addressed getter in this app follows.
+export async function getBlastSignalsForPr(accountId, prId) {
+    const { pullRequests } = schema;
+    const rows = await db
+        .select({
+        repoId: pullRequests.repoId,
+        files: pullRequests.files,
+        additions: pullRequests.additions,
+        deletions: pullRequests.deletions,
+        changedFiles: pullRequests.changedFiles,
+    })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.accountId, accountId), eq(pullRequests.id, prId)))
+        .limit(1)
+        .execute();
+    const pr = rows[0];
+    if (!pr)
+        return null;
+    const coupling = await loadRepoCoupling(accountId, [pr.repoId]);
+    // ⚠ null here is the SAME "we never measured this pull request" the chip renders nothing for.
+    // The caller must skip rather than describe a diff nobody measured.
+    return blastSignalsFor(pr, hubReadingFor(pr.files, coupling.get(pr.repoId)));
+}
+//# sourceMappingURL=blast-radius-query.js.map

package/dist/db/blast-radius.js

@@ -0,0 +1,226 @@
+import { codeLocFor, isNonCodeFile, PR_FILES_PAGE_CAP } from './code-loc.js';
+// ============================================================================
+// BLAST RADIUS — how far a pull request can REACH, folded from its stored files
+// ============================================================================
+//
+// The second, ORTHOGONAL reading beside the large-PR flag. Size is a weak proxy for risk: a
+// 2,000-line lockfile bump is trivial and a four-line change to a database migration is not.
+// This module produces the EVIDENCE VECTOR; it never decides a level. The level is decided by
+// exactly one function, `blastRadius()` in the SPA's `lib/ui.ts`, so that changing the
+// sensitivity dial in Settings repaints every surface with no cache invalidation anywhere.
+//
+// ---- WHY THIS IS NOT THE CLAUDE REVIEW ROUTER ------------------------------
+//
+// `decideReviewMode` (packages/pro/src/claude-review/routing.ts) asks a genuinely similar
+// question — "can this be reviewed from the diff alone?" — and its SHAPE is the ancestor of the
+// arms below (file / line / directory / subsystem ceilings, a contract-touch signal,
+// `allFilesNew`). It cannot be CALLED here, for three structural reasons:
+//
+//   1. It runs on the DIFF BODY — `analyzeDiff` over the noise-stripped unified diff that
+//      `review/prepare.ts` fetches through the `gh` CLI. That is a GitHub call per pull request,
+//      and NOTHING ON THE PENDING BOARD MAY FETCH ON MOUNT (fifty cards would be ~150 calls to
+//      paint a screen). This module reads columns that are already on the row.
+//   2. Claude Review is LOCAL-ONLY and force-disabled in cloud. Blast radius works in both modes.
+//   3. Its gate is deliberately OVER-conservative — any ambiguity routes to `worktree` — because
+//      over-routing there only costs money. Over-routing HERE marks everything `high` and the
+//      feature stops meaning anything.
+//
+// ⚠ FOR THE SAME REASONS IT MUST NOT IMPORT `NOISE_GLOBS` OR `API_PATH_PATTERNS`. Both live in
+// `review/prepare.ts` and both are tuned for a paid agent's diff budget, where over-matching is
+// SAFE. Over-matching here is a false claim on screen. Editing either to suit this feature would
+// silently change what Claude Review reviews, with no test to catch it.
+//
+// ---- THE FOUR PATH CLASSIFIERS, AND WHY NONE MAY BE FOLDED INTO ANOTHER -----
+//
+// `db/code-loc.ts` documents the first three. This is the fourth, and the same rule applies:
+// they answer four different questions and are NOT meant to agree.
+//
+//   1. `NOISE_GLOBS`   (review/prepare.ts)  — "strip this from the diff the paid AGENT reads?"
+//   2. `isLockFile`    (frontend lib/diff)  — "start this file's diff COLLAPSED?"
+//   3. `isNonCodeFile` (db/code-loc.ts)     — "does this churn count as CODE a human must read?"
+//   4. `BLAST_SURFACES` + `isTestFile` (HERE) — "do this file's CONSUMERS LIVE OUTSIDE THE DIFF?"
+//
+// Number 4 is the only one asking about REACH rather than volume or presentation, which is why
+// it is a list of contract shapes rather than a list of things to ignore. It sits ON TOP of
+// number 3: `isNonCodeFile` is reused verbatim to split code from prose/config, and this file
+// adds only the two judgements code-loc has no opinion about — is it a test, and is it a
+// contract.
+//
+// ---- CALIBRATION -----------------------------------------------------------
+//
+// Measured over 1,405 open pull requests with a usable measurement, across 22 real repositories:
+// low 34.3% / medium 35.1% / high 29.7% / unknown 0.8%. Arm fire counts: dirs 230, hub 174,
+// files 165, lines 160, subsystems 57 — none redundant. Surface frequency: deps 222, schema 55,
+// ci 43, dts 2, migration 2, sql 2. That last row is why `deps` and `ci` are carried but are NOT
+// high arms (see `BlastSurface` in packages/shared for each one's argument), and why migrations
+// and IDL are rare-but-decisive rather than common.
+/** Path shapes whose consumers live OUTSIDE the diff. Ordered most-consequential first; the
+ *  emitted `surfaces[]` preserves this order so a rendered list needs no client-side sort.
+ *
+ *  ⚠ Matched CASE-INSENSITIVELY on the normalised path, like `isNonCodeFile` and unlike the
+ *  agent's `NOISE_GLOBS` — a `Migrations/` directory is still a migrations directory. */
+const BLAST_SURFACES = [
+    // A migrations directory. The one change on this list that is genuinely hard to undo.
+    ['db_migration', /(^|\/)migrations?\//],
+    // A schema or models tree, or a `schema.*` module. ⚠ THE KNOWN FALSE-POSITIVE SHAPE: in a repo
+    // whose PRODUCT is an ORM, its own `src/**/schema/**` source tree trips a rule that means
+    // "this pull request changes the database". Measured: 55 hits, almost all one such repo. That
+    // is what `surfacesOff` in the account's config exists to switch off, and it is why the chip
+    // always NAMES the surface rather than asserting a bare level.
+    ['db_schema', /(^|\/)(schema|schemas|models)\/|(^|\/)schemas?\.[a-z0-9]+$/],
+    ['sql', /\.sql$/],
+    ['public_types', /\.d\.ts$/],
+    ['idl', /\.(proto|thrift|graphql|gql)$/],
+    ['openapi', /(^|\/)(openapi|swagger)[^/]*\.(ya?ml|json)$/],
+    ['infra', /\.(tf|tfvars)$|(^|\/)(helm|charts|k8s|kubernetes)\//],
+    ['auth', /(^|\/)(auth|authz|authn|security|permissions?|acl|crypto)\//],
+    // MEDIUM, never high — see the BlastSurface doc.
+    ['ci', /(^|\/)\.github\/workflows\//],
+    // Narration only, never an arm — see the BlastSurface doc.
+    [
+        'deps',
+        /(^|\/)(package\.json|requirements\.txt|go\.mod|go\.sum|cargo\.toml|gemfile|pyproject\.toml|build\.gradle|pom\.xml|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|poetry\.lock|composer\.json)$/,
+    ],
+];
+function normalize(path) {
+    let p = path.replace(/\\/g, '/');
+    if (p.startsWith('./'))
+        p = p.slice(2);
+    if (p.startsWith('/'))
+        p = p.slice(1);
+    return p.toLowerCase();
+}
+/**
+ * Is this path a TEST?
+ *
+ * Tests are code — `isNonCodeFile` correctly counts them, because a reviewer does read them —
+ * but they are code whose blast radius is bounded by construction: a broken test fails CI rather
+ * than production. So they are counted APART, and "every code file here is a test" is one of the
+ * two ways a pull request earns `low`.
+ *
+ * ⚠ Deliberately does NOT match a bare `test`/`tests` BASENAME, only a directory segment or a
+ * conventional suffix. `scripts/test` is an executable and `test.go` in a package root is
+ * ambiguous enough to leave counted — the same "directory segments only" trap `isNonCodeFile`
+ * documents, where treating a basename as a directory silently uncounts a hand-written file.
+ */
+export function isTestFile(path) {
+    const p = normalize(path);
+    if (/(^|\/)(tests?|__tests__|specs?|e2e|testing)\//.test(p))
+        return true;
+    if (/\.(test|spec)\.[a-z0-9]+$/.test(p))
+        return true;
+    if (/_test\.[a-z0-9]+$/.test(p))
+        return true;
+    if (/(^|\/)test_[^/]+\.py$/.test(p))
+        return true;
+    return false;
+}
+/** The contract surfaces this path matches, if any. Exported for the fixture tests. */
+export function surfacesForPath(path) {
+    const p = normalize(path);
+    const out = [];
+    for (const [surface, re] of BLAST_SURFACES)
+        if (re.test(p))
+            out.push(surface);
+    return out;
+}
+function dirOf(path) {
+    const i = path.lastIndexOf('/');
+    return i === -1 ? '.' : path.slice(0, i);
+}
+function subsystemOf(path) {
+    const i = path.indexOf('/');
+    return i === -1 ? path : path.slice(0, i);
+}
+/**
+ * The change shape, but only when it still describes the CURRENT head.
+ *
+ * ⚠ RETURNS null ON ANY MISMATCH OR ABSENCE, and null never demotes anything. Three separate
+ * things land here and all three are the same answer: never classified, classified at a head
+ * that has since moved, or classified with no sha recorded at all.
+ */
+function contentKindFor(pr) {
+    if (pr.contentKind == null)
+        return null;
+    if (pr.contentKindSha == null || pr.headSha == null)
+        return null;
+    return pr.contentKindSha === pr.headSha ? pr.contentKind : null;
+}
+/**
+ * Fold one stored pull-request row into its blast-radius signal vector.
+ *
+ * Returns `null` for every UNKNOWN — and it does not re-derive what "unknown" means, it calls
+ * `codeLocFor` and inherits all four of its data traps (`files IS NULL` at 18.5% of the corpus,
+ * a never-observed size at 18.8%, the overloaded `files = []` sentinel, and the page cap). One
+ * definition of "we did not measure this pull request", used by both features.
+ *
+ * ⚠ `null` IS NOT "low". Roughly a tenth of open pull requests land here and every surface must
+ * render nothing for them — a reader who can tell an unmeasured pull request from a small one is
+ * reading a claim we did not make.
+ */
+export function blastSignalsFor(pr, hub) {
+    const { codeLoc, codeLocIsLowerBound } = codeLocFor(pr);
+    // Unknown size or no per-file breakdown → nothing honest to say about reach either.
+    if (codeLoc == null)
+        return null;
+    const files = pr.files ?? [];
+    let testFiles = 0;
+    let nonCodeFiles = 0;
+    let allNew = true;
+    const codePaths = [];
+    const surfaces = new Set();
+    for (const f of files) {
+        if (typeof f?.path !== 'string')
+            continue;
+        // ⚠ SURFACES ARE COLLECTED OVER EVERY FILE, code or not. An OpenAPI document and a Terraform
+        // plan are `isNonCodeFile` (structured config, correctly excluded from the LINE count) and
+        // are exactly the contracts this feature exists to catch. Restricting the scan to code files
+        // would make `openapi` and half of `infra` unreachable.
+        for (const s of surfacesForPath(f.path))
+            surfaces.add(s);
+        if (isNonCodeFile(f.path)) {
+            nonCodeFiles += 1;
+            continue;
+        }
+        if (isTestFile(f.path)) {
+            testFiles += 1;
+            continue;
+        }
+        codePaths.push(normalize(f.path));
+        // A file with no additions and no deletions is a pure rename/mode change; it cannot be the
+        // reason a PR is "all new", so it does not vote either way.
+        if (f.deletions > 0)
+            allNew = false;
+    }
+    // ⚠ `allNew` is only meaningful when there IS code. An empty code list would otherwise report
+    // `true` and claim "nothing existing can break" about a pull request with nothing in it.
+    if (codePaths.length === 0)
+        allNew = false;
+    return {
+        codeFiles: codePaths.length,
+        testFiles,
+        nonCodeFiles,
+        dirs: new Set(codePaths.map(dirOf)).size,
+        subsystems: new Set(codePaths.map(subsystemOf)).size,
+        // Emitted in BLAST_SURFACES order (most-consequential first) rather than insertion order, so
+        // the chip's sentence leads with the migration and not with whichever file GitHub listed first.
+        surfaces: BLAST_SURFACES.map(([s]) => s).filter((s) => surfaces.has(s)),
+        allNew,
+        hubDegree: hub?.degree ?? null,
+        hubBar: hub?.bar ?? null,
+        hubPath: hub?.path ?? null,
+        // The same fact `codeLocIsLowerBound` reports, re-stated for the reach vector because it
+        // governs a DIFFERENT rule here: over there it forbids asserting "small", here it forbids
+        // asserting "low". Both come from the one page-cap test in `codeLocFor`.
+        truncated: codeLocIsLowerBound,
+        // ⚠ THE STALENESS TEST LIVES HERE, ONCE. A diff read is only true of the commit it read, so a
+        // verdict stored against an older head describes code that may no longer be there — and a
+        // stale "comments only" would keep a level capped after a force-push added a schema change.
+        // Every surface reads the fold, so no surface has to remember this comparison.
+        contentKind: contentKindFor(pr),
+    };
+}
+/** Re-exported so a caller folding both features reads one import. The page cap is the single
+ *  fact behind `codeLocIsLowerBound` and `BlastSignals.truncated` alike. */
+export { PR_FILES_PAGE_CAP };
+//# sourceMappingURL=blast-radius.js.map

package/dist/db/bot-dormancy.js

@@ -0,0 +1,115 @@
+// ── "Is this bot dormant?" — ONE predicate, ONE window, CORE ─────────────────────────────────
+//
+// The Bots → ROI table has always been able to say a reviewer is DORMANT: it is still classified,
+// still (perhaps) paid for, and it did nothing inside the window being read. Two OTHER surfaces —
+// the Bots → Benchmark tab and the Bot Tuning Advisor — used to keep rendering those reviewers, so
+// one screen said "dormant" while the next two placed the same bot against a peer cohort and
+// offered tuning advice for it. This module is the one fact both of those surfaces now hide on.
+//
+// ⚠ THE WINDOW IS FIXED AT 30 DAYS AND MUST STAY FIXED. The three surfaces disagreed about time
+// before this existed: ROI defaults to a trailing 14 days that the USER FLIPS with a chip, the
+// Advisor is pinned to `rolling_30`, and the benchmark fold has no time window at all. Adopting the
+// ROI chip's value would make a workspace's peer placement appear and disappear because somebody
+// flipped a selector on a different tab — a fact about a bot must not be a function of another
+// screen's view state. 30 days is the Advisor's existing pin, so no surface changed its own window
+// to gain this gate.
+//
+// ⚠ CONSEQUENCE, STATED RATHER THAN HIDDEN: a bot with nothing in the last 14 days but something in
+// the last 30 reads "dormant" on the ROI table (relative to the view) and still appears on the
+// Benchmark and the Advisor (it is not dormant as a fact). That is deliberate. The ROI table's
+// window chip and its "widen the window to see them counted" affordance are about the CURRENT VIEW;
+// this predicate is about the BOT.
+//
+// ⚠ THE GRAIN IS THE WORKSPACE, NEVER A REPO. The Advisor cannot narrow by repository at all (the
+// SPA sends only `?workspace=`), and a `?repoIds=`-narrowed benchmark request deliberately builds no
+// rollup — so a repo-grained gate has nowhere to land on two of the three surfaces. The repository
+// set below is therefore the workspace's MEMBERSHIP and never a caller's `repoIds` narrowing, the
+// same rule `workspaceHumanSeatCount` follows for the same reason: the answer must not shrink
+// because a reader filtered a chart.
+//
+// ⚠ THE EVIDENCE IS EXACTLY THE ROI TABLE'S, DELIBERATELY. `getBotAnalytics` calls a reviewer
+// dormant when it has NO window activity, where activity is: a review THREAD it opened, a review
+// COMMENT it left, or a submitted REVIEW (body-only "nothing to flag" passes included — that is a
+// bot doing its job and saying so). Three tables, unioned. The Advisor's own emission gate is
+// narrower (threads-or-ML-labels), so a bot can already be absent from the Advisor while ROI calls
+// it live; widening THIS predicate to match the Advisor instead would hide bots the ROI table shows
+// as working, which is the opposite of what a reader asked for. The union is the safe direction:
+// any observed work at all keeps a reviewer visible.
+//
+// The predicate is CORE because both consumers must not be able to disagree: the Advisor filter
+// lives in `getAdvisorFindings` (`db/queries.ts`), and the benchmark reaches this through the
+// OPTIONAL `ProHostQueries.dormantBotUserIds` seam (apiVersion stays 21 — the `getWorkPlan` /
+// `workspaceHumanSeatCount` precedent; an older host simply hides nothing).
+//
+// ⚠ IT DELIBERATELY IMPORTS NOTHING FROM `queries.ts`. That file imports this one (the Advisor
+// filter lives inside `getAdvisorFindings`), and a cycle between the two would be a hazard nobody
+// wants in the app's largest module. The membership read below is the two lines of
+// `getWorkspaceRepoIds` this needs, minus the render ordering a set does not care about; the
+// candidate ids are the CALLER's, which is also what stops this module owning a second opinion
+// about who is a bot.
+import { and, eq, gte, inArray, ne } from 'drizzle-orm';
+import { db, schema } from './client.js';
+/** The ONE dormancy window, in days. See the header: fixed on purpose, and equal to the Advisor's
+ *  existing `rolling_30` pin so no surface moved its own window to gain this gate. */
+export const DORMANCY_WINDOW_DAYS = 30;
+const { pullRequests, reviewComments, reviewThreads, reviews, workspaceRepos } = schema;
+/**
+ * The automated reviewers that produced NO observable work in this workspace over the fixed
+ * dormancy window.
+ *
+ * `candidateUserIds` IS THE CALLER'S OWN LINEUP and is required: the Advisor passes the automated
+ * set it already resolved, the benchmark passes the review vendors it is about. Nothing here
+ * re-decides who is a bot — a second classifier is how a benchmark ends up disagreeing with the
+ * Timeline about a login. The result is always a SUBSET of the candidates, so a caller can treat it
+ * as a plain "hide these" set.
+ *
+ * ⚠ An empty workspace (no repos) yields NO dormant ids rather than "all of them". Dormancy is a
+ * claim about observed silence, and a workspace whose data we hold none of has observed nothing —
+ * hiding every bot there would be an absence rendered as a judgement.
+ */
+export async function dormantBotUserIds(accountId, workspaceId, candidateUserIds) {
+    const candidates = [...new Set(candidateUserIds)];
+    if (candidates.length === 0)
+        return [];
+    // ⚠ MEMBERSHIP, NOT A NARROWING — see the header. Account-scoped on both columns, so a foreign or
+    // unknown workspace id yields no repos and therefore no dormant ids (never another tenant's).
+    const memberRows = await db
+        .select({ repoId: workspaceRepos.repoId })
+        .from(workspaceRepos)
+        .where(and(eq(workspaceRepos.accountId, accountId), eq(workspaceRepos.workspaceId, workspaceId)))
+        .execute();
+    const repoIds = memberRows.map((r) => r.repoId);
+    if (repoIds.length === 0)
+        return [];
+    const since = new Date(Date.now() - DORMANCY_WINDOW_DAYS * 86_400_000);
+    const repoScope = inArray(pullRequests.repoId, repoIds);
+    const [threadRows, commentRows, reviewRows] = await Promise.all([
+        db
+            .selectDistinct({ userId: reviewThreads.originalCommenterId })
+            .from(reviewThreads)
+            .innerJoin(pullRequests, eq(pullRequests.id, reviewThreads.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(reviewThreads.originalCommenterId, candidates), gte(reviewThreads.createdAt, since), repoScope))
+            .execute(),
+        db
+            .selectDistinct({ userId: reviewComments.authorId })
+            .from(reviewComments)
+            .innerJoin(pullRequests, eq(pullRequests.id, reviewComments.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(reviewComments.authorId, candidates), gte(reviewComments.createdAt, since), repoScope))
+            .execute(),
+        // A body-only review IS activity — the ROI table counts it for exactly this decision, and a
+        // reviewer that reads a PR and says "nothing to flag" is working.
+        db
+            .selectDistinct({ userId: reviews.authorId })
+            .from(reviews)
+            .innerJoin(pullRequests, eq(pullRequests.id, reviews.prId))
+            .where(and(eq(pullRequests.accountId, accountId), inArray(reviews.authorId, candidates), ne(reviews.state, 'pending'), gte(reviews.submittedAt, since), repoScope))
+            .execute(),
+    ]);
+    const active = new Set();
+    for (const rows of [threadRows, commentRows, reviewRows])
+        for (const r of rows)
+            if (r.userId != null)
+                active.add(r.userId);
+    return candidates.filter((id) => !active.has(id));
+}
+//# sourceMappingURL=bot-dormancy.js.map