mergejudge-runner 0.4.0 → 0.4.1

package/README.md

@@ -63,7 +63,7 @@ mergejudge-runner run --concurrency 2 # capped by the concurrency registered wit
 - Network errors, 5xx and 429 back off exponentially with jitter; `Retry-After` is honoured.
 - `SIGINT`/`SIGTERM`: stop polling, give in-flight jobs 30 s to finish, then kill the engine and nack them ("runner shutting down") and exit. A second signal exits immediately.
 - The access token is rotated through `/token/rotate` when it has < 14 days left (or when a response carries an `x-mergejudge-rotate` header). The new token is written to the config file (atomic rename) **before** it is used.
-- Modes: `diff`, `context` and `deep`. **Deep on a runner is a single pass**: the Worker builds a temporary index of the repo (nothing stored, no Cloud AI), looks up callers, importers and imports of the changed code, and sends them as context with the job. The engine still runs with no tools and no checkout, so it cannot browse further. If the repo is too big to index, the review falls back to `context` and says so. Runners older than 0.3.0 do not advertise `deep`, so they are never offered such jobs; upgrade and restart to receive them. With `runner.code_source: local` the runner reads its own clone instead; see below.
+- Modes: `diff`, `context` and `deep`. **Deep on a runner is a single pass**: the Worker builds a temporary index of the repo (nothing stored, no Cloud AI), looks up callers, importers and imports of the changed code (two hops out, hop 1 first), plus files that reference strings, object keys and env var names the diff changed or removed, and sends them as context with the job. The engine still runs with no tools and no checkout, so it cannot browse further. If the repo is too big to index, the review falls back to `context` and says so. Runners older than 0.3.0 do not advertise `deep`, so they are never offered such jobs; upgrade and restart to receive them. With `runner.code_source: local` the runner reads its own clone instead; see below.
 
 ## Local code (deep mode without code leaving your machine) — runner 0.4.0
 
@@ -121,3 +121,9 @@ Logs go to stderr.
 - **Token storage.** The runner token (`mjr_a_...`) is a bearer credential for your installation's review jobs. It lives only in the 0600 config file; it is never logged (logs hold job ids, repo/PR numbers, durations and sizes; a redaction filter masks token shapes as a safety net) and never passed to the engine. Revoke or rotate it in the panel if a machine is lost. The runner follows no redirects, so the token cannot be forwarded to another origin.
 - **What the runner sees.** Job payloads contain the PR diff, title/body, the repo's policy files and (context mode) related files. Nothing is written to disk by the runner except the config file.
 - The `claude` process runs as you. Run the runner under a dedicated OS user if you do not want PR text processed in your main account.
+
+## Changelog
+
+- **0.4.1** (2026-10-16): local-code deep reviews use the new retrieval from MergeJudge #82: two-hop importers/imports and a repo search for changed string literals, keys and env names, within fixed budgets. No config or protocol changes.
+- **0.4.0**: local code source (`runner.code_source: local`).
+- **0.3.0**: deep mode on the runner (single pass, Worker-built context).

package/dist/cli.js

@@ -28065,7 +28065,18 @@ ${c.text}`.slice(0, 1500);
 
 // ../../src/deepretrieve.ts
 var DEEP_RETRIEVE_DEFAULTS = { max_bytes: 8e4, max_files: 60, max_symbols: 8, max_callers: 5, max_file_bytes: 12e3 };
-var MAX_IMPORTERS = 6;
+var DEEP_HOP_DEFAULTS = {
+  max_importers: 6,
+  max_hop2_importers: 6,
+  max_hop2_imports: 4,
+  max_examine: 40,
+  max_literals: 12,
+  max_literal_files: 8,
+  literal_common_files: 25,
+  max_scan_bytes: 8e6,
+  literal_piece_bytes: 6e3,
+  max_ms: 3e3
+};
 function snapshotText(snap, path2) {
   const f = snap.files[path2];
   if (!f) return null;
@@ -28084,8 +28095,109 @@ function snapshotSource(snap) {
     searchSymbol: async (sym) => [...new Set(findReferences(snap, sym, 80).map((h) => h.path))]
   };
 }
+var baseName = (p) => p.replace(/\.[^./]+$/, "").split("/").pop();
+var escapeRe2 = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var wholeToken = (lit) => new RegExp(`(?<![\\w$])${escapeRe2(lit)}(?![\\w$])`);
+var COMMON_LITERALS = /* @__PURE__ */ new Set([
+  "use strict",
+  "utf8",
+  "utf-8",
+  "string",
+  "number",
+  "object",
+  "boolean",
+  "function",
+  "undefined",
+  "default",
+  "error",
+  "data",
+  "json",
+  "true",
+  "false",
+  "null",
+  "none",
+  "type",
+  "name",
+  "value",
+  "values",
+  "test",
+  "index",
+  "main",
+  "node",
+  "content-type",
+  "application/json",
+  "text/plain",
+  "text/html",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "message",
+  "status",
+  "result",
+  "results",
+  "items",
+  "length",
+  "key",
+  "keys",
+  "path",
+  "file",
+  "text",
+  "info",
+  "warn",
+  "debug",
+  "require",
+  "exports",
+  "module",
+  "string",
+  "return",
+  "async",
+  "await",
+  "const",
+  "this",
+  "self",
+  "class"
+]);
+function distinct(t) {
+  let sc = Math.min(t.length, 24) / 4;
+  if (/[._:/-]/.test(t)) sc += 3;
+  if (/[a-z][A-Z]/.test(t) || /^[A-Z0-9_]{4,}$/.test(t)) sc += 2;
+  if (/\d/.test(t)) sc += 1;
+  return sc;
+}
+function patchLiterals(patch, max = DEEP_HOP_DEFAULTS.max_literals) {
+  if (!patch) return [];
+  const seen = /* @__PURE__ */ new Map();
+  const note = (text, kind, removed) => {
+    if (text.length < 3 || text.length > 80 || /\s/.test(text) || COMMON_LITERALS.has(text) || /^[\d._-]+$/.test(text)) return;
+    if (/^[./]|^@[\w-]+\/|^node:/.test(text)) return;
+    const e = seen.get(text) ?? { removed: false, added: false, kind };
+    if (removed) e.removed = true;
+    else e.added = true;
+    if (kind === "env") e.kind = "env";
+    seen.set(text, e);
+  };
+  for (const line of patch.split("\n")) {
+    if (!/^[+-]/.test(line) || /^(\+\+\+|---)/.test(line) || line.length > 600) continue;
+    const removed = line[0] === "-";
+    const l = line.slice(1);
+    if (/^\s*(?:import\b|export\s[^'"]*\sfrom\b|from\s+\S+\s+import\b)|\brequire\s*\(/.test(l)) continue;
+    for (const m of l.matchAll(/process\.env\.([A-Za-z_]\w*)|import\.meta\.env\.([A-Za-z_]\w*)|\benv\.([A-Z_][A-Z0-9_]*)|(?:process\.env|os\.environ|env)\[\s*['"]([A-Za-z_]\w*)['"]\s*\]|os\.(?:getenv|environ\.get)\(\s*['"]([A-Za-z_]\w*)['"]/g))
+      note(m[1] ?? m[2] ?? m[3] ?? m[4] ?? m[5], "env", removed);
+    for (const m of l.matchAll(/(["'`])((?:\\.|(?!\1)[^\\$])*?)\1/g)) note(m[2], "string", removed);
+    for (const m of l.matchAll(/(?:^|[{,(])\s*["']?([A-Za-z_$][\w$-]{4,})["']?\s*:(?!:)/g)) note(m[1], "key", removed);
+    for (const m of l.matchAll(/\.([a-z][\w$]*[A-Z][\w$]*)\b/g)) note(m[1], "key", removed);
+  }
+  const out = [...seen].map(([text, e]) => ({ text, kind: e.kind, side: e.removed && e.added ? "both" : e.removed ? "removed" : "added" }));
+  const rank = (x) => (x.side === "removed" ? 4 : x.side === "added" ? 2 : 0) + (x.kind === "env" ? 3 : 0) + distinct(x.text);
+  return out.sort((a, b) => rank(b) - rank(a) || (a.text < b.text ? -1 : 1)).slice(0, max);
+}
 async function retrieveDeepContext(snap, files, opts = {}, log = () => {
 }) {
+  const t0 = Date.now();
+  const { max_importers, max_hop2_importers, max_hop2_imports, max_examine, max_literals, max_literal_files, literal_common_files, max_scan_bytes, literal_piece_bytes, max_ms } = { ...DEEP_HOP_DEFAULTS, ...opts };
   const o = { ...DEEP_RETRIEVE_DEFAULTS, ...opts };
   const src = snapshotSource(snap);
   const g = await gatherContext(files, src, o, log);
@@ -28093,26 +28205,138 @@ async function retrieveDeepContext(snap, files, opts = {}, log = () => {
   let bytes = g.bytes;
   const seen = /* @__PURE__ */ new Set([...pieces.map((p) => p.path), ...files.map((f) => f.path)]);
   const symbols = [...new Set(files.flatMap((f) => changedSymbols(f.patch)))];
-  let added = 0;
+  const timeUp = () => Date.now() - t0 > max_ms;
+  const full = () => o.max_bytes - bytes < 512 || pieces.length >= o.max_files;
+  const stats = { hop1: 0, literal: 0, hop2: 0, scanned: 0, timedOut: false };
+  const addPiece = (path2, text, kind, why, re, cap0 = o.max_file_bytes) => {
+    const cap = Math.min(o.max_bytes - bytes, cap0);
+    const truncated = text.length > cap;
+    const lines = text.split("\n");
+    const hit = re ? lines.flatMap((l, i) => re.test(l) ? [[i + 1, i + 1]] : []) : [];
+    const content = truncated ? excerpt(text, hit.length ? hit : [[1, 40]], cap) : text;
+    pieces.push({ path: path2, kind, why: why + (truncated ? ", excerpt around relevant lines" : ""), content, truncated });
+    bytes += content.length;
+    seen.add(path2);
+    return true;
+  };
+  const symRe = (names) => new RegExp(names.map((n) => escapeRe2(n)).join("|"));
+  const rankCandidates = (cands, needles) => {
+    const out = [];
+    const uniq = [...new Set(cands)].filter((c) => !seen.has(c) && !o.skip?.(c) && !isSensitivePath(c)).sort();
+    const re = needles.length ? symRe(needles) : null;
+    for (const c of uniq.slice(0, max_examine)) {
+      if (timeUp()) {
+        stats.timedOut = true;
+        break;
+      }
+      const text = snapshotText(snap, c);
+      if (text !== null) out.push({ path: c, text, rel: re ? re.test(text) : false });
+    }
+    return out.sort((a, b) => Number(b.rel) - Number(a.rel));
+  };
+  const hop1 = g.pieces.filter((x) => x.kind === "caller").map((x) => ({
+    path: x.path,
+    via: files.find((f) => importersOf(snap, f.path).includes(x.path))?.path ?? files[0]?.path ?? "a changed file"
+  }));
   for (const f of files) {
-    if (f.status === "removed") continue;
-    for (const imp of importersOf(snap, f.path)) {
-      if (added >= MAX_IMPORTERS || seen.has(imp) || o.skip?.(imp)) continue;
-      const text = snapshotText(snap, imp);
-      if (text === null) continue;
-      const room = o.max_bytes - bytes;
-      if (room < 512) return { pieces, bytes };
-      const hit = text.split("\n").flatMap((l, i) => l.includes(f.path.replace(/\.[^./]+$/, "").split("/").pop()) || symbols.some((s) => l.includes(s)) ? [[i + 1, i + 1]] : []);
-      const cap = Math.min(room, o.max_file_bytes);
-      const truncated = text.length > cap;
-      const content = truncated ? excerpt(text, hit.length ? hit : [[1, 40]], cap) : text;
-      pieces.push({ path: imp, kind: "caller", why: `imports ${f.path}${truncated ? ", excerpt around relevant lines" : ""}`, content, truncated });
-      bytes += content.length;
-      seen.add(imp);
-      added++;
-    }
-  }
-  log(`deep: ${pieces.length} piece(s), ${bytes} bytes retrieved from the index`);
+    if (f.status === "removed" || full() || timeUp()) continue;
+    const needles = [baseName(f.path), ...symbols];
+    for (const c of rankCandidates(importersOf(snap, f.path), needles)) {
+      if (stats.hop1 >= max_importers || full() || seen.has(c.path)) continue;
+      addPiece(c.path, c.text, "caller", `imports ${f.path}`, symRe(needles));
+      hop1.push({ path: c.path, via: f.path });
+      stats.hop1++;
+    }
+  }
+  if (!full() && !timeUp() && max_literals > 0 && max_literal_files > 0) {
+    const lits = /* @__PURE__ */ new Map();
+    for (const f of files) for (const l of patchLiterals(f.patch, max_literals)) {
+      const e = lits.get(l.text);
+      if (e) {
+        e.from.push(f.path);
+        if (e.side !== l.side) e.side = "both";
+      } else lits.set(l.text, { ...l, from: [f.path] });
+    }
+    const list = [...lits.values()].slice(0, max_literals);
+    if (list.length) {
+      const changed = new Set(files.map((f) => f.path));
+      const res = list.map((l) => wholeToken(l.text));
+      const hits = list.map(() => /* @__PURE__ */ new Map());
+      const common = list.map(() => false);
+      let scanned = 0;
+      scan: for (const [path2, fe] of Object.entries(snap.files)) {
+        if (changed.has(path2) || o.skip?.(path2) || isSensitivePath(path2)) continue;
+        if (timeUp()) {
+          stats.timedOut = true;
+          break;
+        }
+        for (const c of fe.chunks) {
+          scanned += c.text.length;
+          if (scanned > max_scan_bytes) break scan;
+          for (let i = 0; i < list.length; i++) {
+            if (common[i] || !c.text.includes(list[i].text) || !res[i].test(c.text)) continue;
+            const m = hits[i];
+            if (!m.has(path2) && m.size >= literal_common_files) {
+              common[i] = true;
+              m.clear();
+              continue;
+            }
+            const lines = m.get(path2) ?? [];
+            c.text.split("\n").forEach((l, j) => {
+              if (l.includes(list[i].text) && res[i].test(l)) lines.push(c.start + j);
+            });
+            m.set(path2, lines);
+          }
+        }
+      }
+      stats.scanned = scanned;
+      const byFile = /* @__PURE__ */ new Map();
+      list.forEach((l, i) => {
+        for (const [path2, lines] of hits[i]) {
+          const e = byFile.get(path2) ?? { score: 0, lits: [], lines: [] };
+          e.score += (l.side === "removed" ? 3 : l.side === "both" ? 1 : 2) + distinct(l.text) / 10;
+          e.lits.push(i);
+          e.lines.push(...lines);
+          byFile.set(path2, e);
+        }
+      });
+      const near = new Set(hop1.map((h) => h.path));
+      const ranked = [...byFile].filter(([p]) => !seen.has(p)).sort((a, b) => b[1].score - a[1].score || Number(near.has(b[0])) - Number(near.has(a[0])) || (a[0] < b[0] ? -1 : 1));
+      for (const [path2, e] of ranked) {
+        if (stats.literal >= max_literal_files || full()) break;
+        const text = snapshotText(snap, path2);
+        if (text === null) continue;
+        const names = e.lits.slice(0, 3).map((i) => `${JSON.stringify(list[i].text)} (${list[i].side === "removed" ? "removed" : list[i].side === "added" ? "added" : "changed"} in ${list[i].from[0]})`);
+        const re = symRe(e.lits.map((i) => list[i].text));
+        addPiece(path2, text, "caller", `references literal ${names.join(", ")} changed in this PR; may depend on the old or new value`, re, literal_piece_bytes);
+        stats.literal++;
+      }
+    }
+  }
+  if (!full() && !timeUp() && (max_hop2_importers > 0 || max_hop2_imports > 0)) {
+    for (const h of hop1) {
+      if (stats.hop2 >= max_hop2_importers || full()) break;
+      const needles = [baseName(h.path), ...symbols];
+      for (const c of rankCandidates(importersOf(snap, h.path), needles)) {
+        if (stats.hop2 >= max_hop2_importers || full()) break;
+        addPiece(c.path, c.text, "caller", `imports ${h.path}, which imports ${h.via} (2 hops from the changed file)`, symRe(needles));
+        stats.hop2++;
+      }
+    }
+    let imp2 = 0;
+    const pathSet = new Set(Object.keys(snap.files));
+    for (const p of g.pieces.filter((x) => x.kind === "import")) {
+      if (imp2 >= max_hop2_imports || full() || timeUp()) break;
+      const targets = (snap.files[p.path]?.imports ?? []).map((spec) => resolveImport(p.path, spec, pathSet)).filter((t) => !!t);
+      for (const c of rankCandidates(targets, symbols)) {
+        if (imp2 >= max_hop2_imports || full()) break;
+        addPiece(c.path, c.text, "import", `imported by ${p.path}, which a changed file imports (2 hops)`, symbols.length ? symRe(symbols) : null);
+        imp2++;
+        stats.hop2++;
+      }
+    }
+  }
+  log(`deep: ${pieces.length} piece(s), ${bytes} bytes retrieved from the index (hop1 importers ${stats.hop1}, literal refs ${stats.literal}, hop2 ${stats.hop2}, ${stats.scanned} bytes scanned, ${Date.now() - t0} ms${stats.timedOut ? ", time budget hit" : ""})`);
   return { pieces, bytes };
 }
 
@@ -30172,13 +30396,14 @@ function scanSecrets(patch, path2 = "") {
 function findSecrets(patch, path2 = "") {
   return scanSecrets(patch, path2).blocked;
 }
-var CODE_AUTO_NEVER_GLOBS = [".github/**", "**/.env*"];
+var CODE_AUTO_NEVER_GLOBS = [".github/**", "**/.env*", "_headers", "**/_headers"];
+var ALWAYS_REVIEW_GLOBS = ["_headers", "**/_headers"];
 var CODE_AUTO_NEVER_EXT = /* @__PURE__ */ new Set(["sql", "sh", "bash", "zsh", "ps1", "wasm"]);
 function codeAutoBlocker(file2, paths, changed, ca) {
   if (file2.status === "removed" || file2.status === "renamed" || file2.previousPath) return "code file deleted or renamed (needs human review)";
   if (file2.status !== "added" && file2.status !== "modified") return `code file with status ${file2.status} (needs human review)`;
   if (paths.some((p) => matchesAny(p, CODE_AUTO_NEVER_GLOBS) || CODE_AUTO_NEVER_EXT.has(p.split(".").pop().toLowerCase())))
-    return "code file type never eligible for lanes.code_auto (CI, env, shell, SQL, wasm)";
+    return "code file type never eligible for lanes.code_auto (CI, env, headers, shell, SQL, wasm)";
   if (ca.paths.length && !matchesAny(file2.path, ca.paths)) return "code file outside lanes.code_auto.paths";
   if (changed > ca.max_lines) return `code file with ${changed} changed lines (lanes.code_auto.max_lines ${ca.max_lines})`;
   return void 0;
@@ -30199,6 +30424,7 @@ function classifyFileInner(file2, cfg) {
   const secrets = findSecrets(file2.patch, file2.path);
   if (secrets.length) raise("block", `possible secret in added lines (${secrets.join(", ")})`);
   if (paths.some((p) => matchesAny(p, cfg.lanes.protected))) raise("review", "protected path");
+  else if (paths.some((p) => matchesAny(p, ALWAYS_REVIEW_GLOBS))) raise("review", "protected path (hosting headers file)");
   const ca = cfg.lanes.code_auto;
   const codeCandidate = !!ca?.enabled && paths.some(isCodeFile);
   if (!codeCandidate && paths.some(isCodeFile)) raise("review", "code file (always needs human review)");
@@ -32284,7 +32510,7 @@ function installAutostart(d, bundle) {
 }
 
 // src/version.ts
-var VERSION = "0.4.0";
+var VERSION = "0.4.1";
 var MODES = ["diff", "context", "deep"];
 var FEATURES = ["local-code"];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergejudge-runner",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "license": "MIT",
   "type": "module",
   "description": "Run MergeJudge reviews on your own machine with your own Claude Code login (runner protocol /runner/v1)",