secondpair 0.1.0

package/dist/github/comments.js

@@ -0,0 +1,193 @@
+import { collectIdsFromBodies, embedFindingId, parseFindingId } from "../finding-id.js";
+import { collectWontFixIds } from "../suppress-signals.js";
+export const AGENT_MARKER = "<!-- secondpair -->";
+export const SEVERITY_EMOJI = {
+    critical: "🟥",
+    high: "🔴",
+    medium: "🟡",
+    low: "🔵",
+    info: "⚪",
+};
+export function formatCommentBody(f) {
+    const parts = [
+        `${SEVERITY_EMOJI[f.severity]} **${f.severity.toUpperCase()}** · \`${f.category}\` · confidence ${Math.round(f.confidence * 100)}%`,
+        "",
+        `**${f.title}**`,
+        "",
+        f.body.trim(),
+    ];
+    if (f.suggestion) {
+        parts.push("", "```suggestion", f.suggestion.replace(/\n$/, ""), "```");
+    }
+    parts.push("", AGENT_MARKER);
+    let body = parts.join("\n");
+    if (f.id)
+        body = embedFindingId(body, f.id);
+    return body;
+}
+export function formatReviewBody(result, failed) {
+    const counts = countBySeverity(result.findings);
+    const countLine = result.findings.length === 0
+        ? "No findings."
+        : Object.entries(counts)
+            .map(([sev, n]) => `${SEVERITY_EMOJI[sev]} ${n} ${sev}`)
+            .join(" · ");
+    const recon = result.reconciliation;
+    const reconLine = recon
+        ? `\n_Lifecycle:_ ${recon.new.length} new · ${recon.persistent.length} persistent · ${recon.resolved.length} resolved · ${recon.suppressed.length} suppressed`
+        : "";
+    return [
+        `## PR Review Agent`,
+        "",
+        result.summary.trim(),
+        "",
+        countLine,
+        reconLine,
+        failed ? "\n❌ **Check failed**: findings at or above the configured severity threshold." : "",
+        AGENT_MARKER,
+    ].join("\n");
+}
+function countBySeverity(findings) {
+    const counts = {};
+    for (const f of findings)
+        counts[f.severity] = (counts[f.severity] ?? 0) + 1;
+    return counts;
+}
+/** Collect finding ids already posted on this PR by the agent. */
+export async function listPostedFindingIds(octokit, pr) {
+    const existing = await octokit.paginate(octokit.pulls.listReviewComments, {
+        ...pr,
+        per_page: 100,
+    });
+    return collectIdsFromBodies(existing.filter((c) => c.body.includes(AGENT_MARKER)).map((c) => c.body));
+}
+export async function listWontFixFindingIds(octokit, pr) {
+    const comments = await octokit.paginate(octokit.pulls.listReviewComments, {
+        ...pr,
+        per_page: 100,
+    });
+    const byId = new Map(comments.map((comment) => [comment.id, comment]));
+    return collectWontFixIds(comments.map((comment) => {
+        const parent = comment.in_reply_to_id
+            ? byId.get(comment.in_reply_to_id)
+            : undefined;
+        return {
+            body: comment.body,
+            isAgent: comment.body.includes(AGENT_MARKER),
+            parentAgentId: parent?.body.includes(AGENT_MARKER) === true
+                ? parseFindingId(parent.body)
+                : null,
+        };
+    }));
+}
+/** Resolve unresolved review threads whose comments contain one of the finding ids. */
+export async function resolveThreadsForIds(octokit, pr, ids, log = () => { }) {
+    const wanted = new Set(Array.from(ids, (id) => id.toLowerCase()));
+    if (wanted.size === 0)
+        return 0;
+    let threads;
+    try {
+        threads = [];
+        let cursor = null;
+        for (;;) {
+            const data = (await octokit.graphql(`query($owner:String!,$repo:String!,$number:Int!,$cursor:String){
+          repository(owner:$owner,name:$repo){
+            pullRequest(number:$number){
+              reviewThreads(first:100,after:$cursor){
+                nodes{id isResolved comments(first:100){nodes{body}}}
+                pageInfo{hasNextPage endCursor}
+              }
+            }
+          }
+        }`, { owner: pr.owner, repo: pr.repo, number: pr.pull_number, cursor }));
+            const page = data.repository?.pullRequest?.reviewThreads;
+            threads.push(...(page?.nodes ?? []));
+            if (!page?.pageInfo?.hasNextPage || !page.pageInfo.endCursor)
+                break;
+            cursor = page.pageInfo.endCursor;
+        }
+    }
+    catch (err) {
+        log(`warn: failed to list GitHub review threads: ${err.message}`);
+        return 0;
+    }
+    let resolved = 0;
+    for (const thread of threads) {
+        if (thread.isResolved ||
+            !thread.comments.nodes.some((comment) => {
+                const id = parseFindingId(comment.body);
+                return id != null && wanted.has(id.toLowerCase());
+            })) {
+            continue;
+        }
+        try {
+            await octokit.graphql(`mutation($id:ID!){
+          resolveReviewThread(input:{threadId:$id}){thread{isResolved}}
+        }`, { id: thread.id });
+            resolved++;
+        }
+        catch (err) {
+            log(`warn: failed to resolve GitHub review thread ${thread.id}: ${err.message}`);
+        }
+    }
+    return resolved;
+}
+/**
+ * Post new findings as one PR review with inline comments.
+ * Persistent findings (same id already on the PR) are skipped.
+ */
+export async function postReview(opts) {
+    const { octokit, pr, result, log = () => { } } = opts;
+    const toPost = result.findingsToPost ?? result.findings;
+    const existingIds = await listPostedFindingIds(octokit, pr);
+    const comments = [];
+    let skipped = 0;
+    for (const f of toPost) {
+        if (f.id && existingIds.has(f.id)) {
+            skipped++;
+            continue;
+        }
+        comments.push({
+            path: f.file,
+            line: f.end_line,
+            ...(f.end_line > f.start_line ? { start_line: f.start_line, start_side: "RIGHT" } : {}),
+            side: "RIGHT",
+            body: formatCommentBody(f),
+        });
+    }
+    if (skipped)
+        log(`Skipping ${skipped} comment(s) already posted (same finding id).`);
+    const body = formatReviewBody(result, opts.failed);
+    try {
+        await octokit.pulls.createReview({
+            ...pr,
+            commit_id: opts.headSha,
+            event: "COMMENT",
+            body,
+            comments,
+        });
+        log(`Posted review with ${comments.length} inline comment(s).`);
+    }
+    catch (err) {
+        log(`Inline review failed (${err.message}); posting summary-only review.`);
+        const fallbackBody = [
+            body,
+            "",
+            "### Findings (inline placement failed)",
+            ...toPost.map((f) => `- **${f.severity}** \`${f.file}:${f.start_line}-${f.end_line}\` — ${f.title}${f.id ? ` (\`${f.id}\`)` : ""}\n\n  ${f.body.split("\n").join("\n  ")}`),
+        ].join("\n");
+        await octokit.pulls.createReview({
+            ...pr,
+            commit_id: opts.headSha,
+            event: "COMMENT",
+            body: fallbackBody,
+        });
+    }
+    const resolvedIds = result.reconciliation?.resolved ?? [];
+    if (resolvedIds.length > 0) {
+        const resolved = await resolveThreadsForIds(octokit, pr, resolvedIds, log);
+        if (resolved)
+            log(`Resolved ${resolved} thread(s) for fixed findings.`);
+    }
+}
+//# sourceMappingURL=comments.js.map

package/dist/github/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/github/comments.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3D,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,MAAM,KAAK,GAAG;QACZ,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,mBAAmB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG;QACnI,EAAE;QACF,KAAK,CAAC,CAAC,KAAK,IAAI;QAChB,EAAE;QACF,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;KACd,CAAC;IACF,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE;QAAE,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,MAAe;IACpE,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GACb,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,GAAe,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;aACnE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC;IACpC,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,MAAM,UAAU,KAAK,CAAC,UAAU,CAAC,MAAM,iBAAiB,KAAK,CAAC,QAAQ,CAAC,MAAM,eAAe,KAAK,CAAC,UAAU,CAAC,MAAM,aAAa;QAC9J,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,oBAAoB;QACpB,EAAE;QACF,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,EAAE;QACF,SAAS;QACT,SAAS;QACT,MAAM,CAAC,CAAC,CAAC,+EAA+E,CAAC,CAAC,CAAC,EAAE;QAC7F,YAAY;KACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAmB;IAC1C,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAWD,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB,EAAE,EAAS;IACpE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QACxE,GAAG,EAAE;QACL,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IACH,OAAO,oBAAoB,CACzB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,EAAS;IAET,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;QACxE,GAAG,EAAE;QACL,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,iBAAiB,CACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAClC,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5C,aAAa,EACX,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI;gBAC1C,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,CAAC,CAAC,IAAI;SACX,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAQD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,EAAS,EACT,GAAqB,EACrB,MAA6B,GAAG,EAAE,GAAE,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CACjC;;;;;;;;;UASE,EACF,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,CACnE,CASA,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAAE,MAAM;YACpE,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,+CAAgD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IACE,MAAM,CAAC,UAAU;YACjB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACtC,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,EACF,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CACnB;;UAEE,EACF,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAClB,CAAC;YACF,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,gDAAgD,MAAM,CAAC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,IAAI,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,QAAQ;YAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,EAAE,OAAgB;YACtB,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO;QAAE,GAAG,CAAC,YAAY,OAAO,+CAA+C,CAAC,CAAC;IAErF,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAC/B,GAAG,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,KAAK,EAAE,SAAS;YAChB,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CAAC,sBAAsB,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,yBAA0B,GAAa,CAAC,OAAO,iCAAiC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG;YACnB,IAAI;YACJ,EAAE;YACF,wCAAwC;YACxC,GAAG,MAAM,CAAC,GAAG,CACX,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACxJ;SACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAC/B,GAAG,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,GAAG,CAAC,YAAY,QAAQ,gCAAgC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/gitlab/comments.d.ts

@@ -0,0 +1,46 @@
+import type { ReviewResult } from "../types.js";
+export interface GlRef {
+    /** GitLab server base URL, e.g. https://gitlab.com */
+    serverUrl: string;
+    /** URL-encoded project path ("group%2Fproject") or numeric project id. */
+    projectId: string;
+    mrIid: number;
+}
+export interface GlDiffRefs {
+    base_sha: string;
+    head_sha: string;
+    start_sha: string;
+}
+/** Resolve project/MR from flags or GitLab CI env vars. */
+export declare function resolveGlRef(repoSlug: string | undefined, pr: number | undefined): GlRef;
+/** Fetch MR changes and reconstruct a unified diff the parser understands. */
+export declare function getGlMrDiff(ref: GlRef): Promise<{
+    diffText: string;
+    diffRefs: GlDiffRefs;
+}>;
+interface GlNote {
+    id?: number;
+    body?: string;
+    type?: string | null;
+    parent_id?: number;
+    reply_id?: number;
+    discussion_id?: string;
+}
+export declare function listGlNotes(ref: GlRef): Promise<GlNote[]>;
+export declare function listGlFindingIds(ref: GlRef): Promise<Set<string>>;
+export declare function listGlWontFixFindingIds(ref: GlRef): Promise<Set<string>>;
+/** Resolve unresolved MR discussions whose notes contain one of the finding ids. */
+export declare function resolveGlDiscussionsForIds(ref: GlRef, ids: Iterable<string>, log?: (msg: string) => void): Promise<number>;
+export interface PostGlReviewOptions {
+    ref: GlRef;
+    diffRefs: GlDiffRefs;
+    result: ReviewResult;
+    failed: boolean;
+    log?: (msg: string) => void;
+}
+/**
+ * Post findings to a GitLab MR: one summary note plus one positioned discussion
+ * per *new* finding. Persistent findings (same pr-review-id) are skipped.
+ */
+export declare function postGlReview(opts: PostGlReviewOptions): Promise<void>;
+export {};

package/dist/gitlab/comments.js

@@ -0,0 +1,213 @@
+import { formatBbCommentBody, formatBbSummaryBody } from "../bitbucket/comments.js";
+import { collectIdsFromBodies, parseFindingId } from "../finding-id.js";
+import { AGENT_MARKER, SEVERITY_EMOJI } from "../github/comments.js";
+import { collectWontFixIds } from "../suppress-signals.js";
+function resolveGlToken() {
+    const token = process.env.GITLAB_TOKEN || process.env.GL_TOKEN;
+    if (!token) {
+        throw new Error("GitLab auth required: set GITLAB_TOKEN (personal or project access token with api scope). " +
+            "CI_JOB_TOKEN cannot post merge request notes.");
+    }
+    return token;
+}
+/** Resolve project/MR from flags or GitLab CI env vars. */
+export function resolveGlRef(repoSlug, pr) {
+    const env = process.env;
+    const serverUrl = (env.CI_SERVER_URL || "https://gitlab.com").replace(/\/$/, "");
+    const projectId = repoSlug ? encodeURIComponent(repoSlug) : env.CI_PROJECT_ID;
+    const mrIid = pr ?? (env.CI_MERGE_REQUEST_IID ? parseInt(env.CI_MERGE_REQUEST_IID, 10) : undefined);
+    if (!projectId || mrIid == null || Number.isNaN(mrIid)) {
+        throw new Error("GitLab MR not identified. Pass --repo group/project and --pr <iid>, " +
+            "or run in a merge_request_event pipeline (CI_PROJECT_ID / CI_MERGE_REQUEST_IID).");
+    }
+    return { serverUrl, projectId, mrIid };
+}
+function glApi(ref) {
+    return `${ref.serverUrl}/api/v4/projects/${ref.projectId}/merge_requests/${ref.mrIid}`;
+}
+async function glFetch(url, init = {}) {
+    const res = await fetch(url, {
+        ...init,
+        headers: {
+            "private-token": resolveGlToken(),
+            accept: "application/json",
+            ...(init.body ? { "content-type": "application/json" } : {}),
+            ...(init.headers ?? {}),
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`GitLab API ${init.method ?? "GET"} ${url} failed (${res.status}): ${text.slice(0, 400)}`);
+    }
+    return res;
+}
+/** Fetch MR changes and reconstruct a unified diff the parser understands. */
+export async function getGlMrDiff(ref) {
+    const res = await glFetch(`${glApi(ref)}/changes`);
+    const data = (await res.json());
+    if (!data.diff_refs)
+        throw new Error("GitLab MR has no diff_refs (empty or unmergeable MR?).");
+    const parts = (data.changes ?? []).map((c) => {
+        const oldFile = c.new_file ? "/dev/null" : `a/${c.old_path}`;
+        const newFile = c.deleted_file ? "/dev/null" : `b/${c.new_path}`;
+        return `diff --git a/${c.old_path} b/${c.new_path}\n--- ${oldFile}\n+++ ${newFile}\n${c.diff}`;
+    });
+    return { diffText: parts.join(""), diffRefs: data.diff_refs };
+}
+export async function listGlNotes(ref) {
+    const notes = [];
+    let page = 1;
+    for (;;) {
+        const res = await glFetch(`${glApi(ref)}/notes?per_page=100&page=${page}`);
+        const batch = (await res.json());
+        notes.push(...batch);
+        const next = res.headers.get("x-next-page");
+        if (!next)
+            break;
+        page = parseInt(next, 10);
+    }
+    return notes;
+}
+export async function listGlFindingIds(ref) {
+    const notes = await listGlNotes(ref);
+    return collectIdsFromBodies(notes.filter((n) => n.body?.includes(AGENT_MARKER)).map((n) => n.body ?? ""));
+}
+export async function listGlWontFixFindingIds(ref) {
+    const notes = await listGlNotes(ref);
+    const byId = new Map(notes.flatMap((note) => (note.id == null ? [] : [[note.id, note]])));
+    const discussionAgentIds = new Map();
+    for (const note of notes) {
+        const body = note.body ?? "";
+        const id = body.includes(AGENT_MARKER) ? parseFindingId(body) : null;
+        if (note.discussion_id && id)
+            discussionAgentIds.set(note.discussion_id, id);
+    }
+    return collectWontFixIds(notes.map((note) => {
+        let parent = byId.get(note.parent_id ?? note.reply_id ?? -1);
+        while (parent) {
+            const body = parent.body ?? "";
+            if (body.includes(AGENT_MARKER)) {
+                return { body: note.body ?? "", parentAgentId: parseFindingId(body) };
+            }
+            parent = byId.get(parent.parent_id ?? parent.reply_id ?? -1);
+        }
+        const body = note.body ?? "";
+        return {
+            body,
+            isAgent: body.includes(AGENT_MARKER),
+            parentAgentId: note.discussion_id
+                ? discussionAgentIds.get(note.discussion_id) ?? null
+                : null,
+        };
+    }));
+}
+/** Resolve unresolved MR discussions whose notes contain one of the finding ids. */
+export async function resolveGlDiscussionsForIds(ref, ids, log = () => { }) {
+    const wanted = new Set(Array.from(ids, (id) => id.toLowerCase()));
+    if (wanted.size === 0)
+        return 0;
+    const discussions = [];
+    try {
+        let page = 1;
+        for (;;) {
+            const res = await glFetch(`${glApi(ref)}/discussions?per_page=100&page=${page}`);
+            discussions.push(...(await res.json()));
+            const next = res.headers.get("x-next-page");
+            if (!next)
+                break;
+            page = parseInt(next, 10);
+        }
+    }
+    catch (err) {
+        log(`warn: failed to list GitLab discussions: ${err.message}`);
+        return 0;
+    }
+    let resolved = 0;
+    for (const discussion of discussions) {
+        const matches = discussion.notes.some((note) => {
+            const id = parseFindingId(note.body ?? "");
+            return id != null && wanted.has(id.toLowerCase());
+        });
+        const unresolved = discussion.notes.some((note) => note.resolvable !== false && note.resolved !== true);
+        if (!matches || !unresolved)
+            continue;
+        try {
+            await glFetch(`${glApi(ref)}/discussions/${discussion.id}`, {
+                method: "PUT",
+                body: JSON.stringify({ resolved: true }),
+            });
+            resolved++;
+        }
+        catch (err) {
+            log(`warn: failed to resolve GitLab discussion ${discussion.id}: ${err.message}`);
+        }
+    }
+    return resolved;
+}
+/**
+ * Post findings to a GitLab MR: one summary note plus one positioned discussion
+ * per *new* finding. Persistent findings (same pr-review-id) are skipped.
+ */
+export async function postGlReview(opts) {
+    const { ref, diffRefs, result, log = () => { } } = opts;
+    const notes = await listGlNotes(ref);
+    const mine = notes.filter((n) => n.body?.includes(AGENT_MARKER));
+    const existingIds = collectIdsFromBodies(mine.map((n) => n.body ?? ""));
+    const alreadySummarized = mine.some((n) => n.type == null);
+    if (!alreadySummarized || result.findings.length === 0) {
+        await glFetch(`${glApi(ref)}/notes`, {
+            method: "POST",
+            body: JSON.stringify({ body: formatBbSummaryBody(result, opts.failed) }),
+        });
+    }
+    const toPost = result.findingsToPost ?? result.findings;
+    let posted = 0;
+    let skipped = 0;
+    const failedInline = [];
+    for (const f of toPost) {
+        if (f.id && existingIds.has(f.id)) {
+            skipped++;
+            continue;
+        }
+        try {
+            await glFetch(`${glApi(ref)}/discussions`, {
+                method: "POST",
+                body: JSON.stringify({
+                    body: formatBbCommentBody(f),
+                    position: {
+                        position_type: "text",
+                        base_sha: diffRefs.base_sha,
+                        start_sha: diffRefs.start_sha,
+                        head_sha: diffRefs.head_sha,
+                        new_path: f.file,
+                        new_line: f.end_line,
+                    },
+                }),
+            });
+            posted++;
+        }
+        catch {
+            failedInline.push(f);
+        }
+    }
+    if (failedInline.length > 0) {
+        const body = [
+            "### Findings that could not be placed inline",
+            ...failedInline.map((f) => `- ${SEVERITY_EMOJI[f.severity]} **${f.severity}** \`${f.file}:${f.start_line}-${f.end_line}\` — ${f.title}\n\n  ${f.body.split("\n").join("\n  ")}`),
+            "",
+            AGENT_MARKER,
+        ].join("\n");
+        await glFetch(`${glApi(ref)}/notes`, { method: "POST", body: JSON.stringify({ body }) });
+    }
+    log(`GitLab: posted ${posted} inline discussion(s)` +
+        (skipped ? `, skipped ${skipped} duplicate(s)` : "") +
+        (failedInline.length ? `, ${failedInline.length} moved to a summary note` : "") +
+        ".");
+    const resolvedIds = result.reconciliation?.resolved ?? [];
+    if (resolvedIds.length > 0) {
+        const resolved = await resolveGlDiscussionsForIds(ref, resolvedIds, log);
+        if (resolved)
+            log(`GitLab: resolved ${resolved} discussion(s) for fixed findings.`);
+    }
+}
+//# sourceMappingURL=comments.js.map

package/dist/gitlab/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/gitlab/comments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAiB3D,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,QAA4B,EAAE,EAAsB;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,KAAK,CAAC,GAAU;IACvB,OAAO,GAAG,GAAG,CAAC,SAAS,oBAAoB,GAAG,CAAC,SAAS,mBAAmB,GAAG,CAAC,KAAK,EAAE,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,OAAoB,EAAE;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,eAAe,EAAE,cAAc,EAAE;YACjC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAU;IAEV,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAS7B,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjE,OAAO,gBAAgB,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,QAAQ,SAAS,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AAChE,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAU;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,MAAM;QACjB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAU;IAC/C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,oBAAoB,CACzB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAU;IACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE;YAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,iBAAiB,CACtB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YACpC,aAAa,EAAE,IAAI,CAAC,aAAa;gBAC/B,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI;gBACpD,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAWD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAU,EACV,GAAqB,EACrB,MAA6B,GAAG,EAAE,GAAE,CAAC;IAErC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,MAAM,WAAW,GAAmB,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;YACjF,WAAW,CAAC,IAAI,CAAC,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,MAAM;YACjB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,4CAA6C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;YAAE,SAAS;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,UAAU,CAAC,EAAE,EAAE,EAAE;gBAC1D,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aACzC,CAAC,CAAC;YACH,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,6CAA6C,UAAU,CAAC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,IAAI,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAE3D,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC;IACxD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,YAAY,GAAc,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;oBAC5B,QAAQ,EAAE;wBACR,aAAa,EAAE,MAAM;wBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,QAAQ,EAAE,CAAC,CAAC,IAAI;wBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;qBACrB;iBACF,CAAC;aACH,CAAC,CAAC;YACH,MAAM,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG;YACX,8CAA8C;YAC9C,GAAG,YAAY,CAAC,GAAG,CACjB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACvJ;YACD,EAAE;YACF,YAAY;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,GAAG,CACD,kBAAkB,MAAM,uBAAuB;QAC7C,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,MAAM,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CACN,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,QAAQ;YAAE,GAAG,CAAC,oBAAoB,QAAQ,oCAAoC,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { runReview } from "./review.js";
+export { runIndex, selectContext, loadIndex } from "codengram";
+export { loadConfig, DEFAULT_CONFIG } from "./config.js";
+export { parseDiff, renderDiffForPrompt } from "./diff/parse.js";
+export { validateFindings, reviewOutputSchema, findingSchema } from "./llm/schema.js";
+export { formatReport, shouldFail } from "./report/cli.js";
+export { fingerprintFinding, normalizeTitle, parseFindingId, embedFindingId, findingsSoftMatch, titleSimilarity, } from "./finding-id.js";
+export { reconcileFindings } from "./reconcile.js";
+export { loadSuppressions, SUPPRESSIONS_FILENAME } from "./suppressions.js";
+export * from "./types.js";

package/dist/index.js

@@ -0,0 +1,11 @@
+export { runReview } from "./review.js";
+export { runIndex, selectContext, loadIndex } from "codengram";
+export { loadConfig, DEFAULT_CONFIG } from "./config.js";
+export { parseDiff, renderDiffForPrompt } from "./diff/parse.js";
+export { validateFindings, reviewOutputSchema, findingSchema } from "./llm/schema.js";
+export { formatReport, shouldFail } from "./report/cli.js";
+export { fingerprintFinding, normalizeTitle, parseFindingId, embedFindingId, findingsSoftMatch, titleSimilarity, } from "./finding-id.js";
+export { reconcileFindings } from "./reconcile.js";
+export { loadSuppressions, SUPPRESSIONS_FILENAME } from "./suppressions.js";
+export * from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,cAAc,YAAY,CAAC"}

package/dist/llm/prompt.d.ts

@@ -0,0 +1,23 @@
+import type { FileDiff, ReviewConfig } from "../types.js";
+export declare const REVIEW_SYSTEM_PROMPT = "You are a senior software engineer reviewing a pull request. You are rigorous but pragmatic: you flag real problems, not style preferences the team hasn't asked for.\n\nReview the diff for these categories:\n- bug: logic errors, off-by-one mistakes, incorrect conditions, broken error handling, race conditions, wrong API usage\n- security: injection, unsafe deserialization, secrets in code, missing authorization or validation at trust boundaries, path traversal\n- missing-tests: changed or new behavior with no corresponding test change, especially branches and error paths\n- naming: identifiers inconsistent with the surrounding codebase's conventions, or misleading about what they do\n- complexity: functions that grew too long or deeply nested to reason about, duplicated logic that already exists elsewhere in the repo\n- custom: anything the repository's custom instructions ask you to flag\n\nRules:\n1. Comment ONLY on lines that appear as added (+) lines in the diff. Use the new-file line numbers printed at the start of each line.\n2. Use the REPOSITORY CONTEXT section (summaries and symbols of related files) to judge consistency, spot callers the change might break, and avoid flagging things the codebase already handles elsewhere. Do not report findings about context files themselves \u2014 only about the diff.\n3. Severity rubric:\n   - critical: will corrupt data, break production, or is an exploitable vulnerability\n   - high: incorrect behavior on realistic inputs, or a security weakness\n   - medium: likely bug under edge cases, missing tests for risky logic, significant maintainability problem\n   - low: minor issues worth fixing but not blocking\n   - info: observations and suggestions, no action strictly required\n4. Report every real issue you find, including ones you are uncertain about \u2014 set confidence accordingly; a downstream filter handles thresholds. Do not pad the review with nitpicks to seem thorough.\n5. When you provide a suggestion, it must be a drop-in replacement for exactly the lines in start_line..end_line, complete and correctly indented.\n6. Keep each finding's body focused: what is wrong, why it matters, how to fix it.\n7. When the REPOSITORY CONTEXT contradicts a suspicion (the pattern is established elsewhere, a caller already handles the case, a convention explains the choice), do not report it as high or critical unless you can cite the specific added lines that break it \u2014 cite that evidence in the body, or lower the severity and confidence accordingly. Never report a critical/high finding that rests on guesses about code you cannot see.";
+export declare const CRITIQUE_SYSTEM_PROMPT = "You are re-reading your own PR review before it is posted. Your ONLY job is to remove findings you would walk back if a developer pushed back \u2014 speculative issues, style opinions dressed as bugs, problems the surrounding code or repository context already handles, or duplicates.\n\nRules:\n1. You may ONLY drop findings. Never edit, merge, reword, or add findings.\n2. Keep every finding you would defend in a face-to-face review \u2014 when in doubt, keep it. Dropping a real bug is far worse than keeping a borderline nitpick.\n3. Return the ids of the findings to KEEP.";
+export declare function buildCritiqueUserPrompt(input: {
+    findings: {
+        id?: string;
+        file: string;
+        start_line: number;
+        severity: string;
+        title: string;
+        body: string;
+    }[];
+    changeDescription: string;
+}): string;
+export interface ReviewPromptInput {
+    files: FileDiff[];
+    /** Rendered repository context from the codemap; empty when no index exists. */
+    context: string;
+    config: ReviewConfig;
+    /** e.g. "PR #42: Add session refresh" or "local diff vs origin/main" */
+    changeDescription: string;
+}
+export declare function buildReviewUserPrompt(input: ReviewPromptInput): string;

package/dist/llm/prompt.js

@@ -0,0 +1,53 @@
+import { renderDiffForPrompt } from "../diff/parse.js";
+export const REVIEW_SYSTEM_PROMPT = `You are a senior software engineer reviewing a pull request. You are rigorous but pragmatic: you flag real problems, not style preferences the team hasn't asked for.
+
+Review the diff for these categories:
+- bug: logic errors, off-by-one mistakes, incorrect conditions, broken error handling, race conditions, wrong API usage
+- security: injection, unsafe deserialization, secrets in code, missing authorization or validation at trust boundaries, path traversal
+- missing-tests: changed or new behavior with no corresponding test change, especially branches and error paths
+- naming: identifiers inconsistent with the surrounding codebase's conventions, or misleading about what they do
+- complexity: functions that grew too long or deeply nested to reason about, duplicated logic that already exists elsewhere in the repo
+- custom: anything the repository's custom instructions ask you to flag
+
+Rules:
+1. Comment ONLY on lines that appear as added (+) lines in the diff. Use the new-file line numbers printed at the start of each line.
+2. Use the REPOSITORY CONTEXT section (summaries and symbols of related files) to judge consistency, spot callers the change might break, and avoid flagging things the codebase already handles elsewhere. Do not report findings about context files themselves — only about the diff.
+3. Severity rubric:
+   - critical: will corrupt data, break production, or is an exploitable vulnerability
+   - high: incorrect behavior on realistic inputs, or a security weakness
+   - medium: likely bug under edge cases, missing tests for risky logic, significant maintainability problem
+   - low: minor issues worth fixing but not blocking
+   - info: observations and suggestions, no action strictly required
+4. Report every real issue you find, including ones you are uncertain about — set confidence accordingly; a downstream filter handles thresholds. Do not pad the review with nitpicks to seem thorough.
+5. When you provide a suggestion, it must be a drop-in replacement for exactly the lines in start_line..end_line, complete and correctly indented.
+6. Keep each finding's body focused: what is wrong, why it matters, how to fix it.
+7. When the REPOSITORY CONTEXT contradicts a suspicion (the pattern is established elsewhere, a caller already handles the case, a convention explains the choice), do not report it as high or critical unless you can cite the specific added lines that break it — cite that evidence in the body, or lower the severity and confidence accordingly. Never report a critical/high finding that rests on guesses about code you cannot see.`;
+export const CRITIQUE_SYSTEM_PROMPT = `You are re-reading your own PR review before it is posted. Your ONLY job is to remove findings you would walk back if a developer pushed back — speculative issues, style opinions dressed as bugs, problems the surrounding code or repository context already handles, or duplicates.
+
+Rules:
+1. You may ONLY drop findings. Never edit, merge, reword, or add findings.
+2. Keep every finding you would defend in a face-to-face review — when in doubt, keep it. Dropping a real bug is far worse than keeping a borderline nitpick.
+3. Return the ids of the findings to KEEP.`;
+export function buildCritiqueUserPrompt(input) {
+    const list = input.findings
+        .map((f) => `- id: ${f.id}\n  location: ${f.file}:${f.start_line} [${f.severity}]\n  title: ${f.title}\n  body: ${f.body}`)
+        .join("\n");
+    return `Change under review: ${input.changeDescription}\n\n# FINDINGS\n${list}\n\nReturn the ids to keep.`;
+}
+export function buildReviewUserPrompt(input) {
+    const parts = [];
+    parts.push(`Reviewing: ${input.changeDescription}`);
+    if (input.config.custom_instructions.trim()) {
+        parts.push(`# CUSTOM REVIEW INSTRUCTIONS (from this repository's .pr-review.yml)\n${input.config.custom_instructions.trim()}`);
+    }
+    if (input.context.trim()) {
+        parts.push(`# REPOSITORY CONTEXT\nSummaries and exported symbols of files related to this change (importers listed first — they depend on the changed code):\n\n${input.context}`);
+    }
+    else {
+        parts.push(`# REPOSITORY CONTEXT\n(none available — no codemap index; review the diff on its own)`);
+    }
+    const diffs = input.files.map((f) => renderDiffForPrompt(f)).join("\n\n");
+    parts.push(`# DIFF\nEach line is prefixed with its new-file line number. Only '+' lines are commentable.\n\n${diffs}`);
+    return parts.join("\n\n");
+}
+//# sourceMappingURL=prompt.js.map

package/dist/llm/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/llm/prompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;8aAsB0Y,CAAC;AAE/a,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;2CAKK,CAAC;AAE5C,MAAM,UAAU,uBAAuB,CAAC,KAGvC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ;SACxB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,IAAI,EAAE,CACjH;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,wBAAwB,KAAK,CAAC,iBAAiB,mBAAmB,IAAI,6BAA6B,CAAC;AAC7G,CAAC;AAWD,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEpD,IAAI,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,yEAAyE,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,uJAAuJ,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrL,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,mGAAmG,KAAK,EAAE,CAAC,CAAC;IAEvH,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}