secondpair 0.1.0

package/dist/llm/schema.d.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import type { FileDiff, ReviewConfig, ReviewResult } from "../types.js";
+export declare const findingSchema: z.ZodObject<{
+    file: z.ZodString;
+    start_line: z.ZodNumber;
+    end_line: z.ZodNumber;
+    severity: z.ZodEnum<{
+        critical: "critical";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        info: "info";
+    }>;
+    category: z.ZodEnum<{
+        bug: "bug";
+        security: "security";
+        "missing-tests": "missing-tests";
+        naming: "naming";
+        complexity: "complexity";
+        custom: "custom";
+    }>;
+    confidence: z.ZodNumber;
+    title: z.ZodString;
+    body: z.ZodString;
+    suggestion: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const reviewOutputSchema: z.ZodObject<{
+    summary: z.ZodString;
+    findings: z.ZodArray<z.ZodObject<{
+        file: z.ZodString;
+        start_line: z.ZodNumber;
+        end_line: z.ZodNumber;
+        severity: z.ZodEnum<{
+            critical: "critical";
+            high: "high";
+            medium: "medium";
+            low: "low";
+            info: "info";
+        }>;
+        category: z.ZodEnum<{
+            bug: "bug";
+            security: "security";
+            "missing-tests": "missing-tests";
+            naming: "naming";
+            complexity: "complexity";
+            custom: "custom";
+        }>;
+        confidence: z.ZodNumber;
+        title: z.ZodString;
+        body: z.ZodString;
+        suggestion: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ReviewOutput = z.infer<typeof reviewOutputSchema>;
+/**
+ * Post-validate model findings against the diff and config.
+ * Drops findings on files/lines outside the diff, below the confidence floor,
+ * or in disabled categories. Line ranges that merely overlap the changed lines
+ * are clamped rather than dropped.
+ */
+export declare function validateFindings(raw: ReviewOutput, files: FileDiff[], config: ReviewConfig): ReviewResult;

package/dist/llm/schema.js

@@ -0,0 +1,73 @@
+import { z } from "zod";
+export const findingSchema = z.object({
+    file: z.string().describe("Repo-relative path of the file the finding is in"),
+    start_line: z.number().int().describe("First affected line (new-file line numbers)"),
+    end_line: z.number().int().describe("Last affected line (inclusive)"),
+    severity: z.enum(["critical", "high", "medium", "low", "info"]),
+    category: z.enum(["bug", "security", "missing-tests", "naming", "complexity", "custom"]),
+    confidence: z.number().describe("Self-rated confidence between 0 and 1"),
+    title: z.string().describe("One-line summary of the issue"),
+    body: z.string().describe("Markdown explanation with reasoning and impact"),
+    suggestion: z
+        .string()
+        .nullable()
+        .describe("Replacement code for exactly the start_line..end_line range, or null. Must be complete lines with correct indentation."),
+});
+export const reviewOutputSchema = z.object({
+    summary: z.string().describe("2-4 sentence overall assessment of the change"),
+    findings: z.array(findingSchema),
+});
+/**
+ * Post-validate model findings against the diff and config.
+ * Drops findings on files/lines outside the diff, below the confidence floor,
+ * or in disabled categories. Line ranges that merely overlap the changed lines
+ * are clamped rather than dropped.
+ */
+export function validateFindings(raw, files, config) {
+    const changedByFile = new Map(files.map((f) => [f.path, new Set(f.changedLines)]));
+    const findings = [];
+    const dropped = [];
+    for (const f of raw.findings) {
+        const finding = { ...f, confidence: clamp01(f.confidence) };
+        if (config.categories[finding.category] === false) {
+            dropped.push(finding);
+            continue;
+        }
+        if (finding.confidence < config.min_confidence) {
+            dropped.push(finding);
+            continue;
+        }
+        const changed = changedByFile.get(finding.file);
+        if (!changed || changed.size === 0) {
+            dropped.push(finding);
+            continue;
+        }
+        // Clamp the range onto changed lines; drop when there is no overlap.
+        const inRange = [...changed].filter((l) => l >= finding.start_line && l <= finding.end_line);
+        if (inRange.length === 0) {
+            dropped.push(finding);
+            continue;
+        }
+        const start = Math.min(...inRange);
+        const end = Math.max(...inRange);
+        if (start !== finding.start_line || end !== finding.end_line) {
+            // Suggestions are only valid for the exact original range.
+            if (finding.suggestion)
+                finding.suggestion = null;
+            finding.start_line = start;
+            finding.end_line = end;
+        }
+        findings.push(finding);
+    }
+    findings.sort((a, b) => severityOrder(a.severity) - severityOrder(b.severity) ||
+        a.file.localeCompare(b.file) ||
+        a.start_line - b.start_line);
+    return { findings, summary: raw.summary, dropped };
+}
+function severityOrder(s) {
+    return ["critical", "high", "medium", "low", "info"].indexOf(s);
+}
+function clamp01(n) {
+    return Math.max(0, Math.min(1, n));
+}
+//# sourceMappingURL=schema.js.map

package/dist/llm/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/llm/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACrE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACxF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAC3E,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wHAAwH,CACzH;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC7E,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAiB,EACjB,KAAiB,EACjB,MAAoB;IAEpB,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CACpD,CAAC;IAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAc,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAY,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAErE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CACxD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,OAAO,CAAC,UAAU,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7D,2DAA2D;YAC3D,IAAI,OAAO,CAAC,UAAU;gBAAE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAClD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC;QACzB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAC9B,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,CAAsB;IAC3C,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/reconcile.d.ts

@@ -0,0 +1,20 @@
+import type { Finding, Reconciliation } from "./types.js";
+export type { Reconciliation };
+export interface ReconcileResult {
+    /** Findings that still count for display + CI gate (new + persistent). */
+    active: Finding[];
+    /** Findings that should be posted as new PR comments. */
+    toPost: Finding[];
+    reconciliation: Reconciliation;
+}
+export type PreviousFinding = Pick<Finding, "id" | "file" | "category" | "title" | "start_line" | "end_line">;
+/**
+ * Classify findings against previous/known ids and suppressions.
+ * Soft-matches previous report findings when titles were rephrased, and
+ * reuses the prior id so PR comment dedupe stays stable.
+ */
+export declare function reconcileFindings(findings: Finding[], opts?: {
+    previousIds?: Iterable<string>;
+    previousFindings?: PreviousFinding[];
+    suppressedIds?: Iterable<string>;
+}): ReconcileResult;

package/dist/reconcile.js

@@ -0,0 +1,70 @@
+import { findingsSoftMatch } from "./finding-id.js";
+/**
+ * Classify findings against previous/known ids and suppressions.
+ * Soft-matches previous report findings when titles were rephrased, and
+ * reuses the prior id so PR comment dedupe stays stable.
+ */
+export function reconcileFindings(findings, opts = {}) {
+    const previous = new Set([...(opts.previousIds ?? [])].map((id) => id.toLowerCase()));
+    for (const pf of opts.previousFindings ?? []) {
+        if (pf.id)
+            previous.add(pf.id.toLowerCase());
+    }
+    const suppressed = new Set([...(opts.suppressedIds ?? [])].map((id) => id.toLowerCase()));
+    const previousFindings = [...(opts.previousFindings ?? [])].filter((p) => p.id);
+    const reconciliation = {
+        new: [],
+        persistent: [],
+        resolved: [],
+        suppressed: [],
+    };
+    const active = [];
+    const toPost = [];
+    const currentIds = new Set();
+    const claimedPrevious = new Set();
+    for (const raw of findings) {
+        let f = raw;
+        let id = (f.id ?? "").toLowerCase();
+        if (!id)
+            continue;
+        // Exact id hit, or soft-match a prior finding and adopt its id.
+        let matchedPrevious = previous.has(id);
+        if (!matchedPrevious) {
+            const soft = previousFindings.find((p) => p.id &&
+                !claimedPrevious.has(p.id.toLowerCase()) &&
+                !suppressed.has(p.id.toLowerCase()) &&
+                findingsSoftMatch(f, p));
+            if (soft?.id) {
+                const priorId = soft.id.toLowerCase();
+                f = { ...f, id: priorId };
+                id = priorId;
+                matchedPrevious = true;
+                claimedPrevious.add(priorId);
+            }
+        }
+        else {
+            claimedPrevious.add(id);
+        }
+        currentIds.add(id);
+        if (suppressed.has(id)) {
+            reconciliation.suppressed.push(id);
+            continue;
+        }
+        if (matchedPrevious) {
+            reconciliation.persistent.push(id);
+            active.push(f);
+        }
+        else {
+            reconciliation.new.push(id);
+            active.push(f);
+            toPost.push(f);
+        }
+    }
+    for (const id of previous) {
+        if (!currentIds.has(id) && !suppressed.has(id)) {
+            reconciliation.resolved.push(id);
+        }
+    }
+    return { active, toPost, reconciliation };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkBpD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAmB,EACnB,OAII,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,EAAE,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,cAAc,GAAmB;QACrC,GAAG,EAAE,EAAE;QACP,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,CAAC;QACZ,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,SAAS;QAElB,gEAAgE;QAChE,IAAI,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,EAAE;gBACJ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACxC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACnC,iBAAiB,CAAC,CAAC,EAAE,CAAY,CAAC,CACrC,CAAC;YACF,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACtC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;gBAC1B,EAAE,GAAG,OAAO,CAAC;gBACb,eAAe,GAAG,IAAI,CAAC;gBACvB,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEnB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/C,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,3 @@
+export declare const BUILTIN_REDACT_PATTERNS: RegExp[];
+export declare function compileRedactPatterns(sources: string[]): RegExp[];
+export declare function redactSecrets(text: string, extra?: RegExp[]): string;

package/dist/redact.js

@@ -0,0 +1,25 @@
+export const BUILTIN_REDACT_PATTERNS = [
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\b(sk|ghp|gho|ghu|ghs|ghr|glpat)-[A-Za-z0-9_-]{20,}\b/g,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+    /\b(password|api[_-]?key|secret|token)\b\s*[:=]\s*['"]?[^\s'"]{8,}/gi,
+];
+export function compileRedactPatterns(sources) {
+    return sources.map((src, i) => {
+        try {
+            return new RegExp(src, "g");
+        }
+        catch (e) {
+            throw new Error(`Invalid redact_patterns[${i}]: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    });
+}
+export function redactSecrets(text, extra = []) {
+    let out = text;
+    for (const re of [...BUILTIN_REDACT_PATTERNS, ...extra]) {
+        const flags = re.flags.includes("g") ? re.flags : re.flags + "g";
+        out = out.replace(new RegExp(re.source, flags), "[REDACTED]");
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAa;IAC/C,uBAAuB;IACvB,wDAAwD;IACxD,2GAA2G;IAC3G,qEAAqE;CACtE,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,OAAiB;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB,EAAE;IAC9D,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,uBAAuB,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QACjE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/report/cli.d.ts

@@ -0,0 +1,5 @@
+import { type Finding, type ReviewResult, type Severity } from "../types.js";
+export declare function formatReport(result: ReviewResult): string;
+export declare function summaryCounts(findings: Finding[]): string;
+/** True when any finding meets or exceeds the fail_on severity threshold. */
+export declare function shouldFail(findings: Finding[], failOn: Severity): boolean;

package/dist/report/cli.js

@@ -0,0 +1,63 @@
+import pc from "picocolors";
+import { severityRank } from "../types.js";
+const SEVERITY_LABEL = {
+    critical: (s) => pc.bgRed(pc.white(` ${s.toUpperCase()} `)),
+    high: (s) => pc.red(s.toUpperCase()),
+    medium: (s) => pc.yellow(s.toUpperCase()),
+    low: (s) => pc.cyan(s.toUpperCase()),
+    info: (s) => pc.dim(s.toUpperCase()),
+};
+export function formatReport(result) {
+    const lines = [];
+    lines.push(pc.bold("PR Review"));
+    lines.push("");
+    lines.push(result.summary.trim());
+    lines.push("");
+    if (result.findings.length === 0) {
+        lines.push(pc.green("✓ No findings."));
+        return lines.join("\n");
+    }
+    const byFile = new Map();
+    for (const f of result.findings) {
+        if (!byFile.has(f.file))
+            byFile.set(f.file, []);
+        byFile.get(f.file).push(f);
+    }
+    for (const [file, findings] of byFile) {
+        lines.push(pc.bold(pc.underline(file)));
+        for (const f of findings) {
+            const range = f.start_line === f.end_line ? `L${f.start_line}` : `L${f.start_line}-${f.end_line}`;
+            lines.push(`  ${SEVERITY_LABEL[f.severity](f.severity)} ${pc.dim(`[${f.category}]`)} ${pc.dim(range)} ${f.title} ${pc.dim(`(${Math.round(f.confidence * 100)}%)`)}`);
+            for (const bodyLine of f.body.trim().split("\n")) {
+                lines.push(`      ${bodyLine}`);
+            }
+            if (f.suggestion) {
+                lines.push(pc.dim("      suggestion:"));
+                for (const s of f.suggestion.split("\n"))
+                    lines.push(pc.green(`      + ${s}`));
+            }
+            lines.push("");
+        }
+    }
+    lines.push(summaryCounts(result.findings));
+    if (result.reconciliation) {
+        const r = result.reconciliation;
+        lines.push(pc.dim(`lifecycle: ${r.new.length} new · ${r.persistent.length} persistent · ${r.resolved.length} resolved · ${r.suppressed.length} suppressed`));
+    }
+    return lines.join("\n");
+}
+export function summaryCounts(findings) {
+    const counts = new Map();
+    for (const f of findings)
+        counts.set(f.severity, (counts.get(f.severity) ?? 0) + 1);
+    const parts = [...counts.entries()]
+        .sort((a, b) => severityRank(a[0]) - severityRank(b[0]))
+        .map(([sev, n]) => `${n} ${sev}`);
+    return pc.bold(`${findings.length} finding(s): ${parts.join(", ")}`);
+}
+/** True when any finding meets or exceeds the fail_on severity threshold. */
+export function shouldFail(findings, failOn) {
+    const threshold = severityRank(failOn);
+    return findings.some((f) => severityRank(f.severity) <= threshold);
+}
+//# sourceMappingURL=cli.js.map

package/dist/report/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/report/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAkD,MAAM,aAAa,CAAC;AAE3F,MAAM,cAAc,GAA4C;IAC9D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;CACrC,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAClG,KAAK,CAAC,IAAI,CACR,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CACzJ,CAAC;YACF,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CACJ,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,eAAe,CAAC,CAAC,UAAU,CAAC,MAAM,aAAa,CACzI,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAmB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,QAAmB,EAAE,MAAgB;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC;AACrE,CAAC"}

package/dist/report/json.d.ts

@@ -0,0 +1,27 @@
+import type { Finding, Reconciliation, ReviewResult, RunStats } from "../types.js";
+export interface JsonReport {
+    meta: {
+        generatedAt: string;
+        model: string;
+        changeDescription: string;
+        usedContext: boolean;
+    };
+    summary: string;
+    findings: ReviewResult["findings"];
+    reconciliation?: Reconciliation;
+    stats?: RunStats;
+}
+export declare function buildJsonReport(result: ReviewResult & {
+    stats?: RunStats;
+}, meta: {
+    model: string;
+    changeDescription: string;
+    usedContext: boolean;
+}): JsonReport;
+/** One structured log line for CI parsing: counts, tokens, model. */
+export declare function formatRunSummaryLine(stats: RunStats): string;
+export declare function writeJsonReport(path: string, report: JsonReport): Promise<void>;
+/** Load finding ids from a previous pr-review-report.json if present. */
+export declare function loadPreviousIds(reportPath: string): Promise<Set<string>>;
+/** Load prior findings (for soft-match reconcile when titles were rephrased). */
+export declare function loadPreviousFindings(reportPath: string): Promise<Finding[]>;

package/dist/report/json.js

@@ -0,0 +1,53 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+export function buildJsonReport(result, meta) {
+    return {
+        meta: { generatedAt: new Date().toISOString(), ...meta },
+        summary: result.summary,
+        findings: result.findings,
+        reconciliation: result.reconciliation,
+        stats: result.stats,
+    };
+}
+/** One structured log line for CI parsing: counts, tokens, model. */
+export function formatRunSummaryLine(stats) {
+    return `pr-review-summary ${JSON.stringify(stats)}`;
+}
+export async function writeJsonReport(path, report) {
+    await writeFile(path, JSON.stringify(report, null, 2) + "\n", "utf8");
+}
+/** Load finding ids from a previous pr-review-report.json if present. */
+export async function loadPreviousIds(reportPath) {
+    const findings = await loadPreviousFindings(reportPath);
+    const ids = new Set();
+    for (const f of findings) {
+        if (f.id)
+            ids.add(f.id.toLowerCase());
+    }
+    if (!existsSync(reportPath))
+        return ids;
+    try {
+        const raw = JSON.parse(await readFile(reportPath, "utf8"));
+        for (const id of raw.reconciliation?.new ?? [])
+            ids.add(id.toLowerCase());
+        for (const id of raw.reconciliation?.persistent ?? [])
+            ids.add(id.toLowerCase());
+    }
+    catch {
+        /* ignore */
+    }
+    return ids;
+}
+/** Load prior findings (for soft-match reconcile when titles were rephrased). */
+export async function loadPreviousFindings(reportPath) {
+    if (!existsSync(reportPath))
+        return [];
+    try {
+        const raw = JSON.parse(await readFile(reportPath, "utf8"));
+        return (raw.findings ?? []).filter((f) => f && f.id && f.file && f.category && f.title);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=json.js.map

package/dist/report/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/report/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAgBvD,MAAM,UAAU,eAAe,CAC7B,MAA2C,EAC3C,IAAwE;IAExE,OAAO;QACL,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE;QACxD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,KAAe;IAClD,OAAO,qBAAqB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,MAAkB;IACpE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAExD,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAExD,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/review.d.ts

@@ -0,0 +1,41 @@
+import { type FileDiff, type Finding, type ReviewConfig, type ReviewResult, type RunStats } from "./types.js";
+export interface RunReviewOptions {
+    cwd: string;
+    diffText: string;
+    config: ReviewConfig;
+    changeDescription: string;
+    /** Disable codemap context injection. */
+    useContext?: boolean;
+    /** Fingerprints from a previous report or existing PR comments. */
+    previousIds?: Iterable<string>;
+    /** Prior findings for soft-match when titles were rephrased. */
+    previousFindings?: import("./reconcile.js").PreviousFinding[];
+    /** Ids listed in `.pr-review-suppressions.yml`. */
+    suppressedIds?: Iterable<string>;
+    log?: (msg: string) => void;
+}
+export interface RunReviewOutput extends ReviewResult {
+    files: FileDiff[];
+    usedContext: boolean;
+    stats: RunStats;
+}
+export declare function runReview(opts: RunReviewOptions): Promise<RunReviewOutput>;
+/**
+ * Collapse findings that share a fingerprint id — the same underlying issue
+ * reported more than once in a single LLM response (or across chunked calls
+ * for a file split isn't possible, but the model itself repeating a finding
+ * for the same file/category/title is common). Keeps the higher-confidence
+ * copy; first-seen position is preserved so downstream ordering is stable.
+ */
+export declare function dedupeById(findings: Finding[]): {
+    kept: Finding[];
+    duplicates: Finding[];
+};
+/**
+ * Enforce per-file and total finding caps, dropping lowest-confidence first
+ * (severity breaks ties). Kept findings stay in validation order.
+ */
+export declare function capFindings(findings: Finding[], limits: ReviewConfig["limits"]): {
+    kept: Finding[];
+    capped: Finding[];
+};