whobrokeit 0.1.0 → 0.1.1

package/README.md

@@ -35,6 +35,64 @@ whobrokeit --test "node repro.mjs" --with repro.mjs   # a test you haven't commi
 
 Any command works. Exit code 0 means it works, 125 means this commit can't be tested (skip it), anything else means broken. Add `--explain` to get the explanation and a fix in this mode too.
 
+## On GitHub issues
+
+whobrokeit can also run as a GitHub Action. When you label an issue `whobrokeit`, or comment `/whobrokeit`, it looks for the commit that broke it and replies on the issue with the culprit, the proof and a fix it has tested.
+
+Add an `ANTHROPIC_API_KEY` secret to the repo, then save this as `.github/workflows/whobrokeit.yml`:
+
+```yaml
+name: whobrokeit
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  whobrokeit:
+    # Only people who can label issues, or members and collaborators who comment /whobrokeit.
+    if: >-
+      (github.event_name == 'issues' && github.event.label.name == 'whobrokeit') ||
+      (github.event_name == 'issue_comment' && !github.event.issue.pull_request &&
+       startsWith(github.event.comment.body, '/whobrokeit') &&
+       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association))
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0               # whobrokeit needs the history
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22             # whatever your project uses
+      - uses: BerkanAtik/whobrokeit@v0
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+By default it works from the issue's title and body. Text after `/whobrokeit` replaces them, so you can put the bug more precisely: `/whobrokeit Adding 3 mugs costs the same as 1 mug.`
+
+| Input | |
+|---|---|
+| `anthropic-api-key` | Anthropic API key. Or `claude-code-oauth-token`, made with `claude setup-token`, to use a Claude subscription. |
+| `bug` | What is broken. Default: the comment text after `/whobrokeit`, else the issue. |
+| `test` | Your own failing test command. No AI writes the test then. |
+| `explain` | `auto` (default), `true` or `false`. |
+| `agent`, `model`, `good`, `bad`, `setup`, `timeout` | As on the command line. `setup: none` turns installs off. |
+| `working-directory` | The repository to search, if it is not the workspace root. |
+| `comment` | Set to `false` to skip the issue comment. The report is in the job summary either way. |
+
+Outputs: `exit-code`, `commit` (short hash of the culprit) and `report` (path to the Markdown report). The job fails only on errors. A bug it could not reproduce is reported on the issue like any other result.
+
+Read an issue before you start a run on it. The agent only reads code, but whobrokeit runs the test it writes, and issue text can try to steer the agent. The tests whobrokeit runs never get the AI key or the GitHub token in their environment, and the token can't change anything but comments. Code on the runner runs as the same user, though, so use an API key with a spending limit.
+
 ## What it does
 
 1. **Reproduce.** The agent reads your code and writes a small script that prints a `WHOBROKEIT_BUG:` line when it sees the bug. whobrokeit runs it at `HEAD` and only goes on if it fails there for that reason. A crash without that line counts as "can't tell", so a test that calls a function older commits don't have never blames the wrong commit.

package/README.tr.md

@@ -35,6 +35,64 @@ whobrokeit --test "node repro.mjs" --with repro.mjs   # henüz commit'lemediğin
 
 Her komut olur. Çıkış kodu 0 çalışıyor, 125 bu commit test edilemiyor (atla), diğer her şey bozuk demektir. Bu modda da açıklama ve düzeltme istersen `--explain` ekle.
 
+## GitHub issue'larında
+
+whobrokeit bir GitHub Action olarak da çalışır. Bir issue'ya `whobrokeit` etiketini koyduğunda ya da `/whobrokeit` yorumunu yazdığında hatayı getiren commit'i arar. Sonra issue'ya bir yorum yazar: suçlu commit, kanıtı ve test edilmiş bir düzeltme.
+
+Repoya `ANTHROPIC_API_KEY` adında bir secret ekle, sonra şunu `.github/workflows/whobrokeit.yml` olarak kaydet:
+
+```yaml
+name: whobrokeit
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  whobrokeit:
+    # Yalnız issue etiketleyebilenler ya da /whobrokeit yazan üyeler ve katkıcılar.
+    if: >-
+      (github.event_name == 'issues' && github.event.label.name == 'whobrokeit') ||
+      (github.event_name == 'issue_comment' && !github.event.issue.pull_request &&
+       startsWith(github.event.comment.body, '/whobrokeit') &&
+       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association))
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0               # whobrokeit geçmişe ihtiyaç duyar
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22             # projen hangisini kullanıyorsa
+      - uses: BerkanAtik/whobrokeit@v0
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+Varsayılan olarak issue'nun başlığı ve metniyle çalışır. `/whobrokeit`'ten sonra bir metin yazarsan onların yerine o kullanılır. Böylece hatayı daha net anlatabilirsin: `/whobrokeit Sepete 3 kupa ekleyince fiyat 1 kupa kadar çıkıyor.`
+
+| Girdi | |
+|---|---|
+| `anthropic-api-key` | Anthropic API anahtarı. Claude aboneliğini kullanmak için onun yerine `claude setup-token` ile alınan `claude-code-oauth-token`. |
+| `bug` | Bozuk olan şey. Varsayılan: yorumda `/whobrokeit`'ten sonraki metin, o da yoksa issue. |
+| `test` | Başarısız olan kendi test komutun. O zaman testi yapay zekâ yazmaz. |
+| `explain` | `auto` (varsayılan), `true` ya da `false`. |
+| `agent`, `model`, `good`, `bad`, `setup`, `timeout` | Komut satırındakiyle aynı. `setup: none` kurulumu kapatır. |
+| `working-directory` | Aranacak repo, çalışma alanının kökü değilse. |
+| `comment` | Issue'ya yorum yazmasın istersen `false`. Rapor her durumda job özetinde de olur. |
+
+Çıktılar: `exit-code`, `commit` (suçlu commit'in kısa hash'i) ve `report` (Markdown raporun yolu). Job yalnız bir hata olursa başarısız olur. Yeniden üretilemeyen bir hata da diğer sonuçlar gibi issue'ya yazılır.
+
+Bir issue'da çalıştırmadan önce issue'yu oku. Ajan yalnız kodu okur, ama yazdığı testi whobrokeit çalıştırır, ve issue metni ajanı yönlendirmeye çalışabilir. whobrokeit'in çalıştırdığı testlerin ortamında AI anahtarı da GitHub token'ı da olmaz, token da yorumlar dışında hiçbir şeyi değiştiremez. Yine de runner'daki kod aynı kullanıcıyla çalışır; harcama sınırı olan bir API anahtarı kullan.
+
 ## Ne yapar
 
 1. **Hatayı yeniden üretir.** Ajan kodu okur ve hatayı görünce `WHOBROKEIT_BUG:` satırı basan küçük bir betik yazar. whobrokeit onu `HEAD`'de çalıştırır, yalnız bu sebeple başarısız olursa devam eder. Bu satır olmadan gelen bir çökme "belli değil" sayılır; eski commit'lerde olmayan bir fonksiyonu çağıran test yüzünden yanlış commit suçlanmaz.

package/dist/agent.js

@@ -79,7 +79,9 @@ function claudeAgent(model) {
                 await rm(dir, { recursive: true, force: true }).catch(() => { });
             }
             lines.flush();
-            failIfBroken(label, run, timeoutMs, result === undefined);
+            // Its own error message (a bad key, no credit) says more than the exit code does.
+            if (!result?.isError || run.timedOut)
+                failIfBroken(label, run, timeoutMs, result === undefined);
             if (result?.isError) {
                 throw new UserError(`${label} stopped with an error: ${result.text || result.subtype || 'unknown error'}`);
             }

package/dist/engine.js

@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises';
+import { readFile, realpath } from 'node:fs/promises';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { UserError } from './errors.js';
 import { applyEdits, buildExplainPrompt, parseExplanation } from './explain.js';
@@ -344,9 +344,12 @@ async function resolveCommit(repoRoot, input, flag) {
     return result.stdout.trim();
 }
 async function readOverlays(cwd, repoRoot, files) {
-    const root = resolve(repoRoot);
+    // Real paths on both sides: the folder may be reached through a symlink (/tmp on macOS) or a
+    // short Windows name, while git reports the repository's real location.
+    const root = await realpath(repoRoot).catch(() => resolve(repoRoot));
+    const base = await realpath(cwd).catch(() => resolve(cwd));
     return Promise.all(files.map(async (file) => {
-        const absolute = resolve(cwd, file);
+        const absolute = resolve(base, file);
         const rel = relative(root, absolute);
         if (!rel || rel.startsWith('..') || isAbsolute(rel)) {
             throw new UserError(`--with ${file} must be a file inside the repository.`);

package/dist/exec.js

@@ -1,4 +1,17 @@
 import { spawn } from 'node:child_process';
+/** Credentials whobrokeit or its agent may need, but the tested code never does. */
+const SECRET_ENV = [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'CLAUDE_CODE_OAUTH_TOKEN',
+    'OPENAI_API_KEY',
+    'CODEX_API_KEY',
+    'GITHUB_TOKEN',
+    'GH_TOKEN',
+    'ACTIONS_RUNTIME_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'ACTIONS_ID_TOKEN_REQUEST_URL',
+];
 const MAX_OUTPUT = 200_000;
 const active = new Set();
 /** Runs a shell command and captures combined stdout/stderr. Never rejects. */
@@ -9,6 +22,12 @@ export function runCommand(command, cwd, timeoutMs, options = {}) {
         delete env.FORCE_COLOR;
         // Set when whobrokeit itself runs under `node --test`; a nested `node --test` would then exit 0.
         delete env.NODE_TEST_CONTEXT;
+        if (options.untrusted) {
+            for (const name of Object.keys(env)) {
+                if (SECRET_ENV.includes(name.toUpperCase()))
+                    delete env[name];
+            }
+        }
         const child = spawn(command, {
             cwd,
             env,

package/dist/repro.js

@@ -78,40 +78,40 @@ const ATTEMPT_OUTPUT_LINES = 60;
 export function buildPrompt(input) {
     const { bug, commit, attempts, maxAttempts } = input;
     const parts = [
-        `You are helping whobrokeit find the commit that introduced a bug. Your only job: write one small script that shows the bug at the current commit. whobrokeit will then run that script on older commits with git bisect.
-
-## Bug report
-
-<bug_report>
-${bug.trim()}
-</bug_report>
-
-The repository is checked out in the current directory at commit ${commit.short} ("${commit.subject}"). You can read and search the files, but you cannot change them or run anything. whobrokeit runs your script and tells you what happened.
-
-## The script
-
-It will run unchanged on many older commits, so it must follow this contract exactly:
-
-- The behavior is correct: exit 0.
-- The bug is present: print one line that starts with \`${BUG_MARKER}\` and says what was expected and what actually happened, then exit 1.
-- The check cannot run on this version of the code, because something it needs (a module, function or option) does not exist yet: exit 125. Never use 125 for the bug itself.
-- If the bug shows up as an exception or a crash, catch it around the one call that triggers it and report it as the bug, but only when it is the error from the report: check its message or type, and rethrow anything else. Never put imports or setup inside that try, because on an older commit they can fail for unrelated reasons.
-- Any other failure, like a crash in the script itself, counts as "can't tell" rather than as the bug.
-
-Keep it short (usually under 40 lines) and deterministic: no network, no sleeping, no dependence on today's date or on random values, done in a few seconds. Use only the language runtime, the project's own code and the dependencies it already has (they are installed before the script runs). Load the code under test through stable entry points so the script still works on older commits. Prefer a plain script over a test framework. Write comments and messages in the language the bug report is written in (an English report gets English messages), whatever language you usually reply in. In Node.js, set process.exitCode instead of calling process.exit(), so the output is not cut off.
-
-Put the script in a new file, never an existing one, at the repository root unless the language needs it somewhere else. The command runs from the repository root and must run only this script, not the whole test suite.
-
-## Reply format
-
-Reply with these three tags, and nothing after them:
-
-<path>whobrokeit-repro.mjs</path>
-<command>node whobrokeit-repro.mjs</command>
-<code>
-...the complete file...
-</code>
-
+        `You are helping whobrokeit find the commit that introduced a bug. Your only job: write one small script that shows the bug at the current commit. whobrokeit will then run that script on older commits with git bisect.
+
+## Bug report
+
+<bug_report>
+${bug.trim()}
+</bug_report>
+
+The repository is checked out in the current directory at commit ${commit.short} ("${commit.subject}"). You can read and search the files, but you cannot change them or run anything. whobrokeit runs your script and tells you what happened.
+
+## The script
+
+It will run unchanged on many older commits, so it must follow this contract exactly:
+
+- The behavior is correct: exit 0.
+- The bug is present: print one line that starts with \`${BUG_MARKER}\` and says what was expected and what actually happened, then exit 1.
+- The check cannot run on this version of the code, because something it needs (a module, function or option) does not exist yet: exit 125. Never use 125 for the bug itself.
+- If the bug shows up as an exception or a crash, catch it around the one call that triggers it and report it as the bug, but only when it is the error from the report: check its message or type, and rethrow anything else. Never put imports or setup inside that try, because on an older commit they can fail for unrelated reasons.
+- Any other failure, like a crash in the script itself, counts as "can't tell" rather than as the bug.
+
+Keep it short (usually under 40 lines) and deterministic: no network, no sleeping, no dependence on today's date or on random values, done in a few seconds. Use only the language runtime, the project's own code and the dependencies it already has (they are installed before the script runs). Load the code under test through stable entry points so the script still works on older commits. Prefer a plain script over a test framework. Write comments and messages in the language the bug report is written in (an English report gets English messages), whatever language you usually reply in. In Node.js, set process.exitCode instead of calling process.exit(), so the output is not cut off.
+
+Put the script in a new file, never an existing one, at the repository root unless the language needs it somewhere else. The command runs from the repository root and must run only this script, not the whole test suite.
+
+## Reply format
+
+Reply with these three tags, and nothing after them:
+
+<path>whobrokeit-repro.mjs</path>
+<command>node whobrokeit-repro.mjs</command>
+<code>
+...the complete file...
+</code>
+
 If the report does not describe something you can check, or the code shows that the described behavior is intended, reply with <cannot>one sentence saying why</cannot> instead.`,
     ];
     if (attempts.length > 0) {

package/dist/sandbox.js

@@ -89,14 +89,14 @@ export class Sandbox {
             const setup = await this.pendingSetup();
             if (setup) {
                 onSetup?.(setup.command);
-                const result = await runCommand(setup.command, this.dir, this.timeoutMs);
+                const result = await runCommand(setup.command, this.dir, this.timeoutMs, { untrusted: true });
                 if (result.code !== 0) {
                     this.installedKey = null;
                     return { verdict: 'skip', run: result, reason: 'dependencies failed to install' };
                 }
                 this.installedKey = setup.key;
             }
-            const run = await runCommand(test, this.dir, this.timeoutMs);
+            const run = await runCommand(test, this.dir, this.timeoutMs, { untrusted: true });
             return { ...classify(run), run };
         }
         finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whobrokeit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Find the commit that broke it, and prove it.",
   "type": "module",
   "bin": {