18 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
claw	491df7cb1f	fix(github): address review findings from rounds 2867/2870 ... - Extract duplicated CheckRedirect lambda to defaultCheckRedirect function (sonnet #1: eliminate duplication between NewClient and SetHTTPClient) - Remove unnecessary int64 cast in response size check (sonnet #3) - Validate fallback unmarshal in ListContents to reject zero-value entries (sonnet #5: prevent accepting unexpected JSON formats silently) - Rename strPtr to stringPtr for consistency (sonnet #6) - Add doc comment about APIError.Error body exposure (security #3) Deferred to separate issues: - #95: Reject cross-host redirects entirely (security #1) - #96: Add safeguards for AllowInsecureHTTP (security #2)	2026-05-12 17:30:24 -07:00
claw	1fcc0b738a	fix(github): address MINOR/NIT findings from review #2866 ... - SetHTTPClient(nil): preserve CheckRedirect auth-stripping policy instead of restoring a plain http.Client that loses cross-host protection. - Authorization header: add comment documenting why Bearer scheme is correct (OAuth2 standard, works for both classic PATs and fine-grained tokens). - Retry-After parsing: support HTTP-date format (RFC 7231) in addition to integer seconds. GitHub only sends integers today, but the implementation is now spec-compliant. - escapePath dot-segment removal: document the behavior in public API doc comments for ListContents and GetFileContentAtRef so callers are aware without reading the internal helper.	2026-05-12 17:13:07 -07:00
claw	fce5f2d184	fix(github): address review findings on client.go ... - Use net/url.Parse for HTTPS scheme check (case-insensitive) - Guard SetHTTPClient against nil (restores default 30s client) - Rename 'url' param to 'reqURL' in doRequest/doGet for clarity - Return error when response exceeds maxResponseBytes instead of silently truncating Finding #1 (Bearer auth scheme) intentionally kept: GitHub REST API officially supports and recommends Bearer for all token types. See: https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api	2026-05-12 16:55:32 -07:00
claw	af72c64b7f	fix(github): correct ListContents error wrapping and move HTTPS guard before retry loop	2026-05-12 16:48:39 -07:00
claw	1bc3f206ba	fix: address review findings from rounds 2843-2846 ... - Remove redundant timer.Stop() after timer fires (Sonnet #1, GPT #2) - Remove unused TotalCount field from checkRunsResponse (Sonnet #2) - Improve escapePath doc comment to explain deliberate silent stripping (Sonnet #3) - Fix ListContents to handle both array (directory) and object (single file) responses from GitHub Contents API (GPT #3) - Add HTTPS enforcement: refuse to send credentials over non-HTTPS URLs unless AllowInsecureHTTP() option is passed (Security #1) - Replace constant-value test with actual behavior test for response body limiting (Sonnet #6) - Run gofmt for consistent formatting (Sonnet #4) - Add tests for HTTPS enforcement and ListContents single-file handling	2026-05-12 16:39:01 -07:00
claw	c10bb72117	fix: address self-review NIT findings on PR #93 ... - Add timer.Stop() on happy path in retry loop (idiomatic) - Add concurrency caveat to Client doc comment for SetHTTPClient/SetRetryBackoff - Add explicit 'stale'/'waiting' cases to mapCheckRunStatus	2026-05-12 16:25:32 -07:00
claw	ae91c8aef5	fix: address review findings from rounds 2834-2838 ... - Unexport RetryBackoff, add SetRetryBackoff method (#17286) - Rename http field to httpClient to avoid shadowing (#17289) - Group const blocks into single declaration (#17291) - Fix CheckRedirect to compare against previous hop, not first (#17302) - Strip auth header on protocol downgrade https→http (#17297) - Add maxPages safeguard to pagination loops (#17299, #17300) - Document mapCheckRunStatus unused second parameter (#17287, #17303)	2026-05-12 16:11:58 -07:00
claw	75f65fbf5d	fix: address MINOR review findings on PR #93 (round 2) ... - Add User-Agent header to all requests (gpt-review-bot) - Limit successful response body to 10 MiB via io.LimitReader (security-review-bot) - Add CheckRedirect to strip Authorization on cross-host redirects (security-review-bot) - Fix decodeBase64Content to strip both \r and \n (gpt-review-bot) - Document that transport errors are not retried (sonnet-review-bot) - Update package doc to reflect current scope (no review submission yet) - Add tests for User-Agent, empty-token auth skip, CRLF base64, CheckRedirect	2026-05-12 16:00:09 -07:00
claw	5b43afc6d4	fix: address review feedback on PR #93 ... - Fix Retry-After slice mutation: copy c.RetryBackoff before modifying to prevent permanent mutation of the shared slice (sonnet#1, security#1) - Cap Retry-After to 120s maximum to prevent excessive sleeps (security#2) - Guard auth header: only set Authorization when token is non-empty (gpt#2) - Fix GetFileContent doc comment to match actual behavior (sonnet#3, gpt#1) - Remove dead 'in_progress/queued' case in mapCheckRunStatus (sonnet#4) - Add testing.Short() guard to slow retry test (sonnet#5) - Reject dot-segments in escapePath to prevent path traversal (security#3) - Add regression tests for non-mutation and escapePath safety	2026-05-12 15:43:45 -07:00
claw	d1ef1e21e5	feat(github): implement PRReader + FileReader client (#80) ... Implement the GitHub API client with PRReader and FileReader interface conformance for both github.com and GitHub Enterprise. New files: - github/client.go: Client struct, NewClient with configurable base URL, HTTP helpers with 429 retry and Retry-After support - github/pr.go: GetPullRequest, GetPullRequestDiff (per-request Accept header), GetPullRequestFiles (paginated, populates Patch field), GetFileContentAtRef (base64 decode), GetCommitStatuses (merges commit statuses + check runs with conclusion mapping) - github/files.go: GetFileContent (delegates to GetFileContentAtRef), ListContents, escapePath, decodeBase64Content helpers Type changes: - vcs/types.go: Add Patch field to ChangedFile struct Tests cover: happy path, 404, 401, 429+retry, malformed response, pagination, binary files, check run conclusion mapping, base64 decoding. Compile-time checks: var _ vcs.PRReader = (*Client)(nil) var _ vcs.FileReader = (*Client)(nil) Exit criteria met: - go test ./github/... passes (all methods) - NewClient with empty baseURL uses https://api.github.com - NewClient with GHE URL targets correctly - GetFileContent delegates to GetFileContentAtRef with empty ref - GetPullRequestFiles paginates and populates Patch field - GetCommitStatuses merges both commit statuses and check-runs	2026-05-12 15:18:55 -07:00
claw	ec03dc2373	fix: address remaining review findings (interface assertions, DismissReview ctx, import order, filepath param, spelling)	2026-05-12 13:07:41 -07:00
claw	1749d95727	fix(vcs): address review findings on PR #88 ... Findings addressed: - F1/G1: Add doc comment to GetAllFilesInPath documenting fail-fast contract - F2/G2: Add explicit backslash-prefix guard to skip '\ No newline' markers - F3: Add comment explaining position > 0 guard (skip lines before first hunk) - F4: Refactor parseHunkNewStart to use strconv.Atoi instead of per-char concat - F5: Add error propagation tests (ListContents, GetFileContent, nested, ctx cancel) - F6: Wrap errors.ErrUnsupported in DismissReview for programmatic checking - S1: Add ctx.Err() checks + max file count/byte constants with clear errors - S2: Addressed by S1 — input bounds are now enforced via the same constants	2026-05-12 12:56:13 -07:00
claw	7c83365fc4	feat(vcs): complete Phase 1 — util.go, type cleanup, interface additions (fixes #84, #85, #86) ... - Create vcs/util.go with GetAllFilesInPath and BuildLineToPositionMap - Create vcs/util_test.go with comprehensive tests for both functions - Remove review.ContentEntry type, replace with vcs.ContentEntry - Remove review.GiteaClient interface, replace with vcs.FileReader - Update review/repo_persona.go to use vcs.FileReader - Update review/repo_persona_test.go to use vcs.ContentEntry - Update cmd/review-bot/main.go adapter to implement vcs.FileReader - Add Number and Base fields to vcs.PullRequest - Add CommitStatus type to vcs/types.go - Add GetFileContentAtRef to vcs.PRReader interface - Add GetCommitStatuses to vcs.PRReader interface - Add DismissReview to vcs.Reviewer interface - Add stub implementations on gitea.Client for new interface methods Closes #84, Closes #85, Closes #86	2026-05-12 12:38:21 -07:00
claw	cd6cd93bf0	fix(vcs): address PR #83 review findings (round 2) ... - Extract named HeadRef and UserInfo structs from anonymous structs in PullRequest and Review (comments 16615, 16616) - Change ReviewEventApprove value from "APPROVED" to "APPROVE" to represent the action, not the state; document adapter translation responsibility (comment 16621) - Add doc comment on ReviewComment.CommitID noting optionality (16531) - Move compile-time assertion from check.go (//go:build ignore) to check_test.go with a "phase2" build tag — removes gitea adapter import from the vcs package (comment 16622) - check.go misleading comment was already fixed in prior commit (16532, 16539) - Sha→SHA, typed ReviewEvent, duplicate package doc already resolved (16537, 16538, 16530)	2026-05-12 12:06:29 -07:00
claw	c889724dda	fix(vcs): address Phase 1 review findings ... - Rename PullRequest.Head.Sha → SHA (Go acronym convention) - Add typed ReviewEvent alias with exported constants - Remove duplicate package doc from types.go (kept in interfaces.go) - Fix misleading comment in check.go	2026-05-12 12:00:30 -07:00
claw	1ac51669ed	docs(vcs): add package doc to interfaces.go	2026-05-12 10:05:39 -07:00
claw	2e6f46f28d	feat(vcs): extract interfaces and types from gitea/ (Phase 1, #78) ... Add vcs/interfaces.go and vcs/types.go as the foundation for multi-platform VCS support. Interfaces are discovered from working gitea/client.go code, not invented in a vacuum. vcs/interfaces.go — role-based interfaces: - PRReader: GetPullRequest, GetPullRequestDiff, GetPullRequestFiles - FileReader: GetFileContent (path + ref), ListContents - Reviewer: PostReview (ReviewRequest), ListReviews, DeleteReview - Identity: GetAuthenticatedUser - Client: all four composed vcs/types.go — types extracted from gitea/: - PullRequest, ChangedFile, ContentEntry, Review (identical to gitea/) - ReviewComment: uses GitHub diff-position convention (Position int, CommitID string) instead of Gitea's NewPosition int64 - ReviewRequest: new type wrapping Body, Event, Comments vcs/check.go (//go:build ignore) — documents the gaps gitea.Client must bridge in Phase 2: 1. PostReview signature mismatch (event+body+[]ReviewComment vs ReviewRequest) 2. GetFileContent missing ref parameter 3. ReviewComment type mismatch (NewPosition vs Position/CommitID) No behavior changes. All existing tests pass.	2026-05-12 10:04:57 -07:00
claw	db479d0ff4	fix: retry on transient LLM response body truncation ... Addresses intermittent 'unexpected end of JSON input' failures where the LLM response body is truncated in transit between the proxy and client. Root cause: network-level truncation where io.ReadAll returns partial data (observed in 3/50 CI runs through HAI proxy). The response body reading was already using io.ReadAll correctly, but transient network issues between the proxy and client can still cause partial reads. Changes: - Add Content-Length validation in doRequest: detect when fewer bytes arrive than the server declared, triggering a retry - Add retry logic in Complete: retries once on retryable errors (body read failures, content-length mismatches) with a 500ms backoff - Add parse-level retry in main: if ParseResponse fails, re-requests from the LLM once before giving up (defensive, since retries always succeed per issue evidence) - Improve ParseResponse error diagnostics: log raw vs cleaned lengths and a preview of the cleaned content to aid future debugging Does NOT retry on API errors (4xx/5xx) or structural issues — only transient body read problems. Closes #47	2026-05-07 00:44:32 -07:00