Commit Graph
11 Commits
Author SHA1 Message Date
Vlad MocanuandClaude Opus 4.6 29a1032aa6 fix: normalize Forgejo PR/issue state to uppercase
Forgejo REST API returns state as lowercase ("closed"/"open") but
branch.ts compares against GraphQL-style uppercase ("CLOSED"/"MERGED").
This caused @claude on closed/merged PRs to take the open-PR checkout
path, failing with "fatal: invalid reference: refs/pull/N/head".

Normalize state to uppercase in the Forgejo data fetcher, matching the
existing pattern used for review state (line 153).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 21:19:53 +02:00
Vlad MocanuandClaude Opus 4.6 741f12afaf fix(prd-7): M5 code quality review — remove dead re-exports, verify type safety
- Removed unused re-exports (CommentUpdateInput, ExecutionDetails,
  ensureProperlyEncodedUrl) from forgejo/comment-logic.ts
- Verified no `any` type escapes in Forgejo-specific code
- Confirmed naming conventions consistent with upstream
- No dead code, unused imports, or unreachable branches
- All complex decisions documented with comments
- Typecheck, format, and 834 tests pass clean

Progress: 83% complete — M6 (documentation accuracy) remaining

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:57:25 +02:00
Vlad MocanuandClaude Opus 4.6 6b0302d226 fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation
- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
  with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)

Progress: 50% complete (3/6 milestones) — next: M4 test coverage review

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:31:12 +02:00
Vlad MocanuandClaude Opus 4.6 cefc229199 fix(prd-7): M2 error handling review — fix process.exit bypasses, TOCTOU gap, URL consistency
- F1: Replace process.exit(1) with throw in branch.ts (cleanup was bypassed)
- F2: Replace process.exit(1) with throw in install-mcp-server.ts (same issue)
- F2b: Replace process.exit(1) with throw in create-prompt/index.ts (same issue)
- F3: Use getServerUrl() instead of GITHUB_SERVER_URL constant in branch-cleanup.ts
- F4: Use updated_at for review TOCTOU filtering in Forgejo data fetcher
- Accepted notes: no pagination >100, no retry, unconditional trigger, image no-op

Progress: 33% complete — M2 done, M3 (security review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:16:22 +02:00
Vlad MocanuandClaude Opus 4.6 ac58fb6c14 fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection
- F1: Consolidated updateForgejoCommentBody into unified updateCommentBody (~150 lines removed)
- F2: Fixed wrong run identifier in update-with-branch.ts (context.runId → getForgejoRunIndex())
- F3: Memoized detectPlatform() with _resetPlatformCache() for tests
- F4: Added getServerUrl() runtime helper to resolve constant-vs-function inconsistency
- F5: Fixed sticky comment bot matching on Forgejo via context.inputs.botName
- F6: Documented GHES heuristic misidentification in docs/forgejo.md
- Updated PRD M1 checkbox to complete

Progress: 17% complete — M1 done, M2 (error handling review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:09:02 +02:00
Vlad MocanuandClaude Opus 4.6 23f15aecb9 fix: use GITHUB_RUN_NUMBER for Forgejo job URLs and pin Bun version in CI
Forgejo uses the per-repo sequential run index (GITHUB_RUN_NUMBER) in
action URLs, not the internal DB run ID (GITHUB_RUN_ID). This caused
"View job" links to return 404. Fixed in all 4 URL construction sites:
create-initial comment, update-comment-link, and both prompt generators.

Also pins Bun to 1.2.21 in CI — Bun 1.3.9 broke spyOn(fs, ...) which
failed 18 upstream image-downloader tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 21:07:40 +02:00
Vlad MocanuandClaude Opus 4.6 b4a6c34853 fix: use per-review comment fetching for Forgejo compatibility
Forgejo doesn't have the flat GET /pulls/{number}/comments endpoint
(returns 404). Replace pulls.listReviewComments() with a 2-phase
approach: fetch reviews first, then pulls.listCommentsForReview()
per-review in parallel. Updates tests to mock the new per-review API.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 20:52:25 +02:00
Vlad MocanuandClaude Opus 4.6 0802ac18eb feat(prd-1): implement M5 - Forgejo comment URL formatting
- Create src/forgejo/comment-logic.ts with Forgejo-specific URL builders:
  - Unicode spinner (replaces GitHub CDN image)
  - PR compare URL with expand=1 (no quick_pull=1)
  - Dynamic extractOwnerRepoFromUrl() fixing hardcoded github.com regex
  - updateForgejoCommentBody() with cross-platform URL extraction
- 41 tests covering all URL patterns, spinner, and the critical regex fix
- No upstream files modified (lean adapter approach)

Progress: 56% complete (5/9) - next: M6 (MCP server platform routing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 17:48:16 +02:00
Vlad MocanuandClaude Opus 4.6 4b0737c54c feat(prd-1): implement M4b - Forgejo REST comment/review fetching
- Add 3 REST calls to Promise.all for PRs (listComments, listReviews,
  listReviewComments) and 1 for issues (listComments)
- Add mapping helpers: mapRestComments, mapRestReviewComments,
  mapRestReviews (groups inline comments by pull_request_review_id)
- Import and apply TOCTOU filtering (filterCommentsToTriggerTime,
  filterReviewsToTriggerTime) and actor filtering from GitHub fetcher
- Add image processing pipeline via downloadCommentImages (no-op on
  Forgejo due to URL pattern mismatch, architecturally correct)
- Deep-clone reviews before filtering to preserve contextData immutability
- Update test suite: 51 tests covering mapping helpers, full fetch
  flow, TOCTOU filtering, actor filtering, and contextData immutability
- Updated PRD checkboxes for M4b completion

Progress: 44% complete (4/9 milestones) - next: M5 or M3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 17:00:13 +02:00
Vlad MocanuandClaude Opus 4.6 6e104a33dc feat(prd-1): implement M4a - Forgejo REST data fetching (PR/issue basics)
- Add src/forgejo/data/fetcher.ts: REST-based data fetcher replacing
  GraphQL queries with parallel Octokit REST calls (PR details + files
  + commits via Promise.all, issue details, file status mapping, SHA
  computation, TOCTOU title/body protection, user display name)
- Add test/forgejo-data-fetcher.test.ts with 31 test cases covering
  field mapping, parallel fetch, null handling, and edge cases
- Output matches FetchDataResult type for downstream compatibility
- Comments/reviews left empty (M4b scope)

Progress: 33% complete (M1, M2, M4a done) - next: M4b or M5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 16:19:09 +02:00
Vlad MocanuandClaude Opus 4.6 385acacc32 feat(prd-1): implement M2 - Forgejo token handling
- Add src/forgejo/token.ts: synchronous token handler that returns
  OVERRIDE_GITHUB_TOKEN or DEFAULT_WORKFLOW_TOKEN directly (no OIDC)
- Wire platform-aware token setup into run.ts with early branch
  before existing setupGitHubToken() call
- Add test/forgejo-token.test.ts with 8 test cases covering
  override precedence, default fallback, and error handling
- GitHub token path remains completely unchanged

Progress: 22% complete (M1, M2 done) - next: M3 (CI workflows) or M5 (comment URLs)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 16:10:00 +02:00