Merge branch 'main' into feat/scoring-branch-eligibility-breakdown

Author: andriypolanski

review-enrichment/src/analyzers/doc-comment-drift.ts

@@ -10,6 +10,7 @@ import type { EnrichRequest, DocCommentDriftFinding } from "../types.js";
 const MAX_FILES = 20;
 const MAX_FINDINGS = 50;
 const MAX_SIGNATURE_LINES = 40;
+const MAX_FETCH_BYTES = 1_000_000;
 const SOURCE_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs)$/;
 const SKIP_RE = /(?:\.d\.ts$|\.min\.|\.test\.|\.spec\.|__tests__\/|(?:^|\/)tests?\/)/;
 const SLUG_RE = /^[A-Za-z0-9._-]+$/;
@@ -22,6 +23,34 @@ interface ScanOptions {
   signal?: AbortSignal;
 }
 
+async function readBoundedText(resp: Response, signal?: AbortSignal): Promise<string | null> {
+  const length = Number(resp.headers.get("content-length"));
+  if (Number.isFinite(length) && length > MAX_FETCH_BYTES) return null;
+  if (!resp.body) return null;
+
+  const reader = resp.body.getReader();
+  const decoder = new TextDecoder();
+  let size = 0;
+  let text = "";
+  try {
+    while (true) {
+      if (signal?.aborted) return null;
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_FETCH_BYTES) {
+        await reader.cancel();
+        return null;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
 /** Reconstruct the pre-PR content of a file by reverse-applying its unified `patch` to the post-PR `newContent`:
  *  context and removed (`-`) lines rebuild the old text; added (`+`) lines are dropped. Returns null if a hunk's
  *  position runs past the content (so the caller falls back to "no old parameters" and reports nothing). Pure. */
@@ -325,7 +354,7 @@ export async function scanDocCommentDrift(
         `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/contents/${path}?ref=${encodeURIComponent(headSha)}`,
         { headers, signal: options.signal },
       );
-      if (resp.ok) content = await resp.text();
+      if (resp.ok) content = await readBoundedText(resp, options.signal);
     } catch {
       content = null;
     }

review-enrichment/test/doc-comment-drift.test.ts

@@ -19,8 +19,8 @@ const baseReq = (files) => ({
   githubToken: "ght",
   files,
 });
-const fileWith = (content) => async () => ({ ok: true, text: async () => content });
-const status = (code) => async () => ({ ok: code >= 200 && code < 300, status: code, text: async () => "" });
+const fileWith = (content, init) => async () => new Response(content, init);
+const status = (code) => async () => new Response("", { status: code });
 const oldParams = (entries) => new Map(entries.map(([name, ids]) => [name, new Set(ids)]));
 
 const DRIFTED = `/**\n * @param oldName the old one\n */\nexport function doThing(newName) {\n  return newName;\n}\n`;
@@ -227,6 +227,43 @@ test("scanDocCommentDrift: fetches the file at headSha and reports drift", async
   assert.deepEqual(findings[0].staleParams, ["oldName"]);
 });
 
+test("scanDocCommentDrift: skips oversized file responses before reading the body", async () => {
+  let bodyAccessed = false;
+  const out = await scanDocCommentDrift(
+    baseReq([{ path: "src/a.ts", patch: DRIFT_PATCH }]),
+    async () => ({
+      ok: true,
+      headers: new Headers({ "content-length": "1000001" }),
+      get body() {
+        bodyAccessed = true;
+        return new Response(DRIFTED).body;
+      },
+    }),
+  );
+  assert.deepEqual(out, []);
+  assert.equal(bodyAccessed, false);
+});
+
+test("scanDocCommentDrift: cancels streamed file responses that exceed the byte cap", async () => {
+  let canceled = false;
+  const chunk = new Uint8Array(500_001);
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(chunk);
+      controller.enqueue(chunk);
+    },
+    cancel() {
+      canceled = true;
+    },
+  });
+  const out = await scanDocCommentDrift(
+    baseReq([{ path: "src/a.ts", patch: DRIFT_PATCH }]),
+    async () => new Response(stream),
+  );
+  assert.deepEqual(out, []);
+  assert.equal(canceled, true);
+});
+
 test("scanDocCommentDrift: requires a github token and a head sha", async () => {
   assert.deepEqual(await scanDocCommentDrift({ repoFullName: "o/r", prNumber: 1, headSha: "x", files: [{ path: "src/a.ts", patch: DRIFT_PATCH }] }, fileWith(DRIFTED)), []);
   assert.deepEqual(await scanDocCommentDrift({ repoFullName: "o/r", prNumber: 1, githubToken: "t", files: [{ path: "src/a.ts", patch: DRIFT_PATCH }] }, fileWith(DRIFTED)), []);

scripts/deploy-selfhost-image.sh

@@ -129,8 +129,8 @@ validate_inputs() {
     exit 1
   fi
   case "$image" in
-    *[[:space:]\"\'\\]*)
-      echo "error: image contains unsupported whitespace, quote, or backslash characters" >&2
+    *[[:space:]\"\'\\\$\{\}]*)
+      echo "error: image contains unsupported whitespace, quote, backslash, or compose interpolation characters" >&2
       exit 1
       ;;
   esac

src/index.ts

@@ -52,7 +52,8 @@ export default {
                 resetAt,
               }),
             );
-            message.retry({ delaySeconds: delayUntil(resetAt) });
+            await env.JOBS.send(message.body, { delaySeconds: delayUntil(resetAt) });
+            message.ack();
             continue;
           }
         }

test/unit/index.test.ts

@@ -169,6 +169,12 @@ describe("worker entrypoint", () => {
     await recordGitHubRateLimitObservation(env, { repoFullName: "owner/repo", resource: "rest", path: "/x", statusCode: 200, limitValue: 5000, remaining: 120, resetAt: "2026-06-24T12:10:00.000Z", observedAt: "2026-06-24T12:00:00.000Z" });
     const acked: string[] = [];
     const retries: Array<{ delaySeconds?: number } | undefined> = [];
+    const requeued: Array<{ message: import("../../src/types").JobMessage; delaySeconds?: number }> = [];
+    env.JOBS = {
+      async send(message: import("../../src/types").JobMessage, options?: { delaySeconds?: number }) {
+        requeued.push({ message, ...(options?.delaySeconds === undefined ? {} : { delaySeconds: options.delaySeconds }) });
+      },
+    } as unknown as Queue;
     const batch = {
       messages: [
         {
@@ -182,8 +188,20 @@ describe("worker entrypoint", () => {
 
     await worker.queue(batch, env);
 
-    expect(acked).toEqual([]);
-    expect(retries).toEqual([{ delaySeconds: 615 }]);
+    expect(acked).toEqual(["background-regate"]);
+    expect(retries).toEqual([]);
+    expect(requeued).toEqual([
+      {
+        message: {
+          type: "agent-regate-pr",
+          deliveryId: "sweep:owner/repo#7",
+          repoFullName: "owner/repo",
+          prNumber: 7,
+          installationId: 123,
+        },
+        delaySeconds: 615,
+      },
+    ]);
     vi.useRealTimers();
   });
 

test/unit/selfhost-image-deploy.test.ts

@@ -192,4 +192,23 @@ describe("self-host image deploy script", () => {
       harness.cleanup();
     }
   });
+
+  it.each([
+    "registry.example/gittensory:${GITHUB_OAUTH_CLIENT_SECRET}",
+    "registry.example/gittensory:$GITHUB_OAUTH_CLIENT_SECRET",
+    "registry.example/gittensory:{GITHUB_OAUTH_CLIENT_SECRET}",
+  ])("rejects compose interpolation characters in image %s", (image) => {
+    const { harness, result } = runHarness({ args: [image], envFile: "EXISTING=1\n" });
+    try {
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain(
+        "image contains unsupported whitespace, quote, backslash, or compose interpolation characters",
+      );
+      expect(readFileSync(harness.envPath, "utf8")).toBe("EXISTING=1\n");
+      expect(harness.readImages()).toBe("");
+      expect(harness.readCalls()).not.toContain(" pull ");
+    } finally {
+      harness.cleanup();
+    }
+  });
 });