feat: opencode review engine + .opencode factory

Replace the single Python model-call reviewer with an opencode agent factory. A primary 'pragent' agent reads a brief (title/body/diff/config/ prior reviews), inspects the checked-out repo, runs the repo's own linters via bash, loads review-methodology + findings-schema skills, and emits a {summary, findings} JSON with per-finding severity/path/line/problem/fix/ suggestion/reference. Dormant security/tests/perf subagent lenses fan out only on large/risky diffs (lean by default). pilot/opencode_review.py: fetches the repo archive at the head sha into a temp workdir, writes .pragent/brief.md, drops the factory, runs 'opencode run --pure --agent pragent --dir <workdir>' headlessly. Isolates HOME (shared, warmed), strips ANTHROPIC_* env (leaked host vars caused ProviderModelNotFoundError), stdin=DEVNULL (opencode blocks on stdin), maps the bare OLLAMA_MODEL to the provider-prefixed ref. No Gitea I/O — ai_review.review_pr parses + anchors + posts (reuses all v2 logic/tests). PRAGENT_ENGINE=opencode (default) selects it; =ollama keeps the legacy direct-call path. Verified end-to-end: posts a real review with a summary section, inline [CRITICAL]/[HIGH] comments + apply-able suggestions + reference links, and the sha dedupe marker. 49 tests pass. Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-17 23:01:59 +00:00
parent 8758b22802
commit 6e3a9eb5b0
13 changed files with 1336 additions and 48 deletions
@@ -14,6 +14,7 @@ from ai_review import (  # noqa: E402
    parse_diff_anchors,
    parse_findings,
    parse_repo_config,
+    parse_review_output,
    parse_text_blocks,
    prior_review_bodies,
    reviewed_shas,
@@ -340,4 +341,90 @@ def test_prior_review_bodies_skips_current_sha():

 def test_format_review_body_has_sha_marker():
    body = format_review_body("- [high] x:1 — b", "glm-5.2:cloud", "abcdef1234567890")
-    assert "<!-- pragent:sha=abcdef1234567890 -->" in body
+    assert "<!-- pragent:sha=abcdef1234567890 -->" in body
+
+
+# ---------------------------------------------------------------------------
+# parse_review_output (opencode engine: {summary, findings} + reference)
+# ---------------------------------------------------------------------------
+
+
+def test_parse_review_output_summary_and_findings():
+    txt = (
+        "This PR adds an eval helper — risky. See findings.\n\n"
+        "```json\n"
+        '{"summary":"Adds eval() — security risk.","findings":['
+        '{"severity":"critical","path":"src/x.ts","line":4,"problem":"eval on user input",'
+        '"fix":"parse explicitly","suggestion":"const n = Number(s)","reference":"https://owasp.org/x"}'
+        "]}",
+        "\n```",
+    )
+    summary, fs = parse_review_output("".join(txt))
+    assert "eval()" in summary
+    assert len(fs) == 1
+    assert fs[0]["severity"] == "critical"
+    assert fs[0]["reference"] == "https://owasp.org/x"
+    assert fs[0]["suggestion"] == "const n = Number(s)"
+
+
+def test_parse_review_output_bare_findings_no_summary():
+    txt = '```json\n{"findings":[{"severity":"low","path":"a","line":1,"problem":"p"}]}\n```'
+    summary, fs = parse_review_output(txt)
+    assert summary == ""
+    assert len(fs) == 1
+    assert fs[0]["reference"] == ""  # default
+
+
+def test_parse_review_output_empty_and_bogus():
+    assert parse_review_output("") == ("", [])
+    assert parse_review_output("no json here") == ("", [])
+    assert parse_review_output('{"findings":[]}') == ("", [])
+
+
+def test_parse_review_output_uses_last_json_block():
+    # Agent emits a stray json-ish block first, then the real one last.
+    txt = (
+        "```json\n{\"findings\":[{\"path\":\"x\",\"line\":1,\"severity\":\"low\"}]}\n```\n"
+        "more prose\n"
+        "```json\n{\"summary\":\"real\",\"findings\":[{\"path\":\"y\",\"line\":2,\"severity\":\"high\"}]}\n```"
+    )
+    summary, fs = parse_review_output(txt)
+    assert summary == "real"
+    assert len(fs) == 1
+    assert fs[0]["path"] == "y"
+
+
+# ---------------------------------------------------------------------------
+# reference rendering in inline_comment_body + summary_bullets + summary section
+# ---------------------------------------------------------------------------
+
+
+def test_inline_comment_body_renders_reference():
+    f = {"severity": "high", "path": "a", "line": 1, "problem": "p", "fix": "f",
+         "suggestion": "", "reference": "https://cve.example/X"}
+    body = inline_comment_body(f)
+    assert "📎 ref: https://cve.example/X" in body
+
+
+def test_inline_comment_body_no_reference_no_ref_line():
+    f = {"severity": "low", "path": "a", "line": 1, "problem": "p", "fix": "",
+         "suggestion": "", "reference": ""}
+    assert "📎 ref" not in inline_comment_body(f)
+
+
+def test_summary_bullets_renders_reference():
+    fs = [{"severity": "high", "path": "a.py", "line": 7, "problem": "p", "fix": "f",
+           "suggestion": "", "reference": "https://r.example"}]
+    b = summary_bullets(fs)
+    assert "https://r.example" in b
+    assert "`a.py:7`" in b
+
+
+def test_format_review_body_with_summary_section():
+    body = format_review_body("- [high] x:1 — b", "glm-5.2:cloud", "abcdef1234567890",
+                              summary="This PR adds a risky helper.")
+    assert "This PR adds a risky helper." in body
+    assert "- [high] x:1" in body
+    assert "<!-- pragent:sha=abcdef1234567890 -->" in body
+    # summary appears before the findings bullets
+    assert body.index("risky helper") < body.index("[high]")
@@ -0,0 +1,126 @@
+"""Unit tests for the opencode engine glue (no network, no opencode run)."""
+import io
+import os
+import sys
+import tarfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
+sys.path.insert(0, os.path.join(ROOT, "pilot"))
+
+import opencode_review as oc  # noqa: E402
+
+
+# ---------------------------------------------------------------------------
+# write_brief
+# ---------------------------------------------------------------------------
+
+
+def test_write_brief_contains_key_sections(tmp_path):
+    brief = oc.write_brief(
+        str(tmp_path),
+        repo="masi/portfolio", index="3", sha="abcdef1234567890",
+        title="Add eval helper", description="Closes #1",
+        diff="diff --git a/x b/x\n+++ b/x\n@@ -1 +1,2 @@\n+eval(input())",
+        config={"focus": ["security"], "instructions": "Flag eval()."},
+        prior_reviews=["🤖 AI Review …\n- [high] old finding"],
+    )
+    assert brief.endswith(".pragent/brief.md")
+    text = open(brief, encoding="utf-8").read()
+    assert "masi/portfolio" in text
+    assert "#3" in text
+    assert "abcdef1234567890" in text
+    assert "Add eval helper" in text
+    assert "Closes #1" in text
+    assert "eval(input())" in text
+    assert "security" in text
+    assert "Flag eval()" in text
+    assert "old finding" in text
+    assert "POST-CHANGE" in text  # anchor hint
+
+
+def test_write_brief_none_config_and_prior(tmp_path):
+    brief = oc.write_brief(
+        str(tmp_path), repo="o/r", index="1", sha="sha1234567",
+        title="t", description="", diff="d", config=None, prior_reviews=None,
+    )
+    text = open(brief, encoding="utf-8").read()
+    assert "_(none)_" in text  # both config and prior fall back to none
+    assert "diff" in text
+
+
+# ---------------------------------------------------------------------------
+# _extract_tar_strip_one — strips the single top-level dir
+# ---------------------------------------------------------------------------
+
+
+def _make_tar(top: str) -> bytes:
+    """Build a tar.gz in memory with one top-level dir `top` containing files."""
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        # dir
+        ti = tarfile.TarInfo(name=f"{top}/")
+        ti.type = tarfile.DIRTYPE
+        tar.addfile(ti)
+        # file src/a.py
+        data = b"print('a')\n"
+        ti = tarfile.TarInfo(name=f"{top}/src/a.py")
+        ti.size = len(data)
+        tar.addfile(ti, io.BytesIO(data))
+        # file README.md
+        data = b"# hi\n"
+        ti = tarfile.TarInfo(name=f"{top}/README.md")
+        ti.size = len(data)
+        tar.addfile(ti, io.BytesIO(data))
+    return buf.getvalue()
+
+
+def test_extract_tar_strips_top_level_dir(tmp_path):
+    blob = _make_tar("repo-deadbeef")
+    oc._extract_tar_strip_one(blob, str(tmp_path))
+    # files sit directly at dest root (prefix stripped)
+    assert os.path.isfile(tmp_path / "README.md")
+    assert os.path.isfile(tmp_path / "src" / "a.py")
+    assert not os.path.isdir(tmp_path / "repo-deadbeef")  # top dir gone
+
+
+def test_extract_tar_no_common_prefix_extracts_as_is(tmp_path):
+    # Two different top-level entries -> no strip.
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        for name, data in (("a.txt", b"A"), ("b.txt", b"B")):
+            ti = tarfile.TarInfo(name=name)
+            ti.size = len(data)
+            tar.addfile(ti, io.BytesIO(data))
+    oc._extract_tar_strip_one(buf.getvalue(), str(tmp_path))
+    assert os.path.isfile(tmp_path / "a.txt")
+    assert os.path.isfile(tmp_path / "b.txt")
+
+
+def test_extract_tar_skips_parent_traversal(tmp_path):
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        ti = tarfile.TarInfo(name="top/../../escape.txt")
+        data = b"evil"
+        ti.size = len(data)
+        tar.addfile(ti, io.BytesIO(data))
+        ti = tarfile.TarInfo(name="top/ok.txt")
+        data = b"ok"
+        ti.size = len(data)
+        tar.addfile(ti, io.BytesIO(data))
+    oc._extract_tar_strip_one(buf.getvalue(), str(tmp_path))
+    assert os.path.isfile(tmp_path / "ok.txt")
+    assert not os.path.isfile(tmp_path / "escape.txt")
+    assert not os.path.isfile(os.path.join(str(tmp_path), "..", "escape.txt"))
+
+
+# ---------------------------------------------------------------------------
+# drop_factory — copies opencode.json + .opencode/ from the repo
+# ---------------------------------------------------------------------------
+
+
+def test_drop_factory_copies_config_and_agents(tmp_path):
+    oc.drop_factory(str(tmp_path))
+    assert os.path.isfile(tmp_path / "opencode.json")
+    assert os.path.isfile(tmp_path / ".opencode" / "agents" / "pragent.md")
+    assert os.path.isfile(tmp_path / ".opencode" / "skills" / "findings-schema" / "SKILL.md")