Bug Review

name: Track Bug Review Resolutions

# TEMPLATE: This Action requires adaptation for your repository.
#
# Before using:
# 1. Copy this file to your repo's .github/workflows/
# 2. Copy the bug-review scripts/ directory to your repo root (or adjust SCRIPT_DIR below)
# 3. Set FINDINGS_DIR to where your findings are stored
#    (default assumes findings are committed to .bug-review/findings/ in the repo)
# 4. Ensure gh CLI is available (actions/checkout provides it)
#
# This Action uses repo-committed findings (not CLAUDE_PLUGIN_DATA, which is local-only).
# To use this, configure store-findings.sh to write to .bug-review/findings/ in the repo
# and commit the findings as part of the review workflow.
#
# Alternative: Skip this Action entirely and run /bug-review:resolve <PR> manually.

on:
  pull_request:
    types: [closed]

env:
  # Adjust these paths for your repository
  SCRIPT_DIR: .bug-review/scripts
  FINDINGS_DIR: .bug-review/findings

jobs:
  resolve:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check for stored findings
        id: check
        run: |
          PR=${{ github.event.pull_request.number }}
          if [[ -f "${{ env.FINDINGS_DIR }}/pr-${PR}.json" ]]; then
            echo "found=true" >> "$GITHUB_OUTPUT"
          else
            echo "found=false" >> "$GITHUB_OUTPUT"
            echo "No bug-review findings for PR #$PR — skipping."
          fi

      - name: Classify resolutions
        if: steps.check.outputs.found == 'true'
        run: |
          export CLAUDE_PLUGIN_DATA="$(pwd)/.bug-review"
          bash ${{ env.SCRIPT_DIR }}/classify-resolutions.sh ${{ github.event.pull_request.number }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Update category weights
        if: steps.check.outputs.found == 'true'
        run: |
          export CLAUDE_PLUGIN_DATA="$(pwd)/.bug-review"
          bash ${{ env.SCRIPT_DIR }}/update-weights.sh ${{ env.SCRIPT_DIR }}/../config.json \
            || echo "Insufficient data for weight update — skipping."

      - name: Commit resolution data
        if: steps.check.outputs.found == 'true'
        run: |
          git config user.name "bug-review[bot]"
          git config user.email "bug-review[bot]@users.noreply.github.com"
          git add .bug-review/findings/ .bug-review/config.json 2>/dev/null || true
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            git commit -m "chore: update bug-review resolution data for PR #${{ github.event.pull_request.number }}"
            git push
          fi

{
  "review_passes": 5,
  "vote_threshold": 3,
  "max_context_files": 15,
  "agent_model": "sonnet",
  "validator_model": "opus",
  "min_confidence": 0.5,
  "category_weights": {
    "null-access": 1.0,
    "boundary": 1.0,
    "race": 1.0,
    "resource-leak": 1.0,
    "injection": 1.0,
    "auth-bypass": 1.0,
    "data-loss": 1.0,
    "error-swallow": 1.0,
    "type-coercion": 1.0,
    "stale-ref": 1.0,
    "api-contract": 1.0,
    "dead-code": 1.0,
    "perf": 1.0,
    "config": 1.0
  },
  "_setup_instructions": {
    "review_passes": "Number of parallel review passes (default: 5)",
    "vote_threshold": "Minimum votes to surface a finding (default: 3 = majority of 5)",
    "max_context_files": "Max context files beyond changed files (default: 15)",
    "agent_model": "Model for review passes: 'sonnet' (faster/cheaper) or 'opus' (thorough)",
    "validator_model": "Model for independent validator: 'opus' (recommended) or 'sonnet'",
    "min_confidence": "Findings below this confidence get a 'low confidence' warning (default: 0.5)",
    "category_weights": "Learned from resolution rate data. 1.0 = full weight, 0.1 = suppressed. Updated by scripts/update-weights.sh"
  }
}

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{
          "type": "command",
          "command": "if echo \"$TOOL_INPUT\" | grep -qE 'git push.*--force($| )|git push.*-f([^i]|$)|git reset --hard' && ! echo \"$TOOL_INPUT\" | grep -q 'force-with-lease'; then echo 'BLOCKED: Destructive git operation. Bug-review never force-pushes or hard resets.' >&2; exit 1; fi",
          "timeout": 5
        }]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit",
        "hooks": [{
          "type": "command",
          "command": "CHANGED=$(git diff --stat 2>/dev/null | tail -1); FILES=$(echo \"$CHANGED\" | grep -oE '[0-9]+ file' | grep -oE '[0-9]+'); LINES=$(echo \"$CHANGED\" | grep -oE '[0-9]+ insertion' | grep -oE '[0-9]+'); if [ \"${FILES:-0}\" -gt 1 ] || [ \"${LINES:-0}\" -gt 20 ]; then echo \"WARNING: Autofix scope exceeded (${FILES:-0} files, ${LINES:-0} insertions). Verify the change is minimal.\" >&2; fi",
          "timeout": 5
        }]
      }
    ]
  }
}

{
  "version": "1.0.4",
  "organization": "dot-skills",
  "technology": "GitHub Pull Requests",
  "discipline": "composition",
  "type": "automation",
  "date": "March 2026",
  "abstract": "Multi-pass PR review agent with 5 parallel passes (shuffled diffs for attention diversity), majority voting, independent Opus validation, and resolution rate learning. Tracks whether findings get resolved at merge time and adjusts category weights to improve future precision. Supports repo-specific rules via .bug-review.md, optional autofix with scope validation, and resolution rate reporting.",
  "references": [
    "https://cursor.com/blog/bugbot-out-of-beta",
    "https://cursor.com/blog/building-bugbot",
    "https://cursor.com/blog/dynamic-context-discovery"
  ]
}

#!/usr/bin/env bash
# classify-resolutions.sh — Classify whether findings were resolved at merge time
# Part of: bug-review
# Purpose: The core of the resolution rate feedback loop. Compares code at
#          review time vs merge time to determine if flagged bugs were fixed.
#
# Usage: $0 <pr-number>
# Exit codes: 0 = success, 1 = error, 2 = PR not merged or no stored findings
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <pr-number>" >&2
  exit 1
fi

PR_NUMBER="$1"

# Load stored findings
STORE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/plugin-data}/bug-review/findings"
FINDINGS_FILE="$STORE_DIR/pr-${PR_NUMBER}.json"

if [[ ! -f "$FINDINGS_FILE" ]]; then
  echo "Error: No stored findings for PR #$PR_NUMBER" >&2
  echo "Hint: Run /bug-review on this PR first, then resolve after merge" >&2
  exit 2
fi

# Check if PR is merged
MERGE_INFO=$(gh pr view "$PR_NUMBER" --json merged,mergeCommit 2>/dev/null) || {
  echo "Error: Could not fetch PR #$PR_NUMBER" >&2
  exit 1
}

IS_MERGED=$(echo "$MERGE_INFO" | jq -r '.merged')
if [[ "$IS_MERGED" != "true" ]]; then
  echo "PR #$PR_NUMBER is not merged yet. Resolve after merge." >&2
  exit 2
fi

MERGE_COMMIT=$(echo "$MERGE_INFO" | jq -r '.mergeCommit.oid')
REVIEW_COMMIT=$(jq -r '.reviewCommit' "$FINDINGS_FILE")
FINDINGS=$(jq '.findings' "$FINDINGS_FILE")
FINDINGS_COUNT=$(echo "$FINDINGS" | jq 'length')

if [[ "$FINDINGS_COUNT" -eq 0 ]]; then
  echo "No findings to classify for PR #$PR_NUMBER"
  exit 0
fi

echo "Classifying $FINDINGS_COUNT findings for PR #$PR_NUMBER"
echo "  Review commit: $REVIEW_COMMIT"
echo "  Merge commit:  $MERGE_COMMIT"

RESOLUTIONS="[]"
RESOLVED=0
UNRESOLVED=0
INCONCLUSIVE=0

# For each finding, check if the code changed at the finding's location
for i in $(seq 0 $((FINDINGS_COUNT - 1))); do
  FINDING=$(echo "$FINDINGS" | jq ".[$i]")
  FILE=$(echo "$FINDING" | jq -r '.file')
  LINE=$(echo "$FINDING" | jq -r '.line')
  TITLE=$(echo "$FINDING" | jq -r '.title')

  echo "  [$((i+1))/$FINDINGS_COUNT] $TITLE ($FILE:$LINE)"

  # Get the diff for this file between review and merge
  FILE_DIFF=$(git diff "$REVIEW_COMMIT".."$MERGE_COMMIT" -- "$FILE" 2>/dev/null || echo "")

  if [[ -z "$FILE_DIFF" ]]; then
    # No changes to this file between review and merge
    STATUS="UNRESOLVED"
    CONFIDENCE="0.9"
    REASONING="File $FILE was not modified between review and merge"
    ((UNRESOLVED++))
  else
    # Check if the specific line range was modified
    # Parse full hunk ranges: @@ -old,count +new,count @@ → expand to all lines in range
    CHANGED_LINES=$(echo "$FILE_DIFF" | grep -oE '@@ -[0-9]+(,[0-9]+)? \+([0-9]+)(,[0-9]+)? @@' | \
      sed -E 's/@@ -[0-9]+(,[0-9]+)? \+([0-9]+),?([0-9]*) @@/\2 \3/' | \
      while read -r start count; do
        count="${count:-1}"
        for ((l=start; l<start+count; l++)); do echo "$l"; done
      done || true)

    LINE_START=$((LINE - 5))
    LINE_END=$((LINE + 10))
    [[ $LINE_START -lt 1 ]] && LINE_START=1

    LINE_CHANGED=false
    while IFS= read -r changed_line; do
      [[ -z "$changed_line" ]] && continue
      if [[ "$changed_line" -ge "$LINE_START" && "$changed_line" -le "$LINE_END" ]]; then
        LINE_CHANGED=true
        break
      fi
    done <<< "$CHANGED_LINES"

    if $LINE_CHANGED; then
      # Code at the finding's location was modified — likely resolved
      STATUS="RESOLVED"
      CONFIDENCE="0.75"
      REASONING="Code at $FILE:$LINE was modified between review ($REVIEW_COMMIT) and merge ($MERGE_COMMIT)"
      ((RESOLVED++))
    else
      # File changed but not at this location — inconclusive
      STATUS="INCONCLUSIVE"
      CONFIDENCE="0.5"
      REASONING="File $FILE was modified but not near line $LINE"
      ((INCONCLUSIVE++))
    fi
  fi

  echo "    → $STATUS (confidence: $CONFIDENCE)"

  RESOLUTIONS=$(echo "$RESOLUTIONS" | jq \
    --arg id "$(echo "$FINDING" | jq -r '.id // ("F" + ('"$i"' | tostring))')" \
    --arg status "$STATUS" \
    --arg confidence "$CONFIDENCE" \
    --arg reasoning "$REASONING" \
    --arg merge_commit "$MERGE_COMMIT" \
    --arg detected_at "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
    '. + [{
      id: $id,
      status: $status,
      confidence: ($confidence | tonumber),
      reasoning: $reasoning,
      mergeCommit: $merge_commit,
      detectedAt: $detected_at
    }]')
done

# Calculate resolution rate
TOTAL=$((RESOLVED + UNRESOLVED + INCONCLUSIVE))
if [[ $TOTAL -gt 0 ]]; then
  RATE=$(echo "scale=1; $RESOLVED * 100 / $TOTAL" | bc)
else
  RATE="0.0"
fi

# Update the stored findings with resolutions
jq --argjson resolutions "$RESOLUTIONS" \
  --arg rate "$RATE" \
  --arg merge "$MERGE_COMMIT" \
  '.resolutions = {
    mergeCommit: $merge,
    analyzedAt: (now | todate),
    results: $resolutions,
    summary: {
      total: ($resolutions | length),
      resolved: ([$resolutions[] | select(.status == "RESOLVED")] | length),
      unresolved: ([$resolutions[] | select(.status == "UNRESOLVED")] | length),
      inconclusive: ([$resolutions[] | select(.status == "INCONCLUSIVE")] | length),
      resolutionRate: ($rate | tonumber)
    }
  }' "$FINDINGS_FILE" > "$FINDINGS_FILE.tmp" && mv "$FINDINGS_FILE.tmp" "$FINDINGS_FILE"

echo ""
echo "Resolution Summary for PR #$PR_NUMBER:"
echo "  Resolved:     $RESOLVED"
echo "  Unresolved:   $UNRESOLVED"
echo "  Inconclusive: $INCONCLUSIVE"
echo "  Resolution rate: ${RATE}%"

#!/usr/bin/env bash
# dedup.sh — Find existing [bug-review] comments on a PR for deduplication
# Part of: bug-review
# Purpose: Extracts prior bug-review findings by location (file + line)
#          so the main agent can match by proximity, not text similarity.
#
# Usage: $0 <pr-number>
# Output: JSON array of {id, path, line, category, created_at}
# Exit codes: 0 = success (may return empty array)
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <pr-number>" >&2
  exit 1
fi

PR_NUMBER="$1"

# Fetch all review comments (inline comments on diff)
REVIEW_COMMENTS=$(gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/comments" --paginate 2>/dev/null) || {
  echo "[]"
  exit 0
}

# Filter for [bug-review] tagged comments and extract location + category
# The category is extracted from the comment body pattern "**SEVERITY**: title"
echo "$REVIEW_COMMENTS" | jq '[
  .[] | select(.body | contains("[bug-review]")) |
  {
    id: .id,
    path: .path,
    line: (.line // .original_line),
    category: (
      .body | capture("\\*\\*(?<sev>[A-Z]+)\\*\\*: (?<title>.+?)\\n") |
      .title // "unknown"
    ),
    severity: (
      .body | capture("\\*\\*(?<sev>[A-Z]+)\\*\\*:") | .sev // "UNKNOWN"
    ),
    created_at: .created_at
  }
]'

#!/usr/bin/env bash
# fetch-pr.sh — Fetch PR diff and metadata as JSON
# Part of: bug-review
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <pr-number-or-url>" >&2
  echo "  Accepts: PR number (42), URL (https://github.com/.../pull/42), or branch name" >&2
  exit 1
fi

PR_INPUT="$1"

# Verify gh is authenticated before any gh calls
if ! gh auth status >/dev/null 2>&1; then
  echo "Error: gh CLI is not authenticated" >&2
  echo "Hint: Run 'gh auth login' to authenticate" >&2
  exit 1
fi

# Resolve PR number from various input formats
if [[ "$PR_INPUT" =~ ^https://github\.com/.*/pull/([0-9]+) ]]; then
  PR_NUMBER="${BASH_REMATCH[1]}"
elif [[ "$PR_INPUT" =~ ^[0-9]+$ ]]; then
  PR_NUMBER="$PR_INPUT"
else
  # Try to resolve branch name to PR number
  PR_NUMBER=$(gh pr view "$PR_INPUT" --json number --jq '.number' 2>/dev/null) || {
    echo "Error: Could not find an open PR for '$PR_INPUT'" >&2
    echo "Hint: Check that the PR exists and is open with 'gh pr list'" >&2
    exit 1
  }
fi

# Fetch PR metadata (use 'files' for file paths, 'changedFiles' is just a count)
PR_META=$(gh pr view "$PR_NUMBER" --json number,title,body,baseRefName,headRefName,files,additions,deletions 2>/dev/null) || {
  echo "Error: Could not fetch PR #$PR_NUMBER" >&2
  echo "Hint: Make sure the PR exists and you have access to the repository" >&2
  exit 1
}

# Fetch PR diff into a temp file (avoids ARG_MAX limits on large PRs)
DIFF_TMP=$(mktemp)
trap 'rm -f "$DIFF_TMP"' EXIT

gh pr diff "$PR_NUMBER" > "$DIFF_TMP" 2>/dev/null || {
  echo "Error: Could not fetch diff for PR #$PR_NUMBER" >&2
  exit 1
}

# Combine metadata and diff into a single JSON output
echo "$PR_META" | jq --rawfile diff "$DIFF_TMP" '. + {diff: $diff}'

#!/usr/bin/env bash
# gather-context.sh — Priority-based context gathering for code review
# Part of: bug-review
# Purpose: Intelligently gather surrounding code context for review passes.
#          Prioritizes callers, types, and tests of modified functions.
#
# Usage: $0 <changed-files-json> [max-files]
#   changed-files-json: JSON array of file paths or gh pr files output
#   max-files: max context files beyond changed files (default: 15)
#
# Output: JSON with {files: [{path, relevance, reason}]}
# Exit codes: 0 = success, 1 = error
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <changed-files-json> [max-files]" >&2
  echo "  changed-files-json: JSON file with array of {path} objects or string paths" >&2
  exit 1
fi

FILES_JSON="$1"
MAX_FILES="${2:-15}"
BUDGET="$MAX_FILES"

if [[ ! -f "$FILES_JSON" ]]; then
  echo "Error: File not found: $FILES_JSON" >&2
  exit 1
fi

# Extract file paths from JSON (handles both [{path:"x"}] and ["x"] formats)
CHANGED_FILES=$(jq -r '
  if type == "array" then
    .[] | if type == "object" then .path else . end
  else empty end
' "$FILES_JSON" 2>/dev/null)

if [[ -z "$CHANGED_FILES" ]]; then
  echo '{"files":[],"stats":{"changed":0,"callers":0,"types":0,"tests":0,"total":0}}'
  exit 0
fi

# Output accumulator
CONTEXT_FILES="[]"
CALLER_COUNT=0
TYPE_COUNT=0
TEST_COUNT=0

# Skip patterns
SKIP_PATTERN="node_modules/|vendor/|\.generated\.|dist/|build/|\.min\.|__pycache__"

# --- Priority 1: Extract modified function names from changed files ---
MODIFIED_FUNCTIONS=""
while IFS= read -r file; do
  [[ -f "$file" ]] || continue

  # Extract function/method names using common patterns
  # Handles: function foo, const foo =, export function foo, def foo, func foo
  FUNCS=$(grep -nE '(function\s+\w+|const\s+\w+\s*=\s*(async\s+)?\(|export\s+(async\s+)?function\s+\w+|def\s+\w+|func\s+\w+)' "$file" 2>/dev/null | \
    sed -E 's/.*function\s+(\w+).*/\1/; s/.*const\s+(\w+).*/\1/; s/.*def\s+(\w+).*/\1/; s/.*func\s+(\w+).*/\1/' | \
    sort -u || true)

  if [[ -n "$FUNCS" ]]; then
    MODIFIED_FUNCTIONS="$MODIFIED_FUNCTIONS"$'\n'"$FUNCS"
  fi
done <<< "$CHANGED_FILES"

MODIFIED_FUNCTIONS=$(echo "$MODIFIED_FUNCTIONS" | sort -u | grep -v '^$' || true)

# --- Priority 2: Find callers of modified functions (up to 5) ---
if [[ -n "$MODIFIED_FUNCTIONS" && $BUDGET -gt 0 ]]; then
  CALLER_LIMIT=$((BUDGET < 5 ? BUDGET : 5))

  while IFS= read -r func; do
    [[ $CALLER_COUNT -ge $CALLER_LIMIT ]] && break
    [[ -z "$func" ]] && continue

    # Search for callers, excluding changed files themselves and skip patterns
    CALLERS=$(grep -rlE "\b${func}\b" --include="*.ts" --include="*.js" --include="*.tsx" --include="*.jsx" --include="*.py" --include="*.go" --include="*.rs" --include="*.java" . 2>/dev/null | \
      grep -vE "$SKIP_PATTERN" | \
      while IFS= read -r caller; do
        # Exclude the changed files themselves
        IS_CHANGED=false
        while IFS= read -r cf; do
          [[ "$caller" == "./$cf" || "$caller" == "$cf" ]] && IS_CHANGED=true
        done <<< "$CHANGED_FILES"
        $IS_CHANGED || echo "$caller"
      done | head -"$CALLER_LIMIT" || true)

    while IFS= read -r caller; do
      [[ -z "$caller" ]] && continue
      [[ $CALLER_COUNT -ge $CALLER_LIMIT ]] && break

      CONTEXT_FILES=$(echo "$CONTEXT_FILES" | jq --arg path "$caller" --arg reason "Calls $func" \
        '. + [{"path": $path, "relevance": "caller", "reason": $reason}]')
      ((CALLER_COUNT++))
      ((BUDGET--))
    done <<< "$CALLERS"
  done <<< "$MODIFIED_FUNCTIONS"
fi

# --- Priority 3: Find type definitions imported by changed files (up to 3) ---
if [[ $BUDGET -gt 0 ]]; then
  TYPE_LIMIT=$((BUDGET < 3 ? BUDGET : 3))

  while IFS= read -r file; do
    [[ $TYPE_COUNT -ge $TYPE_LIMIT ]] && break
    [[ -f "$file" ]] || continue

    # Extract import paths (handles: import {X} from './path', from path import X)
    IMPORTS=$(grep -oE "(from\s+['\"]\.?\.?/[^'\"]+['\"]|import\s+['\"]\.?\.?/[^'\"]+['\"])" "$file" 2>/dev/null | \
      sed -E "s/(from|import)\s+['\"]//; s/['\"]$//" | \
      grep -vE "$SKIP_PATTERN" || true)

    while IFS= read -r imp; do
      [[ -z "$imp" ]] && continue
      [[ $TYPE_COUNT -ge $TYPE_LIMIT ]] && break

      # Resolve relative import to a file path
      DIR=$(dirname "$file")
      for ext in "" ".ts" ".tsx" ".js" ".jsx" "/index.ts" "/index.js"; do
        RESOLVED="${DIR}/${imp}${ext}"
        if [[ -f "$RESOLVED" ]]; then
          # Check if it contains type definitions
          if grep -qE "(interface\s|type\s|enum\s|class\s)" "$RESOLVED" 2>/dev/null; then
            CONTEXT_FILES=$(echo "$CONTEXT_FILES" | jq --arg path "$RESOLVED" --arg reason "Types imported by $file" \
              '. + [{"path": $path, "relevance": "type-definition", "reason": $reason}]')
            ((TYPE_COUNT++))
            ((BUDGET--))
          fi
          break
        fi
      done
    done <<< "$IMPORTS"
  done <<< "$CHANGED_FILES"
fi

# --- Priority 4: Find test files for changed modules (up to 3) ---
if [[ $BUDGET -gt 0 ]]; then
  TEST_LIMIT=$((BUDGET < 3 ? BUDGET : 3))

  while IFS= read -r file; do
    [[ $TEST_COUNT -ge $TEST_LIMIT ]] && break
    [[ -f "$file" ]] || continue

    BASENAME=$(basename "$file" | sed -E 's/\.[^.]+$//')
    DIR=$(dirname "$file")

    # Search for test files matching the changed file name
    for pattern in "${DIR}/${BASENAME}.test."* "${DIR}/${BASENAME}.spec."* "${DIR}/__tests__/${BASENAME}."* "${DIR}/${BASENAME}_test."*; do
      [[ $TEST_COUNT -ge $TEST_LIMIT ]] && break

      for testfile in $pattern; do
        [[ -f "$testfile" ]] || continue
        CONTEXT_FILES=$(echo "$CONTEXT_FILES" | jq --arg path "$testfile" --arg reason "Tests for $file" \
          '. + [{"path": $path, "relevance": "test", "reason": $reason}]')
        ((TEST_COUNT++))
        ((BUDGET--))
        break
      done
    done
  done <<< "$CHANGED_FILES"
fi

# --- Priority 5: Check for .bug-review.md ---
if [[ -f ".bug-review.md" && $BUDGET -gt 0 ]]; then
  CONTEXT_FILES=$(echo "$CONTEXT_FILES" | jq \
    '. + [{"path": ".bug-review.md", "relevance": "repo-rules", "reason": "Repository-specific review rules"}]')
  ((BUDGET--))
fi

# Deduplicate by path
CONTEXT_FILES=$(echo "$CONTEXT_FILES" | jq 'unique_by(.path)')

CHANGED_COUNT=$(echo "$CHANGED_FILES" | wc -l | tr -d ' ')
TOTAL=$(echo "$CONTEXT_FILES" | jq 'length')

# Output final JSON
jq -n \
  --argjson files "$CONTEXT_FILES" \
  --arg changed "$CHANGED_COUNT" \
  --arg callers "$CALLER_COUNT" \
  --arg types "$TYPE_COUNT" \
  --arg tests "$TEST_COUNT" \
  --argjson total "$TOTAL" \
  '{
    files: $files,
    stats: {
      changed_files: ($changed | tonumber),
      callers_found: ($callers | tonumber),
      type_defs_found: ($types | tonumber),
      test_files_found: ($tests | tonumber),
      total_context_files: $total
    }
  }'

#!/usr/bin/env bash
# post-review.sh — Post findings as a GitHub PR review with inline comments
# Part of: bug-review
# Exit codes: 0 = review posted, 1 = error, 2 = no findings to post (skipped)
set -euo pipefail

if [[ $# -lt 2 ]]; then
  echo "Usage: $0 <pr-number> <findings-json-file>" >&2
  echo "  findings-json-file: path to JSON file with array of findings" >&2
  exit 1
fi

PR_NUMBER="$1"
FINDINGS_FILE="$2"

if [[ ! -f "$FINDINGS_FILE" ]]; then
  echo "Error: Findings file not found: $FINDINGS_FILE" >&2
  exit 1
fi

FINDINGS_COUNT=$(jq 'length' "$FINDINGS_FILE")

if [[ "$FINDINGS_COUNT" -eq 0 ]]; then
  echo "No findings to post. Skipping review."
  exit 2
fi

# Get the latest commit SHA on the PR (required for creating review)
COMMIT_SHA=$(gh pr view "$PR_NUMBER" --json headRefOid --jq '.headRefOid')

# Build severity summary
CRITICAL_COUNT=$(jq '[.[] | select(.severity == "CRITICAL")] | length' "$FINDINGS_FILE")
HIGH_COUNT=$(jq '[.[] | select(.severity == "HIGH")] | length' "$FINDINGS_FILE")
MEDIUM_COUNT=$(jq '[.[] | select(.severity == "MEDIUM")] | length' "$FINDINGS_FILE")
LOW_COUNT=$(jq '[.[] | select(.severity == "LOW")] | length' "$FINDINGS_FILE")

REVIEW_BODY="## Bug Review Summary

Found **${FINDINGS_COUNT}** issue(s): ${CRITICAL_COUNT} critical, ${HIGH_COUNT} high, ${MEDIUM_COUNT} medium, ${LOW_COUNT} low.

<!-- [bug-review] automated review -->"

# Build inline comments from findings
COMMENTS=$(jq -c '[.[] | {
  path: .file,
  line: .line,
  body: (
    "**" + .severity + "**: " + .title + "\n\n" +
    .description + "\n\n" +
    "**Trigger scenario**: " + .triggerScenario + "\n\n" +
    (if .suggestedFix then ("**Suggested fix**: " + .suggestedFix + "\n\n") else "" end) +
    "<!-- [bug-review] -->"
  )
}]' "$FINDINGS_FILE")

# Create the review via GitHub API
PAYLOAD=$(jq -n \
  --arg body "$REVIEW_BODY" \
  --arg sha "$COMMIT_SHA" \
  --argjson comments "$COMMENTS" \
  '{
    commit_id: $sha,
    body: $body,
    event: "COMMENT",
    comments: $comments
  }')

echo "$PAYLOAD" | gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/reviews" \
  --input - \
  --method POST >/dev/null 2>&1 || {
  echo "Error: Failed to post review on PR #$PR_NUMBER" >&2
  echo "Hint: Check that your gh token has write permission on the repository" >&2
  exit 1
}

echo "Posted review with $FINDINGS_COUNT finding(s) on PR #$PR_NUMBER"

#!/usr/bin/env bash
# resolution-report.sh — Aggregate resolution rate statistics
# Part of: bug-review
# Purpose: Generates resolution rate report across all tracked PRs.
#          Shows overall rate, by severity, by category, and trends.
#
# Usage: $0 [--json]
#   --json: output JSON instead of markdown
# Exit codes: 0 = success, 1 = error, 2 = no data
set -euo pipefail

FORMAT="markdown"
[[ "${1:-}" == "--json" ]] && FORMAT="json"

STORE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/plugin-data}/bug-review/findings"

if [[ ! -d "$STORE_DIR" ]]; then
  echo "No bug-review data found. Run /bug-review on a PR first." >&2
  exit 2
fi

# Collect all PR files that have resolutions
RESOLVED_FILES=$(find "$STORE_DIR" -name "pr-*.json" -exec grep -l '"resolutions"' {} + 2>/dev/null || true)

if [[ -z "$RESOLVED_FILES" ]]; then
  echo "No resolution data found. Run /bug-review:resolve on a merged PR first." >&2
  exit 2
fi

# Aggregate all resolution data
TOTAL_FINDINGS=0
TOTAL_RESOLVED=0
TOTAL_UNRESOLVED=0
TOTAL_INCONCLUSIVE=0
PRS_ANALYZED=0

# Per-severity and per-category accumulators (stored as temp files)
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

while IFS= read -r file; do
  [[ -f "$file" ]] || continue

  HAS_RESOLUTIONS=$(jq 'has("resolutions") and .resolutions != null and .resolutions.results != null' "$file" 2>/dev/null)
  [[ "$HAS_RESOLUTIONS" == "true" ]] || continue

  ((PRS_ANALYZED++))

  # Extract findings with their resolutions
  jq -c '.findings as $findings | .resolutions.results[] as $res |
    ($findings | to_entries[] | select(
      (.value.id // ("F" + (.key | tostring))) == $res.id
    ) | .value) as $finding |
    {
      severity: ($finding.severity // "UNKNOWN"),
      category: ($finding.category // "unknown"),
      status: $res.status
    }' "$file" 2>/dev/null >> "$TMPDIR/all_resolutions.jsonl" || true

  # Count per-status
  R=$(jq '.resolutions.summary.resolved // 0' "$file")
  U=$(jq '.resolutions.summary.unresolved // 0' "$file")
  I=$(jq '.resolutions.summary.inconclusive // 0' "$file")
  T=$(jq '.resolutions.summary.total // 0' "$file")

  TOTAL_FINDINGS=$((TOTAL_FINDINGS + T))
  TOTAL_RESOLVED=$((TOTAL_RESOLVED + R))
  TOTAL_UNRESOLVED=$((TOTAL_UNRESOLVED + U))
  TOTAL_INCONCLUSIVE=$((TOTAL_INCONCLUSIVE + I))
done <<< "$RESOLVED_FILES"

# Calculate overall rate
if [[ $TOTAL_FINDINGS -gt 0 ]]; then
  OVERALL_RATE=$(echo "scale=1; $TOTAL_RESOLVED * 100 / $TOTAL_FINDINGS" | bc)
else
  OVERALL_RATE="0.0"
fi

# Calculate per-severity rates
SEVERITY_REPORT="[]"
for severity in CRITICAL HIGH MEDIUM LOW; do
  SEV_TOTAL=$(grep -c "\"severity\":\"$severity\"" "$TMPDIR/all_resolutions.jsonl" 2>/dev/null || echo "0")
  SEV_RESOLVED=$(grep "\"severity\":\"$severity\"" "$TMPDIR/all_resolutions.jsonl" 2>/dev/null | grep -c '"status":"RESOLVED"' || echo "0")

  if [[ "$SEV_TOTAL" -gt 0 ]]; then
    SEV_RATE=$(echo "scale=1; $SEV_RESOLVED * 100 / $SEV_TOTAL" | bc)
  else
    SEV_RATE="0.0"
  fi

  SEVERITY_REPORT=$(echo "$SEVERITY_REPORT" | jq \
    --arg sev "$severity" --arg total "$SEV_TOTAL" \
    --arg resolved "$SEV_RESOLVED" --arg rate "$SEV_RATE" \
    '. + [{"severity": $sev, "total": ($total|tonumber), "resolved": ($resolved|tonumber), "rate": ($rate|tonumber)}]')
done

# Calculate per-category rates
CATEGORY_REPORT="[]"
if [[ -f "$TMPDIR/all_resolutions.jsonl" ]]; then
  CATEGORIES=$(jq -r '.category' "$TMPDIR/all_resolutions.jsonl" 2>/dev/null | sort -u || true)

  while IFS= read -r cat; do
    [[ -z "$cat" ]] && continue
    CAT_TOTAL=$(grep -c "\"category\":\"$cat\"" "$TMPDIR/all_resolutions.jsonl" 2>/dev/null || echo "0")
    CAT_RESOLVED=$(grep "\"category\":\"$cat\"" "$TMPDIR/all_resolutions.jsonl" 2>/dev/null | grep -c '"status":"RESOLVED"' || echo "0")

    if [[ "$CAT_TOTAL" -gt 0 ]]; then
      CAT_RATE=$(echo "scale=1; $CAT_RESOLVED * 100 / $CAT_TOTAL" | bc)
    else
      CAT_RATE="0.0"
    fi

    CATEGORY_REPORT=$(echo "$CATEGORY_REPORT" | jq \
      --arg cat "$cat" --arg total "$CAT_TOTAL" \
      --arg resolved "$CAT_RESOLVED" --arg rate "$CAT_RATE" \
      '. + [{"category": $cat, "total": ($total|tonumber), "resolved": ($resolved|tonumber), "rate": ($rate|tonumber)}]')
  done <<< "$CATEGORIES"
fi

# Sort categories by rate (ascending — worst performers first)
CATEGORY_REPORT=$(echo "$CATEGORY_REPORT" | jq 'sort_by(.rate)')

if [[ "$FORMAT" == "json" ]]; then
  jq -n \
    --arg prs "$PRS_ANALYZED" \
    --arg total "$TOTAL_FINDINGS" \
    --arg resolved "$TOTAL_RESOLVED" \
    --arg unresolved "$TOTAL_UNRESOLVED" \
    --arg inconclusive "$TOTAL_INCONCLUSIVE" \
    --arg rate "$OVERALL_RATE" \
    --argjson severity "$SEVERITY_REPORT" \
    --argjson category "$CATEGORY_REPORT" \
    '{
      prs_analyzed: ($prs|tonumber),
      overall: {
        total: ($total|tonumber),
        resolved: ($resolved|tonumber),
        unresolved: ($unresolved|tonumber),
        inconclusive: ($inconclusive|tonumber),
        resolution_rate: ($rate|tonumber)
      },
      by_severity: $severity,
      by_category: $category
    }'
else
  echo "# Bug Review Resolution Report"
  echo ""
  echo "**PRs analyzed:** $PRS_ANALYZED"
  echo "**Overall resolution rate:** ${OVERALL_RATE}%"
  echo ""
  echo "| Metric | Count |"
  echo "|--------|-------|"
  echo "| Total findings | $TOTAL_FINDINGS |"
  echo "| Resolved | $TOTAL_RESOLVED |"
  echo "| Unresolved | $TOTAL_UNRESOLVED |"
  echo "| Inconclusive | $TOTAL_INCONCLUSIVE |"
  echo ""
  echo "## By Severity"
  echo ""
  echo "| Severity | Total | Resolved | Rate |"
  echo "|----------|-------|----------|------|"
  echo "$SEVERITY_REPORT" | jq -r '.[] | "| \(.severity) | \(.total) | \(.resolved) | \(.rate)% |"'
  echo ""
  echo "## By Category"
  echo ""
  echo "| Category | Total | Resolved | Rate |"
  echo "|----------|-------|----------|------|"
  echo "$CATEGORY_REPORT" | jq -r '.[] | "| \(.category) | \(.total) | \(.resolved) | \(.rate)% |"'
fi

#!/usr/bin/env bash
# shuffle-diff.sh — Randomize file ordering in a unified diff
# Part of: bug-review
# Purpose: Each review pass gets a different file ordering to create
#          attention diversity. Earlier files in a diff get more careful
#          review, so shuffling forces different bugs to the "top."
#
# Usage: $0 <seed> < input.diff > shuffled.diff
# Exit codes: 0 = success, 1 = error, 2 = empty diff
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <seed>" >&2
  echo "  Reads unified diff from stdin, outputs shuffled diff to stdout" >&2
  echo "  seed: integer seed for deterministic shuffling (use pass number)" >&2
  exit 1
fi

SEED="$1"

# Read entire diff from stdin
DIFF=$(cat)

if [[ -z "$DIFF" ]]; then
  echo "Error: Empty diff on stdin" >&2
  exit 2
fi

# Split diff into per-file chunks using "diff --git" as delimiter
# Store each chunk in a temp directory as a numbered file
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

CHUNK_NUM=0
CURRENT_CHUNK=""

while IFS= read -r line; do
  if [[ "$line" =~ ^diff\ --git ]]; then
    # Save previous chunk if exists
    if [[ -n "$CURRENT_CHUNK" ]]; then
      printf '%s\n' "$CURRENT_CHUNK" > "$TMPDIR/chunk_$(printf '%04d' $CHUNK_NUM)"
      ((CHUNK_NUM++))
    fi
    CURRENT_CHUNK="$line"
  else
    if [[ -n "$CURRENT_CHUNK" ]]; then
      CURRENT_CHUNK="$CURRENT_CHUNK"$'\n'"$line"
    fi
  fi
done <<< "$DIFF"

# Save last chunk
if [[ -n "$CURRENT_CHUNK" ]]; then
  printf '%s\n' "$CURRENT_CHUNK" > "$TMPDIR/chunk_$(printf '%04d' $CHUNK_NUM)"
  ((CHUNK_NUM++))
fi

if [[ $CHUNK_NUM -eq 0 ]]; then
  # Not a git diff format — try splitting on "---" lines (plain unified diff)
  echo "$DIFF"
  exit 0
fi

# Generate a shuffled order using the seed
# Use awk with seeded random to create a permutation
ls "$TMPDIR"/chunk_* 2>/dev/null | awk -v seed="$SEED" '
  BEGIN { srand(seed) }
  { print rand() "\t" $0 }
' | sort -k1,1n | cut -f2- | while IFS= read -r chunk_file; do
  cat "$chunk_file"
done

#!/usr/bin/env bash
# store-findings.sh — Persist findings to durable storage for resolution tracking
# Part of: bug-review
# Purpose: Save review findings so we can later measure whether they were
#          resolved at merge time (the resolution rate feedback loop).
#
# Usage: $0 <pr-number> <findings-json-file> <review-commit>
# Exit codes: 0 = success, 1 = error
set -euo pipefail

if [[ $# -lt 3 ]]; then
  echo "Usage: $0 <pr-number> <findings-json-file> <review-commit>" >&2
  echo "  Stores findings to \${CLAUDE_PLUGIN_DATA}/bug-review/findings/" >&2
  exit 1
fi

PR_NUMBER="$1"
FINDINGS_FILE="$2"
REVIEW_COMMIT="$3"

if [[ ! -f "$FINDINGS_FILE" ]]; then
  echo "Error: Findings file not found: $FINDINGS_FILE" >&2
  exit 1
fi

# Determine storage directory
STORE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/plugin-data}/bug-review/findings"
mkdir -p "$STORE_DIR"

TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

# Get repo info for context
REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner' 2>/dev/null || echo "unknown")

# Read findings and wrap with metadata
FINDINGS=$(jq '
  if type == "array" then .
  elif .findings then .findings
  else []
  end
' "$FINDINGS_FILE")

FINDINGS_COUNT=$(echo "$FINDINGS" | jq 'length')

# Build the stored record
jq -n \
  --arg pr "$PR_NUMBER" \
  --arg repo "$REPO" \
  --arg commit "$REVIEW_COMMIT" \
  --arg timestamp "$TIMESTAMP" \
  --argjson count "$FINDINGS_COUNT" \
  --argjson findings "$FINDINGS" \
  '{
    pr: ($pr | tonumber),
    repo: $repo,
    reviewCommit: $commit,
    postedAt: $timestamp,
    findingsCount: $count,
    findings: $findings,
    resolutions: null
  }' > "$STORE_DIR/pr-${PR_NUMBER}.json"

echo "Stored $FINDINGS_COUNT findings for PR #$PR_NUMBER at $STORE_DIR/pr-${PR_NUMBER}.json"

#!/usr/bin/env bash
# update-weights.sh — Learn category weights from resolution rate data
# Part of: bug-review
# Purpose: The optimization loop. Categories with low resolution rates
#          (findings that developers don't fix) are likely false-positive-heavy.
#          This script adjusts category_weights in config.json based on actual
#          resolution data, so future reviews deprioritize noisy categories.
#
# Usage: $0 [--dry-run] [config-path]
#   --dry-run:   show the proposed weight changes without modifying config.json
#   config-path: path to config.json (default: auto-detect from skill dir)
# Exit codes: 0 = success, 1 = error, 2 = insufficient data
set -euo pipefail

SCRIPT_DIR=$(dirname "$0")
DRY_RUN=0
CONFIG_PATH=""
for arg in "$@"; do
  case "$arg" in
    --dry-run) DRY_RUN=1 ;;
    *) CONFIG_PATH="$arg" ;;
  esac
done
CONFIG_PATH="${CONFIG_PATH:-$SCRIPT_DIR/../config.json}"

if [[ ! -f "$CONFIG_PATH" ]]; then
  echo "Error: config.json not found at $CONFIG_PATH" >&2
  exit 1
fi

# Get resolution report as JSON
REPORT=$(bash "$SCRIPT_DIR/resolution-report.sh" --json 2>/dev/null) || {
  echo "Error: Could not generate resolution report. Need at least 1 resolved PR." >&2
  exit 2
}

TOTAL_FINDINGS=$(echo "$REPORT" | jq '.overall.total')
PRS_ANALYZED=$(echo "$REPORT" | jq '.prs_analyzed')

# Require minimum data before adjusting weights
MIN_FINDINGS=10
MIN_PRS=3

if [[ "$TOTAL_FINDINGS" -lt "$MIN_FINDINGS" || "$PRS_ANALYZED" -lt "$MIN_PRS" ]]; then
  echo "Insufficient data for weight learning (need $MIN_FINDINGS+ findings across $MIN_PRS+ PRs)." >&2
  echo "  Current: $TOTAL_FINDINGS findings across $PRS_ANALYZED PRs" >&2
  exit 2
fi

# Compute weights from category resolution rates
# Weight = resolution_rate / 100, clamped to [0.1, 1.0]
# Categories below 30% resolution rate get minimum weight (0.1)
CATEGORY_WEIGHTS=$(echo "$REPORT" | jq '
  .by_category | map({
    key: .category,
    value: (
      if .total < 3 then 1.0  # Not enough data, keep default
      elif .rate < 30 then 0.1  # Likely false-positive-heavy, suppress
      else (.rate / 100)  # Scale 0-100% to 0-1.0
      end
    )
  }) | from_entries
')

echo "Category weights computed from $TOTAL_FINDINGS findings across $PRS_ANALYZED PRs:"
echo "$CATEGORY_WEIGHTS" | jq -r 'to_entries[] | "  \(.key): \(.value)"'

# Show the change (current -> proposed) so the effect is reviewable before applying.
echo ""
echo "Proposed category_weights change (current -> new):"
jq -n \
  --argjson cur "$(jq '.category_weights // {}' "$CONFIG_PATH")" \
  --argjson new "$CATEGORY_WEIGHTS" '
    (($cur + $new) | keys_unsorted)
    | map({ key: ., value: { old: ($cur[.] // "default"), new: ($new[.] // "unchanged") } })
    | from_entries' \
  | jq -r 'to_entries[] | "  \(.key): \(.value.old) -> \(.value.new)"'

if [[ "$DRY_RUN" -eq 1 ]]; then
  echo ""
  echo "Dry run — no changes written. Re-run without --dry-run to apply."
  exit 0
fi

# Back up before overwriting, then update config.json with new weights.
cp "$CONFIG_PATH" "${CONFIG_PATH}.bak"
jq --argjson weights "$CATEGORY_WEIGHTS" '.category_weights = $weights' "$CONFIG_PATH" > "${CONFIG_PATH}.tmp" \
  && mv "${CONFIG_PATH}.tmp" "$CONFIG_PATH"

echo ""
echo "Updated $CONFIG_PATH with learned category weights (backup: ${CONFIG_PATH}.bak)."

# Flag suppressed categories
SUPPRESSED=$(echo "$CATEGORY_WEIGHTS" | jq -r 'to_entries[] | select(.value <= 0.1) | .key')
if [[ -n "$SUPPRESSED" ]]; then
  echo ""
  echo "WARNING: These categories have been suppressed (resolution rate < 30%):"
  while IFS= read -r cat; do
    RATE=$(echo "$REPORT" | jq -r --arg c "$cat" '.by_category[] | select(.category == $c) | .rate')
    echo "  - $cat (${RATE}% resolution rate)"
  done <<< "$SUPPRESSED"
  echo "  They will have minimal impact on future review scoring."
fi

#!/usr/bin/env bash
# verify.sh — Verify bug review was posted successfully
# Part of: bug-review
set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <pr-number>" >&2
  exit 1
fi

PR_NUMBER="$1"

PASS=0
FAIL=0

assert_true() {
  local label="$1" condition="$2"
  if [[ "$condition" == "true" ]]; then
    echo "  PASS: $label"
    ((PASS++))
  else
    echo "  FAIL: $label"
    ((FAIL++))
  fi
}

# Check that at least one [bug-review] review exists on the PR
REVIEWS_RAW=$(gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/reviews" --paginate 2>&1) || {
  echo "  ERROR: Could not fetch reviews — API call failed: $REVIEWS_RAW" >&2
  exit 1
}
REVIEW_COUNT=$(echo "$REVIEWS_RAW" | jq '[.[] | select(.body | contains("[bug-review]"))] | length')

assert_true "At least one [bug-review] review exists" \
  "$([ "$REVIEW_COUNT" -gt 0 ] && echo true || echo false)"

# Check that review comments exist
COMMENTS_RAW=$(gh api "repos/{owner}/{repo}/pulls/$PR_NUMBER/comments" --paginate 2>&1) || {
  echo "  ERROR: Could not fetch comments — API call failed: $COMMENTS_RAW" >&2
  exit 1
}
COMMENT_COUNT=$(echo "$COMMENTS_RAW" | jq '[.[] | select(.body | contains("[bug-review]"))] | length')

assert_true "Review has inline comments" \
  "$([ "$COMMENT_COUNT" -gt 0 ] && echo true || echo false)"

echo ""
echo "Results: $PASS passed, $FAIL failed"
echo "Reviews: $REVIEW_COUNT, Inline comments: $COMMENT_COUNT"
[[ $FAIL -eq 0 ]] || exit 1