Wait for login instructions

A finding about one line now lands on that line of the diff: the agent writes anchors as JSON, and the review posts them with the body in one call. Bad entries fail the run, and an anchor Gitea refuses falls back to posting the body alone.

Verified with deno fmt, lint and check.

Reviewed-on: #10
Co-authored-by: bot <temeddix@gmail.com>
Co-committed-by: bot <temeddix@gmail.com>

auth.ts

@@ -0,0 +1,12 @@
+export async function retryInvalidToken<
+  T extends { status: { success: boolean }; error: string },
+>(attempt: () => Promise<T>, relogin: () => Promise<void>): Promise<T> {
+  let result = await attempt();
+  if (
+    !result.status.success && result.error.includes("invalid_refresh_token")
+  ) {
+    await relogin();
+    result = await attempt();
+  }
+  return result;
+}

auth_test.ts

@@ -0,0 +1,44 @@
+import { assertEquals } from "jsr:@std/assert@1";
+import { retryInvalidToken } from "./auth.ts";
+
+Deno.test("retries once after an invalid refresh token", async () => {
+  let attempts = 0;
+  let relogins = 0;
+  const result = await retryInvalidToken(
+    () =>
+      Promise.resolve({
+        status: { success: false },
+        error: attempts++ === 0 ? "invalid_refresh_token" : "still failed",
+      }),
+    () => {
+      relogins++;
+      return Promise.resolve();
+    },
+  );
+
+  assertEquals({ attempts, relogins, error: result.error }, {
+    attempts: 2,
+    relogins: 1,
+    error: "still failed",
+  });
+});
+
+Deno.test("does not retry an unrelated failure", async () => {
+  let attempts = 0;
+  let relogins = 0;
+  await retryInvalidToken(
+    () => {
+      attempts++;
+      return Promise.resolve({
+        status: { success: false },
+        error: "rate limited",
+      });
+    },
+    () => {
+      relogins++;
+      return Promise.resolve();
+    },
+  );
+
+  assertEquals({ attempts, relogins }, { attempts: 1, relogins: 0 });
+});

prompt.md

@@ -19,33 +19,43 @@ author's push credentials. Read the code there, run its checks and tests when
 they bear on the task, and push from there.
 
 For a `pull_request` event, and for a comment on a pull request that asks you to
-review it, review the PR without changing code, using the
+review it, review the PR without changing code against its base and head. Run
-`requesting-code-review` skill from superpowers: run its code reviewer template
+the project's checks on the head and treat a failure as at least Important.
-against the PR's base and head. Run the project's checks on the head and treat a
+Check the whole repository against the code rules at the end of this prompt, not
-failure as at least Important. Check the whole repository against the code rules
+only the diff; a violation is at least Important even when the diff did not
-at the end of this prompt, not only the diff; a violation is at least Important
+cause it. Write the complete review, and nothing else, to the file
-even when the diff did not cause it. Write the complete review, and nothing
+`${REVIEW_PATH}`: it is posted verbatim as a pull request review from the bot
-else, to the file `${REVIEW_PATH}`: it is posted verbatim as a pull request
+account, and your final response is not posted at all. The file's first line
-review from the bot account, and your final response is not posted at all. The
+must be exactly the verdict and nothing else: `Approved` when the head is ready
-file's first line must be exactly the verdict and nothing else: `Approved` when
+to merge, `Changes requested` otherwise. The mark in front of it is added when
-the template's answer is yes, `Changes requested` otherwise. The mark in front
+posting, so write the words alone; any other first line is posted as a plain
-of it is added when posting, so write the words alone; any other first line is
+comment, which wastes the run. Minor issues alone never block, and neither does
-posted as a plain comment, which wastes the run. Minor issues alone never block,
+a finding the author has answered in the comment history below as intended or a
-and neither does a finding the author has answered in the comment history below
+false alarm, once the code or docs make that clear. When the verdict is
-as intended or a false alarm, once the code or docs make that clear. When the
+`Changes requested`, the second line names what must change in one line,
-verdict is `Changes requested`, the second line names what must change in one
+addressed to the author; the author's own agent picks the fixes up, so never ask
-line, addressed to the author; the author's own agent picks the fixes up, so
+`@bot` to make them. For UI changes, check that the result is aligned, clean,
-never ask `@bot` to make them. For UI changes, check that the result is aligned,
+and pixel-perfect, and that included screenshots prove the intended result was
-clean, and pixel-perfect, and that included screenshots prove the intended
+achieved.
-result was achieved.
 
-The review must read at a glance: everything outside `<details>` blocks totals
+Every finding that belongs to one line of the diff goes on that line instead of
-under 512 bytes. Only core information stays visible: the verdict, the summary
+into the body. Write those to `${ANCHORS_PATH}` as a JSON array, each entry
-line, and the section headings. Anything verbose goes into a `<details>` block
+`{"path": "<path from the repository root>", "line": <number>, "side": "new" |
-whose `<summary>` is a few words, such as the `file:line` and title of an issue
+"old", "body": "<the finding>"}`.
-with the what, why, and how inside; the same for each strength, each
+`side` is `new` for a line in the head file and `old` for one only in the base
-recommendation, the reasoning, and any compliance notes. Details blocks are
+file; `line` is that file's own line number, and it must be a line the diff
-top-level, never inside a list item, because Gitea breaks them there.
+touches, or Gitea refuses the anchor. Write the file only when there is
+something to anchor, and keep each body to the what, the why, and the how, with
+no `file:line` prefix; the line carries that.
+
+The review body must read at a glance: everything outside `<details>` blocks
+totals under 512 bytes. Only core information stays visible: the verdict, the
+summary line, and the section headings. Anything verbose goes into a `<details>`
+block whose `<summary>` is a few words, such as the title of an issue with the
+what, why, and how inside; the same for each strength, each recommendation, the
+reasoning, and any compliance notes. A finding you anchored belongs there only
+as its title, since its detail is on the line. Details blocks are top-level,
+never inside a list item, because Gitea breaks them there.
 
 For an `issue_comment` or `pull_request_review_comment` event, treat the `body`
 in the triggering comment payload below as the user's exact instruction.

run.ts

@@ -3,6 +3,7 @@
 // GITEA_TOKEN; everything this script posts goes through the reviewer token,
 // so it appears as the bot account.
 import { TextLineStream } from "jsr:@std/streams@1/text-line-stream";
+import { retryInvalidToken } from "./auth.ts";
 
 type GiteaUser = { login: string; email: string };
 type GiteaComment = { user: GiteaUser; created_at: string; body: string };
@@ -64,12 +65,50 @@ async function postComment(body: string): Promise<void> {
 // picks up narration while a file's first line is written on purpose. That line
 // is the verdict, matched whole; anything unexpected only comments, never
 // approves. The mark in front is added here, so it is never part of the match.
-const REVIEW_PATH = `${await Deno.makeTempDir()}/review.md`;
+const REVIEW_DIR = await Deno.makeTempDir();
+const REVIEW_PATH = `${REVIEW_DIR}/review.md`;
 const VERDICTS: Record<string, [event: string, mark: string]> = {
   Approved: ["APPROVED", "✅"],
   "Changes requested": ["REQUEST_CHANGES", "🛑"],
 };
 
+// A finding about one line is posted on that line of the diff rather than as
+// `file:line` prose in the body. Those anchors come as JSON, so the file and
+// line are structured instead of parsed back out of English; a malformed entry
+// fails the run, because a silently dropped finding is worse than a red run.
+const ANCHORS_PATH = `${REVIEW_DIR}/anchors.json`;
+type Anchor = { path: string; line: number; side: "new" | "old"; body: string };
+
+function parseAnchors(text: string): Anchor[] {
+  const entries: unknown = JSON.parse(text);
+  if (!Array.isArray(entries)) throw new Error(`${ANCHORS_PATH}: not an array`);
+  return entries.map((entry: unknown, index) => {
+    const at = `${ANCHORS_PATH}[${index}]`;
+    if (typeof entry !== "object" || entry === null) {
+      throw new Error(`${at}: not an object`);
+    }
+    const { path, line, side = "new", body } = entry as Record<string, unknown>;
+    if (typeof path !== "string" || path === "") {
+      throw new Error(`${at}.path: expected a repository path`);
+    }
+    if (typeof line !== "number" || !Number.isInteger(line) || line < 1) {
+      throw new Error(`${at}.line: expected a line number`);
+    }
+    if (side !== "new" && side !== "old") {
+      throw new Error(`${at}.side: expected "new" or "old"`);
+    }
+    if (typeof body !== "string" || body.trim() === "") {
+      throw new Error(`${at}.body: expected the finding`);
+    }
+    return { path, line, side, body };
+  });
+}
+
+async function readAnchors(): Promise<Anchor[]> {
+  const written = await Deno.readTextFile(ANCHORS_PATH).catch(() => null);
+  return written === null ? [] : parseAnchors(written);
+}
+
 async function postResult(body: string): Promise<void> {
   const review = await Deno.readTextFile(REVIEW_PATH).catch(() => null);
   if (review === null) {
@@ -80,9 +119,25 @@ async function postResult(body: string): Promise<void> {
   }
   const [verdict, ...rest] = review.split("\n");
   const [event, mark] = VERDICTS[verdict.trim()] ?? ["COMMENT", "💬"];
-  await gitea(REVIEWER_TOKEN, `repos/${REPO}/pulls/${INDEX}/reviews`, {
+  const post = (anchors: Anchor[]) =>
-    body: stripAnsi([`${mark} ${verdict.trim()}`, ...rest].join("\n")),
+    gitea(REVIEWER_TOKEN, `repos/${REPO}/pulls/${INDEX}/reviews`, {
-    event,
+      body: stripAnsi([`${mark} ${verdict.trim()}`, ...rest].join("\n")),
+      event,
+      comments: anchors.map(({ path, line, side, body }) => ({
+        path,
+        body: stripAnsi(body),
+        new_position: side === "new" ? line : 0,
+        old_position: side === "old" ? line : 0,
+      })),
+    });
+  const anchors = await readAnchors();
+  // Gitea rejects the whole review when an anchor names a line outside the
+  // diff, and a verdict that never lands blocks the pull request, so the body
+  // goes up alone rather than not at all.
+  await post(anchors).catch(async (error: Error) => {
+    if (anchors.length === 0) throw error;
+    console.error(`inline comments rejected: ${error.message}`);
+    await post([]);
   });
 }
 
@@ -99,19 +154,6 @@ async function configureGitAuthor(): Promise<void> {
   }
 }
 
-// The superpowers plugin gives the agent its skills, including the code review
-// one that the prompt asks for. Both installs are idempotent on the persisted
-// home.
-async function installSuperpowers(bot: string): Promise<void> {
-  const commands = bot === "claude"
-    ? [
-      ["plugin", "marketplace", "add", "obra/superpowers-marketplace"],
-      ["plugin", "install", "-y", "superpowers@superpowers-marketplace"],
-    ]
-    : [["plugin", "add", "superpowers@openai-curated-remote"]];
-  for (const args of commands) await run(bot, args);
-}
-
 async function renderPrompt(): Promise<string> {
   const comments: GiteaComment[] = await (await gitea(
     REVIEWER_TOKEN,
@@ -128,6 +170,7 @@ async function renderPrompt(): Promise<string> {
     GITEA_REPOSITORY: REPO,
     ISSUE_INDEX: INDEX,
     REVIEW_PATH,
+    ANCHORS_PATH,
   };
   const template = await Deno.readTextFile(
     new URL("prompt.md", import.meta.url),
@@ -145,7 +188,6 @@ async function runClaude(prompt: string): Promise<string> {
       "Run `claude setup-token` locally and set the `bot-token` action input.",
     );
   }
-  await installSuperpowers("claude");
   const claude = new Deno.Command("claude", {
     args: [
       "--print",
@@ -196,12 +238,17 @@ async function codexDeviceLogin(): Promise<void> {
       new WritableStream({ write: (chunk) => void (shown += chunk) }),
     );
   const drained = Promise.all([collect(login.stdout), collect(login.stderr)]);
+  const status = login.status;
   await new Promise((resolve) => setTimeout(resolve, 3000));
+  while (shown.trim() === "") {
+    const exited = await Promise.race([
+      status.then(() => true),
+      new Promise<boolean>((resolve) => setTimeout(() => resolve(false), 100)),
+    ]);
+    if (exited) throw new Error("AI bot login produced no instructions");
+  }
   await postComment(shown);
-  await Promise.all([login.status, drained]);
+  await Promise.all([status, drained]);
-  const status = await new Deno.Command("codex", { args: ["login", "status"] })
-    .output();
-  await postComment(new TextDecoder().decode(status.stdout));
 }
 
 async function runCodex(prompt: string): Promise<string> {
@@ -210,23 +257,36 @@ async function runCodex(prompt: string): Promise<string> {
   })
     .output();
   if (!loggedIn.success) await codexDeviceLogin();
-  await installSuperpowers("codex");
   const file = await Deno.makeTempFile();
-  const status = await new Deno.Command("codex", {
+  const attempt = async () => {
-    args: [
+    const codex = new Deno.Command("codex", {
-      "exec",
+      args: [
-      "--model",
+        "exec",
-      model("codex"),
+        "--model",
-      "--dangerously-bypass-approvals-and-sandbox",
+        model("codex"),
-      "--output-last-message",
+        "--dangerously-bypass-approvals-and-sandbox",
-      file,
+        "--output-last-message",
-      prompt,
+        file,
-    ],
+        prompt,
-    env: agentEnv,
+      ],
-    clearEnv: true,
+      env: agentEnv,
-    stdout: "inherit",
+      clearEnv: true,
-    stderr: "inherit",
+      stdout: "inherit",
-  }).spawn().status;
+      stderr: "piped",
+    }).spawn();
+    const decoder = new TextDecoder();
+    let error = "";
+    for await (const chunk of codex.stderr) {
+      await Deno.stderr.write(chunk);
+      error += decoder.decode(chunk, { stream: true });
+    }
+    error += decoder.decode();
+    return { status: await codex.status, error };
+  };
+  const { status } = await retryInvalidToken(attempt, async () => {
+    await run("codex", ["logout"]);
+    await codexDeviceLogin();
+  });
   if (!status.success) throw new Error(`codex exited with ${status.code}`);
   return await Deno.readTextFile(file);
 }