Request CodeRabbit review on opened PRs

src/__tests__/mount-delete-callsite-invariant.test.ts

@@ -8,6 +8,8 @@ const SDK_ROOT = resolve(fileURLToPath(new URL('..', import.meta.url)))
 const ALLOWED_DELETE_CALLSITES = new Set([
   'writeback/linear.ts',
   'writeback/slack.ts',
+  // Deletes only the exact review draft after its publish operation reaches a terminal state.
+  'mount/relayfile-github-connection-write.ts',
 ])
 
 describe('mount.deleteFile callsite invariant', () => {

src/cli/fleet.test.ts

@@ -2050,6 +2050,21 @@ describe('fleet CLI runtime', () => {
             { ref: 'refs/heads/factory/77', sha: 'abc123' },
             { guarded: true },
           )).toBe(false)
+          expect(await opts?.isAllowedDraft?.(
+            `/github/repos/${input.repo}/pulls/42/comments/factory-coderabbit-review.json`,
+            { body: '@coderabbitai review\n<!-- factory-coderabbit-review-request -->' },
+            { guarded: true },
+          )).toBe(true)
+          expect(await opts?.isAllowedDraft?.(
+            `/github/repos/${input.repo}/pulls/42/comments/factory-coderabbit-review.json`,
+            { body: 'arbitrary public comment' },
+            { guarded: true },
+          )).toBe(false)
+          expect(await opts?.isAllowedDraft?.(
+            `/github/repos/${input.repo}/pulls/42/comments/arbitrary.json`,
+            { body: '@coderabbitai review' },
+            { guarded: true },
+          )).toBe(false)
           closes.push(input)
         },
       }

src/cli/fleet.ts

@@ -70,6 +70,7 @@ import {
 import type { FactoryIntegrationProvider } from '../ports'
 import { checkMountStaleness } from '../mount/relayfile-binary'
 import { MountAuthScopeError } from '../mount/mount-auth-error'
+import { isAllowedFactoryGithubWritebackDraft } from '../github/review-request'
 
 interface FleetCliDeps {
   fleet?: FleetClient
@@ -178,7 +179,7 @@ export async function runFleetCli(argv: string[], deps: FleetCliDeps = {}): Prom
         const workspaceId = (await (deps.resolveWorkspace ?? resolveFactoryWorkspace)()).workspaceId
         mount = deps.mount ?? await (deps.cloudMountFromConfig ?? RelayfileCloudMountClient.fromConfig)({
           workspaceId,
-          isAllowedDraft: (path, _content, opts) => isAllowedFactoryGithubDraft(path, opts),
+          isAllowedDraft: (path, content, opts) => isAllowedFactoryGithubDraft(path, content, opts),
         })
         await prepareFactoryIntegrations(command, mount, undefined, globals, deps, workspaceId, err)
         githubWrite = mount.githubWrite
@@ -1489,20 +1490,18 @@ async function isAllowedFactoryDraft(
     return true
   }
 
-  if (isAllowedFactoryGithubDraft(path, opts)) {
+  if (isAllowedFactoryGithubDraft(path, content, opts)) {
     return true
   }
 
   return false
 }
 
-const isFactoryGithubWritebackPath = (path: string): boolean =>
-  /^\/github\/repos\/[^/]+\/[^/]+\/(?:pull-requests\/factory-[^/]+\.json|refs\/(?:factory\.json|refs%2Fheads%2Ffactory%2F[^/]+\.json)|pulls\/[1-9]\d*\/close\.json)$/iu.test(path)
-
 const isAllowedFactoryGithubDraft = (
   path: string,
+  content: unknown,
   opts: { guarded?: boolean } | undefined,
-): boolean => opts?.guarded === true && isFactoryGithubWritebackPath(path)
+): boolean => opts?.guarded === true && isAllowedFactoryGithubWritebackDraft(path, content)
 
 const scopeIssueFromDraftContent = (content: unknown) => ({
   title: typeof asRecord(content)?.title === 'string' ? asRecord(content)?.title as string : '',

src/github/index.ts

@@ -14,6 +14,7 @@ export {
   standaloneBabysitterAgentName,
 } from './standalone-babysitter'
 export type {
+  GhRunOptions,
   GhRunner,
   GhRunResult,
   GithubMergeInput,

src/github/merge-gate.ts

@@ -8,7 +8,12 @@ export interface GhRunResult {
   stderr?: string
 }
 
-export type GhRunner = (args: string[]) => Promise<GhRunResult>
+export interface GhRunOptions {
+  /** Cancels the underlying `gh` subprocess; callers must await its settlement before retrying. */
+  signal?: AbortSignal
+}
+
+export type GhRunner = (args: string[], options?: GhRunOptions) => Promise<GhRunResult>
 
 export interface GithubMergeGateInput {
   repo: string
@@ -172,10 +177,13 @@ export function evaluateGithubMergeGate(
   }
 }
 
-export const defaultGhRunner: GhRunner = async (args) => {
+export const defaultGhRunner: GhRunner = async (args, options) => {
   // TODO(issue-52): retire this compatibility runner when merge-gate reads and
   // guarded merges are fully represented by the mounted GitHub connection.
-  const { stdout, stderr } = await execFileAsync('gh', args, { maxBuffer: 1024 * 1024 })
+  const { stdout, stderr } = await execFileAsync('gh', args, {
+    maxBuffer: 1024 * 1024,
+    signal: options?.signal,
+  })
   return { stdout, stderr }
 }
 

src/github/review-request.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  containsCoderabbitReviewRequest,
+  FACTORY_CODERABBIT_REVIEW_BODY,
+  isAllowedFactoryGithubWritebackDraft,
+  isFactoryGithubWritebackPath,
+} from './review-request'
+
+describe('isFactoryGithubWritebackPath', () => {
+  it('allows only the deterministic factory review-request comment path', () => {
+    expect(isFactoryGithubWritebackPath(
+      '/github/repos/AgentWorkforce/factory/pulls/42/comments/factory-coderabbit-review.json',
+    )).toBe(true)
+    expect(isFactoryGithubWritebackPath(
+      '/github/repos/AgentWorkforce/factory/pulls/42/comments/arbitrary.json',
+    )).toBe(false)
+  })
+
+  it('allows only the fixed review-request body at the public comment path', () => {
+    const path = '/github/repos/AgentWorkforce/factory/pulls/42/comments/factory-coderabbit-review.json'
+    expect(isAllowedFactoryGithubWritebackDraft(path, {
+      body: FACTORY_CODERABBIT_REVIEW_BODY,
+    })).toBe(true)
+    expect(isAllowedFactoryGithubWritebackDraft(path, {
+      body: 'arbitrary public comment',
+    })).toBe(false)
+    expect(isAllowedFactoryGithubWritebackDraft(path, {
+      body: FACTORY_CODERABBIT_REVIEW_BODY,
+      title: 'unexpected extra field',
+    })).toBe(false)
+  })
+
+  it('does not mistake a public marker-only comment for a review command', () => {
+    expect(containsCoderabbitReviewRequest(
+      '<!-- factory-coderabbit-review-request -->',
+    )).toBe(false)
+    expect(containsCoderabbitReviewRequest(
+      FACTORY_CODERABBIT_REVIEW_BODY,
+    )).toBe(true)
+  })
+})

src/github/review-request.ts

@@ -0,0 +1,21 @@
+export const CODERABBIT_REVIEW_REQUEST = '@coderabbitai review'
+export const FACTORY_CODERABBIT_REVIEW_MARKER = '<!-- factory-coderabbit-review-request -->'
+export const FACTORY_CODERABBIT_REVIEW_BODY =
+  `${CODERABBIT_REVIEW_REQUEST}\n${FACTORY_CODERABBIT_REVIEW_MARKER}`
+
+export const factoryCoderabbitReviewCorrelationId = (repo: string, number: number): string =>
+  `factory:coderabbit-review:${repo.toLowerCase()}#${number}`
+
+export const containsCoderabbitReviewRequest = (value: string): boolean =>
+  value.includes(CODERABBIT_REVIEW_REQUEST) && value.includes(FACTORY_CODERABBIT_REVIEW_MARKER)
+
+export const isFactoryGithubWritebackPath = (path: string): boolean =>
+  /^\/github\/repos\/[^/]+\/[^/]+\/(?:pull-requests\/factory-[^/]+\.json|refs\/(?:factory\.json|refs%2Fheads%2Ffactory%2F[^/]+\.json)|pulls\/[1-9]\d*\/(?:close\.json|comments\/factory-coderabbit-review\.json))$/iu.test(path)
+
+export const isAllowedFactoryGithubWritebackDraft = (path: string, content: unknown): boolean => {
+  if (!isFactoryGithubWritebackPath(path)) return false
+  if (!/\/pulls\/[1-9]\d*\/comments\/factory-coderabbit-review\.json$/iu.test(path)) return true
+  if (content === null || typeof content !== 'object' || Array.isArray(content)) return false
+  const record = content as Record<string, unknown>
+  return Object.keys(record).length === 1 && record.body === FACTORY_CODERABBIT_REVIEW_BODY
+}

src/index.ts

@@ -114,6 +114,7 @@ export {
 export type {
   CloseProbePrInput,
   CloseProbePrResult,
+  GhRunOptions,
   GhRunner,
   GhRunResult,
   GithubMergeInput,
@@ -301,6 +302,7 @@ export type {
   FactoryIntegrationProvider,
   GithubPublishPullRequestInput,
   GithubPublishPullRequestResult,
+  GithubPullRequestRef,
   LocalMountOptions,
   MountClient,
   ProviderSyncStatus,