100 lines
3.8 KiB
JavaScript
100 lines
3.8 KiB
JavaScript
import { execFile } from "node:child_process";
|
|
import { promisify } from "node:util";
|
|
import { mkdtemp, rm, mkdir } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import crypto from "node:crypto";
|
|
import { authenticatedCloneUrl, createBranch, createPullRequest } from "./gitea.js";
|
|
|
|
const execFileAsync = promisify(execFile);
|
|
const WORKSPACE_ROOT = "/workspace";
|
|
|
|
async function run(cmd, args, opts = {}) {
|
|
const { stdout } = await execFileAsync(cmd, args, {
|
|
maxBuffer: 1024 * 1024 * 32,
|
|
...opts,
|
|
});
|
|
return stdout;
|
|
}
|
|
|
|
async function withWorkspace(fn) {
|
|
await mkdir(WORKSPACE_ROOT, { recursive: true });
|
|
const dir = await mkdtemp(path.join(WORKSPACE_ROOT, "job-"));
|
|
try {
|
|
return await fn(dir);
|
|
} finally {
|
|
await rm(dir, { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
// Runs Claude Code headless. Unattended containers have no TTY to answer permission
|
|
// prompts, so this trusts the sandboxing of the throwaway clone dir instead:
|
|
// bypassPermissions to avoid hanging, plus --disallowedTools as defense in depth so
|
|
// Claude can never push/commit/checkout itself — this script owns those steps.
|
|
async function runClaude(cwd, prompt, { allowEdits }) {
|
|
const disallowed = ["Bash(git push:*)", "Bash(git commit:*)", "Bash(git checkout:*)"];
|
|
if (!allowEdits) disallowed.push("Edit", "Write", "NotebookEdit");
|
|
|
|
const args = [
|
|
"-p", prompt,
|
|
"--output-format", "text",
|
|
"--permission-mode", "bypassPermissions",
|
|
"--disallowedTools", disallowed.join(","),
|
|
];
|
|
|
|
return run("claude", args, { cwd });
|
|
}
|
|
|
|
export async function reviewPullRequest({ owner, repo, ref, cloneUrl, prTitle, prBody }) {
|
|
return withWorkspace(async (dir) => {
|
|
const authedUrl = authenticatedCloneUrl(cloneUrl);
|
|
await run("git", ["clone", "--quiet", authedUrl, dir]);
|
|
await run("git", ["fetch", "--quiet", "origin", ref], { cwd: dir });
|
|
await run("git", ["checkout", "--quiet", ref], { cwd: dir });
|
|
|
|
const prompt = [
|
|
"You are reviewing a pull request. Diff HEAD against the base branch (origin/main)",
|
|
"and give a concise, specific code review: correctness bugs first, then",
|
|
"simplification/reuse/efficiency notes. Read-only — do not edit any files.",
|
|
`PR title: ${prTitle}`,
|
|
`PR description:\n${prBody}`,
|
|
].join("\n");
|
|
|
|
return runClaude(dir, prompt, { allowEdits: false });
|
|
});
|
|
}
|
|
|
|
export async function runChatTask({ owner, repo, cloneUrl, instruction }) {
|
|
return withWorkspace(async (dir) => {
|
|
const authedUrl = authenticatedCloneUrl(cloneUrl);
|
|
await run("git", ["clone", "--quiet", authedUrl, dir]);
|
|
|
|
const branch = `claude/${crypto.randomBytes(4).toString("hex")}`;
|
|
await createBranch(owner, repo, branch);
|
|
await run("git", ["fetch", "--quiet", "origin", branch], { cwd: dir });
|
|
await run("git", ["checkout", "--quiet", branch], { cwd: dir });
|
|
|
|
const prompt = [
|
|
"Implement the change described below in this repository. Make the smallest",
|
|
"correct change that satisfies it. Do not run git commit, git push, or git",
|
|
"checkout yourself — just edit files; committing and pushing happens separately.",
|
|
`Instruction: ${instruction}`,
|
|
].join("\n");
|
|
|
|
await runClaude(dir, prompt, { allowEdits: true });
|
|
|
|
await run("git", ["add", "-A"], { cwd: dir });
|
|
const status = await run("git", ["status", "--porcelain"], { cwd: dir });
|
|
if (!status.trim()) {
|
|
throw new Error("Claude made no changes for this instruction");
|
|
}
|
|
await run("git", ["commit", "-m", `claude: ${instruction}`.slice(0, 200)], { cwd: dir });
|
|
await run("git", ["push", "--quiet", "origin", branch], { cwd: dir });
|
|
|
|
return createPullRequest(owner, repo, {
|
|
head: branch,
|
|
title: `claude: ${instruction}`.slice(0, 200),
|
|
body: `Requested via Matrix:\n\n> ${instruction}`,
|
|
});
|
|
});
|
|
}
|