vance

[Flue] Redesign pull request reviews (#33634)

chore: migrate cloudflare-docs-bot to Flue 2.0 (#32226) * chore: migrate cloudflare-docs-bot to Flue 2.0 Rework the .flue/ PR-review bot (cloudflare-docs-flue) from Flue 0.11 to Flue 2.0. The 0.11 "workflow-per-Durable-Object + internal HTTP routing" model is replaced by Cloudflare WorkflowEntrypoints that drive per-agent Durable Objects. Trusted TypeScript owns all control flow and every GitHub/R2 side effect; each AI step is a Flue agent that only reasons and returns structured data through a single Valibot-typed submit_* tool. Behavior is preserved: the same code review / conventions / style-guide sections in one PR comment, the spam gate, the Dependabot path, the /rebase command, codeowner slash commands, and log/comment review modes. - Ingress: one HMAC-verified POST /webhooks/github; pure, unit-tested classifyWebhook + startReviewPipeline. No internal HTTP routes. - Workflows: ReviewOrchestrator, IngestWorkflow (spam gate), DependabotReviewWorkflow, RebaseWorkflow. - Agents (7): code-review-file, style-guide-file, conventions-reviewer, reconcile-reviewer, spam-filter, dependabot-reviewer, rebase-conflict-resolver. Per-file fan-out is one DO instance per file. - Build moves to Vite (vite build / vite dev); @flue/cli 2.0 dropped build/dev. wrangler.jsonc gains a v10 DO migration (7 SQLite agent classes). - Roles are re-homed via an explicit useBotRole() hook (2.0 has no role auto-discovery). - Removes the 0.11 workflows/ and superseded lib/ modules. Validated locally: tsc (0 errors), vite build, wrangler deploy --dry-run, and the Vitest suite all pass; the INGEST spam-gate to review pipeline was exercised end to end in log mode. * chore: remove unused shell-sandbox deps and worker_loaders binding Clean up leftovers from the Flue 2.0 migration's deleted shell sandbox. No agent uses a shell sandbox anymore, so these are dead: - Drop @cloudflare/shell and @cloudflare/codemode dependencies (imported nowhere in the code, the generated entry, or @flue). pnpm prunes 32 packages. - Remove the unused worker_loaders/LOADER binding from wrangler.jsonc (no env.LOADER reference in code). - Drop the LOADER bullet from .flue/AGENTS.md. Re-validated: tsc (0 errors), vite build, wrangler deploy --dry-run (13 bindings, no LOADER, v10 migration intact), and the Vitest suite (141 tests) all pass. * fix: address code review findings in PR #32226 - CR-fd682f90a024: Detect duplicate conflict write paths, return low-confidence fallback - CR-69dfb2bf8d15: Log markAutoReviewCompleted failures instead of silently swallowing - CR-d73074aa9ae0: Return reviewedFiles:[] on no-result path to match degraded-error path - CR-813507364944: Wrap v.parse in try/catch for invalid spam verdicts, degrade gracefully - CR-e7b3cc098f19: Remove markdown code fences around JSON in reconcile prompt (prompt injection) - CR-f4cb3cbf256a: Make useInstruction unconditional for hook-order stability - CR-e3dccfc0d318: Distinguish 'never called' vs 'invalid submission' in useAgentFinish reminder - CR-5cf837342595: Reorder spam side effects: close before comment for idempotency - CR-4a5b8f875b0f: Add filename as secondary sort key for deterministic file selection * fix: address code review findings in Flue 2.0 migration - Reconcile fallback carries forward untouched-file findings (F3) - Style-guide no-result returns reviewedFiles: [] (F8) - Spam close/comment ordering — best-effort after close (F9) - Rebase apply/notify split — best-effort after applyResolution (F5) - Conventions read timeout/abort (F7) - Halt on delete/modify conflicts in rebase (F4) - Thread expected_head_sha through update-branch (F6) - Mint GitHub token in-DO, drop from initialData (F1) - Update AGENTS.md token note * feat: add /dev/review/:number endpoint for local review testing Fetches the real PR from GitHub, builds the same WebhookClassification a webhook would, and routes through startReviewPipeline — spam gate, Dependabot detection, codeowner checks, the full pipeline. Gated behind DOCS_FLUE_INTERNAL_TOKEN. * fix: address second round of code review findings in PR #32226 * fix: capture publish step result in DependabotReviewWorkflow Early return from step.do("publish") only exits the step callback; the outer run method continued and returned acted: true even when publish was skipped due to head_moved. Capture the step result and return early from run with acted: false when not finalized.

chore: bump prettier-plugin-astro to 1.0.0 and reformat astro files (#33410) * [Docs Site] Bump prettier-plugin-astro from 0.14.1 to 1.0.0 Bumps [prettier-plugin-astro](https://github.com/withastro/prettier-plugin-astro) from 0.14.1 to 1.0.0. - [Release notes](https://github.com/withastro/prettier-plugin-astro/releases) - [Changelog](https://github.com/withastro/prettier-plugin-astro/blob/main/CHANGELOG.md) - [Commits](https://github.com/withastro/prettier-plugin-astro/compare/v0.14.1...v1.0.0) --- updated-dependencies: - dependency-name: prettier-plugin-astro dependency-version: 1.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * chore: reformat .astro files for prettier-plugin-astro 1.0.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

flue: add generic code review alongside style-guide review (#31562) * flue: add generic code review alongside style-guide review Adds a bonk-style generic engineering review that runs in the same orchestrator run as the existing style-guide review and posts findings in the same bot comment, now split into "### Code Review" and "### Style Guide Review" sections. - New code-review skill: reviews all changed files (including code examples in MDX) for bugs, error handling, security, dead code, and maintainability. No style/prose checks; defers CI-caught issues. - New in-process fan-out (lib/code-review-inproc.ts) mirroring the style-guide one: per-file sessions, concurrency 5, cap 20 files. - Code findings add a `critical` severity above warning/suggestion and use the CR- id namespace; reconcile skill preserves it. - Code-review agent gets full-file context via GitHub-API-backed tools (read_repo_file defaults to the PR head SHA, search_repo). - The repo root AGENTS.md is fetched at the head SHA and injected as agent instructions every run, since the Worker has no repo checkout to discover it from. - Orchestrator runs both reviews concurrently (one failing degrades to empty rather than aborting), reconciles per stream, persists { code, style } findings to R2 (legacy bare-array tolerated), and renders one unified comment. Cadence is unchanged: this rides the existing code-review-orchestrator triggers (auto on PRs, /review, /full-review). * flue: address code-review self-review findings Fixes surfaced by the bot reviewing its own PR (#31562): - getRepoFileContent: decode base64 as UTF-8 via TextDecoder (atob alone produced mojibake for non-ASCII content such as em dashes in AGENTS.md); URL-encode path segments; return null only on 404 and throw on other non-2xx so "absent" is distinct from "failed to load". - Fetch the root AGENTS.md from the PR base ref instead of the head SHA. The content is injected into agent instructions, so reading it from the head let a PR poison AGENTS.md to inject instructions into the reviewer. - Render: a degraded (failed) review section now shows a failure note instead of "No issues found", and the status line notes the partial failure; carried-forward findings still render. Orchestrator passes the per-stream failure flags into renderComment. - Render: match acknowledged findings by stable id, not path:line:rule, so two findings sharing those fields are not both dropped. - github-repo-tools.ts: update stale file header (now shared by the Dependabot and code-review agents). * flue: run review fan-outs sequentially to fix DO memory resets Running the code-review and style-guide fan-outs concurrently kept ~10 model sessions live in a single Durable Object isolate and over-ran its 128 MB limit, producing repeated "isolate exceeded its memory limit and was reset" errors (and downstream event-stream append failures). - Run the two fan-outs sequentially instead of via Promise.all, so one fan-out's sessions are reclaimed before the next starts (roughly halves peak heap). Per-stream failure isolation is preserved. - Lower code-review concurrency from 5 to 3, since its sessions are heavier (full-file reads + injected AGENTS.md) than style-guide ones. Trade-off: review wall-clock is now the sum of the two fan-outs rather than the max — acceptable for a background review bot. * flue: split reviewers into separate specialist workflows Move the code-review and style-guide fan-outs out of the orchestrator DO into their own discovered workflows, so each runs in its own Durable Object isolate (own 128 MB budget). This removes the shared-isolate memory contention that caused "isolate exceeded its memory limit and was reset" errors and restores parallel execution. - New workflows code-review-specialist + style-guide-specialist (FlueCodeReviewSpecialistWorkflow / FlueStyleGuideSpecialistWorkflow). Each self-fetches its own diff once (no per-file fetch, no R2 diff staging), stages it into its own workspace, runs the existing in-process fan-out (reused verbatim), and returns findings as its run result. - Orchestrator now decides diff mode only (no file fetch), admits both specialists via admitWorkflow and polls them concurrently via pollRun (the spam-filter pattern). A timed-out/errored specialist degrades to an empty section with its failure flag set; both failing -> failure comment. - Specialists self-heal incremental -> full diff if the base SHA is gone. - Code-review concurrency restored to 5 (own isolate now). - New shared lib/review-specialist.ts: payload contract + helpers. - writeDiffToWorkspace accepts a minimal DiffPullRequest shape. - wrangler v5 migration adds the two new SQLite DO classes. Supersedes the sequential-fan-out workaround; the fan-outs no longer run in the orchestrator DO at all. * flue: remove unused DiffMode import in code-review-specialist * flue: add beta disclaimer note under Code Review heading * flue: lower code-review specialist concurrency to 3 to stay under DO memory limit * flue: cap code review at 10 files and raise specialist poll timeout The code-review specialist timed out on large PRs. AI Gateway showed all model calls succeeding (0 failures) but slow (p90 ~47s, p99 ~103s), so the cause was DO memory pressure plus total wall-clock, not model errors: - A 13-file run at concurrency 5 hard-OOM'd the specialist isolate ("SQL query failed: ... memory limit") and never reached run_end. - Even without OOM, 13 multi-turn file sessions exceeded the orchestrator's 10-minute poll deadline. Fixes: - CODE_REVIEW_MAX_FILES 20 -> 10. Each code-review file is a multi-turn agent session, so this bounds both peak isolate memory and wall-clock. Covers virtually all docs PRs; larger PRs review their 10 largest files. - Orchestrator specialist poll timeout 10m -> 20m, since a legitimate large review is many slow model calls and the specialist runs durably in its own DO. - Concurrency stays at 3 (memory). * flue: free per-file review sessions to fix specialist DO OOM Delete each per-file agent session as soon as it finishes so harness memory is bounded to ~concurrency live sessions instead of growing with the changed-file count. With the leak fixed, restore the code-review cap to 20 files and concurrency to 5, and drop the dead reserveTokens hint. * enable tracing * flue: document code-review architecture in AGENTS.md * flue: reduce review turns, add watchdog, per-file abort, env-overrides Pre-stage added lines + file content into skill args (code-review-inproc.ts, code-review-specialist.ts, SKILL.md): trusted TypeScript now parses the diff and fetches the full file at head SHA before each session opens, eliminating the mandatory setup turns (read manifest → read patch → parse lines → read_repo_file). Cross-file tools remain available for optional lookups. Removes diff workspace staging from the code-review path entirely. Add external cron watchdog (review-watchdog.ts, review-watchdog-decide.ts, run-state.ts): a scheduled handler fires every 2 minutes, detects reviews stuck past a deadline via inflight R2 markers, and re-drives them. Workflows are non-resumable after DO interruptions; the watchdog is the only reliable recovery path. Inflight markers are written at review start and cleared on completion (code-review-state.ts, code-review-orchestrator.ts). Per-file hard timeout now aborts the CallHandle before deleting the session (code-review-inproc.ts, style-guide-inproc.ts): session.delete() rejects while an operation is active, so abort must settle the operation first. Fixes zombie session leak on timeout. Env-overridable concurrency and file timeout (lib/env.ts): both specialists read CODE_REVIEW_CONCURRENCY, CODE_REVIEW_FILE_TIMEOUT_MS, STYLE_GUIDE_CONCURRENCY, STYLE_GUIDE_FILE_TIMEOUT_MS so local dev can run lower values without touching prod defaults. Staged-diff cleanup in style-guide-specialist.ts: removeWorkspacePath in try/finally so the run-scoped SQLite rows are freed after each review. Added removeWorkspacePath to connectors/cloudflare-shell.ts. Wrangler: cron trigger every 2 min, DOCS_FLUE_BASE_URL var for watchdog. Tooling: flue:reset:local script, NODE_OPTIONS on flue:dev, fixed clear-r2-pr-data.ts to cover both state paths and inflight/ prefix. * flue: remove watchdog (never ran; reviews healthy without it) The scheduled watchdog was never functional in prod: Flue drops non-HTTP handlers from app.ts (they require cloudflare.ts), so the cron fired every 2 minutes and logged "Handler does not export a scheduled() function" 30 times per hour without ever invoking runReviewWatchdog(). Reviews stopped getting stuck independently — the skill rewrite + per-file session.delete() + concurrency limits reduced orchestrator interruptions to near-zero. The watchdog's run-state detection and re-admission path were also untested end-to-end, so enabling it carried real risk. Removes: review-watchdog.ts, review-watchdog-decide.ts, run-state.ts, all inflight marker API from code-review-state.ts, all marker call sites from code-review-orchestrator.ts, triggers.crons + vars.DOCS_FLUE_BASE_URL from wrangler.jsonc. Reverts app.ts to canonical export default app. Keeps: markAutoReviewCompleted, renderFailureComment, bypassReviewLimit (all used independently). bin/clear-r2-pr-data.ts inflight/ handling kept for one-time cleanup of orphaned prod R2 markers. * flue: explicitly clear crons in wrangler config An absent triggers key leaves existing cron triggers intact on deploy; triggers.crons=[] forces wrangler to PUT an empty schedule list, actually deregistering the leftover */2 cron. * flue: address ask-bonk review findings (items 1-4) 1. Extract withConcurrency to lib/inproc-utils.ts; import from both code-review-inproc.ts and style-guide-inproc.ts instead of duplicating. 2. Fix read_repo_file tool UTF-8 decoding: use TextDecoder instead of bare atob() so non-ASCII content (em dashes, CJK, smart quotes) is not mojibake. Also encode path segments with encodeURIComponent, matching the getRepoFileContent fix already applied to github.ts. 3. Fix parseAddedLines: skip lines starting with backslash ('\ No newline at end of file') instead of treating them as context lines. Previously this incremented newLine, producing off-by-one line numbers for every subsequent added line in files without a trailing newline. 4. Fix stale comments: code-review-diff.ts, style-guide-inproc.ts, and wrangler.jsonc v4 comment still described the old in-orchestrator-DO architecture; updated to reflect the specialist-DO split. * flue: add holistic code review mode with size-based routing and forced-mode commands Routes code review to one of two strategies based on combined diff size: Fan-out (≤50 KB): per-file sessions, concurrency 5, cap 20 files. Good for smaller PRs; maximum per-file detail, parallel sessions, per-file degradation. Holistic (>50 KB): single session over the entire PR diff in one pass, cap 50 files (lib/code-review-holistic.ts). Enables cross-file reasoning, no per-file setup overhead, faster and more reliable on large PRs where fan-out wedges. New code-review-holistic skill: rich substance from the per-file skill, reframed for whole-PR review, model-owned navigation. Comment heading reflects which ran: 'Holistic Code Review' or 'Fan Out Code Review'. Both paths log inputTokens/totalTokens for calibration. Two new codeowner slash commands: /fan-out-review — forces fan-out regardless of diff size (with warning in the comment that it may be slow/fail on large PRs) /holistic-review — forces holistic regardless of diff size forceReviewMode threads through orchestrate → orchestrator → review-specialist → code-review-specialist, overriding size-based routing when set. Also: selectCodeReviewFiles takes an optional maxFiles param (holistic passes 50, fan-out uses the existing 20 default); per-file usage logging (inputTokens, totalTokens) added to reviewSingleFile; progress logs committed from the previous session also included here. * flue: fix Dependabot routing for /fan-out-review and /holistic-review; fix partial run consuming auto-review slot /fan-out-review and /holistic-review now check getPullRequest().user.login for dependabot[bot] before dispatching, matching the /review and /full-review pattern. Dependabot PRs route to /workflows/dependabot-review without forceReviewMode; regular PRs keep the forced mode. markAutoReviewCompleted now only fires when both codeOutcome.ok and styleOutcome.ok are true. Previously a partial run (one specialist degraded) still consumed an auto-review slot, which blocked the retry the comment promised would happen on the next push. * [Flue] Replace orchestrator poll with R2 rendezvous + finalize-review workflow Remove the 20-minute specialist poll from the code-review orchestrator (root cause of stuck reviews when the orchestrator DO was interrupted mid-wait). Replace with an event-driven finalize pattern: - Orchestrator is now dispatch-only: limit check, placeholder, diffMode, write context.json to R2, admit both specialists fire-and-forget, return. - Each specialist wraps its review in try/catch (degraded result on error), writes its stream result to R2, then races for a conditional-PUT finalize lock (If-None-Match: *). Exactly one specialist wins. - New finalize-review workflow (FlueFinalizeReviewWorkflow, v6 migration): reads context + stream results from R2, head-guards against newer pushes, idempotency-guards against double-finalize, reconciles both streams, persists review JSON, renders and posts the comment, swaps reactions, marks auto-review slot consumed, cleans up the pending namespace. - reviewMode is carried through context.json so finalize always uses the same mode the orchestrator decided on (fixes log-vs-comment split in local dev where DO env views can differ). - dispatchId scoping isolates concurrent same-head dispatches (e.g. auto-review + /full-review arriving simultaneously). - Zero new custom Durable Object bindings beyond the standard Flue workflow class (FlueFinalizeReviewWorkflow in wrangler.jsonc v6). * [Flue] Use kimi-k2.7-code for reconciliation (drop glm-4.7-flash) * [Flue] Write degraded placeholder before review to prevent stuck finalize A specialist DO that is hard-evicted mid-review never reaches the writeStreamResult call at the end, leaving no code.json/style.json for the other specialist to detect and claim the finalize lock — exactly the stuck-review scenario seen on PR #31736. Fix: each specialist now writes { ok: false, degradedResult } to R2 BEFORE starting its review. If the DO is evicted, the placeholder is already there. The placeholder is overwritten with the real result on success. Either way finalize always has two stream results and will run, posting a degraded-section comment rather than staying stuck forever. Also fixes the unused FinalizeContext import lint error. * [Flue] Fix premature finalize: add final:boolean to stream results The placeholder writes added in the previous commit caused a race: both specialists write their degraded placeholders within ~1-2s, the first to write checks the sibling's placeholder (which looks like a valid result), claims the lock, and finalize fires immediately with two ok:false results before either review ran — posting an instant failure comment. Fix: - Add final:boolean to StreamResultPayload (false=placeholder, true=real) - tryClaimFinalize now checks final:true on the sibling — a placeholder (final:false) is not treated as 'done', preventing premature triggering - Orchestrator writes both crash-protection placeholders (final:false) BEFORE admitting specialists so a key exists even if a specialist DO is evicted immediately after admission - Specialists write final:true in their rendezvous tail (removed the redundant per-specialist placeholder writes added previously) * [Flue] Address AI review findings — robustness, safety, correctness, refactors A. Robustness (stuck-review fixes): - Wrap all specialist setup (token, diff fetch) + review in one try/catch; any setup failure now writes a final:true degraded result and triggers finalize rather than throwing and leaving the placeholder stuck at final:false. Extract shared reportSpecialistResult() helper into lib/finalize-rendezvous.ts to eliminate the duplicated rendezvous tail across both specialists. - Orchestrator admit failures overwrite the placeholder with final:true degraded; if both fail, orchestrator itself claims the finalize lock and admits finalize. Drop redundant type casts on the narrowed admit union. - finalize-review post-comment failure now returns {finalized:false} and skips markAutoReviewCompleted and cleanupPending so the next push can retry without burning an auto-review slot on an undelivered comment. - Degraded streams (ok:false) skip reconciliation and carry previous findings forward as active, preventing false resolution of prior issues. B. Defensive R2 / JSON: - Wrap obj.json() in try/catch in readContext, readStreamResult, and tryClaimFinalize; treat corrupted/partial writes as null/not-final. C. Safety: - Guard req in orchestrator with an explicit throw instead of req!. - safeOrigin() helper returns '' on URL parse failure in both specialists. - parseReviewSpecialistPayload validates pr field shapes and DiffMode union (incremental requires fromSha+toSha strings); normalizes baseUrl to a valid absolute http(s) origin via new URL().origin, dropping invalid values. D. Correctness: - Holistic reviewedFiles now built from patched files only, matching the diff actually sent to the model. - clearTimeout called immediately after await handle resolves in both holistic and per-file reviewSingleFile, preventing a late timer from mislabeling a post-resolve error as a timeout. - Finding ID hash widened from 6 to 12 hex chars (24→48 bit) in both CR-/SG- namespaces; line number deliberately kept excluded for cross-commit stability. - withConcurrency clamps limit to Math.max(1, Math.floor(limit)). E. Dev script (bin/clear-r2-pr-data.ts): - WHERE clause tightened to 'diffs/pr-%' and 'inflight/pr-%' (was 'diffs/%'). - Switch execSync string interpolation to execFileSync with argument arrays. - Freshen stale header comment. F. Refactors: - Collapse four near-identical /review /full-review /fan-out-review /holistic-review handlers in orchestrate.ts into one shared helper. - Merge duplicate cloudflare-shell imports in style-guide-specialist.ts. G. Docs: - AGENTS.md: add finalize-review row to workflow table; rewrite request flow to describe dispatch-only orchestrator, R2 rendezvous, final:bool flag, and finalize-review steps; add v6 migration; update slash-command list. * [Flue] v7+v8 migrations: clear specialist DO storage to break OOM death spiral The FlueCodeReviewSpecialistWorkflow and FlueStyleGuideSpecialistWorkflow DOs accumulated SQLite state from previous crashed runs. Each OOM leaves orphaned session data in the DO's storage. After several crashes the accumulated state is large enough that even the Flue alarm recovery handler OOMs on startup (~900ms, repeating every ~30-60s), creating a death spiral where no future review can complete. Fix: two-step migration to reset the storage: v7 — rename bloated instances to *Old (abandons their storage) v8 — recreate the classes with empty storage under the original names The wrangler bindings still point to the original names (FlueCodeReview- SpecialistWorkflow / FlueStyleGuideSpecialistWorkflow), so no code changes are needed. Run history prior to v7 is lost. * Revert "[Flue] v7+v8 migrations: clear specialist DO storage to break OOM death spiral" This reverts commit fa5e960052398ec7520d3804f145948b1edf6c5e. * [Flue] Specialist split: conventions + redirect specialists, N-stream rendezvous, style-guide rule additions - Generalise finalize rendezvous from 2 streams to N streams (EXPECTED_STREAMS constant; tryClaimFinalize loops all siblings in parallel; stream type widened to string; expectedStreams threaded through context, payload, and options) - Add conventions specialist (light AI session, conventions-check skill): checks PR title format, Summary content against fetched template, and redirect checklist when docs files are renamed/deleted - Add redirect specialist (pure TypeScript, no model): derives old+new URLs from file paths, skips format-only moves (foo.mdx → foo/index.mdx), splat-aware __redirects matching, degrades gracefully if file unreadable - Redirects reconcile deterministically in finalize (no LLM); conventions force full diff mode; bothFailed gate remains code+style only - Add previous_filename to PullRequestFile for correct rename handling - Add marketing-language and time-sensitive-content suggestions to style-guide core-content reference; add component should-use suggestions to code-blocks - Render: 4 sections (Code → Conventions → Style → Redirects); pr path renders as PR label; no-findings messages use <sub> (smaller, no emoji); top-level status line unchanged - wrangler.jsonc v7: new_sqlite_classes for both new DO classes - Fix idempotency guard to skip in log mode (guard is comment-mode only) * [Flue] Add /disable-auto-review command Codeowners can comment /disable-auto-review on a PR to stop push-triggered reviews from running. The flag is stored in R2 at diffs/pr-<n>/auto-review-disabled.json (same pattern as ignore-review-limit). Manual /review and /full-review commands (bypassReviewLimit=true) still work normally. The command is acknowledged with a thumbs-up reaction. * [Flue] Remove holistic code review — always fan-out Holistic mode timed out on large PRs (>50 KB diff, single model pass, 15-min hard timeout) producing zero findings. Fan-out is strictly better: bounded per-file sessions, graceful per-file degradation, guaranteed completion on any diff size. - Delete lib/code-review-holistic.ts and .agents/skills/code-review-holistic/ - code-review-specialist.ts: always fan-out; remove routing logic, holistic imports, env reads, forceReviewMode handling - lib/code-review-inproc.ts: remove CODE_REVIEW_HOLISTIC_* constants and re-export; remove reviewMode from both return sites - lib/code-review-results.ts: remove reviewMode field from CodeReviewResult - lib/review-specialist.ts: remove forceReviewMode from payload type + parser - code-review-orchestrator.ts: remove forceReviewMode from payload + specialistBody - orchestrate.ts: remove /fan-out-review and /holistic-review commands - code-review-render.ts: heading always 'Code Review'; remove codeMode from RenderReviewInput; remove /fan-out-review and /holistic-review command rows - finalize-review.ts: remove codeMode from renderComment call - AGENTS.md: remove holistic routing description and command bullets * [Flue] Remove unused CODE_REVIEW_MAX_FILES import in specialist * [Flue] Relax conventions checks — semantic over format Replace rigid format rules (title must start with [Product] or type:, description must have a ### Summary section) with lenient semantic checks: 1. Product/area identified — title OR description names the area; no tag required 2. Description explains the work — any human prose passes; only flag truly empty/placeholder descriptions 3. Scope accuracy — only flag material misrepresentation, not missing details Default to no finding in all three. Only flag clear, significant violations. * [Flue] Tighten scope accuracy check — flag any unmentioned core change * flue: remove unused-imports rule from style guide review * [Flue] Fix 7 bot-review findings 1. Diff parser: use '+++ '/'--- ' (trailing space) so source lines like '++i;' (patch: '+++i;') are not skipped as file headers. Previously any added line beginning with '++' was silently dropped from args.addedLines. 2. admitWorkflow outside catch-all in reportSpecialistResult: if admitWorkflow threw after tryClaimFinalize won the lock, the exception was swallowed, the lock stayed claimed, and finalize was never admitted for that dispatch. Now the R2 write + lock claim are in the try/catch but the admit call is outside it, so admission errors propagate and can be retried. 3. req guard before placeholder post in orchestrator: the 'if (!req)' check was after the GitHub comment mutation, leaving a stuck 'review pending' comment if req was unexpectedly absent. Moved before the placeholder post. 4. Unhandled getPullRequest failure in finalize: a GitHub API error aborted finalize without running cleanupPending, leaving a stale pending namespace. Wrapped in try/catch with cleanup and graceful return. 5. getIssueComments called unconditionally in log mode: botComment is only used in comment mode (idempotency check + post/update). Moved the fetch inside the 'reviewMode === comment' block to avoid a needless GitHub call and failure surface in log mode. 6. markAutoReviewCompleted read-modify-write race: two concurrent finalizes for the same PR could both read the same state, both pass the headSha dedupe check, and overwrite each other, double-incrementing the count. Fixed with an ETag-based conditional PUT (If-Match / If-None-Match: *) with up to 3 retries on conflict. 7. AGENTS.md stale: updated to reflect 4 specialists (added conventions + redirect rows to workflow table, updated description, request flow, R2 state shape, rendered sections, migration history); added /disable-auto-review to slash commands list. * [Flue] Remove redirect specialist from review pipeline The redirect check added noise without enough signal. Removes the entire stream from the 4-specialist pipeline, leaving code, conventions, and style. - Delete workflows/redirect-specialist.ts - EXPECTED_STREAMS: ['code','style','conventions','redirects'] → 3 streams - Remove degradedRedirectsResult() from finalize-rendezvous.ts - Orchestrator: drop redirects placeholder write, specialist admission, admit-results entry, log fields, and return value - finalize-review: drop redirectsPayload read, missing-results guard term, previousRedirectsFindings, reconcileRedirects helper, reconciledRedirects calls, persisted 'redirects' key, renderComment args, and totalActive/ totalIgnored/totalResolved terms - code-review-render: remove redirects/redirectsFailed from RenderReviewInput, drop redirects from counts and anyFailed, remove Section 4 renderSection call, remove Redirects from acknowledged-by-author block - wrangler.jsonc: v8 migration deletes FlueRedirectSpecialistWorkflow DO class - AGENTS.md: update to 3 specialists throughout; remove redirect rows from workflow table, state shape, rendezvous namespace, and render sections; add v8 migration note; remove stale CI policy note about missing redirects - conventions-check SKILL.md + conventions-specialist.ts: remove stale references to redirect checklist in descriptions/comments * [Flue] Address 16 bot-review findings (W1-W16, S1-S8) W1: Wrap session.skill() reconcile call in finalize-review.ts — a thrown rejection now degrades to current findings instead of crashing finalize. W2+S6: Guard handle.abort() in both inproc timer callbacks with Promise.resolve().catch(() => {}) so abort errors don't produce unhandled rejections from setTimeout. W3: Add allExpectedStreams.includes(myStream) guard in tryClaimFinalize so only legitimate expected streams can trigger finalization. W6: Move parseReviewSpecialistPayload inside the try block in all three specialists (code, style, conventions) so a malformed payload degrades gracefully instead of rejecting the workflow. W7: typeof input.pr === 'object' && input.pr !== null guard in parseReviewSpecialistPayload so non-null non-object values don't cause a TypeError before the intended validation error. W8: Validate every expectedStreams element is a string before passing to downstream rendezvous logic. W9: Wrap isAutoReviewDisabled JSON parse in try/catch — corrupt file now returns false instead of propagating. W10: Validate count and shas shapes in markAutoReviewCompleted before arithmetic and array operations to guard against corrupt data. W11: Rewrite AGENTS.md placeholder description — clarify that final:false placeholders guarantee keys exist in R2 but do NOT trigger finalize; tryClaimFinalize still requires every stream to be final:true. W12+S8: Replace getPullRequest API call in orchestrate.ts slash-command handler with body.issue.user.login from the webhook payload, removing a failure mode that could silently misroute Dependabot PRs. W13+W14: Wrap setReviewLimitIgnored and setAutoReviewDisabled in try/catch in orchestrate.ts — R2 write failure now returns a structured error response instead of propagating a 500 that may trigger webhook retries. W16: Guard NaN in withConcurrency — Math.floor(NaN) passes through Math.max and causes Array.from({ length: NaN }) to throw RangeError. Now clamps to 1 when limit is not finite. S1: Use existing GitHubIssueComment type import in finalize-review.ts instead of inline import() expression. S2: Paginate R2 list in cleanupPending — loop while truncated so all keys under the pending prefix are deleted, not just the first page. S3+S4: Fix stale 'four' in orchestrator header comment; renumber duplicate step-4 labels (context write is now 3, placeholders 4). S7: Preserve original error as cause when converting abort into timeout error in style-guide-inproc.ts. * [Flue] Remove conventions section note from rendered comment * [Flue] Address second-round bot findings (8 fixes) W1: Wrap getIssueComments in finalize-review.ts — API failure now treats the run as not-yet-finalized and continues rather than crashing. W2: Wrap cleanupPending at end of success path — cleanup failure no longer rejects the workflow after the comment is already posted; S1: log markAutoReviewCompleted failure instead of silently swallowing it. W3: More precise git file-header skip in diff parser — match on '+++ b/', '+++ a/', '+++ /dev/null', '--- b/', '--- a/', '--- /dev/null' exactly so source lines like '++ something' (patch: '+++ something') inside a hunk are not incorrectly skipped. W6: Count critical findings from conventions and style in the status-line criticalCount so they surface in '🚨 N critical' even though their renderSection calls still use includeCritical=false. W7: Add pr.body, pr.author, and pr.labels element type checks to parseReviewSpecialistPayload — aligns validation with the declared ReviewSpecialistPrMeta contract. W8+W9: Wrap addReactionToComment after setReviewLimitIgnored and setAutoReviewDisabled — reaction failure no longer masks a successful state write; handler returns acted:true and logs the reaction error. S3: Log when myStream is not in allExpectedStreams in tryClaimFinalize so a misconfigured stream name is visible in logs. * [Flue] Fix two bot findings: quoted diff paths + conventions scope input S: Skip git-quoted file headers in diff parser (paths with spaces/special chars produce headers like '+++ "b/my file.ts"' which the previous prefix checks did not match, causing them to be recorded as added lines). W: Pass changedFiles to conventions-check skill so Rule 3 (scope accuracy) can actually evaluate the full set of changed files, not just renamedDocFiles. Builds a compact {filename,status,additions,deletions} list from the already-fetched PR file list; no extra API call needed. Skill updated to document the new input and use it in Rule 3. * [Flue] Separate 'Acknowledged by author' from last review section with hr * [flue] bump wrangler to 4.107.0; regenerate lockfiles via public npm - .flue/package.json: wrangler 4.97.0 → 4.107.0 (required by @cloudflare/vite-plugin@1.43.0) - Cleared ~/.npmrc Cloudflare internal registry redirect; all @cloudflare/* packages now resolve from public npm, fixing 401 noise and broken workerd@1.20260630.1 binary - Regenerated root and .flue lockfiles against public registry * [flue] fix C1/W1/W2/S3 from code review C1 (style-guide-specialist): guard diffDir before cleanup in finally — without the check, a parse failure would rm -rf / on the DO's SQLite filesystem. W1 (finalize-review + code-review-render): add <!-- status: failure --> to renderFailureComment; update idempotency check to treat both pending and failure as retryable states so /review is not permanently blocked after a both-failed run on the same head SHA. W2 (conventions-specialist): hoist session variable and add finally block calling session?.delete() — matches the pattern in the other two specialists and prevents SQLite event-stream data from accumulating across workflow runs. S3 (clear-r2-pr-data): remove dead OR key LIKE 'inflight/pr-%' branch; no code writes under that prefix. * [flue] fix S2/N1/N2 from re-review S2: renumber orchestrator step comments 3,3,4,4 → 3,4,5,6 N1: style-guide-inproc degraded-file error log: event code_review_orchestrator → style_guide_specialist N2: code-review-inproc degraded-file error log: event code_review_orchestrator → code_review_specialist * [flue] fix N4: delete reconciliation session in finalize-review Session created for the three reconcileStream calls was never deleted, leaving its SQLite event-stream data to accumulate across reviews. Matches the session.delete() pattern from the specialist DOs (W2).

feat: consume reviewer-recommendations queue in Flue (#33465) * feat: consume reviewer-recommendations queue in Flue Add a queue consumer for the corpus worker's reviewer-recommendations events, maintaining a single per-PR contact comment with once-per-PR @-mentions. CODEOWNERS remains the sole formal review mechanism; Flue never mutates reviewers or assignees. Removes the assign-pr action and its workflow job, which has been superseded by the comment-driven suggestions. * feat: add dev-only recommendations endpoint, keep dev off the live queue Adds POST /dev/recommendations (internal-token gated) that feeds a queue-shaped payload through the real processRecommendationEvent path, and strips the queues.consumers entry from dev builds so local/remote dev never attaches to the production reviewer-recommendations queue. * feat: render CODEOWNERS coverage matrix in reviewer-recommendation comment * chore: remove CI codeowners comment, superseded by bot coverage matrix * feat: drop recommendation comments for draft, closed, and spam-labeled PRs * fix: address review findings on recommendation consumer and coverage render * feat: skip recommendation comment for internal-owner-authored PRs * fix: address review findings on recommendation consumer, membership checks, and guards * feat: make review coverage comments action-first * fix: hide reviewer role metadata * fix: avoid redundant review coverage updates * fix: address recommendation review findings * fix: use CODEOWNERS contacts for redirects * fix: suppress CODEOWNERS file contact suggestions * fix: raw area labels and default-rule contact policy - extract CODEOWNERS-only contact policy; sweep the * default rule - drop humanizeAreaName, render raw docs-directory slugs - always show the CODEOWNERS pattern for Other areas - rename Contacts column to Suggested, drop informational footer - remove the humanized Backstage product name from comments * fix: keep suggested reviewers @-mentioned on every update - always render the mention line as "Suggested reviewers: @a @b" - drop the once-per-PR mention tracking (mentionedLogins state, newMentions/withMentions, previously-notified rendering) * fix: drop file counts from the needs-approval table column * fix: address recommendation review findings - AGENTS.md: only the @-mention line notifies; Suggested column is display-only - hardcode expected CODEOWNERS-only patterns in the policy test - isolate the ownershipAreas array check in the corrupt-projection test

feat: add /rebase command to cloudflare-docs-bot (#32121) * feat: add /rebase and /rebaseWithConflicts slash commands to cloudflare-docs-bot * chore: fix lint errors (unused imports, misleading emoji char class) * fix: address code review findings on rebase workflow * fix: address second round of code review findings on rebase workflow * fix: address third round of code review findings on rebase workflow * fix: address fourth round of code review findings on rebase workflow * fix: handle production-side renames in AI conflict resolution path * fix: separate conflict read/write paths and deduplicate tree updates * fix: address sixth round of code review findings on rebase workflow * fix: distinguish permanent vs transient errors in polling, remove duplicate JSDoc * fix: address human reviewer findings (binary files, conflict assertion, fork detection, dead code) * fix: address final review polish (fork null, JSON parse, rename prompt, commit msg, mode, confidence) * fix: fall back to previousPath for mode lookup on renamed conflict files * feat: drop raw API error from halted-conflict, react 👍/👎 based on outcome * feat: improve AI confidence prompt, surface model reason on downgrade * feat: convert /rebaseWithConflicts resolver to Flue agent with bounded tools and skill * fix: address code review findings on rebase agent and tools * fix: extract paginateCompare, fix rate-limit 403, 300-file guard, in-progress error handling, backtick strip, groot-preview, stale JSDoc * fix: token error handling, Retry-After clamping, marker regex, SHA validation, confidence reason * Fixed SHA regex; reviewed PR #32121. Co-authored-by: mvvmm <mvvmm@users.noreply.github.com> * fix: guard fetch errors, binary conflicts, production file cap, duplicate marker, JSDoc * feat: collapse /rebase and /rebaseWithConflicts into a single /rebase command * chore: remove mode field from rebase workflow payload * fix: integer validation for payload IDs, strip stale metadata in render fallback --------- Co-authored-by: ask-bonk[bot] <ask-bonk[bot]@users.noreply.github.com> Co-authored-by: mvvmm <mvvmm@users.noreply.github.com>

feat: Pin the OpenAPI schema used by APIRequest (#33714) * feat: pin the OpenAPI schema used by APIRequest - openapi.lock.json pins an upstream cloudflare/api-schemas SHA + archive sha256 - prebuild/predev fetch the pinned middlecache snapshot and verify its sha256 - OPENAPI_SCHEMA=latest renders against the newest published snapshot - schema SHA feeds the docs-page incremental-build cacheKey - weekly workflow opens a bump PR with an operation diff and broken <APIRequest> usages * fix: force branch rebuild over the rewritten lock in bump workflow

feat: add vitest-evals agent evals for Flue docs bot (#32371) * flue: add vitest-evals agent evals with HTTP harness - Mount 5 reviewable agents at /eval/agents/:name behind DOCS_FLUE_INTERNAL_TOKEN - Custom createHarness adapter: POSTs { kind: 'user', body, initialData } to the agent HTTP endpoint, polls ?view=history until settled, extracts useDataWriter output + tool-call transcript - 10 eval cases across 5 agents: style-guide, conventions, spam-filter, reconcile, code-review - vitest.evals.config.ts: serial execution, 2min timeout, vitest-evals reporter - pnpm run flue:evals: starts dev server, runs evals, tears down - CI evals job in flue-ci.yml (skips forks, uploads results artifact) - @flue/sdk nightly matching other Flue packages * fix: use run-evals.ts script in CI with NODE_OPTIONS and --host - run-evals.ts: add NODE_OPTIONS=--max-old-space-size=8192 and --host flag - run-evals.ts: accept EVALS_CMD env var to switch between evals and evals:json - CI: replace manual server management with pnpm run flue:evals - CI: add if-no-files-found: ignore to upload step * fix: generate ephemeral token when DOCS_FLUE_INTERNAL_TOKEN is not set CI doesn't have the secret configured, so generate a random UUID per run and pass it to both the dev server and the eval runner. This also removes the need for any GitHub secret for the evals job. * fix: require DOCS_FLUE_INTERNAL_TOKEN secret for CI evals Revert ephemeral token generation. The token must be a real secret configured in GitHub repo secrets, matching the value in .flue/.env used for local dev and deployment. * fix: add CLOUDFLARE_API_TOKEN for remote AI binding in CI The @cloudflare/vite-plugin needs CLOUDFLARE_API_TOKEN to start the remote proxy session for the Workers AI binding in non-interactive environments. This secret already exists in GitHub (used by bonk.yml). * fix: revert DOCS_FLUE_CF_TOKEN mapping — not the same as CLOUDFLARE_API_TOKEN * fix: write temp .dev.vars so Vite plugin passes token to Worker env in CI * fix: gitignore .dev.vars and clean up on all exit paths * fix: inject DOCS_FLUE_INTERNAL_TOKEN via vite config vars instead of temp file * fix: gate eval routes behind eval-only flag and fix flue() ordering * fix: address code review findings in eval harness, run-evals, and eval fixtures - CR-05e7a2d07fd4: signal handlers now exit process (130/143) - CR-23f106b05580: null exit code from signal-killed evals treated as failure - CR-97bd650c24de: error handler on server spawn - CR-403793fb5932: remove misleading await on sync spawn() - CR-7cdbe6ebe90c: throw on failed/aborted agent settlement outcome - CR-ce21b70c73e1: include last history-fetch error in timeout message - CR-1432df3ef9c4: encode agentName, normalize baseUrl trailing slashes - CR-baa534c160a3: type predicates instead of as casts - CR-a187fed8c4d2: fix invalid arrow function syntax in fixture - CR-87ca8a89dd92: provide PR template, filter assertions to title/desc findings - CR-86c59fe03330: assert confidence is medium or high, not just not-low - CR-11f19caad313: replace non-null assertions with shape guards - CR-b636760451a7: pin upload-artifact to SHA - CR-4d234e71f0a4: gitignore vitest-results.json * fix: handle non-terminal settlement timeout and assert ignored finding id - CR-5eb2ae9c8a04: throw timeout error when history fetches succeed but agent never reaches a terminal settlement before the deadline - CR-38f31aa30e72: assert ignored_by_reviewer[0].id is SG-bbb222 and reviewer_note is non-empty * fix: use terminal settlement that caused loop break, not settlements.at(-1) CR-97f3e0151e02: If the last settlement is non-terminal while an earlier one is terminal, settlements.at(-1) would misdiagnose a settled run as a timeout. Use findLast with the terminal condition instead. * fix: strengthen eval assertions and add missing eval cases - code-review: assert rule/severity/path/line on existing case, add clean pass case - conventions: assert rule/severity on existing cases, add scope-accuracy case - style-guide: assert rule/severity/path/line on existing case, add body H1 case - spam-filter: add support-request off-topic case, add PR-with-real-diff pass case - reconcile: add weak-comment case (finding stays active) - AGENTS.md: fix harness description (?wait=result -> fire-and-forget + poll), update coverage table to match new cases * fix: broaden eval assertion regexes for model vocabulary variance - code-review: match fire/discard/floating/ignored in rule text (model uses 'fire-and-forget fetch result discarded') - code-review clean pass: assert no false-positive on same issue class rather than zero findings (model nitpicks even clean code) - conventions: match product/area/prefix in rule text for title finding (model uses skill's Rule 1 name, not 'title') - AGENTS.md: update coverage table wording * fix: address code review findings in eval harness and fixtures - CR-ad06158bb788: Extract isTerminalSettlement helper, reuse terminal from loop - CR-e8ee85ef67fe: Fix addedLines/fileContent indentation and line numbers in code-review eval - CR-69bcc2686126: Add word boundaries to rule-name regexes in code-review eval - CR-5ca948bd4c35: Tighten titleFinding to match only title-specific terms - CR-7a376ee81538: Distinguish scopeFinding from descFinding with scope-specific terms - CR-8277af305fa7: Expect conservative is_spam=false for off-topic support requests - CR-f05fa98f6558: Anchor reason regex with word boundaries in spam-filter eval - CR-1af2a86c6f00: Reuse shared PR constant in style-guide eval - CR-bfd3551d062a: Add missing line assertion for H1 finding in style-guide eval * fix: lower review fan-out concurrency to 2 and remove dead env helper - CODE_REVIEW_CONCURRENCY: 5 → 2 - STYLE_GUIDE_CONCURRENCY: 5 → 2 - Delete unused envPositiveInt helper (lib/env.ts) — no imports, no tests * fix: route CI eval model calls through docs-flue AI Gateway DOCS_FLUE_AI_GATEWAY_ID was missing from the evals job env, so CI model calls bypassed the gateway and went directly to Workers AI. * fix: use DOCS_FLUE_AI_GATEWAY_ID secret instead of hardcoded value * fix: accept either is_spam verdict for off-topic support request eval The model may return is_spam:true or false for a misplaced support request. Assert only that the reason identifies it as off-topic/ support-related, not the specific verdict. * fix: expect is_spam:true for off-topic support request Off-topic support requests should be closed with the redirect comment. Revert CR-8277af305fa7 — it conflated spam with off-topic. The bot treats both the same: is_spam:true triggers close, with different comment/label based on the reason. Keep the word-boundary fix on the reason regex. * fix: address code review findings on eval suite - Forward DOCS_FLUE_AI_GATEWAY_ID into Worker vars during eval runs - Align code-review fixture addedLines line number and indentation with fileContent - Tighten conventions title assertion to check evidence/suggestion, not just rule - Tighten conventions scope assertion to require scope-specific terms, not generic 'change' - Skip CR-ad06158bb788 (already fixed on branch)

[Flue] Base draft staleness on human-attributed activity (#33669) - Replace updated_at inference with actor-attributed comments, reviews, issue events, and pushes - Use the repository activity API for pushes, falling back to the head commit date for forks - Remove getHeadRefPushedAt, which queried a GraphQL field that does not exist - Tolerate 60 s skew on reset and delete orphaned draft-stale state - Stop rendering changelog entry age so the date comment is not edited nightly

feat: add unit tests for trusted flue functions (#32186) * feat: add unit tests for trusted flue functions * fix: resolve typecheck and eslint issues in test files * fix: correct malformed hunk headers in diff fixtures * docs: add Testing section to .flue/AGENTS.md