fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedback by joryirving · Pull Request #601 · misospace/dispatch

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

joryirving · 2026-07-09T14:32:37Z

Summary

Failing-check pr-fix feedback was event.body || 'Check "X" concluded failure'. These CI jobs (windowstead's Godot suite, macOS export/validation) publish no check-run output.summary, so the coder received a contentless "check failed" with zero error detail — it burned every attempt guessing blind (all of windowstead's pr-fix workloads exhausted overnight). The same local models fixed these fine under openclaw, which fed them the actual logs.

Why server-side fetch (not coder-pull)

The coder token is classic public_repo — kept minimal, and classic is required because fine-grained PATs can't open fork PRs against upstreams (defilantech/LLMKube). Reading Actions logs needs full classic repo, which would open every private repo just to read public CI logs. So dispatch fetches the log with its own credential and hands the coder a bounded excerpt; the coder token stays untouched.

Change

github.ts: fetchFailedJobLogExcerpt (resolves the logs 302 manually so the signed-blob GET isn't sent the auth header) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl.
sync/route.ts: fetch a bounded excerpt per failing check, put it in the event body.
pr-followup-ingestion.ts: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt.

Requires

Dispatch's GitHub App to have Actions: read — server-side, scoped, and unrelated to the coder's fork-PR token. Until granted, feedback degrades to reason + URL (still better than the old stub).

Verification

vitest: 113 passed across ingestion + github + sync suites (new: excerpt-in-feedback, degrade-to-URL, extractLogExcerpt timestamp-strip/error-region/cap, jobIdFromCheckRunUrl). typecheck + eslint clean.

Notes

Independent of fix(pr-followup): detect merge conflicts in scheduled sync #600 (merge-conflict detection). Both touch sync/route.ts in different spots; merge fix(pr-followup): detect merge conflicts in scheduled sync #600 first, this rebases cleanly.

…d stub Failing-check feedback was event.body || 'Check "X" concluded failure'. But these CI jobs (e.g. windowstead's Godot suite) publish no check-run output.summary, so event.body is empty and the coder received a contentless 'check failed' with zero error detail — it burned every pr-fix attempt guessing blind (esp. macOS jobs it can't run locally). Same models fixed these fine under openclaw, which fed them the actual logs. Build the feedback from the reason + the job-log URL + a copy-pasteable python3 recipe to fetch and grep it (the sandbox has python3 + $GITHUB_TOKEN, no curl/gh). The coder pulls the real error itself instead of being force-fed the whole log. Requires the coder token to carry actions:read.

…feedback Supersedes the earlier pull approach: the coder token is classic public_repo (kept minimal — classic is required for fork PRs to LLMKube), and reading Actions logs needs full `repo`, which is too broad. So fetch the log server-side with dispatch's own credential and hand the coder a bounded error excerpt instead. - github.ts: fetchFailedJobLogExcerpt (manual-redirect to the signed blob so the auth header isn't forwarded) + extractLogExcerpt (pure: strips timestamps, finds the last error marker, returns a bounded window, skips cleanup noise) + jobIdFromCheckRunUrl. - sync: fetch the excerpt per failing check and put it in the event body. - ingestion: feedback = reason + log excerpt + log URL; degrades to reason + URL when no excerpt (e.g. dispatch lacks Actions:read). Requires dispatch's GitHub App to have Actions:read (server-side, scoped — does NOT touch the coder's fork-PR token). Coder token unchanged.

…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffron

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: public_route_changes)

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

This PR enhances CI failure feedback by fetching and including actual job log excerpts (rather than empty summaries) when GitHub Actions checks fail. The implementation is clean, well-tested, and follows repository conventions.

Change-by-Change Findings

`src/lib/github.ts` — New functions for log extraction

jobIdFromCheckRunUrl(): Safely extracts the numeric job ID via regex /\/job\/(\d+)/ from check-run URLs. Only captures digits, preventing injection. Returns null for malformed/missing URLs.
extractLogExcerpt(): Pure function that processes raw log text — strips ISO timestamps, finds last error marker via pattern matching (##[error], ::error::, ERROR:, SCRIPT ERROR, AssertionError, Traceback, FAIL, exit codes, etc.), returns a bounded 6000-char window. Falls back to last lines before cleanup noise when no marker found. No filesystem operations — only string processing.
fetchFailedJobLogExcerpt(): Fetches the GitHub Actions job log, manually resolves the 302 redirect to the signed blob URL (auth header intentionally not sent per GitHub's signed-URL requirement), and passes the result through extractLogExcerpt(). Gracefully returns "" on any failure (network, missing permissions, malformed response).

`src/app/api/pr-followup/sync/route.ts` — Integration point

Calls jobIdFromCheckRunUrl() on checkRun.html_url (safely handles undefined/malformed URLs → returns null)
Only fetches excerpt when jobId is truthy; otherwise uses "" as fallback
Sets body: excerpt || checkRun.output?.summary || "" — consistent with existing fallback behavior

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Uses the fetched excerpt (now in event.body) to construct richer feedback with the actual error and log URL
Degrades gracefully to "reason + URL" when no excerpt is available
Improves on the previous "Check X concluded failure" stub

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

Tests for jobIdFromCheckRunUrl(): valid URL, invalid URL, undefined
Tests for extractLogExcerpt(): error region extraction, timestamp stripping, empty input, length cap
Integration tests: excerpt-in-feedback, degrade-to-URL fallback

Required Checks

Check	Status	Notes
verify route access controls are in place	✅ Verified	`POST /api/pr-followup/sync` already imports and uses `authorizeRequest` from `@/lib/auth`. No new routes added; existing auth is unchanged.
check for unintended public endpoints	✅ Verified	No new API routes introduced. Only library functions and internal route logic modified.
review for path traversal vulnerabilities	✅ Not applicable	This PR handles GitHub API URLs and job log text processing — not filesystem paths. `jobIdFromCheckRunUrl()` strictly extracts numeric IDs via regex. `extractLogExcerpt()` performs pure string manipulation.
test with edge-case paths (null bytes, symlinks)	✅ Not applicable	No filesystem path operations in this PR. Job IDs are validated as numeric strings.

Standards Compliance

Error handling: Uses try/catch with silent degradation to "" (documented behavior for missing Actions:read permission)
Validation: Input URL is validated before extraction; jobId is numeric-only by regex design
No new secrets: No credentials added; uses existing getHeadersAsync() pattern
Test coverage: 113 tests pass including new unit and integration tests
CI: Build, Typecheck, Lint, Tests, Docker Build — all success

Evidence Provider Findings

No evidence providers were configured for this review.

Tool Harness Findings

No tool harness findings to report.

Unknowns / Needs Verification

None identified. The implementation is fully visible in the diff, tests cover edge cases, and all CI checks pass.

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

This comment was marked as outdated.
Sign in to view

joryirving dismissed its-saffron[bot]’s stale review via a8082c7July 9, 2026 14:50

joryirving changed the title ~~fix(pr-followup): give coder the CI log URL + pull recipe, not a blind stub~~fix(pr-followup): inject a server-fetched CI log excerpt into pr-fix feedbackJul 9, 2026

Merge remote-tracking branch 'origin/main' into fix/pr-fix-feedback-c…
d85f9db
…i-logs # Conflicts: # src/app/api/pr-followup/sync/route.ts # src/lib/github.ts

its-saffronBot approved these changes Jul 9, 2026
View reviewed changes

joryirving merged commit 4bc1b7a into mainJul 9, 2026
6 checks passed

joryirving deleted the fix/pr-fix-feedback-ci-logs branch July 9, 2026 15:05

its-saffronBot mentioned this pull request Jul 9, 2026
chore(release): bump version to 0.5.23 #602
Merged

Uh oh!

Conversation

joryirving commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why server-side fetch (not coder-pull)

Change

Requires

Verification

Notes

Uh oh!

This comment was marked as outdated.

Uh oh!

its-saffronBot left a comment

Choose a reason for hiding this comment

AI Automated Review

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

Change-by-Change Findings

src/lib/github.ts — New functions for log extraction

src/app/api/pr-followup/sync/route.ts — Integration point

src/lib/pr-followup-ingestion.ts — Feedback generation

Test files — github.test.ts, pr-followup-ingestion.test.ts

Required Checks

Standards Compliance

Evidence Provider Findings

Tool Harness Findings

Unknowns / Needs Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

joryirving commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why server-side fetch (not coder-pull)

Change

Requires

Verification

Notes

Uh oh!

This comment was marked as outdated.

Uh oh!

its-saffronBot left a comment

Choose a reason for hiding this comment

AI Automated Review

PR PR 601 Review: inject a server-fetched CI log excerpt into pr-fix feedback

Recommendation: Approve

Change-by-Change Findings

src/lib/github.ts — New functions for log extraction

src/app/api/pr-followup/sync/route.ts — Integration point

src/lib/pr-followup-ingestion.ts — Feedback generation

Test files — github.test.ts, pr-followup-ingestion.test.ts

Required Checks

Standards Compliance

Evidence Provider Findings

Tool Harness Findings

Unknowns / Needs Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

joryirving commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

joryirving commented Jul 9, 2026•
edited
Loading

`src/lib/github.ts` — New functions for log extraction

`src/app/api/pr-followup/sync/route.ts` — Integration point

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

joryirving commented Jul 9, 2026•
edited
Loading

`src/lib/github.ts` — New functions for log extraction

`src/app/api/pr-followup/sync/route.ts` — Integration point

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

joryirving commented Jul 9, 2026•
edited
Loading

`src/lib/github.ts` — New functions for log extraction

`src/app/api/pr-followup/sync/route.ts` — Integration point

`src/lib/pr-followup-ingestion.ts` — Feedback generation

Test files — `github.test.ts`, `pr-followup-ingestion.test.ts`

joryirving commented Jul 9, 2026•
edited
Loading