Function localReviewCommand

src/commit-sweeper.ts:422–509

(args: Args)

// Conforms to the #253 replacement spec: clean checkout, unique run dir, no GitHub
// token, and reject unsupported repos (never fall back to a foreign profile).
function localReviewCommand(args: Args): void {
  const targetDir = resolve(argString(args, "target_dir", "."));
  const baseBranch = argString(args, "base", "main");
  const reportDir = resolve(
    argString(args, "report_dir", join(homedir(), ".clawsweeper-local-reviews")),
  );

  // Spec: genuinely offline — withhold every GitHub credential from the review engine.
  for (const tokenVar of LOCAL_REVIEW_SCRUBBED_TOKEN_ENV) {
    delete process.env[tokenVar];
  }

  // Spec: committed-range review requires a clean checkout (no hidden staged/untracked work).
  const dirtyTree = run("git", ["status", "--porcelain"], { cwd: targetDir }).trim();
  if (dirtyTree) {
    console.error(`[local-review] working tree not clean — commit or stash first:\n${dirtyTree}`);
    process.exit(1);
  }

  const targetRepo =
    argString(args, "target_repo", "") ||
    run("git", ["remote", "get-url", "origin"], { cwd: targetDir })
      .replace(/.*github\.com[:/]/, "")
      .replace(/\.git\s*$/, "")
      .trim();

  // Spec: reject unsupported repos — never silently fall back to a foreign profile.
  const profile = configuredRepositoryProfileFor(targetRepo);
  if (!profile) {
    console.error(
      `[local-review] no review profile for '${targetRepo}'. Add a repository profile, or pass --target-repo <known-repo>.`,
    );
    process.exit(1);
  }
  const profileSlug = profile.slug;

  // Range = merge-base(base, HEAD)..HEAD — the whole branch, reviewed as one unit.
  const headSha = run("git", ["rev-parse", "HEAD"], { cwd: targetDir }).trim();
  const baseSha = run("git", ["merge-base", baseBranch, "HEAD"], { cwd: targetDir }).trim();
  if (!baseSha || baseSha === headSha) {
    console.error(`[local-review] no commits on HEAD beyond ${baseBranch} — nothing to review.`);
    process.exit(1);
  }

  const metadata = commitMetadata(targetDir, targetRepo, headSha, true);

  // Spec: unique per-run dir so concurrent runs never collide on result paths.
  const runDir = join(reportDir, `run-${headSha.slice(0, 8)}-${Date.now()}-${process.pid}`);
  ensureDir(runDir);

  // Spec: hard-enforce no GitHub access. The review prompt suggests `gh` for issue
  // refs, and `gh` uses its own configured auth (token-env deletion can't stop it),
  // so point it at an empty config dir — any `gh` the spawned reviewer runs finds
  // no cached credentials. Belt-and-suspenders with Codex's read-only sandbox.
  const ghEmptyConfig = join(runDir, ".gh-empty");
  ensureDir(ghEmptyConfig);
  process.env.GH_CONFIG_DIR = ghEmptyConfig;