Feat: PR diff viewer, review accuracy overhaul (grounding, gates, gatekeeper), and provider/module cleanup by devarshishimpi · Pull Request #55 · devarshishimpi/codra

devarshishimpi · 2026-08-01T15:44:28Z

Description

Files-changed diff viewer. Job detail has a real diff view with syntax highlighting, findings shown next to the lines they're about, and a file tree, plus overview/files/logs tabs. file_reviews.diff_input is no longer persisted; GET /api/jobs/:id/diffs rebuilds it from the KV cache the job wrote or, once that expires, from GitHub using the job's own base and head commits so it still matches what was reviewed.

Review accuracy, the bigger effort. This took several passes:

Findings now have to quote the diff line they're describing. If the quote doesn't match, the finding gets dropped as a hallucination, and the quote itself becomes the comment anchor.
Added a claim-type denylist and a "Gatekeeper" verification pass that rechecks candidate findings and records why each one was dropped, plus per-finding disposition tracking so we know which stage killed it.
A fingerprint and anchor hash stop the same finding from getting reposted after later commits, and webhook feedback now suppresses findings a human deletes.
Added a regex-based rule channel that runs alongside the LLM for deterministic checks, tagged with a source and rule id so each channel's precision can be tracked separately.
Dropped the merged "React" language entry, since it was double-checklisting .tsx files and causing false positives around hook dependencies.
Dashboard now shows right/wrong labels on findings, feeding into the disposition data.

Reliability fixes. Quota 429s are now capped at 2 per file with the rest deferred instead of walking the whole fallback chain, honoring the cool-off Google's response actually states. max_files moved to an instance-wide setting (1 to 500, default 200) with leftover files reported in the summary. Also fixed a jsonb encoding bug where JSON.stringify() bound straight to $n::jsonb was storing a string scalar instead of an object, across six columns.

Providers. Added xAI and a proper Google Vertex provider (OAuth2 instead of API keys), plus a centralized SSRF guard for operator-supplied provider base URLs.

Big refactor. Added an eslint max-lines rule (400) and broke up every file that exceeded it, review.ts, github.ts, model-output.ts, model.ts, jobs.ts, schema.ts, into directories of smaller modules behind unchanged barrel exports, so nothing importing these should need to change. Migrations 004 through 009 got folded back into 003_grounding.sql for fresh installs, and tests were reorganized to mirror the new module layout.

UI. Radix to @base-ui/react, reworked core primitives, and redesigned stats, repos, jobs, settings, landing, and the app shell. Session caching in useJobDetail, GraphQL in the GitHub client, PR-number filtering on jobs, and new account settings with a display name and IANA timezone.

Before merging: this needs a fresh migration run and a clean npm ci (Base UI replaces the Radix packages, and the eslint/lint tooling changed too).

Closes #42 #44
Part of #40 #43

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Documentation update
Chore (refactoring, dependency updates, etc.)

How Has This Been Tested?

Test suite was reorganized alongside the module split (test/api/, test/findings/, test/review/, test/model/), with new coverage for evidence grounding, claim types, finding suppression, quota deferral, max-files capping, jsonb encoding, and the SQL migration splitter. test/api.spec.ts was split into per-route files.

Unit Tests
Integration Tests
Manual Dashboard Verification
Manual GitHub Webhook Verification

Checklist:

I have starred Codra on GitHub
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
New and existing unit tests pass locally with my changes
I have signed the CLA

…nhance utility functions

…stats page

- Updated button styles for primary variant to include border and hover effects. - Implemented session-scoped caching in `useJobDetail` hook to improve performance by reading from sessionStorage. - Added a new `highlight` utility for syntax highlighting in the diff viewer, supporting multiple languages. - Refactored dashboard and job detail pages to improve UI and user experience, including tab navigation for job details. - Replaced icons in the dashboard and jobs pages for better visual representation. - Updated job logs page to enhance file status representation with badges. - Introduced GraphQL support in GitHub client for more efficient data fetching. - Enhanced database queries to support filtering by pull request number. - Updated shared schema to include new query parameters. - Added tests to ensure UI flows are functioning correctly.

Conflicts were limited to package.json / package-lock.json, where main's Dependabot bumps overlapped this branch's own dependency changes. Resolution takes the newer of each side: - wrangler ^4.114.0 (main) over ^4.110.0 - @cloudflare/vitest-pool-workers ^0.18.8, concurrently ^9.2.4 (main) - vitest ^4.1.10 (this branch) so it stays in lockstep with @vitest/browser and @vitest/browser-playwright, which pin an exact peer - Base UI retained and the Radix packages stay removed package-lock.json was regenerated from scratch rather than hand-merged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ssing

…ions

…base queries

…proving omission reasons in review summary

Findings must quote the diff line they describe; unmatched quotes are dropped as hallucinations and the quote becomes the comment anchor. Response schemas are now per call, fixing a verification pass that was silently a no-op. Fingerprint + anchor hash stop re-posting findings on later commits, and webhook feedback suppresses ones humans delete. Adds nit priority, min_severity default P3, and consolidates migrations 003-008.

Cap quota 429s at 2 per file and defer the rest instead of walking the whole fallback chain; honor Google's body-stated cool-off. Size the per-file subrequest estimate from the chain length, and yield 8s (was 2s) so chunks stop sharing one invocation's budget. Move max_files to an instance-wide setting (1-500, default 200) and report files left over the cap in the review summary.

Add claim_type per finding, a disposition column recording which stage dropped it (was just posted=false), and shadow-eval logging for candidate filter rules. Drop the merged React language entry, which was double- checklisting .tsx files and causing hook-dependency false positives.

…an labels Enforce grounding on every provider, deny risky claim types by default, and rework verification into a subtractive pass with per-drop reasons. Add dashboard right/wrong labels on findings. Also fix temperature-0 sampling, migration lock scoping, and quote-folding for evidence matches.

…d JSONB encoding fixes Extract review.ts into focused modules (review-budget, review-diff-cache, review-request, verify-findings) and add a regex-based rule channel (rules/detect.ts, rules/table.ts) alongside the LLM, tagged via new source/rule_id columns for per-channel precision tracking. Add Google Vertex as a distinct provider (OAuth2 vs API keys) and a centralized SSRF guard for operator-supplied provider base URLs. Fix a jsonb encoding bug where JSON.stringify() bound to $n::jsonb stored a string scalar instead of an object across six columns; writers now bind $n::text::jsonb. Also adds fingerprint_v2 for recurrence detection. Client: PR diff UI additions (file-tree, prompt-diff, selection helpers) and removal of unused sparkline/card/dropdown-menu/meter components.

…te migrations Add eslint max-lines (400) and import-boundary rules, then break up every file that exceeded it — review.ts, github.ts, model-output.ts, model.ts, jobs.ts, schema.ts — into directories of cohesive modules behind unchanged barrel exports. verify-findings.ts folds into finding-gates.ts and review/gate-pipeline.ts. Fold migrations 004-009 into 003_grounding.sql (fresh-installs only) and patch 001_initial.sql defensively. Add migrate-sql-split.mjs for per-statement SQL execution, and split setup-cloudflare.js into setup-helpers.js/setup-provisioning.js. Reorganize test/ to mirror the new module boundaries.

chatgpt-codex-connector · 2026-08-05T17:00:04Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

devarshishimpi added 9 commits July 16, 2026 02:28

chore: update dependencies and improve error logging

7e41598

add: redesign stats and about component, update theme handling, and e…

993af70

…nhance utility functions

add: migrate to base ui with new look on llm provider job tables and …

9ebc5cd

…stats page

fix: telemetry and repos ui

f93be3f

refactor: update contributing guidelines and improve UI components

6eb0808

fix: improve issues accuracy and files reviewed ui changes

75136c7

add: accounts settings route

3115e19

feat: refresh job review UI and add timezone-aware account stats

59a5ce2