fix: review hardening — full push-range diff, fail-closed diff fetch, crash-safe queue, 403 self-heal

- push reviews now fetch ONE compare diff (before...after) instead of
  slicing to the first 20 commits under a head-sha status; new-branch
  pushes (zero before-sha) fall back to the head commit diff
- truncated diffs can no longer yield a clean pass: verdict capped at
  warn and status description prefixed 'partial review (diff truncated)'
- any diff-fetch failure (throw / empty body on a non-empty push or PR)
  short-circuits to status 'warning' ('review unavailable — diff fetch
  failed (not blocking)') with a ledger row; a diffless prompt is never
  sent to the model
- accepted jobs persist to sqlite (queue_jobs) before the pending status
  posts; startup re-enqueues rows that never reached a final state, so
  restarts no longer strand shas at 'pending'
- 403 on status/comment posts self-heals: admin-scoped token (config
  admin_token) adds shre-reviewer as collaborator (write), retries once
- scripts/wire-repos.mjs: idempotent estate-wide webhook + collaborator
  wiring over GET /repos/search
- tests: 32 -> 51 (truncation cap, persisted-queue reconciliation,
  collab-retry stubs, fetchDiff routing)

Co-Authored-By: Claude Fable 5 <[email protected]>

test/access.test.js

@@ -0,0 +1,84 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { withCollabRetry } from '../src/lib/access.js';
+
+const err = (status, msg = `http ${status}`) => Object.assign(new Error(msg), { status });
+const noLog = () => {};
+
+function adminStub() {
+  const calls = [];
+  return {
+    calls,
+    addCollaborator(owner, repo, username, permission) {
+      calls.push({ owner, repo, username, permission });
+      return Promise.resolve();
+    }
+  };
+}
+
+test('403 adds collaborator (write) then retries once and succeeds', async () => {
+  const admin = adminStub();
+  let attempts = 0;
+  const out = await withCollabRetry(async () => {
+    attempts++;
+    if (attempts === 1) throw err(403);
+    return 'ok';
+  }, { adminGitea: admin, owner: 'nirpa', repo: 'newrepo', botUsername: 'shre-reviewer', log: noLog });
+  assert.equal(out, 'ok');
+  assert.equal(attempts, 2);
+  assert.deepEqual(admin.calls, [{ owner: 'nirpa', repo: 'newrepo', username: 'shre-reviewer', permission: 'write' }]);
+});
+
+test('non-403 errors are rethrown without touching collaborators', async () => {
+  const admin = adminStub();
+  await assert.rejects(
+    () => withCollabRetry(() => Promise.reject(err(500)), {
+      adminGitea: admin, owner: 'o', repo: 'r', botUsername: 'b', log: noLog
+    }),
+    /http 500/
+  );
+  assert.equal(admin.calls.length, 0);
+});
+
+test('403 with no admin client rethrows the original 403', async () => {
+  await assert.rejects(
+    () => withCollabRetry(() => Promise.reject(err(403)), {
+      adminGitea: null, owner: 'o', repo: 'r', botUsername: 'b', log: noLog
+    }),
+    (e) => e.status === 403
+  );
+});
+
+test('retry happens exactly once: second 403 propagates', async () => {
+  const admin = adminStub();
+  let attempts = 0;
+  await assert.rejects(
+    () => withCollabRetry(() => { attempts++; return Promise.reject(err(403)); }, {
+      adminGitea: admin, owner: 'o', repo: 'r', botUsername: 'b', log: noLog
+    }),
+    (e) => e.status === 403
+  );
+  assert.equal(attempts, 2);
+  assert.equal(admin.calls.length, 1);
+});
+
+test('addCollaborator failure propagates (no infinite loop)', async () => {
+  const admin = {
+    addCollaborator: () => Promise.reject(err(422, 'bad permission'))
+  };
+  let attempts = 0;
+  await assert.rejects(
+    () => withCollabRetry(() => { attempts++; return Promise.reject(err(403)); }, {
+      adminGitea: admin, owner: 'o', repo: 'r', botUsername: 'b', log: noLog
+    }),
+    /bad permission/
+  );
+  assert.equal(attempts, 1);
+});
+
+test('success path never consults the admin client', async () => {
+  const out = await withCollabRetry(() => Promise.resolve(42), {
+    adminGitea: undefined, owner: 'o', repo: 'r', botUsername: 'b', log: noLog
+  });
+  assert.equal(out, 42);
+});

test/fetchdiff.test.js

@@ -0,0 +1,66 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { fetchDiff } from '../src/lib/review.js';
+
+function giteaStub() {
+  const calls = [];
+  return {
+    calls,
+    getPrDiff: (o, r, i) => { calls.push(['pr', o, r, i]); return Promise.resolve('PRDIFF'); },
+    getCommitDiff: (o, r, sha) => { calls.push(['commit', o, r, sha]); return Promise.resolve('HEADDIFF'); },
+    getCompareDiff: (o, r, before, after) => { calls.push(['compare', o, r, before, after]); return Promise.resolve('RANGEDIFF'); }
+  };
+}
+
+const HEAD = 'a'.repeat(40);
+const BEFORE = 'b'.repeat(40);
+
+test('PR jobs use the PR diff', async () => {
+  const g = giteaStub();
+  const out = await fetchDiff({ gitea: g, job: { owner: 'o', repo: 'r', prIndex: 5, sha: HEAD, before: null } });
+  assert.equal(out, 'PRDIFF');
+  assert.deepEqual(g.calls, [['pr', 'o', 'r', 5]]);
+});
+
+test('push uses ONE compare diff over the full before...after range', async () => {
+  const g = giteaStub();
+  const out = await fetchDiff({
+    gitea: g,
+    job: {
+      owner: 'o', repo: 'r', prIndex: null, sha: HEAD, before: BEFORE,
+      // 25 commits in the payload: must NOT fall back to per-commit slicing
+      commitShas: Array.from({ length: 25 }, (_, i) => String(i).padStart(40, '0'))
+    }
+  });
+  assert.equal(out, 'RANGEDIFF');
+  assert.deepEqual(g.calls, [['compare', 'o', 'r', BEFORE, HEAD]]);
+});
+
+test('new-branch push (before = zero sha) falls back to head commit diff', async () => {
+  const g = giteaStub();
+  const out = await fetchDiff({
+    gitea: g,
+    job: { owner: 'o', repo: 'r', prIndex: null, sha: HEAD, before: '0'.repeat(40), commitShas: [HEAD] }
+  });
+  assert.equal(out, 'HEADDIFF');
+  assert.deepEqual(g.calls, [['commit', 'o', 'r', HEAD]]);
+});
+
+test('missing before also falls back to head commit diff', async () => {
+  const g = giteaStub();
+  const out = await fetchDiff({
+    gitea: g,
+    job: { owner: 'o', repo: 'r', prIndex: null, sha: HEAD, before: null, commitShas: [HEAD] }
+  });
+  assert.equal(out, 'HEADDIFF');
+  assert.deepEqual(g.calls, [['commit', 'o', 'r', HEAD]]);
+});
+
+test('compare failure propagates (no silent placeholder diff)', async () => {
+  const g = giteaStub();
+  g.getCompareDiff = () => Promise.reject(new Error('boom 500'));
+  await assert.rejects(
+    () => fetchDiff({ gitea: g, job: { owner: 'o', repo: 'r', prIndex: null, sha: HEAD, before: BEFORE } }),
+    /boom 500/
+  );
+});

test/persistqueue.test.js

@@ -0,0 +1,51 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { openDb, enqueueJob, finishJob, recoverPendingJobs } from '../src/lib/db.js';
+
+const JOB = (over = {}) => ({
+  event: 'push', owner: 'nirpa', repo: 'demo', sha: 'a'.repeat(40),
+  ref: 'refs/heads/main', before: 'b'.repeat(40), prIndex: null, prTitle: null,
+  pusher: 'nirpa', authors: ['nirpa'], commitShas: ['a'.repeat(40)],
+  commitMessages: ['msg'], ...over
+});
+
+test('enqueued jobs that never finish are recovered on startup', () => {
+  const db = openDb(':memory:');
+  const id1 = enqueueJob(db, JOB({ sha: '1'.repeat(40) }));
+  const id2 = enqueueJob(db, JOB({ sha: '2'.repeat(40) }));
+  const id3 = enqueueJob(db, JOB({ sha: '3'.repeat(40), prIndex: 7 }));
+  finishJob(db, id2, 'pass');
+
+  const pending = recoverPendingJobs(db);
+  assert.equal(pending.length, 2);
+  assert.deepEqual(pending.map(p => p.id), [id1, id3]);
+  // job payload round-trips intact
+  assert.equal(pending[0].job.sha, '1'.repeat(40));
+  assert.equal(pending[1].job.prIndex, 7);
+  assert.deepEqual(pending[0].job.commitMessages, ['msg']);
+});
+
+test('finished jobs are not recovered again', () => {
+  const db = openDb(':memory:');
+  const id = enqueueJob(db, JOB());
+  finishJob(db, id, 'warn');
+  assert.equal(recoverPendingJobs(db).length, 0);
+});
+
+test('unparseable persisted job is marked done, not re-run forever', () => {
+  const db = openDb(':memory:');
+  db.prepare(`INSERT INTO queue_jobs (repo, sha, job) VALUES ('a/b', 'c', '{broken')`).run();
+  assert.equal(recoverPendingJobs(db).length, 0);
+  // and it is now terminal
+  assert.equal(recoverPendingJobs(db).length, 0);
+  const row = db.prepare(`SELECT state, outcome FROM queue_jobs`).get();
+  assert.equal(row.state, 'done');
+  assert.equal(row.outcome, 'unparseable-job');
+});
+
+test('recovery is ordered oldest first', () => {
+  const db = openDb(':memory:');
+  const ids = [enqueueJob(db, JOB()), enqueueJob(db, JOB()), enqueueJob(db, JOB())];
+  const pending = recoverPendingJobs(db);
+  assert.deepEqual(pending.map(p => p.id), ids);
+});

test/verdict.test.js

@@ -78,3 +78,30 @@ test('normalizeReview tolerates junk', () => {
   assert.equal(r.verdict, 'pass');
   assert.equal(r.findings.length, 0);
 });
+
+// --- applyTruncationCap ---
+import { applyTruncationCap } from '../src/lib/verdict.js';
+
+test('truncation caps pass at warn', () => {
+  const r = { verdict: 'pass' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'warn');
+});
+
+test('truncation leaves warn as warn', () => {
+  const r = { verdict: 'warn' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'warn');
+});
+
+test('truncation does not downgrade fail', () => {
+  const r = { verdict: 'fail' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'fail');
+});
+
+test('no truncation leaves pass untouched', () => {
+  const r = { verdict: 'pass' };
+  applyTruncationCap(r, false);
+  assert.equal(r.verdict, 'pass');
+});