Build ZCode PR review bot pilot

[100yenadmin]

Summary

• add a local TypeScript worker that polls allowlisted pilot PRs and prepares isolated worktrees
• run ZCode/GLM-5.2 through the local ZCode CLI with read-only policy, JSON schema validation, secret redaction, and current RIGHT-side diff-line validation
• add SQLite head-SHA dedupe, GitHub App review posting, launchd daemon support, setup docs, and live canary configs

Test Plan

• npm test (12 files / 24 tests)
• npm run build
• npm run doctor
• dry-run review-plan generation for pilot PRs
• duplicate-head rerun proved processed heads are skipped
• live canary posted as evaos-code-review-bot[bot] on WorldOS#1161 and evaOS-GUI#497
• launchd live duplicate cycle reports reviewed:0 and skippedProcessed:2

Live Pilot Evidence

• WorldOS#1161 review: feat(viewer): 4 sat→7 web-viewer UX/correctness fixes (battle-log sanitize, dice-header strip, roll context, drop-confirm) WorldOS#1161 (review)
• evaOS-GUI#497 review: [codex] Guard public repo sensitive content 100yenadmin/evaOS-GUI#497 (review)
• Evidence/log root: /Volumes/LEXAR/Codex/evaos-code-review-bot/evidence/2026-07-01/

Launch Status

No current launch blocker for the v0.1 canary. The canary remains intentionally limited to electricsheephq/WorldOS#1161 and 100yenadmin/evaOS-GUI#497; those PRs still need separate follow-through and are not completed by this bot rollout.

Closes #1

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 84587f02-0023-4611-a63a-8002679fcbbe

📥 Commits

Reviewing files that changed from the base of the PR and between 6310f4f and b01f16d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (34)

• .gitignore
• README.md
• config.example.json
• docs/github-app-setup.md
• docs/launchd.md
• launchd/evaos-code-review-bot.plist.example
• package.json
• src/cli.ts
• src/config.ts
• src/daemon-log.ts
• src/diff.ts
• src/findings.ts
• src/git.ts
• src/github.ts
• src/secrets.ts
• src/state.ts
• src/types.ts
• src/worker.ts
• src/zcode-env.ts
• src/zcode.ts
• tests/canary.test.ts
• tests/daemon-log.test.ts
• tests/diff.test.ts
• tests/findings.test.ts
• tests/git-clean.test.ts
• tests/github-app-read.test.ts
• tests/secrets.test.ts
• tests/state.test.ts
• tests/synthetic-review.test.ts
• tests/zcode-env.test.ts
• tests/zcode-output.test.ts
• tests/zcode-policy.test.ts
• tsconfig.json
• vitest.config.ts

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pilot/zcode-review-bot

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​3.2.6
	@​types/​node@​24.13.2
	tsx@​4.22.4
	typescript@​5.9.3

View full report

[100yenadmin]

Live pilot evidence update:

• Running live launchd canary now: com.electricsheephq.evaos-code-review-bot, dryRun=false, canaryPulls WorldOS#1161 and evaOS-GUI#497.
• Posted as evaos-code-review-bot[bot]:
  • WorldOS#1161: feat(viewer): 4 sat→7 web-viewer UX/correctness fixes (battle-log sanitize, dice-header strip, roll context, drop-confirm) WorldOS#1161 (review)
  • evaOS-GUI#497: [codex] Guard public repo sensitive content 100yenadmin/evaOS-GUI#497 (review)
• Live duplicate cycle: reviewed 0, skippedProcessed 2.
• Validation: npm test (12 files/24 tests) passed, npm run build passed, App-token doctor passed, shareable evidence secret scan passed.
• Evidence: /Volumes/LEXAR/Codex/evaos-code-review-bot/evidence/2026-07-01/ and /Volumes/LEXAR/Codex/evaos-code-review-bot/logs/.

[100yenadmin]

Post-merge live closeout:

• Merged into main at 2dfad82600719c359e40df10f4ce0e92b5b7efbb.
• Local launchd checkout synced to main at the same SHA.
• Launchd restarted from /Users/lume/Library/LaunchAgents/com.electricsheephq.evaos-code-review-bot.plist; post-restart pid observed as 92105.
• Post-merge live daemon cycles completed with reviewed:0 and skippedProcessed:2, confirming duplicate suppression on the two existing canary heads.
• Fresh validation before merge: npm test passed (12 files / 24 tests), npm run build passed, GitHub checks green, review threads empty.
• v0.2 roadmap milestone: https://github.com/electricsheephq/evaos-code-review-bot/milestone/1
• v0.2 tracker: v0.2 Roadmap: CodeRabbit-Class Reviewer Pilot #3

Canary PRs remain intentionally separate follow-through lanes: WorldOS#1161 and evaOS-GUI#497 are not completed by this bot merge.