Merge pull request #1 from node9-ai/dev

fix: merge latest dev updates into main

Author: node9ai

.github/workflows/ai-review.yml

@@ -0,0 +1,25 @@
+name: AI Code Review
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  review:
+    name: Gemini Code Review
+    runs-on: ubuntu-latest
+    # Skip if the PR was opened by the bot itself
+    if: github.actor != 'github-actions[bot]'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm install @anthropic-ai/sdk @octokit/rest
+
+      - name: Run AI Review
+        env:
+          GITHUB_TOKEN: ${{ secrets.AUTO_PR_TOKEN }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: node scripts/ai-review.mjs

scripts/ai-review.mjs

@@ -0,0 +1,67 @@
+import Anthropic from "@anthropic-ai/sdk";
+import { Octokit } from "@octokit/rest";
+
+const prNumber = parseInt(process.env.PR_NUMBER);
+const githubToken = process.env.GITHUB_TOKEN;
+const [repoOwner, repoName] = (process.env.GITHUB_REPOSITORY || "").split("/");
+
+const octokit = new Octokit({ auth: githubToken });
+
+async function runReview() {
+  try {
+    console.log(`Fetching diff for PR #${prNumber}...`);
+    const { data: prDiff } = await octokit.pulls.get({
+      owner: repoOwner,
+      repo: repoName,
+      pull_number: prNumber,
+      mediaType: { format: "diff" },
+    });
+
+    if (!prDiff || prDiff.trim().length === 0) {
+      console.log("Empty diff, skipping review.");
+      return;
+    }
+
+    const prompt = `You are a senior Python engineer reviewing a pull request for the Node9 Python SDK.
+Node9 is an execution security library — a @protect decorator that intercepts AI agent tool calls and asks for human approval before running them.
+
+Review the following git diff and provide concise, actionable feedback. Focus on:
+- Correctness and edge cases
+- Security issues (this is a security library — be strict)
+- API design and usability for developers integrating with LangChain, CrewAI, etc.
+- Test coverage gaps
+- Anything that could break the daemon HTTP communication
+
+If the changes look good with no issues, say so briefly.
+Do NOT rewrite the code. Just review it.
+Keep your review under 400 words.
+
+## Git Diff:
+${prDiff}`;
+
+    console.log("Sending diff to Claude for review...");
+    const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+    const message = await client.messages.create({
+      model: "claude-sonnet-4-5",
+      max_tokens: 1024,
+      messages: [{ role: "user", content: prompt }],
+    });
+
+    const review = message.content[0].text;
+
+    console.log("Posting review comment...");
+    await octokit.issues.createComment({
+      owner: repoOwner,
+      repo: repoName,
+      issue_number: prNumber,
+      body: `## 🤖 Claude Code Review\n\n${review}\n\n---\n*Automated review by Claude Sonnet*`,
+    });
+
+    console.log("Review posted successfully.");
+  } catch (error) {
+    console.error("Error:", error.message);
+    process.exit(1);
+  }
+}
+
+runReview();