Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat(review): codebase-aware context beyond the diff (cross-file analysis)

Open
  • Is something wrong?
#55 3 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
38/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java
Domain
ai-infra-agents, backend-api-design

Research direction

The issue specifies deterministic reference extraction, a selection call, bounded file fetching, and context injection into review and verification, but names no source files or tests. Start by locating the contents client, prompt batching and escaping, and ReviewTokenLedger; trace how review context reaches the verifier. Done means selected related files are safely budgeted and included in both review and verification, with the stated fail-open behavior.

Written by the indexing model from the issue text.

Description

enhancement help wanted java

Sanitized 2026-08-13: the proposed solution originally offered two variants (fetch related files vs build a semantic/dependency index). It is now committed to the deterministic-first fetch design below; the index is recorded under Alternatives Considered. Part of the v0.8 phase of #669.

Problem Statement

Reviews see only the PR diff plus a base..head comparison, so the bot cannot reason about callers/callees outside the diff. The prompts have to legislate around unseen layers ("a sanitizer you cannot see is not a sanitizer"), and the verifier downgrades findings whose evidence lives outside the window. Cross-file bugs that diff-only review misses go uncaught, and correct findings get watered down.

Proposed Solution — deterministic extraction, one small selection call, bounded fetch
  1. Deterministic reference extraction (free). From the diff itself, extract candidate related paths: import/package statements touched or surrounding changed hunks, plus symbols referenced by added lines. No model call; language-aware only to the depth of import-line parsing.
  2. One small selection call (concise binding). Input: changed file list + extracted references + hunk headers — not diffs. Output: up to K paths worth fetching, each with a reason (caller / interface / sanitizer-or-validator / config-consumer). Ledger-gated (ReviewTokenLedger.ensureCallAllowed), counted in the maxAiCalls accounting, fail-open — no selection means the review proceeds exactly as today.
  3. Bounded fetch + injection. Fetch selected files via the existing contents client, clip to the relevant regions, inject per batch as a fenced ## Related context (read-only, not part of the change) section — wrapped by PromptTemplateEscaper like every untrusted slot, capped at a fixed share of perCallInputBudget() the way PREVIOUS_FINDINGS_BUDGET_SHARE bounds the previous-findings block.
  4. Feed the verifier too. Attach the fetched context to verification (per-finding via #668), turning "downgraded — not verifiable from the provided material" hedges into real confirm/reject verdicts.

Bounded by cost/latency and the per-PR spend cap (#42) by construction: one extra small call, and the injected context can never exceed its budget share.

Alternatives Considered
  • Diff + base comparison only (current) — cheap and simple, but blind to cross-file impact.
  • Lightweight semantic/dependency index of the repo — better recall on indirect relationships, but heavy for a small-footprint self-hosted bot (build, storage, invalidation per push). Revisit only if the fetch design measurably misses relationships that matter.
Priority

Important

Code of Conduct
  • I have searched for existing issues and this is not a duplicate.
Dominant language
Java
Stars
35
Forks
7
Avg merge
9h 32m
Merged PRs (30d)
144

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from devops-thiago/ThrillhouseBot

All issues in devops-thiago/ThrillhouseBot

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.