fix(rees): bound external analyzer fetches

[JSONbored]

Summary

• Fixes fix(rees): standardize bounded external fetches #1812.
• Adds a shared bounded external fetch layer for REES and migrates analyzer network calls onto it.
• Keeps analyzer failures fail-open while making timeout/cap/network degradation attributable.

What changed

• Added bounded JSON/text fetch helpers with parent abort propagation, per-subcall timeouts, response byte caps, safe endpoint categories, and safe diagnostics.
• Routed request-scoped fetches through AnalysisContext for in-flight de-dupe, per-category counters, and call caps.
• Migrated REES external analyzers from direct fetch calls to the shared helper across OSV, deps.dev, npm, PyPI, Bundlephobia, endoflife.date, and GitHub endpoints.
• Extended Sentry analyzer context with generic endpoint category and external failure reason fields.
• Added bounded-fetch tests and updated degraded/fail-safe analyzer expectations.

Why

REES external I/O was still uneven across analyzers. A slow registry or GitHub subcall could be hard to attribute, and some fail-safe paths looked successful even when analysis was incomplete. This gives each analyzer bounded, cacheable, diagnosable external calls without logging URLs, request bodies, diffs, tokens, prompts, comments, or private config.

Validation

• npm --prefix review-enrichment test
• npm run test:ci
• git diff --check
• Direct source scan confirmed no remaining direct fetch(...), fetchImpl(...), or fetchFn(...) calls in review-enrichment/src.
• Secret-shaped fixture scan over review-enrichment/src and review-enrichment/test.

Notes

• Stacked on perf(rees): share analyzer request context #1817 because it uses the shared REES request context/cache introduced there.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-30 07:51:30 UTC}

42 files · 1 AI reviewer · 1 blocker · readiness 98/100 · CI pending · unknown

⏸️ Suggested Action - Manual Review

• AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/registry.ts:386 still calls scanDocCommentDrift with only { signal }, and review-enrichment/src/analyzers/doc-comment-drift.ts:288 reads the GitHub Contents response with fetchFn(...).text() instead of the bounded AnalysisContext helper, so a small patch in a very large source file will still perform an uncapped external body read. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Review summary
The PR adds REES profile scheduling, request-scoped bounded fetch helpers, generated analyzer metadata, and migrates most external analyzers onto the shared AnalysisContext path. The direction is correct, but the migration is incomplete for a default GitHub-backed analyzer: docCommentDrift still uses the old direct GitHub Contents fetch and unbounded text read. That leaves the central external-fetch bounding guarantee false for a reachable balanced/deep analyzer path.

Blockers

• review-enrichment/src/analyzers/registry.ts:386 still calls scanDocCommentDrift with only { signal }, and review-enrichment/src/analyzers/doc-comment-drift.ts:288 reads the GitHub Contents response with fetchFn(...).text() instead of the bounded AnalysisContext helper, so a small patch in a very large source file will still perform an uncapped external body read.

Nits — 6 non-blocking

• apps/gittensory-ui/src/routes/docs.self-hosting-rees-analyzers.tsx:91 lists the GitHub API analyzers but omits docCommentDrift even though the generated metadata marks it as github-light and requiring github-token/head-sha.
• review-enrichment/src/external-fetch.ts:48 builds cache keys from method/url/body only; callers with representation-changing headers should provide an explicit cacheKey or the helper should document that requirement.
• review-enrichment/src/external-fetch.ts:250 collapses all non-string BodyInit values to the same "stream" cache suffix, which is safe for current string-body callers but brittle for future POST callers.
• review-enrichment/src/brief.ts:112 uses if (!item) in a generic concurrency helper, which is fine for AnalyzerPlanItem objects but should be index-bounds based if the helper remains generic.
• Pass analysis and diagnostics into scanDocCommentDrift from review-enrichment/src/analyzers/registry.ts and fetch file contents through analysis.fetchText with endpointCategory "github-contents", maxBytes, maxCallsPerCategory, and phase/subcall set.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Concerns raised — review before merging

• review-enrichment/src/analyzers/registry.ts:386 still calls scanDocCommentDrift with only { signal }, and review-enrichment/src/analyzers/doc-comment-drift.ts:288 reads the GitHub Contents response with fetchFn(...).text() instead of the bounded AnalysisContext helper, so a small patch in a very large source file will still perform an uncapped external body read.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#1812
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XXL; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 2 registered-repo PR(s), 2 merged, 273 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 2 PR(s), 273 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2 PR(s), 273 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	gittensory-ui	fc5c344	Jun 30 2026, 07:15 AM

[sentry]

Issues attributed to commits in this pull request

This pull request was merged and Sentry observed the following issues:

• ‼️ Error: analyzer_timeout in production

• ‼️ Error: bundlephobia-size_timeout in production

• ‼️ Error: analyzer_timeout in production

• ‼️ Error: npm-attestations_timeout in production

• ‼️ Error: analyzer_timeout in production

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.66%. Comparing base (4f92e60) to head (026ee54).
⚠️ Report is 16 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1831   +/-   ##
=======================================
  Coverage   95.66%   95.66%           
=======================================
  Files         214      214           
  Lines       23299    23343   +44     
  Branches     8412     8427   +15     
=======================================
+ Hits        22288    22332   +44     
  Misses        419      419           
  Partials      592      592           

Files with missing lines	Coverage Δ
src/review/enrichment-wire.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.