// deep-report.jsx — the "Highlights" view of a deep-scout report.
// The markdown is the artifact you forward; this is the 10-second read:
// verdict first, then incidents ranked by evidence strength — the strongest
// one opens by itself, so the receipt is the first thing below the verdict.
// Renders the structured view built server-side by lib/report-view.mjs.
const { useState, useRef, useEffect } = React;
// ---- tiny inline-markdown (bold + code) used by story sentences ----------
function mdInline(text) {
const parts = [];
String(text || "").split(/(\*\*[^*]+\*\*|`[^`]+`)/g).forEach((chunk, index) => {
if (/^\*\*/.test(chunk)) parts.push({chunk.slice(2, -2)});
else if (/^`/.test(chunk)) parts.push({chunk.slice(1, -1)});
else if (chunk) parts.push(chunk);
});
return parts;
}
// ---- dates ----------------------------------------------------------------
function fmtDate(iso) {
if (!iso) return null;
const date = new Date(iso);
return Number.isNaN(date.getTime()) ? null : date.toLocaleDateString("en-US", { month: "short", day: "numeric" });
}
// "same day" / "1 day later" / "12 days later" — null when either date is
// missing (older reports have no culprit date; never guess).
function fixDelay(incident) {
const days = incident.daysToFix;
if (days == null) return null;
if (days === 0) return "the same day";
return days === 1 ? "1 day later" : `${days} days later`;
}
// ---- verdict decision → pill palette ---------------------------------------
// New reports carry the decision a merge queue would act on: BLOCKED is red
// (the merge would have been refused), ESCALATED amber, PASSED neutral.
// Legacy reports have no decision and fall back to the status palette.
const DECISION_PILL = { block: "high", escalate: "med", pass: "neutral" };
// Copyable one-liner for a blocked incident's failing probe — the receipt.
function ReproChip({ command }) {
const [copied, setCopied] = useState(false);
return (
);
}
// ---- cold-email export -----------------------------------------------------
// Plain text — no markdown, no tables — so it pastes cleanly into Gmail or
// Outlook. The three strongest catches: view.incidents is already ranked by
// evidence strength server-side (report-view.mjs), so filter to real hits and
// take the head of the list.
function plainStory(text) {
return String(text || "").replace(/\*\*([^*]*)\*\*/g, "$1").replace(/`([^`]*)`/g, "$1");
}
// One line of hard evidence per incident: an executed before/after flip when
// we have one (the strongest claim), else the sharpest line from the diff.
function emailEvidenceLine(finding) {
if (!finding) return null;
const clip = (text) => { const s = String(text); return s.length > 90 ? `${s.slice(0, 87)}...` : s; };
const flip = (finding.boundary?.cases || []).find((row) => row.changed);
if (flip && finding.boundary.executed) {
return `Ran both versions on the same input (${clip(flip.input)}): before ${clip(flip.before)} -> after ${clip(flip.after)}`;
}
const removed = finding.deps?.removed?.[0];
const added = finding.deps?.added?.[0];
if (removed && added) return `The change: - ${clip(removed)} -> + ${clip(added)}`;
if (removed) return `What disappeared: ${clip(removed)}`;
if (added) return `What appeared: ${clip(added)}`;
if (flip) return `Before: ${clip(flip.before)} -> after: ${clip(flip.after)}`;
return null;
}
function buildEmailSummary(view) {
const summary = view.summary || {};
const control = view.control || summary.control || null;
const catches = (view.incidents || []).filter((incident) => incident.status === "hit").slice(0, 3);
const commitUrl = (sha) => `https://github.com/${view.repo}/commit/${sha}`;
const lines = [];
// Lead with THEIR problems — a cold-email reader gives the first line one
// skim; Kaval's own scorecard only earns attention after the evidence has.
const count = catches.length;
lines.push(`${count === 1 ? "A recent commit" : `${count} recent commits`} in ${view.repo} ${count === 1 ? "shipped a regression" : "each shipped a regression"} your team had to go back and fix. Kaval flagged ${count === 1 ? "it" : `all ${count}`} pre-merge — replaying your history blind to the future and executing the changed code, both versions. No model opinions, only observed behavior:`);
catches.forEach((incident, index) => {
lines.push("");
const subject = incident.culprit?.subject || incident.fix?.msg || "(no subject)";
lines.push(`${index + 1}. "${subject}"`);
const finding = (incident.findings || [])[0];
if (finding) {
// The story sentence when it carries real content; keyword-lane stories
// ("Head changes ... in ") just restate the title — there, the
// title plus the file path says more in fewer words.
const story = plainStory(finding.story || "");
const boilerplate = !story || /^Head (changes|adds|removes)\b/.test(story);
lines.push(boilerplate
? ` ${plainStory(finding.title)}${finding.file ? ` (${finding.file})` : ""}.`
: ` ${plainStory(finding.title)} — ${story}`);
const evidence = emailEvidenceLine(finding);
if (evidence) lines.push(` ${evidence}`);
}
if (incident.decision === "block") {
lines.push(" Kaval would have blocked this merge with a runnable failing probe.");
}
if (incident.fix) {
const delay = fixDelay(incident);
lines.push(` Your team's fix${delay ? ` landed ${delay}` : ""}: "${incident.fix.msg}" (${incident.fix.sha}).`);
}
if (incident.culprit?.sha) lines.push(` ${commitUrl(incident.culprit.sha)}`);
});
lines.push("");
// The closer is the no-noise claim — never the hit count. "Caught 9 of 13"
// reads as "missed 4" to a cold reader; zero false alarms is the line that
// separates Kaval from every linter they ignore.
const noise = control?.commits
? `It also ran on ${control.commits} clean commits from the same history and raised ${control.blocks === 0 ? "zero false alarms" : `${control.blocks} false alarm${control.blocks === 1 ? "" : "s"}`}. `
: "";
lines.push(`${noise}Every claim is reproducible from the SHAs — happy to send the full report, or point Kaval at any repo you pick.`);
return lines.join("\n");
}
function EmailCopyButton({ view }) {
const [copied, setCopied] = useState(false);
// Internal sales tool — only the admin (KAVAL_ADMIN_EMAILS, verified server
// side and mirrored onto window.KAVAL_ADMIN) ever sees it. Public viewers
// and signed-out visitors never get a cold-email button.
if (!window.KAVAL_ADMIN) return null;
if (!(view.incidents || []).some((incident) => incident.status === "hit")) return null;
return (
);
}
// ---- incident status → palette -------------------------------------------
function incidentTone(incident) {
if (incident.status === "hit") {
if (incident.strong && !incident.bulk) {
return { seg: { background: "var(--pass)", color: "#fff", border: "1px solid var(--pass)" }, pill: "pass" };
}
return { seg: { background: "var(--pass-subtle)", color: "var(--pass-text)", border: "1px solid var(--pass-border)" }, pill: "pass" };
}
if (incident.status === "miss") {
return { seg: { background: "var(--high-subtle)", color: "var(--high-text)", border: "1px solid var(--high-border)" }, pill: "high" };
}
return { seg: { background: "var(--surface-3)", color: "var(--text-3)", border: "1px solid var(--border)" }, pill: "neutral" };
}
// ---- hero: the verdict, big, plus one clickable segment per incident -----
function SegmentBar({ incidents, onJump }) {
return (
);
}
function LegendDot({ swatch, label }) {
return (
{label}
);
}
function VerdictHero({ view, onJump }) {
const summary = view.summary || {};
// New reports headline the verdict a merge queue would have acted on;
// legacy reports (no blockedCulprits) keep the flagged/analyzed framing.
const hasVerdicts = typeof summary.blockedCulprits === "number";
const control = view.control || summary.control || null;
const setAside = (summary.notRegression || 0) + (summary.outOfScope || 0);
// The hero number is the CATCH rate (hits/analyzed) — never the block
// count. "1/13 BLOCKED" reads like Kaval found 1 of 13; the gate's block and
// escalate counts are what it would have done about the catches.
const subParts = [];
if (hasVerdicts) {
if (summary.blockedCulprits) subParts.push(`${summary.blockedCulprits} auto-blocked with a failing probe`);
if (summary.escalatedCulprits) subParts.push(`${summary.escalatedCulprits} escalated to a human`);
if (summary.misses) subParts.push(`${summary.misses} missed — shown below`);
} else {
if (summary.strongHits) subParts.push(`${summary.strongHits} with strong evidence`);
if (summary.misses) subParts.push(`${summary.misses} missed — shown below`);
}
if (setAside) subParts.push(`${setAside} set aside (additive, nothing regressed)`);
return (
{summary.hits ?? 0}/{summary.analyzed ?? 0}
{hasVerdicts ? "culprits caught pre-merge" : "culprits flagged before merge"}
{summary.incidents ?? view.incidents.length} changes in this repo's history needed a follow-up fix. Kaval replayed each one
pre-merge, blind to the future — {hasVerdicts
? "it ran the changed code, both versions, and blocked merges only on reproduced unlicensed behavior."
: "green means it pointed at the code the fix later had to touch."}
{/* Cold-outreach export: top 3 problems as paste-ready plain text.
Lives in normal flow (end of the legend row) so it can never
cover the hero copy the way an absolute corner pin did. */}
);
}
// ---- evidence pieces ------------------------------------------------------
function ProbeTable({ boundary }) {
if (!boundary?.cases?.length) return null;
return (
);
}
// ---- the incident timeline ------------------------------------------------
// One numbered step of the expanded incident story.
function StoryStep({ label, last = false, children }) {
return (
{!last && }
{label}
{children}
);
}
// An incident reads in shipping order: a commit landed, Kaval (replaying it
// blind) flagged files, and days later a fix had to touch those same files.
// That overlap is the product claim, so the row tells it in that order.
function IncidentRow({ incident, flash, defaultOpen = false, repo }) {
const [open, setOpen] = useState(defaultOpen);
const tone = incidentTone(incident);
const findings = incident.findings || [];
// A culprit alone is enough to expand: the story steps (dates, fix files)
// carry the proof chain even without evidence cards.
const expandable = findings.length > 0 || incident.reason || incident.culpritScope || Boolean(incident.culprit);
const others = findings.slice(1).map((finding) => finding.name).filter(Boolean);
const delay = fixDelay(incident);
const flaggedFiles = new Set((incident.findings || []).map((finding) => finding.file).filter(Boolean));
return (
{incident.culprit.subject && “{incident.culprit.subject}”}
{incident.status === "hit" || incident.status === "miss" ? "merged with the problem already inside." : "merged."}
{incident.culpritScope && (
{Icon.warn({ s: 12, style: { display: "inline-block", verticalAlign: "-2px", marginRight: 5 } })}
Honesty note: this was a {incident.culpritScope} — “pre-merge review would have caught it” is a weaker claim for bulk drops.
{incident.blockRule && (
Why a block: {incident.blockRule}.
)}
Run the failing probe yourself:{incident.repro.command}— exits non-zero while the regression is present.
{control.commits} commit{control.commits === 1 ? "" : "s"} that never needed a fix — and share no files with any incident above — went
through the identical pipeline: blast radius, intent, both-versions execution, verdict. A tool that blocks good merges is worse than no tool.
Ranked by evidence strength, scored against this repo’s real reverts and hotfixes — misses included. Click a row for the full story.
{/* #1 is the strongest story by construction — open it so the first
thing on screen below the verdict is the full proof chain. */}
{view.incidents.map((incident) => (
))}
High-signal changes a reviewer would want to know landed — whether or not they have caused damage yet.
{view.topFindings.map((finding, index) => )}
)}
{stats.findings ?? 0} findings across {scope}{stats.high ? ` (${stats.high} high)` : ""}
{stats.findingsPerCulprit != null && <> · median {stats.findingsPerCulprit} findings per analyzed change}
{stats.hitRate != null && <> · {Math.round(stats.hitRate * 100)}% backtest hit rate}
Every claim is reproducible from the listed SHAs — Kaval executes the code before and after each change. No model decides what is true:
every flip is deterministically observed; AI only parses commit intent into a licensed delta and orders findings.
);
}
// ---- PR advisory report (/pr/:owner/:repo/:number) -------------------------
// One PR, one verdict, a handful of findings — the page a "Details" link on a
// GitHub check opens. Public by design: anyone on the PR can read it. Renders
// buildPrView (report-view.mjs); evidence cards are the same ones the deep
// report uses, so a flip reads identically here and in the gallery.
const PR_DECISION_COPY = {
block: { label: "Kaval would block this", sub: "Executed evidence of an unlicensed behavior change — the diff does something the PR never claimed." },
escalate: { label: "Worth a human look", sub: "Kaval found behavior changes it could not license against the PR's stated intent. Advisory only — nothing is blocked." },
pass: { label: "No silent change", sub: "Kaval ran the changed code at base and head; observed behavior matches the PR's stated intent." },
};
function PrReport({ view }) {
const decision = PR_DECISION_COPY[view.decision] || PR_DECISION_COPY.escalate;
const counts = view.counts || {};
const coverage = view.coverage || {};
const partial = coverage.filesTruncated || coverage.patchesMissing > 0;
const date = fmtDate(view.generatedAt);
return (
{/* verdict hero: decision first, the PR it judged second */}
{counts.licensed || 0} licensed · {counts.unlicensed || 0} unlicensed · {counts.ambiguous || 0} ambiguous
{view.intent !== "parsed" && <> · the PR description doesn't state a clear intent, so nothing could be licensed}
{view.escalateReasons?.length > 0 && (
Why a human should look
{view.escalateReasons.map((reason, index) => (
•
{reason}
))}
)}
{view.findings?.length > 0 && (
The evidence
Kaval ran the changed code at both ends of this PR. Every flip below was observed, not inferred.
{view.findings.map((finding, index) => )}
)}
{partial && (
Partial coverage.{" "}
{coverage.filesTruncated && <>The diff exceeds GitHub's comparison window, so only the first {coverage.fileCount} files were analyzed. }
{coverage.patchesMissing > 0 && <>{coverage.patchesMissing} file{coverage.patchesMissing === 1 ? "" : "s"} had no readable patch. }
This verdict covers what Kaval could see — it is not a clean bill for the rest.
)}
Advisory check — Kaval never blocks a merge. {coverage.fileCount || 0} file{coverage.fileCount === 1 ? "" : "s"} across {coverage.totalCommits || 0} commit{coverage.totalCommits === 1 ? "" : "s"} analyzed
{view.engineVersion && <> · engine {view.engineVersion}}
{date && <> · {date}}
Every claim is reproducible from the listed SHAs — Kaval executes the code before and after the change. No model decides what is true:
every flip is deterministically observed; AI only parses PR intent into a licensed delta.