sova: Command for Claude Code

Ingest PR Review Feedback

Parse structured review findings from TaskRun records and update agent memory.

Instructions

1. Get the PR number from $ARGUMENTS. If empty, ask the user. Validate it is a positive integer before using it anywhere below: reject non-numeric input and ask the user to clarify rather than passing raw argument text into generated code. <PR_NUMBER> in every snippet in this command means this validated integer, never the raw $ARGUMENTS text.

2. Query the database for reviewer TaskRun records linked to this PR. Substitute the validated integer for <PR_NUMBER>: it becomes part of a Python expression evaluated via python3 -c, so unvalidated text here is a code injection risk, not just a bad query:

   # Find the reviewer run's handoff data
   python3 -c "
   import asyncio, json, os
   os.environ.setdefault('SOVA_DATABASE_URL', 'sqlite+aiosqlite:///.claude/sova.db')
   from sova.db.session import init_db, get_session
   from sova.db.models import TaskRun
   from sqlalchemy import select
   
   async def main():
       await init_db(run_migrations=False)
       async with await get_session() as session:
           stmt = select(TaskRun).where(
               TaskRun.pr_number == <PR_NUMBER>,
               TaskRun.role.in_(['reviewer', 'command:review-pr']),
               TaskRun.status == 'done',
           ).order_by(TaskRun.id.desc()).limit(1)
           run = (await session.execute(stmt)).scalar_one_or_none()
           if not run or not run.handoff_json:
               print('NO_FINDINGS')
               return
           print(json.dumps(run.handoff_json, indent=2))
   
   asyncio.run(main())
   "
   

3. If the output is NO_FINDINGS, do not stop here: the SOVA reviewer may simply not have run a TaskRun for this PR while external reviewers (CodeRabbit, human reviewers) still left comments. Continue to step 4 (there is nothing to parse from this source, so skip it) and step 5. Only report "No reviewer findings found for PR #N (no SOVA reviewer TaskRun and no external review comments)" and stop if step 5 also finds nothing.