@broject/bro 0.2.1 → 0.2.2

package/README.md

@@ -112,7 +112,11 @@ run on defaults until they set up. Everything's optional:
 {
   "stores": ["jsonl", "beads"],
   "personality": "terse",
-  "debt": { "dir": ".agents/review-debt" },
+  "debt": {
+    "dir": ".agents/review-debt",
+    "sources": ["review-threads", "dependabot", "secret-scanning"],
+    "stale_days": 14
+  },
   "connectors": { "reviews": "github", "tasks": "beads" },
   "sdd": { "mode": "remind", "dir": "specs" }
 }
@@ -141,6 +145,23 @@ The ledger dir is machine-local state too — bro adds it to
 `.git/info/exclude` on first write so harvest evidence can't be committed
 by accident.
 
+`debt.sources` picks which collectors `bro debt collect` runs. The
+default is `["review-threads"]` — the original merged-PR sweep. Opt-in
+sources feed the same ledger and beads projection (`debt:<source>`
+labels, `thread_id` is the source's stable key):
+
+| Source | Feeds on |
+| ------ | -------- |
+| `review-threads` | Unresolved review threads on merged PRs (default) |
+| `dependabot` | Open Dependabot alerts — skipped when an open `dependabot/*` PR already covers the dependency |
+| `code-scanning` | Open code-scanning alerts (rule + file ref) |
+| `secret-scanning` | Open secret-scanning alerts — always blocking priority |
+| `stale-prs` | Open PRs idle > `debt.stale_days` days or failing checks (WIP drafts don't count) |
+| `failed-ci` | Latest default-branch workflow run, if it failed |
+
+Alert sources reconcile both ways: a finding that disappears upstream is
+marked `done` in the ledger on the next collect.
+
 ## Labels bro manages
 
 | Label | Meaning |

package/dist/{dist-CZDdATdS.js → dist-DxwSa6Hg.js}

@@ -187,7 +187,14 @@ const PERSONALITIES = [
 	"mentor",
 	"sarcastic"
 ];
-const debtSection = (raw) => ({ dir: typeof raw === "object" && raw !== null && typeof raw.dir === "string" && raw.dir.trim() !== "" ? raw.dir : DEFAULT_CONFIG.debt.dir });
+const debtSection = (raw) => {
+	const obj = typeof raw === "object" && raw !== null ? raw : {};
+	return {
+		dir: typeof obj.dir === "string" && obj.dir.trim() !== "" ? obj.dir : DEFAULT_CONFIG.debt.dir,
+		sources: Array.isArray(obj.sources) && obj.sources.every((s) => typeof s === "string" && s.trim() !== "") && obj.sources.length > 0 ? obj.sources : DEFAULT_CONFIG.debt.sources,
+		stale_days: typeof obj.stale_days === "number" && Number.isFinite(obj.stale_days) && obj.stale_days > 0 ? obj.stale_days : DEFAULT_CONFIG.debt.stale_days
+	};
+};
 const syncSection = (raw) => {
 	const obj = typeof raw === "object" && raw !== null ? raw : {};
 	return {
@@ -273,7 +280,11 @@ const CORE_SECTIONS = {
 const DEFAULT_CONFIG = {
 	stores: ["jsonl", "beads"],
 	personality: "terse",
-	debt: { dir: ".agents/review-debt" },
+	debt: {
+		dir: ".agents/review-debt",
+		sources: ["review-threads"],
+		stale_days: 14
+	},
 	sync: {
 		ref: "refs/bro/data",
 		remote: "origin",

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { A as parallelWorkLines, B as stackSection, C as ghJson, D as initBeadsStealth, E as gitTry, F as registerConnector, H as syncSection, I as reviewHost, L as sddSection, M as promptContextLines, N as readPlanDoc, O as loadConfig, P as refKind$1, R as sessionStartLines, S as gh, T as git, U as taskStore, V as stopGateContributions, W as verbMethod, _ as docTypeNamed, a as bd, b as evidenceKind$1, c as beadsSection, d as dataRefPull, f as dataRefPush, g as definePlugin, i as actSection, j as planKind, l as checkBeads, m as debtSection, n as PERSONALITIES, o as bdJson$1, p as dataRefRoot, r as STANDARD_VERBS, s as bdTry, t as DEFAULT_GLOBAL_BEADS_DIR, u as dataRefCommit, v as docVerbs, w as ghTry, x as facade, y as ensureAuth, z as sessionTaskClaims } from "./dist-CZDdATdS.js";
+import { A as parallelWorkLines, B as stackSection, C as ghJson, D as initBeadsStealth, E as gitTry, F as registerConnector, H as syncSection, I as reviewHost, L as sddSection, M as promptContextLines, N as readPlanDoc, O as loadConfig, P as refKind$1, R as sessionStartLines, S as gh, T as git, U as taskStore, V as stopGateContributions, W as verbMethod, _ as docTypeNamed, a as bd, b as evidenceKind$1, c as beadsSection, d as dataRefPull, f as dataRefPush, g as definePlugin, i as actSection, j as planKind, l as checkBeads, m as debtSection, n as PERSONALITIES, o as bdJson$1, p as dataRefRoot, r as STANDARD_VERBS, s as bdTry, t as DEFAULT_GLOBAL_BEADS_DIR, u as dataRefCommit, v as docVerbs, w as ghTry, x as facade, y as ensureAuth, z as sessionTaskClaims } from "./dist-DxwSa6Hg.js";
 import { createRequire } from "node:module";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -963,7 +963,7 @@ function sanitizeRunId(runId) {
 function harvestFilename(opts) {
 	const d = new Date(opts.harvestedAt);
 	const pad = (n) => String(n).padStart(2, "0");
-	return `${`${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`}-pr-${opts.pr}-run-${sanitizeRunId(opts.runId)}.jsonl`;
+	return `${`${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`}-${opts.source ? `src-${sanitizeRunId(opts.source)}` : `pr-${opts.pr}`}-run-${sanitizeRunId(opts.runId)}.jsonl`;
 }
 /** Append-only harvest snapshot (one new file per PR per run — no merge conflicts). */
 function writeHarvestFile(opts) {
@@ -972,7 +972,8 @@ function writeHarvestFile(opts) {
 	const path = join(dir, harvestFilename({
 		harvestedAt: opts.harvestedAt,
 		pr: opts.pr,
-		runId: opts.runId
+		runId: opts.runId,
+		source: opts.source
 	}));
 	mkdirSync(dir, { recursive: true });
 	ensureDebtDirExcluded(debtDir(opts.cwd));
@@ -1648,7 +1649,8 @@ function beadInput(rec) {
 		description: `${rec.body}\n\n---\nthread: ${rec.thread_url}\npr: ${rec.source_pr_url}`,
 		labels: [
 			"debt",
-			`pr:${rec.source_pr}`,
+			...rec.source ? [`debt:${rec.source}`] : [],
+			...rec.source_pr > 0 ? [`pr:${rec.source_pr}`] : [],
 			`area:${rec.area}`,
 			`author:${rec.author}`,
 			`priority:${rec.priority}`
@@ -1817,6 +1819,202 @@ const debtConnector = {
 		}
 	} })
 };
+const DEBT_SOURCES = [
+	"dependabot",
+	"code-scanning",
+	"secret-scanning",
+	"stale-prs",
+	"failed-ci"
+];
+const ALL_SOURCES = ["review-threads", ...DEBT_SOURCES];
+function parseSources(raw) {
+	if (!Array.isArray(raw)) return ["review-threads"];
+	const valid = new Set(ALL_SOURCES);
+	const out = raw.filter((s) => typeof s === "string" && valid.has(s));
+	return out.length > 0 ? out : ["review-threads"];
+}
+/** `gh api --paginate --slurp` — all pages of a list endpoint as one flat
+*  array. Truncating at page 1 would drop real findings and falsely
+*  resolve ledger rows that still exist upstream. */
+function ghJsonAll(endpoint) {
+	return ghJson([
+		"api",
+		"--paginate",
+		"--slurp",
+		endpoint
+	]).flat();
+}
+function baseRecord(ctx, opts) {
+	return {
+		thread_id: opts.threadId,
+		thread_url: opts.url,
+		status: "open",
+		priority: opts.priority,
+		needs: "code_change",
+		source_pr: 0,
+		source_pr_url: "",
+		source_pr_title: opts.source,
+		merged_at: opts.createdAt,
+		merged_sha: "",
+		path: opts.path,
+		line: null,
+		author: opts.author,
+		body: opts.body,
+		body_preview: bodyPreview(opts.body),
+		fingerprint: fingerprint({
+			body: opts.body,
+			path: opts.path
+		}),
+		area: deriveArea(opts.path),
+		harvested_at: ctx.harvestedAt,
+		harvest_run_id: ctx.runId,
+		times_seen: 1,
+		fix_pr: null,
+		fixed_at: null,
+		notes: null,
+		source: opts.source
+	};
+}
+/** Open dependabot PRs — an alert with a fix PR in flight isn't debt, the
+*  PR is the work item. Matched by head ref `dependabot/.../<pkg>-<ver>` —
+*  the trailing dash is the version boundary so `ember` can't match
+*  `ember-cli-1.0`. Dependabot refs drop the `@` from scoped packages.
+*  Failure propagates: an empty list here would mark every covered alert
+*  as debt, so the caller skips the whole source on error. */
+function dependabotOpenPrs(repo) {
+	return ghJson([
+		"pr",
+		"list",
+		"--repo",
+		repo,
+		"--author",
+		"app/dependabot",
+		"--state",
+		"open",
+		"--json",
+		"number,headRefName,url",
+		"--limit",
+		"200"
+	]);
+}
+function collectDependabot(ctx) {
+	const alerts = ghJsonAll(`repos/${ctx.repo}/dependabot/alerts?state=open&per_page=100`);
+	const prs = dependabotOpenPrs(ctx.repo);
+	const out = [];
+	for (const a of alerts) {
+		const pkg = a.security_vulnerability?.package?.name?.replace(/^@/, "") ?? "";
+		if (pkg ? prs.find((p) => p.headRefName.includes(`${pkg}-`)) : void 0) continue;
+		const severity = a.security_vulnerability?.severity ?? "medium";
+		const body = a.security_vulnerability?.summary ?? `Dependabot alert #${a.number} (${pkg || "unknown package"}, ${severity})`;
+		out.push(baseRecord(ctx, {
+			threadId: `dependabot:${a.number}`,
+			url: a.html_url,
+			priority: severity === "critical" || severity === "high" ? "blocking" : "scan",
+			path: a.dependency?.manifest_path ?? "",
+			author: "dependabot[bot]",
+			body: `[${severity}] ${pkg}: ${body}`,
+			createdAt: a.created_at,
+			source: "dependabot"
+		}));
+	}
+	return out;
+}
+function collectCodeScanning(ctx) {
+	return ghJsonAll(`repos/${ctx.repo}/code-scanning/alerts?state=open&per_page=100`).map((a) => baseRecord(ctx, {
+		threadId: `code-scanning:${a.number}`,
+		url: a.html_url,
+		priority: a.rule?.severity === "error" ? "blocking" : "scan",
+		path: a.most_recent_instance?.location?.path ?? "",
+		author: "github-code-scanning",
+		body: `${a.rule?.id ?? "unknown rule"}: ${a.rule?.description ?? "code scanning alert"}`,
+		createdAt: a.created_at,
+		source: "code-scanning"
+	}));
+}
+function collectSecretScanning(ctx) {
+	return ghJsonAll(`repos/${ctx.repo}/secret-scanning/alerts?state=open&per_page=100`).map((a) => baseRecord(ctx, {
+		threadId: `secret-scanning:${a.number}`,
+		url: a.html_url,
+		priority: "blocking",
+		path: "",
+		author: "github-secret-scanning",
+		body: `Secret scanning alert: ${a.secret_type_display_name ?? a.secret_type ?? "unknown type"}`,
+		createdAt: a.created_at,
+		source: "secret-scanning"
+	}));
+}
+/** Open PRs idle > staleDays or failing checks. Drafts are flagged only when
+*  they fail checks — a quiet WIP draft is work in progress, not debt. */
+function collectStalePrs(ctx, staleDays) {
+	const prs = ghJson([
+		"pr",
+		"list",
+		"--repo",
+		ctx.repo,
+		"--state",
+		"open",
+		"--json",
+		"number,title,url,updatedAt,isDraft,author,statusCheckRollup",
+		"--limit",
+		"200"
+	]);
+	const cutoff = Date.now() - staleDays * 24 * 60 * 60 * 1e3;
+	const out = [];
+	for (const pr of prs) {
+		const failing = (pr.statusCheckRollup ?? []).some((c) => c.conclusion === "FAILURE");
+		const updated = Date.parse(pr.updatedAt);
+		if (Number.isNaN(updated)) continue;
+		const idleDays = Math.floor((Date.now() - updated) / 864e5);
+		const stale = updated < cutoff;
+		if (pr.isDraft && !failing) continue;
+		if (!stale && !failing) continue;
+		const reasons = [stale ? `idle ${idleDays}d` : null, failing ? "failing checks" : null].filter(Boolean);
+		out.push(baseRecord(ctx, {
+			threadId: `stale-pr:${pr.number}`,
+			url: pr.url,
+			priority: failing ? "blocking" : "nit",
+			path: "",
+			author: pr.author?.login ?? "unknown",
+			body: `PR #${pr.number} "${pr.title}" — ${reasons.join(", ")}`,
+			createdAt: pr.updatedAt,
+			source: "stale-prs"
+		}));
+	}
+	return out;
+}
+/** Latest completed run on the default branch — a single stable row
+*  (`failed-ci:<branch>`) instead of one row per failed run. */
+function collectFailedCi(ctx) {
+	const branch = ghJson(["api", `repos/${ctx.repo}`]).default_branch ?? "main";
+	const latest = ghJson(["api", `repos/${ctx.repo}/actions/runs?branch=${encodeURIComponent(branch)}&status=completed&per_page=1`]).workflow_runs?.[0];
+	if (latest?.conclusion !== "failure") return [];
+	return [baseRecord(ctx, {
+		threadId: `failed-ci:${branch}`,
+		url: latest.html_url,
+		priority: "blocking",
+		path: "",
+		author: "ci",
+		body: `Default-branch CI failing: "${latest.name ?? "workflow"}" on ${branch} (run ${latest.id})`,
+		createdAt: latest.created_at,
+		source: "failed-ci"
+	})];
+}
+const COLLECTORS = {
+	dependabot: (ctx) => collectDependabot(ctx),
+	"code-scanning": (ctx) => collectCodeScanning(ctx),
+	"secret-scanning": (ctx) => collectSecretScanning(ctx),
+	"stale-prs": (ctx, staleDays) => collectStalePrs(ctx, staleDays),
+	"failed-ci": (ctx) => collectFailedCi(ctx)
+};
+/**
+* Alerts/CI are server-side truth: an open ledger row for a source whose
+* finding is absent from the fresh fetch resolved upstream — return its
+* thread_ids so collect can overlay them `done`.
+*/
+function resolvedThreadIds(existing, source, fresh) {
+	const live = new Set(fresh.map((r) => r.thread_id));
+	return existing.filter((r) => r.source === source && r.status === "open" && !live.has(r.thread_id)).map((r) => r.thread_id);
+}
 
 //#endregion
 //#region ../drill/dist/index.js
@@ -5759,6 +5957,9 @@ Commands:
                                   Filters: --pr-ids, --merged-since, --merged-until,
                                   --last, --pr-author, --labels, --thread-author
                                   Flags: --dry-run, --list-only, --reharvest, --no-label
+                                  Sources: debt.sources config — default review-threads;
+                                  opt in: ${DEBT_SOURCES.join(", ")}
+                                  debt.stale_days tunes stale-prs (default 14)
   status                          Ledger summary + unprocessed merged PR count
   prs [--limit N] [--all]         Unprocessed merged PRs (--all: full matrix)
   list [filters]                  Ledger rows (--status, --area, --author,
@@ -5856,102 +6057,51 @@ async function cmdCollect(argv) {
 	const rev = reviewHost(void 0, loadBroConfig().connectors);
 	const args = parseCollectArgs(rev, argv);
 	ensureAuth("reviews", { dir: process.cwd() }, { prefer: loadBroConfig().connectors });
-	const listLimit = Math.max(args.filters.lastN ?? 0, 100);
-	const matched = resolveHarvestPrs(rev, {
-		repo: args.repo,
-		filters: args.filters,
-		listLimit
-	});
-	const { pending, processed } = partitionByProcessed(matched);
-	const processedAt = readProcessedAt();
-	const futureBound = new Date(Date.now() + 300 * 1e3).toISOString();
-	const stale = processed.filter((pr) => {
-		if (prDebtState(pr.labels) === "skipped") return false;
-		const at = processedAt.get(pr.number);
-		return at === void 0 || at > futureBound || pr.updatedAt !== null && pr.updatedAt > at;
-	});
-	const targets = args.reharvest ? matched.filter((pr) => prDebtState(pr.labels) !== "skipped") : [...pending, ...stale];
-	console.error(`debt collect: ${matched.length} merged PR(s) matched, ${processed.length - stale.length} already processed (debt:* label)` + (stale.length > 0 ? `, ${stale.length} stale (post-scan activity)` : "") + `, scanning ${targets.length}`);
-	if (args.listOnly) {
-		for (const pr of targets) console.log(`${pr.number}\t${pr.mergedAt}\t${pr.author}\t${prDebtState(pr.labels) ?? "none"}`);
-		return;
-	}
-	if (targets.length === 0) return;
-	const labelingEnabled = !args.noLabel && args.threadAuthor === null;
-	if (args.threadAuthor !== null && !args.noLabel) console.error("debt collect: --thread-author is a partial scan — labels disabled");
-	if (!args.dryRun && labelingEnabled) ensureDebtLabels(rev, args.repo);
-	let totalRows = 0;
-	let labeled = 0;
-	for (const pr of targets) {
-		const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
-		let result;
+	const debtCfg = loadBroConfig().debt;
+	const knownSources = new Set(ALL_SOURCES);
+	const sources = new Set(parseSources(debtCfg.sources));
+	for (const s of debtCfg.sources.filter((x) => !knownSources.has(x))) console.error(`debt collect: unknown source "${s}" — ignored`);
+	if (sources.has("review-threads")) await collectReviewThreads(rev, args);
+	for (const source of DEBT_SOURCES) {
+		if (!sources.has(source)) continue;
+		const harvestedAt = (/* @__PURE__ */ new Date()).toISOString();
+		let records = [];
 		try {
-			result = await collectPr(rev, {
+			records = COLLECTORS[source]({
 				repo: args.repo,
-				pr: pr.number,
 				runId: args.runId,
-				threadAuthor: args.threadAuthor
-			});
+				harvestedAt
+			}, debtCfg.stale_days);
 		} catch (err) {
-			console.error(`warning: PR ${rev.prLink(args.repo, pr.number)} skipped — ${err instanceof Error ? err.message : err}`);
+			console.error(`debt: source ${source} failed — ${err instanceof Error ? err.message : err}`);
 			continue;
 		}
-		console.error(`debt: PR ${rev.prLink(args.repo, pr.number)} — ${result.incoming.length} thread(s)`);
+		console.error(`debt: ${source} — ${records.length} finding(s)`);
 		if (args.dryRun) {
-			for (const row of result.incoming) console.log(JSON.stringify(row));
+			for (const row of records) console.log(JSON.stringify(row));
 			continue;
 		}
-		const state = result.incoming.length > 0 ? "collected" : "clean";
-		if (result.incoming.length > 0) {
-			writeHarvestFile({
-				pr: result.pr,
-				runId: args.runId,
-				harvestedAt: result.incoming[0].harvested_at,
-				records: result.incoming
-			});
-			totalRows += result.incoming.length;
-			const overlays = readLedgerOverlays();
-			const reopen = result.incoming.filter((r) => {
-				const s = overlays.get(r.thread_id)?.status;
-				return s === "done" || s === "wontfix";
-			});
-			if (reopen.length > 0) {
-				upsertLedgerOverlays(reopen.map((r) => {
-					const prev = overlays.get(r.thread_id);
-					return {
-						thread_id: r.thread_id,
-						status: "open",
-						fix_pr: null,
-						fixed_at: null,
-						notes: prev?.notes ? `${prev.notes} | reopened by reharvest` : "reopened by reharvest"
-					};
-				}));
-				console.error(`debt: reopened ${reopen.length} terminal row(s) — still unresolved`);
-			}
-		}
-		if (labelingEnabled) {
-			if (prDebtState(rev.labels({
-				repo: args.repo,
-				pr: pr.number
-			})) !== "skipped") {
-				applyCollectLabel(rev, {
-					repo: args.repo,
-					pr: pr.number,
-					state
-				});
-				labeled += 1;
-			}
-			const cursor = rev.prUpdatedAt({
-				repo: args.repo,
-				pr: pr.number
-			}) ?? pr.updatedAt ?? scannedAt;
-			markProcessedAt([pr.number], cursor);
+		if (records.length > 0) writeHarvestFile({
+			pr: 0,
+			source,
+			runId: args.runId,
+			harvestedAt,
+			records
+		});
+		const gone = resolvedThreadIds(readDebtRecords(), source, records);
+		if (gone.length > 0) {
+			upsertLedgerOverlays(gone.map((thread_id) => ({
+				thread_id,
+				status: "done",
+				fix_pr: null,
+				fixed_at: (/* @__PURE__ */ new Date()).toISOString(),
+				notes: "resolved upstream — no longer reported"
+			})));
+			console.error(`debt: ${source} — resolved ${gone.length} row(s) no longer reported`);
 		}
 	}
 	if (!args.dryRun) {
-		if (totalRows > 0) writeSummary(buildSummary(readDebtRecords()));
-		const labeledMsg = labelingEnabled ? `labeled ${labeled} PR(s)` : "labels disabled";
-		console.error(`debt collect: wrote ${totalRows} row(s), ${labeledMsg}`);
+		if (readDebtRecords().length > 0) writeSummary(buildSummary(readDebtRecords()));
 		if (loadBroConfig().stores.includes("beads")) try {
 			const res = syncDebtToBeads(readDebtRecords());
 			console.error(`debt sync: ${res.created} created, ${res.closed} closed, ${res.reopened} reopened, ${res.linked} linked`);
@@ -5962,6 +6112,128 @@ async function cmdCollect(argv) {
 		}
 	}
 }
+function selectTargets(matched, args) {
+	const { pending, processed } = partitionByProcessed(matched);
+	const processedAt = readProcessedAt();
+	const futureBound = new Date(Date.now() + 300 * 1e3).toISOString();
+	const stale = processed.filter((pr) => {
+		if (prDebtState(pr.labels) === "skipped") return false;
+		const at = processedAt.get(pr.number);
+		return at === void 0 || at > futureBound || pr.updatedAt !== null && pr.updatedAt > at;
+	});
+	return {
+		targets: args.reharvest ? matched.filter((pr) => prDebtState(pr.labels) !== "skipped") : [...pending, ...stale],
+		staleCount: stale.length,
+		processedCount: processed.length
+	};
+}
+/** A reharvested thread that was marked done/wontfix is unresolved again
+*  — the terminal overlay must not shadow the fresh open evidence. */
+function reopenTerminalRows(rows) {
+	const overlays = readLedgerOverlays();
+	const reopen = rows.filter((r) => {
+		const s = overlays.get(r.thread_id)?.status;
+		return s === "done" || s === "wontfix";
+	});
+	if (reopen.length === 0) return;
+	upsertLedgerOverlays(reopen.map((r) => {
+		const prev = overlays.get(r.thread_id);
+		return {
+			thread_id: r.thread_id,
+			status: "open",
+			fix_pr: null,
+			fixed_at: null,
+			notes: prev?.notes ? `${prev.notes} | reopened by reharvest` : "reopened by reharvest"
+		};
+	}));
+	console.error(`debt: reopened ${reopen.length} terminal row(s) — still unresolved`);
+}
+async function harvestPr(rev, args, pr, labelingEnabled) {
+	const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+	let result;
+	try {
+		result = await collectPr(rev, {
+			repo: args.repo,
+			pr: pr.number,
+			runId: args.runId,
+			threadAuthor: args.threadAuthor
+		});
+	} catch (err) {
+		console.error(`warning: PR ${rev.prLink(args.repo, pr.number)} skipped — ${err instanceof Error ? err.message : err}`);
+		return {
+			rows: 0,
+			labeled: 0
+		};
+	}
+	console.error(`debt: PR ${rev.prLink(args.repo, pr.number)} — ${result.incoming.length} thread(s)`);
+	if (args.dryRun) {
+		for (const row of result.incoming) console.log(JSON.stringify(row));
+		return {
+			rows: 0,
+			labeled: 0
+		};
+	}
+	if (result.incoming.length > 0) {
+		writeHarvestFile({
+			pr: result.pr,
+			runId: args.runId,
+			harvestedAt: result.incoming[0].harvested_at,
+			records: result.incoming
+		});
+		reopenTerminalRows(result.incoming);
+	}
+	let labeled = 0;
+	if (labelingEnabled) {
+		if (prDebtState(rev.labels({
+			repo: args.repo,
+			pr: pr.number
+		})) !== "skipped") {
+			const state = result.incoming.length > 0 ? "collected" : "clean";
+			applyCollectLabel(rev, {
+				repo: args.repo,
+				pr: pr.number,
+				state
+			});
+			labeled = 1;
+		}
+		const cursor = rev.prUpdatedAt({
+			repo: args.repo,
+			pr: pr.number
+		}) ?? pr.updatedAt ?? scannedAt;
+		markProcessedAt([pr.number], cursor);
+	}
+	return {
+		rows: result.incoming.length,
+		labeled
+	};
+}
+async function collectReviewThreads(rev, args) {
+	const listLimit = Math.max(args.filters.lastN ?? 0, 100);
+	const matched = resolveHarvestPrs(rev, {
+		repo: args.repo,
+		filters: args.filters,
+		listLimit
+	});
+	const { targets, staleCount, processedCount } = selectTargets(matched, args);
+	console.error(`debt collect: ${matched.length} merged PR(s) matched, ${processedCount - staleCount} already processed (debt:* label)` + (staleCount > 0 ? `, ${staleCount} stale (post-scan activity)` : "") + `, scanning ${targets.length}`);
+	if (args.listOnly) {
+		for (const pr of targets) console.log(`${pr.number}\t${pr.mergedAt}\t${pr.author}\t${prDebtState(pr.labels) ?? "none"}`);
+		return;
+	}
+	if (targets.length === 0) return;
+	const labelingEnabled = !args.noLabel && args.threadAuthor === null;
+	if (args.threadAuthor !== null && !args.noLabel) console.error("debt collect: --thread-author is a partial scan — labels disabled");
+	if (!args.dryRun && labelingEnabled) ensureDebtLabels(rev, args.repo);
+	let totalRows = 0;
+	let labeled = 0;
+	for (const pr of targets) {
+		const res = await harvestPr(rev, args, pr, labelingEnabled);
+		totalRows += res.rows;
+		labeled += res.labeled;
+	}
+	const labeledMsg = labelingEnabled ? `labeled ${labeled} PR(s)` : "labels disabled";
+	console.error(`debt collect: wrote ${totalRows} row(s), ${labeledMsg}`);
+}
 function cmdStatus$1() {
 	const records = readDebtRecords();
 	const summary = buildSummary(records);
@@ -6022,6 +6294,7 @@ function rowMatchesFilters(row, filters) {
 	if (filters.author !== null && row.author !== filters.author) return false;
 	if (filters.priority !== null && row.priority !== filters.priority) return false;
 	if (filters.pr !== null && row.source_pr !== filters.pr) return false;
+	if (filters.source !== null && (row.source ?? "review-threads") !== filters.source) return false;
 	return true;
 }
 function cmdList$2(argv) {
@@ -6030,7 +6303,8 @@ function cmdList$2(argv) {
 		area: null,
 		author: null,
 		priority: null,
-		pr: null
+		pr: null,
+		source: null
 	};
 	let limit = 50;
 	for (let i = 0; i < argv.length; i += 1) {
@@ -7025,7 +7299,7 @@ const SKILL_FILES = {
 	"convoy/agents/openai.yaml": "interface:\n  display_name: \"Bro Convoy\"\n  short_description: \"Agent-internal molecule execution — DAG scheduling over beads via the bro CLI\"\n  brand_color: \"#6B4FBB\"\n  default_prompt: \"Use $convoy to get started.\"\npolicy:\n  allow_implicit_invocation: false\n",
 	"convoy/SKILL.md": "---\nname: convoy\ndescription: \"Use when the user invokes /convoy or asks to run a beads workflow — a molecule's DAG of steps executed inside the agent. Thin wrapper over the bro CLI: `bro convoy next` is the scheduler as code; `bro convoy done` advances it. Requires `bro` (npx -y @broject/bro@0) and bd.\"\n---\n\n# /convoy (bro)\n\n**All mechanics live in the `bro` CLI.** This skill is policy only — do not\nreimplement scheduling; `bro convoy next` computes it from beads state.\n\nPrereq: `bro` on PATH or `npx -y @broject/bro@0` (major-pinned). Requires\n`bd` and an initialized `.beads/`.\n\n## What a convoy is\n\nA **convoy** is a beads **molecule** — the persistent instantiation of a\nformula (`bd mol pour`). Steps are child issues; `blocks` edges are the DAG.\nAll state lives in beads: a convoy survives session restarts, compaction,\nand parallel agents. Gas City is **not** required — bro is the executor.\n\n## The loop\n\n```text\nbro convoy pour <formula> [--var K=V]…   → prints the molecule root id (once per run)\nbro convoy status [mol]       → DAG: ✓ done / ▸ ready / · blocked\nbro convoy next   [mol]       → JSON: what to do now\nbro convoy claim <step-id>            → atomic claim — do this before starting\nbro convoy done <step-id> --result \"…\"   → closes the step, emits the new next\n```\n\nRepeat `next` → `claim` → work → `done` until `next` reports\n`\"state\": \"complete\"`. Every command takes the molecule id (positional or\n`--mol`) — pass it whenever more than one convoy is open; no-arg\nresolution only works with exactly one.\n\n`next` states:\n\n- `step` — execute `step` (id, title, description = the work instructions),\n  then `bro convoy done <step.id> --result \"<what you did>\"`.\n- `gate` — a human step is next. **Ask the user** — do not execute it\n  yourself and do not mark it done on their behalf without their answer.\n  Their approval is the result; then `done` it with their decision.\n- `blocked` — open steps exist but none are ready (a dependency cycle,\n  or remaining steps all waiting on other open work). Run\n  `bro convoy status` and report.\n- `complete` — every step done. Close the molecule root:\n  `bd close <mol-id> --reason \"convoy complete\"`.\n\n`next` also reports `gates[]` — every ready human gate, even while an\nagent step runs. Surface them to the user promptly; a ready gate means\nthe convoy is waiting on a human somewhere. `inProgress[]` lists steps\nalready claimed — including yours, once you claim. Steps you didn't claim\nthat appear here belong to another agent; pick a different ready step. And `inputs[]` — the `--result` each closed direct\ndependency was completed with. That is the handoff: read it before\nstarting the step.\n\nWith several open molecules, pass `--mol <id>` explicitly — no-arg\nresolution errors on ambiguity rather than guessing.\n\n## Policy\n\n- **Never skip `next`.** Do not pick steps by eyeballing titles — the DAG\n  decides order. Independent ready steps appear together in `ready[]`;\n  parallel execution across agent sessions is allowed, sequential `step`\n  selection is the safe default.\n- **`--result` is the handoff.** Future steps read it — write what the\n  next step needs (paths, PR urls, verdicts), not a diary entry.\n- **Gates are not optional.** A `human` step exists to stop the machine;\n  treating it as an agent step defeats the formula.\n- **Claim before you start.** `bro convoy claim <step>` is an atomic\n  lease (assignee + in_progress, refused if another agent holds it). With\n  parallel agents in the same repo, an unclaimed step is shared work.\n- **Resume is free.** After compaction or a fresh session, `bro convoy\n  status` reconstructs everything — there is no in-memory state to lose.\n- **Failures stay visible.** If a step cannot be completed, leave it open\n  and tell the user — do not force-close a step you didn't do.\n",
 	"debt/agents/openai.yaml": "interface:\n  display_name: \"Bro Debt\"\n  short_description: \"Review-debt pipeline via the bro CLI — collect + status\"\n  brand_color: \"#B60205\"\n  default_prompt: \"Use $debt to get started.\"\npolicy:\n  allow_implicit_invocation: false\n",
-	"debt/SKILL.md": "---\nname: debt\ndescription: \"Use when the user invokes /debt or asks about review debt on merged PRs. Thin wrapper over the bro CLI — all mechanics live in `bro debt *` commands; this skill carries policy only. Requires `bro` (npx -y @broject/bro@0) and gh.\"\n---\n\n# /debt (bro)\n\n**All mechanics live in the `bro` CLI.** This skill is policy only — do not\nreimplement what `bro debt` already does.\n\nPrereq: `bro` on PATH or `npx -y @broject/bro@0` (major-pinned). Requires\n`gh` auth; `bd` is required only with beads enabled (the default) —\n`\"stores\": [\"jsonl\"]` in bro.config.json opts out and drops the `bd`\nrequirement.\n\n## Commands\n\n| Command | What it does |\n| ------- | ------------ |\n| `bro debt collect [filters]` | Scan merged PRs **without** a `debt:*` label → collect unresolved threads → write `harvests/*.jsonl` → label `debt:collected` / `debt:clean` |\n| `bro debt status` | Ledger summary + unprocessed merged-PR count |\n| `bro debt prs` | Merged PRs still unprocessed — the work queue (`--all`: full matrix) |\n| `bro debt list` | Ledger rows (`--status`, `--area`, `--author`, `--priority`, `--pr`) |\n| `bro debt mark <pr> <state>` | `collected` / `clean` / `skipped` / `none` — manual override |\n| `bro debt set <status> --thread-id ID` | Ledger status: `claimed` / `done --fix-pr N` / `wontfix` / `duplicate` — feeds `bro debt sync` |\n| `bro debt sync` | Project the ledger into beads — `bd ready -l debt` becomes the work queue |\n\n## Policy\n\n- **`debt:*` labels are the PR-level source of truth** for \"processed\".\n  `skipped` is a human opt-out and always wins over machine labels.\n- **beads is a default store.** A normal collect auto-runs\n  `bd init --stealth --skip-agents --skip-hooks` when `.beads` is missing\n  (skipped by `--dry-run`, `--list-only`, and an empty target list) and\n  keeps the ledger dir out of git via `.git/info/exclude`.\n  `\"stores\": [\"jsonl\"]` in bro.config.json is the opt-out.\n- **Label after the file lands.** In CI pipelines run\n  `collect --no-label`, land `harvests/*.jsonl` (`git add -f` — the ledger\n  dir is locally excluded), then `bro debt mark`.\n- **Collect, don't fix.** Triage → backlog, fixes → the fix loop. `bro debt` never edits product code or resolves threads on source PRs.\n- `--reharvest` bypasses the label skip for one run.\n",
+	"debt/SKILL.md": "---\nname: debt\ndescription: \"Use when the user invokes /debt or asks about review debt on merged PRs. Thin wrapper over the bro CLI — all mechanics live in `bro debt *` commands; this skill carries policy only. Requires `bro` (npx -y @broject/bro@0) and gh.\"\n---\n\n# /debt (bro)\n\n**All mechanics live in the `bro` CLI.** This skill is policy only — do not\nreimplement what `bro debt` already does.\n\nPrereq: `bro` on PATH or `npx -y @broject/bro@0` (major-pinned). Requires\n`gh` auth; `bd` is required only with beads enabled (the default) —\n`\"stores\": [\"jsonl\"]` in bro.config.json opts out and drops the `bd`\nrequirement.\n\n## Commands\n\n| Command | What it does |\n| ------- | ------------ |\n| `bro debt collect [filters]` | Scan merged PRs **without** a `debt:*` label → collect unresolved threads → write `harvests/*.jsonl` → label `debt:collected` / `debt:clean`. With `debt.sources` in bro.config.json it also runs opt-in collectors (`dependabot`, `code-scanning`, `secret-scanning`, `stale-prs`, `failed-ci`) — same ledger, `debt:<source>` labels on beads, `debt.stale_days` tunes stale-prs |\n| `bro debt status` | Ledger summary + unprocessed merged-PR count |\n| `bro debt prs` | Merged PRs still unprocessed — the work queue (`--all`: full matrix) |\n| `bro debt list` | Ledger rows (`--status`, `--area`, `--author`, `--priority`, `--pr`) |\n| `bro debt mark <pr> <state>` | `collected` / `clean` / `skipped` / `none` — manual override |\n| `bro debt set <status> --thread-id ID` | Ledger status: `claimed` / `done --fix-pr N` / `wontfix` / `duplicate` — feeds `bro debt sync` |\n| `bro debt sync` | Project the ledger into beads — `bd ready -l debt` becomes the work queue |\n\n## Policy\n\n- **`debt:*` labels are the PR-level source of truth** for \"processed\".\n  `skipped` is a human opt-out and always wins over machine labels.\n- **beads is a default store.** A normal collect auto-runs\n  `bd init --stealth --skip-agents --skip-hooks` when `.beads` is missing\n  (skipped by `--dry-run`, `--list-only`, and an empty target list) and\n  keeps the ledger dir out of git via `.git/info/exclude`.\n  `\"stores\": [\"jsonl\"]` in bro.config.json is the opt-out.\n- **Label after the file lands.** In CI pipelines run\n  `collect --no-label`, land `harvests/*.jsonl` (`git add -f` — the ledger\n  dir is locally excluded), then `bro debt mark`.\n- **Collect, don't fix.** Triage → backlog, fixes → the fix loop. `bro debt` never edits product code or resolves threads on source PRs.\n- `--reharvest` bypasses the label skip for one run.\n",
 	"docs/SKILL.md": "---\nname: docs\ndescription: \"Use when reading or mutating bro documents directly — tasks (beads) and stores — through the verb-first `bro <verb> <noun|ref>` surface. Also covers the user-level global task store. Thin wrapper — mechanics live in the CLI.\"\n---\n\n# /docs (bro)\n\n**All mechanics live in the `bro` CLI.** This skill is policy only.\n\nbro's document surface is noun-first, gh-style: `bro <noun> <verb>\n[ref…] [--flags]`. Doc types are plugin-registered (`task`, `store`);\na type's adapter methods are the verb registry — there is no verb\nlist to consult. Verbs live inside their noun's namespace, so plugin\ndoc types may define any custom verbs freely.\n\nShorthand: task verbs also work verb-first — `bro list`, `bro show\n<id>`, `bro close <id>` mean `bro task …`. A bare ref infers the type\nfrom its prefix; a bare noun (`bro task`, `bro store`) means `list`.\n\nThe doc namespace is guarded, not declared: reserved words = plugin\ncommand names ∪ doc nouns/aliases ∪ shorthand verbs. A plugin taking\na reserved name, or a doc type colliding on noun/alias/idPrefix, is\nskipped with a warning — everything else is usable.\n\nTask verbs resolve through the `tasks` connector facade — beads is the\nbuilt-in provider; `connectors.tasks` in `bro.config.json` (or a plugin\nshipping its own connector via `BroPlugin.connectors`) retargets them.\n\n| Command | What it does |\n| ------- | ------------ |\n| `bro task list [--status=open]` / `bro list` | List tasks — flags pass through to the store |\n| `bro task show <id>` / `bro show <id>` | One doc; the ref infers the type |\n| `bro task new \"title\" [--type=bug]` / `bro new task \"title\"` | Create — returns the doc |\n| `bro task set <id> --status=blocked` / `bro set <id> …` | Update fields |\n| `bro task close <id> [--reason=…]` / `bro rm <id>` | Close / delete a task |\n| `bro task exec [--global] -- <bd args>` | Raw `bd` against the store — escape hatch, not contract |\n| `bro store list` | Store inventory — path + prefix + health |\n| `bro store show --global` | Details of the resolved global dir |\n| `bro store init --global [--prefix=P]` | Create + validate the global store |\n| `bro store path --global` | Print the resolved global store dir |\n| `bro next --global` | Schedule from the global queue — same pipeline, cwd = the store |\n\n## Scopes\n\n`--global` is a scope flag, not a command: the same verbs hit the\nuser-level store (`~/.local/share/bro/beads` by default — `beads.global`\nin `bro.config.json` or `$BRO_GLOBAL_BEADS` relocate it, env wins).\nStores never mix: `bro list`, `bro next`, `bro loop`, and hooks read the\ncheckout's `.beads` only; global work is opt-in at every call.\n\nThe global store is local-only by default — no sync remote. For a\ncross-machine queue set the store's own Dolt remote inside it\n(`bd dolt remote` in the store dir) — bro does not manage it.\n\n## Policy\n\n- **Project work goes to project beads.** Global beads are claimed only\n  through `bro next --global` or `--global` doc verbs.\n- **Global is for user-level work** — cross-repo tasks, personal backlog,\n  anything that must not ride the project's issue tracker or land in its\n  PRs. If in doubt, file in the project.\n- **Prefer verbs over `exec`.** `bro task exec -- …` exists for bd features\n  the doc layer doesn't model yet; workflow output should come through\n  typed verbs so ref inference and rendering keep working.\n",
 	"drill/agents/openai.yaml": "interface:\n  display_name: \"Bro Drill\"\n  short_description: \"Scoped descent over beads — drill frames with mandatory result+prevention memos\"\n  brand_color: \"#B60205\"\n  default_prompt: \"Use $drill to start a scoped drill frame.\"\npolicy:\n  allow_implicit_invocation: false\n",
 	"drill/SKILL.md": "---\nname: drill\ndescription: \"Use when the user invokes /drill or /unwind, or when a task needs scoped descent — narrower investigation frames with mandatory result+prevention memos. Thin wrapper over the bro CLI: drill frames are beads; bd owns storage, `bro drill` owns the invariants. Requires `bro` (npx -y @broject/bro@0) and bd.\"\n---\n\n# /drill (bro)\n\n**All mechanics live in the `bro` CLI over `bd`.** This skill is policy\nonly. A drill frame is a bead labeled `drill`; nesting uses bd's native\n`--parent` hierarchy. There is no `.drills/` directory tree and no\nclaim.json — **beads IS the memory system**.\n\nPrereq: `bro` on PATH or `npx -y @broject/bro@0`, `bd init` done.\n\n## Commands\n\n| Command | What it does |\n| ------- | ------------ |\n| `bro drill down <title> [--under ID] [--ephemeral]` | New child frame under the current leaf (or a root). `--ephemeral` = wisp, no audit trail |\n| `bro drill up --result T [--prevent T]… [--evidence R]…` | Close the current frame. `--result` is **mandatory** (CLI-enforced). `--prevent` is policy-mandatory when the drill found an error, gap, or reusable lesson — each item spawns a `prevention`-labeled task linked `discovered-from` the frame. `--evidence` records a provenance ref (sha/PR) |\n| `bro unwind …` | Alias for `drill up` — collapse a solved frame into its parent |\n| `bro drill current` | The active leaf frame (deepest open path) |\n| `bro drill tree` | All drill hierarchies (● open / ○ closed) |\n| `bro drill list` | Open frames |\n| `bro drill distill ID` | `bd mol distill` — turn a successful drill tree into a reusable proto/formula |\n\n## Policy\n\n- **Narrow → investigate → ascend → prevent.** Descend only into a\n  strictly narrower problem. A frame that returns nothing teaches\n  nothing — the CLI refuses `drill up` without `--result`.\n- **Found a root cause or a reusable lesson? `--prevent` is the policy,\n  not a suggestion.** The CLI can't judge whether a lesson exists — that\n  call is yours; when it does, each item becomes follow-up work in beads,\n  not a footnote.\n- **Isolation.** A child frame gets only task-relevant context; the\n  curated memo lands as a `bd note` on the closed child (prevention items\n  become beads linked `discovered-from` it) — never the raw transcript.\n- **Can't ascend past open children** — bd blocks the close; ascend\n  bottom-up.\n- **Drill → distill → formula** is the learning loop: a drill tree that\n  solved a problem well can be distilled into a proto and re-poured next\n  time (`bd mol pour`/`bd mol wisp`).\n- Lifecycle is auditable for persistent frames: `claim` on down,\n  `handoff` on up, evidence refs as provenance events\n  (`bd provenance log <id>`). `--ephemeral` wisps skip all provenance —\n  by design they leave no audit trail.\n",

package/dist/plugin.js

@@ -1,3 +1,3 @@
-import { g as definePlugin, h as defineConfig, k as makePrinter } from "./dist-CZDdATdS.js";
+import { g as definePlugin, h as defineConfig, k as makePrinter } from "./dist-DxwSa6Hg.js";
 
 export { defineConfig, definePlugin, makePrinter };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broject/bro",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "bro — agent's sidekick CLI: review-debt pipeline, PR triage, fix loops",
   "type": "module",
   "bin": {