@fullstackhouse/cerber 0.23.0 → 0.24.1

package/dist/server/index.js

@@ -15,7 +15,7 @@ import { DaemonConfigSchema, configPath, loadConfig, saveConfig } from "../core/
 import { refreshArtifact } from "../core/refresh.js";
 import { TrustRuleError, describeRule, explainRule, parseTrustRule } from "../core/trust.js";
 import { buildReviewPayload, computeCalibration } from "../core/send.js";
-import { listArtifacts, loadArtifact, loadArtifactByKey, reconcileRunning, saveArtifact, updateArtifactByKey, } from "../core/state.js";
+import { listArtifacts, loadArtifact, loadArtifactByKey, saveArtifact, updateArtifactByKey, } from "../core/state.js";
 import { isReviewRunning } from "../runner/inflight.js";
 import { reviewPr } from "../runner/review.js";
 import { runChatTurn } from "../runner/chat.js";
@@ -23,6 +23,20 @@ import { mergeConcurrentEdits, restoreReview } from "../core/revise.js";
 import { progressWriter } from "./progress.js";
 import { ChatTurnSchema } from "../core/artifact.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+ * The statuses `PATCH /api/reviews/:key` will set: the two that are the user's
+ * own decision about a PR. Everything else is a fact some other path owns.
+ */
+const SETTLEABLE = ["reviewed", "skipped"];
+/**
+ * Is an AI run rewriting this draft right now?
+ *
+ * Two questions, because neither alone is enough: `isReviewRunning` is an
+ * in-memory claim and cannot see a `cerber review` going in another terminal,
+ * while the persisted status cannot see a run this process started moments ago
+ * that has not written yet.
+ */
+const inFlight = (a) => a.status === "running" || isReviewRunning(a.id);
 export async function buildApp(opts) {
     const app = new Hono();
     if (opts.token) {
@@ -251,6 +265,7 @@ export async function buildApp(opts) {
                 trusted: false,
                 sessionId: null,
                 trigger: "user",
+                reviewedSha: null,
             },
             sent: null,
             refresh: null,
@@ -284,6 +299,14 @@ export async function buildApp(opts) {
     // ---- Mutations (all local — artifact edits only) ----
     app.patch("/api/reviews/:key", async (c) => {
         const body = await c.req.json();
+        // Only the two statuses that are the user's own decision. The schema
+        // permits all seven, and taking them all meant this endpoint would happily
+        // write `status: "sent"` with no `sent` record and nothing submitted —
+        // a row that claims a review reached GitHub, which no honest path produces.
+        // `running`/`ready`/`failed` belong to the runner, `sent` to the send path.
+        if (body.status !== undefined && !SETTLEABLE.includes(body.status)) {
+            return c.json({ error: `status must be one of ${SETTLEABLE.join(", ")} — got ${body.status}` }, 400);
+        }
         const updated = await updateArtifactByKey(c.req.param("key"), (a) => {
             const next = { ...a };
             if (body.status !== undefined) {
@@ -429,6 +452,7 @@ export async function buildApp(opts) {
                 trusted: false,
                 sessionId: null,
                 trigger: "user",
+                reviewedSha: null,
             },
         }));
         // Minutes-long: run it detached and let the cockpit poll the artifact.
@@ -589,6 +613,13 @@ export async function buildApp(opts) {
         if (artifact.sent) {
             return c.json({ error: `already sent at ${artifact.sent.at}` }, 409);
         }
+        // Not while a run is rewriting this draft. Vouching for a review that is
+        // being replaced under you is reason enough on its own; on top of that the
+        // run used to save `sent: null` back over the record when it landed, so the
+        // guard above would wave a *second* submission through afterwards.
+        if (inFlight(artifact)) {
+            return c.json({ error: "a review of this PR is running — wait for it to finish" }, 409);
+        }
         const payload = buildReviewPayload(artifact, event);
         try {
             const { url } = await submitReview({ owner: artifact.pr.owner, repo: artifact.pr.repo, number: artifact.pr.number }, { event: payload.event, body: payload.body, comments: payload.comments, commitId: payload.commitId });
@@ -628,11 +659,13 @@ export async function buildApp(opts) {
     }
     return app;
 }
+/**
+ * Serve the cockpit. `reconcileRunning` is deliberately *not* called here: the
+ * caller must have done it before starting the daemon, because the daemon polls
+ * as soon as it is constructed. Doing it here as well would have marked that
+ * poll's own fresh run as an interrupted leftover.
+ */
 export async function startServer(opts) {
-    const cleared = await reconcileRunning();
-    if (cleared > 0) {
-        console.log(`Cleared ${cleared} AI run(s) left in flight by a previous process — start them again from the cockpit.`);
-    }
     const app = await buildApp(opts);
     serve({ fetch: app.fetch, port: opts.port, hostname: opts.host }, (info) => {
         const tokenHint = opts.token ? `/?token=${opts.token}` : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fullstackhouse/cerber",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "description": "AI code-review cockpit: Claude reviews your PRs into local artifacts; nothing reaches GitHub until you say so.",
   "license": "MIT",
   "author": "Full Stack House (https://fullstack.house)",