@fullstackhouse/cerber 0.3.0 → 0.6.0

package/README.md

@@ -5,8 +5,8 @@ a summary, a chaptered walkthrough of the changes, draft inline comments, and a
 verdict with a confidence score. You go through it in a local web cockpit.
 
 **Nothing reaches GitHub until you explicitly say so.** Cerber's only GitHub
-writes happen when you hit Send (coming in a later phase) — reviewing is 100%
-local and read-only.
+write is the Send button (plus opt-in daemon auto-send you turn on yourself) —
+reviewing is 100% local and read-only.
 
 Named after Cerberus, the gatekeeper — and a sibling of
 [cezar](https://github.com/open-mercato/cezar): cezar runs coding agents,
@@ -48,20 +48,60 @@ Each review is a plain JSON artifact in `~/.cerber/reviews/` (override with
 The cockpit (`cerber serve`) renders the queue and the per-PR walkthrough with
 diffs. Artifacts are plain JSON you can `cat`, edit, or pipe into anything.
 
+### When the PR moves under you
+
+A review is written against one commit, but authors keep pushing. Opening a
+review checks the PR's head and pulls the review forward: comments follow their
+code to its new line numbers, and any whose code is gone are flagged and post
+in the review body instead of inline — GitHub rejects an entire review over one
+comment on a line that is no longer in the diff. Sends carry the reviewed
+commit's SHA, so inline comments land where they were written.
+
+The AI's summary and verdict still describe the commit that was reviewed. To
+get its opinion of the new code, hit **Re-review at the new head** in the
+cockpit (or `cerber review <pr> --force`) — comments you wrote or rewrote are
+carried into the fresh review.
+
 ## Status / roadmap
 
-Early. Current phase: review + read-only cockpit.
+Early, but all six planned phases have shipped.
 
 1. ✅ `cerber review <pr>` + artifact schema + cockpit (read-only)
 2. ✅ Comment editing in the cockpit (edit/approve/drop/add), verdict override,
-   gated **Send** (double-confirm; posts the review via your `gh` — the only
-   GitHub write in the codebase) + `cerber export` to markdown
+   gated **Send** (one deliberate click; posts the review via your `gh` — the
+   only GitHub write in the codebase) + `cerber export` to markdown
 3. ✅ `--awaiting-me` discovery, parallel runs (`--parallel`, default 3),
    freshness skip (same head SHA → no re-run; `--force` overrides), queue stats
-4. Daemon/VPS mode: poll for PRs awaiting your review, review them
-   automatically, cockpit always warm
-5. Confidence calibration → shadow-mode auto-send → opt-in auto-send above a
-   threshold
+4. ✅ Daemon/VPS mode: `cerber serve --daemon` polls for PRs awaiting your
+   review and reviews them automatically (read-only); token auth for
+   non-localhost binds
+5. ✅ Confidence calibration (`cerber stats`), shadow-mode auto-send (default
+   in daemon: logs what would be sent), opt-in `--auto-send` (approve-only,
+   `--auto-send-threshold`, default 90%)
+6. ✅ Reviews keep up with the PR: opening one re-anchors its comments onto new
+   commits, flags the ones whose code is gone, and offers a re-review that
+   keeps everything you wrote
+
+## Running on a VPS
+
+```bash
+cerber serve --daemon --host 0.0.0.0 --token "$(openssl rand -hex 16)" \
+  --repo you/repo-a --repo you/repo-b --interval 10
+```
+
+The daemon polls GitHub, reviews anything new (skipping PRs whose artifact
+already matches the head SHA), and the cockpit is always warm — open it any
+minute and see pending/ready/sent reviews. Auth: `?token=…` once in the
+browser (sets a cookie) or `Authorization: Bearer …`. Binding a non-localhost
+host without a token is refused. By default the daemon never sends reviews — Send stays a human click.
+
+**Auto-send** (opt-in): add `--auto-send --auto-send-threshold 90` and the
+daemon will submit APPROVE verdicts at/above the threshold as you. It never
+auto-sends COMMENT or REQUEST_CHANGES. Before enabling, run the default
+shadow mode for a while: every would-send decision lands in
+`~/.cerber/autosend.ndjson`, and `cerber stats` shows how often the AI's
+verdicts and comments survive your review — enable auto-send when its 90%
+actually means 90%.
 
 ## Development
 

package/dist/cli/index.js

@@ -4,15 +4,16 @@ import readline from "node:readline/promises";
 import { artifactId, artifactKey } from "../core/artifact.js";
 import { toMarkdown } from "../core/export.js";
 import { parsePrRef, searchAwaitingMe, submitReview } from "../core/gh.js";
-import { buildReviewPayload, eventForRecommendation } from "../core/send.js";
-import { cerberHome, listArtifacts, loadArtifact, updateArtifactByKey } from "../core/state.js";
+import { buildReviewPayload, computeCalibration, eventForRecommendation } from "../core/send.js";
+import { cerberHome, listArtifacts, loadArtifact, readAutoSendLog, updateArtifactByKey, } from "../core/state.js";
 import { pool, reviewPr } from "../runner/review.js";
+import { startDaemon } from "../server/daemon.js";
 import { startServer } from "../server/index.js";
 const program = new Command();
 program
     .name("cerber")
     .description("AI code-review cockpit. Claude reviews PRs into local artifacts; nothing reaches GitHub until you explicitly send it.")
-    .version("0.3.0");
+    .version("0.5.0");
 program
     .command("review")
     .description("Run an AI review of one or more PRs (local artifact only — no GitHub writes)")
@@ -150,22 +151,102 @@ program
         event: payload.event,
         body: payload.body,
         comments: payload.comments,
+        commitId: payload.commitId,
     });
     await updateArtifactByKey(artifactKey(id), (a) => ({
         ...a,
         status: "sent",
-        sent: { at: new Date().toISOString(), event, url },
+        sent: { at: new Date().toISOString(), event, url, auto: false },
+        calibration: computeCalibration(a, event),
     }));
     console.log(`✔ Review sent${url ? `: ${url}` : "."}`);
 });
+program
+    .command("stats")
+    .description("How well-calibrated the AI reviews are: verdict agreement and comment survival by confidence")
+    .action(async () => {
+    const artifacts = await listArtifacts();
+    const sent = artifacts.filter((a) => a.calibration);
+    if (sent.length === 0) {
+        console.log("No sent reviews with calibration data yet. Stats appear after you send reviews.");
+    }
+    else {
+        const buckets = [
+            ["  <60%", (c) => c < 60],
+            ["60-79%", (c) => c >= 60 && c < 80],
+            ["80-89%", (c) => c >= 80 && c < 90],
+            ["  90%+", (c) => c >= 90],
+        ];
+        console.log(`Calibration over ${sent.length} sent review(s):\n`);
+        console.log("confidence  n   verdict-agree  ai-comments kept/edited/dropped");
+        for (const [label, match] of buckets) {
+            const group = sent.filter((a) => a.calibration.aiConfidence != null && match(a.calibration.aiConfidence));
+            if (group.length === 0)
+                continue;
+            const agree = group.filter((a) => a.calibration.aiRecommendation &&
+                eventForRecommendation(a.calibration.aiRecommendation) === a.calibration.sentEvent).length;
+            const totals = group.reduce((acc, a) => {
+                const c = a.calibration;
+                acc.total += c.aiCommentsTotal;
+                acc.dropped += c.aiCommentsDropped;
+                acc.edited += c.aiCommentsEdited;
+                return acc;
+            }, { total: 0, dropped: 0, edited: 0 });
+            const kept = totals.total - totals.dropped;
+            console.log(`${label}      ${String(group.length).padEnd(3)} ${`${agree}/${group.length}`.padEnd(14)}` +
+                `${kept}/${totals.edited}/${totals.dropped} of ${totals.total}`);
+        }
+    }
+    const log = await readAutoSendLog();
+    if (log.length > 0) {
+        const wouldSend = log.filter((e) => e.decision.startsWith("would send")).length;
+        const autoSent = log.filter((e) => e.sent).length;
+        console.log(`\nAuto-send log (${cerberHome()}/autosend.ndjson): ${log.length} decision(s), ` +
+            `${wouldSend} shadow candidate(s), ${autoSent} auto-sent.`);
+    }
+});
 program
     .command("serve")
-    .description("Start the local review cockpit")
+    .description("Start the review cockpit; --daemon keeps the queue warm by polling GitHub")
     .option("-p, --port <port>", "port", "4820")
-    .option("-H, --host <host>", "host to bind", "127.0.0.1")
+    .option("-H, --host <host>", "host to bind (0.0.0.0 for VPS — requires --token)", "127.0.0.1")
+    .option("-t, --token <token>", "require this token on every request (env: CERBER_TOKEN)")
+    .option("-d, --daemon", "poll for PRs awaiting your review and auto-review them (read-only)")
+    .option("-i, --interval <minutes>", "daemon poll interval", "5")
+    .option("-R, --repo <owner/repo>", "repo(s) the daemon watches (repeatable; default: all)", collect, [])
+    .option("-P, --parallel <n>", "daemon review concurrency", "3")
+    .option("-m, --model <model>", "Claude model override for daemon reviews")
+    .option("--auto-send", "ACTUALLY auto-send APPROVE verdicts at/above --auto-send-threshold (default: shadow mode, which only logs what would be sent)")
+    .option("--auto-send-threshold <pct>", "confidence needed to auto-send", "90")
+    .option("--insecure", "allow binding a non-localhost host without a token (NOT recommended)")
     .action(async (opts) => {
-    await startServer({ port: Number(opts.port), host: opts.host });
+    const token = opts.token ?? process.env.CERBER_TOKEN;
+    const isLocal = ["127.0.0.1", "localhost", "::1"].includes(opts.host);
+    if (!isLocal && !token && !opts.insecure) {
+        console.error(`Refusing to bind ${opts.host} without auth: anyone reaching this port could send reviews as you.\n` +
+            `Pass --token <secret> (or CERBER_TOKEN), or --insecure if the network is trusted.`);
+        process.exit(1);
+    }
+    const threshold = Math.min(100, Math.max(50, Number(opts.autoSendThreshold) || 90));
+    if (opts.autoSend) {
+        console.log(`⚠ auto-send is ON: APPROVE verdicts with confidence ≥ ${threshold}% will be sent to GitHub as you, without a per-review confirmation.\n` +
+            `  Every decision is logged to ${cerberHome()}/autosend.ndjson. COMMENT/REQUEST_CHANGES always wait for a human.`);
+    }
+    const daemon = opts.daemon
+        ? startDaemon({
+            repos: opts.repo,
+            intervalMs: Math.max(1, Number(opts.interval) || 5) * 60_000,
+            parallel: Math.max(1, Number(opts.parallel) || 1),
+            model: opts.model,
+            autoSend: opts.autoSend ? "on" : "shadow",
+            autoSendThreshold: threshold,
+        })
+        : undefined;
+    await startServer({ port: Number(opts.port), host: opts.host, token, daemon });
 });
+function collect(value, previous) {
+    return [...previous, value];
+}
 program.parseAsync().catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);

package/dist/core/anchor.js

@@ -0,0 +1,73 @@
+import { newSideLineText } from "./diff.js";
+export function reanchorComments(comments, oldDiff, newDiff) {
+    const before = newSideLineText(oldDiff);
+    const after = newSideLineText(newDiff);
+    const results = [];
+    const next = comments.map((c) => {
+        const result = reanchorOne(c, before, after);
+        results.push(result);
+        switch (result.state) {
+            case "moved":
+                return {
+                    ...c,
+                    line: result.to,
+                    // Keep pointing at where the human wrote it, however far it travels.
+                    originalLine: c.originalLine ?? result.from,
+                    drifted: false,
+                };
+            case "drifted":
+                // Keep the stale line number: it is the only trace of what the comment
+                // was about, and the send path folds it into the body either way.
+                return { ...c, drifted: true };
+            default:
+                return c.drifted ? { ...c, drifted: false } : c;
+        }
+    });
+    return {
+        comments: next,
+        results,
+        moved: results.filter((r) => r.state === "moved").length,
+        drifted: results.filter((r) => r.state === "drifted").length,
+    };
+}
+function reanchorOne(comment, before, after) {
+    const { id, path, line } = comment;
+    if (line == null)
+        return { id, state: "unanchored", from: null, to: null };
+    const oldLines = before.get(path);
+    const newLines = after.get(path);
+    const oldText = oldLines?.get(line);
+    // No text to match on (the comment was already off-diff), or the file is not
+    // in the new diff at all — either way there is nothing to anchor to.
+    if (!oldLines || !newLines || oldText === undefined) {
+        return { id, state: "drifted", from: line, to: null };
+    }
+    if (newLines.get(line) === oldText) {
+        return { id, state: "unchanged", from: line, to: line };
+    }
+    const candidates = [...newLines].filter(([, text]) => text === oldText).map(([n]) => n);
+    if (candidates.length === 0)
+        return { id, state: "drifted", from: line, to: null };
+    if (candidates.length === 1)
+        return { id, state: "moved", from: line, to: candidates[0] };
+    // The line alone is ambiguous ("}", a blank line, a repeated call). Ask the
+    // neighbours: keep only candidates whose surrounding lines match too.
+    const withContext = candidates.filter((n) => contextMatches(oldLines, line, newLines, n));
+    if (withContext.length === 1)
+        return { id, state: "moved", from: line, to: withContext[0] };
+    return { id, state: "drifted", from: line, to: null };
+}
+const CONTEXT = 3;
+function contextMatches(oldLines, oldLine, newLines, newLine) {
+    for (let offset = -CONTEXT; offset <= CONTEXT; offset++) {
+        if (offset === 0)
+            continue;
+        const oldText = oldLines.get(oldLine + offset);
+        // Outside the old hunk there is nothing to compare — treat as neutral.
+        if (oldText === undefined)
+            continue;
+        if (newLines.get(newLine + offset) !== oldText)
+            return false;
+    }
+    return true;
+}

package/dist/core/artifact.js

@@ -10,6 +10,12 @@ export const CommentSchema = z.object({
     chapterId: z.string().nullable().default(null),
     origin: z.enum(["ai", "user"]),
     status: z.enum(["draft", "approved", "dropped"]).default("draft"),
+    /** Set when the user edits an AI comment's body — calibration signal. */
+    editedByUser: z.boolean().default(false),
+    /** Line this comment was written against, when a refresh has since moved it. */
+    originalLine: z.number().int().positive().nullable().default(null),
+    /** The commented line no longer exists in the diff — it can't post inline. */
+    drifted: z.boolean().default(false),
 });
 /** A logical group of changes — the unit of the review walkthrough. */
 export const ChapterSchema = z.object({
@@ -35,6 +41,8 @@ export const PrInfoSchema = z.object({
     baseRefName: z.string(),
     headRefName: z.string(),
     headSha: z.string().default(""),
+    /** OPEN | CLOSED | MERGED, as of the last fetch. */
+    state: z.enum(["OPEN", "CLOSED", "MERGED"]).default("OPEN"),
     additions: z.number().int().default(0),
     deletions: z.number().int().default(0),
     changedFiles: z.number().int().default(0),
@@ -59,6 +67,28 @@ export const SentInfoSchema = z.object({
     at: z.string(),
     event: z.enum(["APPROVE", "COMMENT", "REQUEST_CHANGES"]),
     url: z.string().nullable().default(null),
+    /** True when the daemon auto-sent this review (opt-in --auto-send). */
+    auto: z.boolean().default(false),
+});
+/** Result of pulling a review forward onto a newer head commit. */
+export const RefreshInfoSchema = z.object({
+    at: z.string(),
+    fromSha: z.string(),
+    toSha: z.string(),
+    /** Comments whose line number changed but whose code was found again. */
+    moved: z.number().int().default(0),
+    /** Comments whose line is gone from the new diff — they now post in the body. */
+    drifted: z.number().int().default(0),
+});
+/** What actually happened vs what the AI proposed — recorded at send time. */
+export const CalibrationSchema = z.object({
+    aiRecommendation: z.enum(["approve", "comment", "request_changes"]).nullable(),
+    aiConfidence: z.number().nullable(),
+    sentEvent: z.enum(["APPROVE", "COMMENT", "REQUEST_CHANGES"]),
+    aiCommentsTotal: z.number().int(),
+    aiCommentsDropped: z.number().int(),
+    aiCommentsEdited: z.number().int(),
+    userCommentsAdded: z.number().int(),
 });
 export const ArtifactSchema = z.object({
     schemaVersion: z.literal(SCHEMA_VERSION),
@@ -76,8 +106,11 @@ export const ArtifactSchema = z.object({
     comments: z.array(CommentSchema).default([]),
     verdict: VerdictSchema.nullable().default(null),
     run: RunInfoSchema.nullable().default(null),
-    /** Set once the user explicitly sent the review to GitHub. */
+    /** Set once the review was sent to GitHub (explicitly, or via opt-in auto-send). */
     sent: SentInfoSchema.nullable().default(null),
+    /** Last time this review was pulled forward onto a newer head commit. */
+    refresh: RefreshInfoSchema.nullable().default(null),
+    calibration: CalibrationSchema.nullable().default(null),
 });
 /** What the AI must return. Subset of the artifact; cerber owns the rest. */
 export const AiReviewSchema = z.object({

package/dist/core/autosend.js

@@ -0,0 +1,26 @@
+/**
+ * Auto-send policy — deliberately narrow:
+ * only APPROVE verdicts, at or above the confidence threshold, never a
+ * re-send. COMMENT and REQUEST_CHANGES always wait for a human.
+ */
+export function evaluateAutoSend(artifact, threshold) {
+    if (artifact.sent)
+        return { eligible: false, reason: "already sent" };
+    if (artifact.status !== "ready")
+        return { eligible: false, reason: `status is ${artifact.status}` };
+    if (!artifact.verdict)
+        return { eligible: false, reason: "no verdict" };
+    if (artifact.verdict.recommendation !== "approve") {
+        return {
+            eligible: false,
+            reason: `recommendation is ${artifact.verdict.recommendation} — only approve auto-sends`,
+        };
+    }
+    if (artifact.verdict.confidence < threshold) {
+        return {
+            eligible: false,
+            reason: `confidence ${artifact.verdict.confidence}% < threshold ${threshold}%`,
+        };
+    }
+    return { eligible: true, reason: `approve at ${artifact.verdict.confidence}% ≥ ${threshold}%` };
+}

package/dist/core/diff.js

@@ -43,13 +43,13 @@ export function patchForFiles(diff, files) {
         .join("\n");
 }
 /**
- * Line numbers (new side of the diff) that a GitHub review comment can attach
- * to, per file: added and context lines inside hunks.
+ * New-side lines of the diff with their text, per file: added and context
+ * lines inside hunks — exactly the lines a GitHub comment can attach to.
  */
-export function newSideLines(diff) {
+export function newSideLineText(diff) {
     const result = new Map();
     for (const { path, patch } of splitDiffByFile(diff)) {
-        const lines = new Set();
+        const lines = new Map();
         let newLine = 0;
         let inHunk = false;
         const patchLines = patch.split("\n");
@@ -68,7 +68,7 @@ export function newSideLines(diff) {
             if (line.startsWith("\\"))
                 continue; // ""
             if (line.startsWith("+") || line.startsWith(" ") || line === "") {
-                lines.add(newLine);
+                lines.set(newLine, line === "" ? "" : line.slice(1));
                 newLine++;
             }
             // "-" lines belong to the old side only.
@@ -77,6 +77,17 @@ export function newSideLines(diff) {
     }
     return result;
 }
+/**
+ * Line numbers (new side of the diff) that a GitHub review comment can attach
+ * to, per file: added and context lines inside hunks.
+ */
+export function newSideLines(diff) {
+    const result = new Map();
+    for (const [path, lines] of newSideLineText(diff)) {
+        result.set(path, new Set(lines.keys()));
+    }
+    return result;
+}
 /** Paths present in the diff but not claimed by any chapter. */
 export function unclaimedFiles(diff, chapters) {
     const claimed = new Set(chapters.flatMap((c) => c.files));

package/dist/core/gh.js

@@ -45,7 +45,7 @@ export async function fetchPrInfo(ref) {
         "--repo",
         `${ref.owner}/${ref.repo}`,
         "--json",
-        "title,url,author,body,baseRefName,headRefName,headRefOid,additions,deletions,changedFiles",
+        "title,url,author,body,baseRefName,headRefName,headRefOid,additions,deletions,changedFiles,state",
     ]);
     const raw = JSON.parse(out);
     return PrInfoSchema.parse({
@@ -59,6 +59,7 @@ export async function fetchPrInfo(ref) {
         baseRefName: raw.baseRefName,
         headRefName: raw.headRefName,
         headSha: raw.headRefOid ?? "",
+        state: raw.state ?? "OPEN",
         additions: raw.additions ?? 0,
         deletions: raw.deletions ?? 0,
         changedFiles: raw.changedFiles ?? 0,
@@ -119,15 +120,19 @@ export async function submitReview(ref, payload) {
         "--input",
         "-",
     ];
+    const { commitId, ...rest } = payload;
+    const body = commitId ? { ...rest, commit_id: commitId } : rest;
     const { execFile: ef } = await import("node:child_process");
     const out = await new Promise((resolve, reject) => {
         const child = ef("gh", args, { maxBuffer: MAX_BUFFER }, (err, stdout, stderr) => {
+            // gh only prints the top-level "message" ("Unprocessable Entity"); the useful
+            // part is the errors[] array it leaves in the response body on stdout.
             if (err)
-                reject(new Error(`gh api reviews failed: ${stderr?.trim() || err.message}`));
+                reject(new Error(`gh api reviews failed: ${ghErrorDetail(stderr, stdout) || err.message}`));
             else
                 resolve(stdout);
         });
-        child.stdin.write(JSON.stringify(payload));
+        child.stdin.write(JSON.stringify(body));
         child.stdin.end();
     });
     try {
@@ -138,3 +143,24 @@ export async function submitReview(ref, payload) {
         return { url: null };
     }
 }
+/** Combine gh's stderr with the details GitHub returns in the response body. */
+export function ghErrorDetail(stderr, stdout) {
+    const head = stderr?.trim() ?? "";
+    let details = [];
+    try {
+        const res = JSON.parse(stdout ?? "");
+        details = (Array.isArray(res.errors) ? res.errors : [])
+            .map((e) => (typeof e === "string" ? e : describeGhError(e)))
+            .filter((s) => s.length > 0 && !head.includes(s));
+    }
+    catch {
+        // Non-JSON body (rate-limit HTML, empty response) — stderr is all we have.
+    }
+    return [head, ...details].filter(Boolean).join(" — ");
+}
+function describeGhError(e) {
+    if (typeof e.message === "string")
+        return e.message;
+    const where = [e.resource, e.field].filter((v) => typeof v === "string").join(".");
+    return [where, e.code].filter(Boolean).join(": ");
+}

package/dist/core/refresh.js

@@ -0,0 +1,54 @@
+import { reanchorComments } from "./anchor.js";
+/**
+ * Pull a review forward onto the PR's current head: swap in the new diff and
+ * carry every comment across, re-anchored to the code it was written about.
+ *
+ * The AI's summary, chapters and verdict still describe the commit that was
+ * reviewed — this only keeps the comments postable. Re-reviewing is the
+ * (expensive) way to get the AI's opinion of the new code.
+ */
+export function refreshArtifact(artifact, pr, diff) {
+    if (artifact.pr.headSha !== "" && artifact.pr.headSha === pr.headSha) {
+        return { artifact, changed: false, moved: 0, drifted: 0, results: [] };
+    }
+    const { comments, results, moved, drifted } = reanchorComments(artifact.comments, artifact.diff, diff);
+    return {
+        artifact: {
+            ...artifact,
+            pr,
+            diff,
+            comments,
+            updatedAt: new Date().toISOString(),
+            refresh: {
+                at: new Date().toISOString(),
+                fromSha: artifact.pr.headSha,
+                toSha: pr.headSha,
+                moved,
+                drifted,
+            },
+        },
+        changed: true,
+        moved,
+        drifted,
+        results,
+    };
+}
+/**
+ * Comments a human put work into: their own, and AI ones they rewrote.
+ * A re-review regenerates everything the AI said, but must not silently bin
+ * these — see carryOverComments.
+ */
+export function humanComments(artifact) {
+    return artifact.comments.filter((c) => c.origin === "user" || c.editedByUser);
+}
+/**
+ * Carry a previous review's human comments into a fresh one, re-anchored to
+ * the new diff. AI comments are dropped: the new run just regenerated them.
+ */
+export function carryOverComments(previous, fresh) {
+    const human = humanComments(previous);
+    if (human.length === 0)
+        return { comments: fresh.comments, carried: 0, drifted: 0 };
+    const { comments, drifted } = reanchorComments(human, previous.diff, fresh.diff);
+    return { comments: [...fresh.comments, ...comments], carried: comments.length, drifted };
+}

package/dist/core/send.js

@@ -13,7 +13,10 @@ export function buildReviewPayload(artifact, event) {
     const inline = [];
     const folded = [];
     for (const c of active) {
-        if (c.line != null && anchorable.get(c.path)?.has(c.line)) {
+        // A drifted comment's line number may still exist in the diff, but it now
+        // holds different code — posting there would point the author at something
+        // the comment was never about.
+        if (!c.drifted && c.line != null && anchorable.get(c.path)?.has(c.line)) {
             inline.push({ path: c.path, line: c.line, side: "RIGHT", body: c.body });
         }
         else {
@@ -33,9 +36,31 @@ export function buildReviewPayload(artifact, event) {
     if (folded.length > 0) {
         parts.push("", "## Additional notes", "");
         for (const c of folded) {
-            parts.push(`- \`${c.path}${c.line != null ? `:${c.line}` : ""}\` — ${c.body}`);
+            // A drifted comment's line no longer exists, so name it as "was at" —
+            // pointing a reader at a line number that moved is worse than no number.
+            const at = c.line != null ? `:${c.drifted ? `~${c.line}` : c.line}` : "";
+            parts.push(`- \`${c.path}${at}\` — ${c.body}`);
         }
     }
     parts.push("", "---", "_Reviewed with [cerber](https://github.com/fullstackhouse/cerber) 🐕 — drafted by AI, sent by a human._");
-    return { event, body: parts.join("\n").trim(), comments: inline, folded };
+    return {
+        event,
+        body: parts.join("\n").trim(),
+        comments: inline,
+        folded,
+        commitId: artifact.pr.headSha || undefined,
+    };
+}
+/** Snapshot of AI-proposal vs human-final, recorded at send time for `cerber stats`. */
+export function computeCalibration(artifact, event) {
+    const ai = artifact.comments.filter((c) => c.origin === "ai");
+    return {
+        aiRecommendation: artifact.verdict?.recommendation ?? null,
+        aiConfidence: artifact.verdict?.confidence ?? null,
+        sentEvent: event,
+        aiCommentsTotal: ai.length,
+        aiCommentsDropped: ai.filter((c) => c.status === "dropped").length,
+        aiCommentsEdited: ai.filter((c) => c.editedByUser).length,
+        userCommentsAdded: artifact.comments.filter((c) => c.origin === "user").length,
+    };
 }

package/dist/core/state.js

@@ -41,6 +41,32 @@ export async function loadArtifactByKey(key) {
         throw err;
     }
 }
+/** Append to ~/.cerber/autosend.ndjson — the shadow/auto-send audit log. */
+export async function appendAutoSendLog(entry) {
+    await fs.mkdir(cerberHome(), { recursive: true });
+    await fs.appendFile(path.join(cerberHome(), "autosend.ndjson"), JSON.stringify(entry) + "\n");
+}
+export async function readAutoSendLog() {
+    try {
+        const raw = await fs.readFile(path.join(cerberHome(), "autosend.ndjson"), "utf8");
+        return raw
+            .split("\n")
+            .filter(Boolean)
+            .flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+}
 /** Load by key, apply a mutation, bump updatedAt, save. Returns the new artifact. */
 export async function updateArtifactByKey(key, mutate) {
     const artifact = await loadArtifactByKey(key);
@@ -50,6 +76,31 @@ export async function updateArtifactByKey(key, mutate) {
     await saveArtifact(updated);
     return updated;
 }
+/**
+ * Clear "running" statuses left behind by a process that died mid-review.
+ * Nothing in a freshly started process is running, so anything still marked
+ * running is a leftover — without this it stays wedged forever, with no way to
+ * retry it from the cockpit. A `cerber review` running in another terminal is
+ * the one false positive; it overwrites the artifact when it finishes anyway.
+ */
+export async function reconcileRunning() {
+    const artifacts = await listArtifacts();
+    let cleared = 0;
+    for (const artifact of artifacts) {
+        if (artifact.status !== "running")
+            continue;
+        await saveArtifact({
+            ...artifact,
+            status: "failed",
+            updatedAt: new Date().toISOString(),
+            run: artifact.run
+                ? { ...artifact.run, error: "interrupted — cerber restarted while this review was running" }
+                : null,
+        });
+        cleared++;
+    }
+    return cleared;
+}
 export async function listArtifacts() {
     let entries;
     try {