@fullstackhouse/cerber 0.31.0 → 0.32.0

package/README.md

@@ -23,6 +23,16 @@ That gate is the whole point, and the reason this is not another review bot:
 
 Named after Cerberus, the gatekeeper: cerber guards what gets merged.
 
+**The whole loop in seventeen seconds** — five PRs already drafted when you sit
+down, the one that isn't an approval, straight to its blocker, arguing with the
+reviewer until it rewrites its own finding, dropping the comment you disagree
+with, and sending what's left as your review:
+
+![The cockpit: an inbox of five drafted reviews; opening the one with a blocker; jumping to the finding through the walkthrough rail; asking the reviewer whether the bug is real and watching it revise its own comment; dropping a second comment; then sending the review to GitHub.](docs/demo.gif)
+
+Same recording in full colour, if the GIF's palette is fighting the code:
+[`docs/demo.mp4`](docs/demo.mp4).
+
 **A drafted review, as you read it** — verdict and confidence beside the PR
 title, the walkthrough rail on the left, a summary written for someone who has
 not read the diff:

package/dist/cli/index.js

@@ -29,8 +29,8 @@ const { version } = createRequire(import.meta.url)("../../package.json");
  * poll. `allowDegraded` is for `serve --no-poll`, which is still useful for
  * reading artifacts already on disk.
  */
-async function requireTools(allowDegraded = false) {
-    const checks = await preflight();
+async function requireTools(allowDegraded = false, opts = {}) {
+    const checks = await preflight(opts);
     if (!checks.some(isBlocking))
         return;
     const message = formatBlockers(checks);
@@ -58,7 +58,8 @@ program
     .option("-t, --trust", "let the review run commands in the checkout (tests, typecheck, git log) whatever the trust config says")
     .option("--no-trust", "keep the review read-only even if a trust rule matches")
     .action(async (prs, opts) => {
-    await requireTools();
+    // `--no-source` never clones the PR head, so a missing `git` is not its problem.
+    await requireTools(false, { git: opts.source });
     let refs;
     if (opts.awaitingMe) {
         const found = await searchAwaitingMe(opts.repo);
@@ -384,6 +385,8 @@ program
     for (const c of checks) {
         if (c.status === "ok") {
             console.log(`  ✔ ${c.name.padEnd(22)} ${c.detail ?? ""}`.trimEnd());
+            if (c.note)
+                console.log(`    ${c.note}`);
         }
         else {
             console.log(`  ✗ ${c.name.padEnd(22)} ${c.status === "missing" ? "not installed" : "not logged in"}`);
@@ -431,7 +434,7 @@ program
     }
     // Without `gh` the cockpit binds, polls into an error loop and shows an
     // empty queue; `--no-poll` is the one shape that still works offline.
-    await requireTools(!opts.poll);
+    await requireTools(!opts.poll, { git: opts.source });
     const threshold = Math.min(100, Math.max(50, Number(opts.autoSendThreshold) || 90));
     if (opts.autoSend) {
         console.log(`⚠ auto-send is ON: APPROVE verdicts with confidence ≥ ${threshold}% will be sent to GitHub as you, without a per-review confirmation.\n` +

package/dist/core/preflight.js

@@ -54,7 +54,17 @@ export async function checkClaude() {
             fix: "Run `claude` once and log in — a review is drafted through your Claude Code session.",
         };
     }
-    return { name: "claude (Claude Code)", status: "ok", detail: version.out.split("\n")[0] };
+    // `claude --version` answers whether or not anyone is logged in, and the only
+    // honest way to test the session is to spend a turn on it — too expensive for
+    // something that runs before every review. So the check says what it knows
+    // and names where the real answer shows up, rather than implying it verified
+    // a login it never looked at.
+    return {
+        name: "claude (Claude Code)",
+        status: "ok",
+        detail: version.out.split("\n")[0],
+        note: "installed; login not checked — a logged-out CLI fails on the first review, with claude's own message",
+    };
 }
 export async function checkGit() {
     const version = await run("git", ["--version"]);
@@ -67,9 +77,16 @@ export async function checkGit() {
     }
     return { name: "git", status: "ok", detail: version.out.split("\n")[0] };
 }
-/** Everything cerber shells out to, checked in parallel. */
-export async function preflight() {
-    return Promise.all([checkGh(), checkClaude(), checkGit()]);
+/**
+ * Everything cerber shells out to for this command, checked in parallel.
+ *
+ * `git` is only reached when a run clones the PR head, so `--no-source` must
+ * not be blocked by its absence: that mode reviews the diff alone and never
+ * touches a checkout.
+ */
+export async function preflight(opts = {}) {
+    const needsGit = opts.git ?? true;
+    return Promise.all([checkGh(), checkClaude(), ...(needsGit ? [checkGit()] : [])]);
 }
 /** The blocking checks, formatted as the message printed instead of failing later. */
 export function formatBlockers(checks) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fullstackhouse/cerber",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "AI code-review cockpit: Claude reviews your PRs into local artifacts; nothing reaches GitHub until you say so.",
   "license": "MIT",
   "keywords": [