@fullstackhouse/cerber 0.36.1 → 0.37.0

package/dist/core/artifact.js

@@ -445,6 +445,12 @@ export const ArtifactSchema = z.object({
     })
         .nullable()
         .optional(),
+    /**
+     * Files the user marked as viewed: path → `fileFingerprint` of the file's
+     * patch at the time. A mark whose fingerprint no longer matches the diff is
+     * a file that changed since, and reads as not viewed. Absent: none yet.
+     */
+    viewed: z.record(z.string(), z.string()).optional(),
     /** Last time this review was pulled forward onto a newer head commit. */
     refresh: RefreshInfoSchema.nullable().default(null),
     /** The last check for findings somebody else already raised. Null: never checked. */

package/dist/core/diff.js

@@ -114,3 +114,27 @@ export function unclaimedFiles(diff, chapters) {
 export function diffLineCounts(diff) {
     return new Map(splitDiffByFile(diff).map((p) => [p.path, p.patch.split("\n").length]));
 }
+/**
+ * What a file's change says, reduced to a short hash — the thing a "viewed"
+ * mark remembers, so a new push that changes the file unticks it.
+ *
+ * Only the changed and context lines count: a rebase that moves the hunk
+ * headers or the blob ids changes nothing you read. A patch with no such lines
+ * (a binary, a pure rename) falls back to the whole patch, whose `index` line
+ * is then the only thing that tells two versions apart.
+ */
+export function fileFingerprint(patch) {
+    const lines = patch.split("\n");
+    // `---`/`+++` are file headers only before the first hunk; inside one they
+    // are a removed `-- comment` or an added `++ line`, and those are changes.
+    const firstHunk = lines.findIndex((l) => l.startsWith("@@"));
+    const content = firstHunk < 0 ? [] : lines.slice(firstHunk).filter((l) => /^[+\- ]/.test(l));
+    const text = (content.length > 0 ? content : lines).join("\n");
+    // FNV-1a, 32-bit.
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0");
+}

package/dist/core/refresh.js

@@ -80,6 +80,9 @@ export function mergeRunResult(fresh, current) {
         notified: current.notified,
         calibration: current.calibration,
         filed: current.filed,
+        // Reading progress is the user's; a mark on a file the run saw change
+        // unticks itself through its fingerprint.
+        viewed: current.viewed,
         // A decision of the user's, like the status above it: a handoff that landed
         // while the run worked has already moved the request on GitHub, and a run
         // that wrote `null` over it would leave the row reading "skipped" with

package/dist/core/revise.js

@@ -72,6 +72,8 @@ export function mergeConcurrentEdits(before, after, current) {
         // Nor does a turn announce anything: the ledger is the poll's, and a turn
         // takes minutes, which is long enough for a poll to have stamped it.
         notified: current.notified,
+        // Ticked while the turn ran, and never the turn's to touch.
+        viewed: current.viewed,
         // Nor does it compare the draft with what others said; that check folds
         // onto the disk on its own.
         raisedCheck: current.raisedCheck,

package/dist/runner/review.js

@@ -167,6 +167,9 @@ async function performReview(ref, pr, existing, opts, log) {
         // `existing` was loaded minutes ago, and a poll may have announced the row
         // since.
         notified: existing?.notified,
+        // Reading progress is the user's, like the chat. A file this run finds
+        // changed unticks itself through its fingerprint.
+        viewed: existing?.viewed,
         pr,
         diff,
         summary: "",
@@ -220,7 +223,9 @@ async function performReview(ref, pr, existing, opts, log) {
     // how the reopen happens at all. A settle that appeared since is the one this
     // must not touch.
     const decided = existing ? userOwnsStatus(existing) : false;
-    const claimed = await updateArtifactByKey(artifactKey(artifact.id), (current) => !decided && userOwnsStatus(current) ? current : { ...artifact, notified: current.notified });
+    const claimed = await updateArtifactByKey(artifactKey(artifact.id), (current) => !decided && userOwnsStatus(current)
+        ? current
+        : { ...artifact, notified: current.notified, viewed: current.viewed });
     const held = claimed !== null && !decided && userOwnsStatus(claimed);
     if (!held) {
         if (claimed)

package/dist/server/index.js

@@ -355,7 +355,9 @@ export async function buildApp(opts) {
         // decision, and claiming the row for a run would erase it — the detached
         // run below folds its draft under whatever the row says instead
         // (`mergeRunResult`), which is the same line every other writer holds.
-        const claimed = await updateArtifactByKey(artifactKey(artifact.id), (current) => userOwnsStatus(current) ? current : { ...artifact, notified: current.notified });
+        const claimed = await updateArtifactByKey(artifactKey(artifact.id), (current) => userOwnsStatus(current)
+            ? current
+            : { ...artifact, notified: current.notified, viewed: current.viewed });
         // Declining the claim is only half the job: the run below forces, and a
         // forced run reopens a settled row on purpose. So the decision ends the
         // request — hand it back and start nothing.
@@ -520,6 +522,27 @@ export async function buildApp(opts) {
             return c.json({ error: "not found" }, 404);
         return c.json(updated);
     });
+    // Reading progress, not a review edit — so a sent review takes it too.
+    app.put("/api/reviews/:key/viewed", async (c) => {
+        const body = await c.req.json().catch(() => null);
+        if (typeof body?.path !== "string" || !body.path) {
+            return c.json({ error: "path must be a non-empty string" }, 400);
+        }
+        if (body.fingerprint !== null && typeof body.fingerprint !== "string") {
+            return c.json({ error: "fingerprint must be a string, or null to unmark" }, 400);
+        }
+        const updated = await updateArtifactByKey(c.req.param("key"), (a) => {
+            const viewed = { ...a.viewed };
+            if (body.fingerprint === null)
+                delete viewed[body.path];
+            else
+                viewed[body.path] = body.fingerprint;
+            return { ...a, viewed };
+        });
+        if (!updated)
+            return c.json({ error: "not found" }, 404);
+        return c.json(updated);
+    });
     // ---- Freshness: pull a review forward onto the PR's current head ----
     // Read-only against GitHub (pr view + pr diff); writes only the local artifact.
     app.post("/api/reviews/:key/refresh", async (c) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fullstackhouse/cerber",
-  "version": "0.36.1",
+  "version": "0.37.0",
   "description": "AI code-review cockpit: Claude reviews your PRs into local artifacts; nothing reaches GitHub until you say so.",
   "license": "MIT",
   "keywords": [