@fullstackhouse/cerber 0.8.0 → 0.9.1

package/README.md

@@ -28,10 +28,19 @@ npx @fullstackhouse/cerber review 123 124 --repo owner/repo
 # See what's in the queue
 npx @fullstackhouse/cerber list
 
-# Open the cockpit
+# Open the cockpit — it's an inbox: it polls GitHub for PRs awaiting your
+# review and drafts a review for each, so they're ready when you arrive
 npx @fullstackhouse/cerber serve        # → http://127.0.0.1:4820
 ```
 
+`serve` does the whole loop by default: discover → draft → wait for you.
+Sending stays a human click. Tame it with `--no-auto-review` (list awaiting
+PRs, review on click) or `--no-poll` (no GitHub polling at all) — or flip the
+same two switches in the cockpit's Settings, which persist in
+`~/.cerber/config.json` and apply on the next poll. Merged and closed PRs are
+archived out of the queue automatically, and PRs in archived repos are never
+picked up at all — the repo is read-only, so a review could never be sent.
+
 ## What a review looks like
 
 Each review is a plain JSON artifact in `~/.cerber/reviews/` (override with
@@ -75,7 +84,7 @@ If you want the old behaviour — faster, lighter, blind past the changed lines:
 
 ```bash
 cerber review owner/repo#123 --no-source
-cerber serve --daemon --no-source
+cerber serve --no-source
 ```
 
 The cockpit labels every review "read the full source" or "read the diff only",
@@ -171,9 +180,10 @@ the default is a review that cannot run anything at all.
 machine — the branch's scripts, its dependencies, its test suite. That is the
 same exposure as checking the branch out and running the tests yourself, which
 is what you would otherwise do; it is not the same as reading a diff. Trust
-orgs and people, not the whole of GitHub. And note the daemon reviews
-unattended: with trust rules set, `cerber serve --daemon` will run matching PRs'
-code with nobody watching. It warns at startup, and `--no-trust` turns it off.
+orgs and people, not the whole of GitHub. And note that `cerber serve` reviews
+unattended by default: with trust rules set, it will run matching PRs' code
+with nobody watching. It warns at startup, the cockpit shows a ⚡ badge while
+it's the case, and `--no-trust` (or `--no-auto-review`) turns it off.
 
 ### When the PR moves under you
 
@@ -199,9 +209,8 @@ Early, but all six planned phases have shipped.
    only GitHub write in the codebase) + `cerber export` to markdown
 3. ✅ `--awaiting-me` discovery, parallel runs (`--parallel`, default 3),
    freshness skip (same head SHA → no re-run; `--force` overrides), queue stats
-4. ✅ Daemon/VPS mode: `cerber serve --daemon` polls for PRs awaiting your
-   review and reviews them automatically (read-only); token auth for
-   non-localhost binds
+4. ✅ Inbox mode (now the default): `cerber serve` polls for PRs awaiting your
+   review and reviews them automatically; token auth for non-localhost binds
 5. ✅ Confidence calibration (`cerber stats`), shadow-mode auto-send (default
    in daemon: logs what would be sent), opt-in `--auto-send` (approve-only,
    `--auto-send-threshold`, default 90%)
@@ -212,11 +221,11 @@ Early, but all six planned phases have shipped.
 ## Running on a VPS
 
 ```bash
-cerber serve --daemon --host 0.0.0.0 --token "$(openssl rand -hex 16)" \
+cerber serve --host 0.0.0.0 --token "$(openssl rand -hex 16)" \
   --repo you/repo-a --repo you/repo-b --interval 10
 ```
 
-The daemon polls GitHub, reviews anything new (skipping PRs whose artifact
+The server polls GitHub, reviews anything new (skipping PRs whose artifact
 already matches the head SHA), and the cockpit is always warm — open it any
 minute and see pending/ready/sent reviews. Auth: `?token=…` once in the
 browser (sets a cookie) or `Authorization: Bearer …`. Binding a non-localhost

package/dist/cli/index.js

@@ -305,16 +305,19 @@ program
     }
 });
 program
-    .command("serve")
-    .description("Start the review cockpit; --daemon keeps the queue warm by polling GitHub")
+    .command("serve", { isDefault: true })
+    .description("Start the review cockpit — an inbox: it polls GitHub for PRs awaiting your review and drafts " +
+    "a review for each, so they're ready when you open it. --no-poll / --no-auto-review to tame it.")
     .option("-p, --port <port>", "port", "4820")
     .option("-H, --host <host>", "host to bind (0.0.0.0 for VPS — requires --token)", "127.0.0.1")
     .option("-t, --token <token>", "require this token on every request (env: CERBER_TOKEN)")
-    .option("-d, --daemon", "poll for PRs awaiting your review and auto-review them (read-only)")
-    .option("-i, --interval <minutes>", "daemon poll interval", "5")
-    .option("-R, --repo <owner/repo>", "repo(s) the daemon watches (repeatable; default: all)", collect, [])
-    .option("-P, --parallel <n>", "daemon review concurrency", "3")
-    .option("-m, --model <model>", "Claude model override for daemon reviews")
+    .option("--no-poll", "don't poll GitHub for PRs awaiting your review (also disables auto-review)")
+    .option("--no-auto-review", "list awaiting PRs but don't review them until you click review")
+    .option("-d, --daemon", "(deprecated no-op — polling and auto-review are now the default)")
+    .option("-i, --interval <minutes>", "poll interval (default: config daemon.intervalMinutes, 5)")
+    .option("-R, --repo <owner/repo>", "repo(s) to watch (repeatable; default: config daemon.repos, all)", collect, [])
+    .option("-P, --parallel <n>", "review concurrency (default: config daemon.parallel, 3)")
+    .option("-m, --model <model>", "Claude model override for unattended reviews")
     .option("--no-source", "review the diff alone, with no local checkout of the PR head (applies to daemon runs and cockpit re-reviews)")
     .option("--no-trust", "ignore the configured trust rules: every review here stays read-only, even for repos you trust")
     .option("--auto-send", "ACTUALLY auto-send APPROVE verdicts at/above --auto-send-threshold (default: shadow mode, which only logs what would be sent)")
@@ -333,27 +336,38 @@ program
         console.log(`⚠ auto-send is ON: APPROVE verdicts with confidence ≥ ${threshold}% will be sent to GitHub as you, without a per-review confirmation.\n` +
             `  Every decision is logged to ${cerberHome()}/autosend.ndjson. COMMENT/REQUEST_CHANGES always wait for a human.`);
     }
+    if (opts.daemon) {
+        console.log("Note: --daemon is deprecated — polling and auto-review are on by default now.");
+    }
+    // Config holds the defaults and is re-read by the daemon on every poll
+    // (so the cockpit's Settings toggles apply live); a --no-* flag caps
+    // this run only, and --no-poll skips the loop entirely.
+    const config = await loadConfig();
+    const d = config.daemon;
     // Trust means "run this PR's code". A human clicking review accepted that
-    // per PR; a daemon does it unattended, on whatever lands in the queue.
-    if (opts.daemon && opts.trust) {
-        const rules = (await loadConfig()).trust;
-        if (rules.length > 0) {
-            console.log(`⚠ ${rules.length} trust rule(s) in ${configPath()}: this daemon will run commands from matching PRs ` +
-                `automatically, with nobody watching. Pass --no-trust to keep every review read-only.`);
-        }
+    // per PR; auto-review does it unattended, on whatever lands in the queue.
+    if (opts.poll && d.poll && opts.autoReview && d.autoReview && opts.trust && config.trust.length > 0) {
+        console.log(`⚠ ${config.trust.length} trust rule(s) in ${configPath()}: unattended reviews will run commands from ` +
+            `matching PRs, with nobody watching. Pass --no-trust to keep every review read-only, ` +
+            `or --no-auto-review to only review on click.`);
     }
-    const daemon = opts.daemon
+    const daemon = opts.poll
         ? startDaemon({
-            repos: opts.repo,
-            intervalMs: Math.max(1, Number(opts.interval) || 5) * 60_000,
-            parallel: Math.max(1, Number(opts.parallel) || 1),
+            repos: opts.repo.length > 0 ? opts.repo : d.repos,
+            intervalMs: Math.max(1, opts.interval !== undefined ? Number(opts.interval) || d.intervalMinutes : d.intervalMinutes) *
+                60_000,
+            parallel: Math.max(1, opts.parallel !== undefined ? Number(opts.parallel) || d.parallel : d.parallel),
             model: opts.model,
             withSource: opts.source,
             trust: opts.trust ? undefined : false,
+            autoReview: opts.autoReview,
             autoSend: opts.autoSend ? "on" : "shadow",
             autoSendThreshold: threshold,
         })
         : undefined;
+    if (!opts.poll) {
+        console.log("Polling is off (--no-poll) — the queue only shows what you review by hand.");
+    }
     await startServer({
         port: Number(opts.port),
         host: opts.host,

package/dist/core/config.js

@@ -11,6 +11,22 @@ import { TrustRuleError, parseTrustRule } from "./trust.js";
  * Rules stay one-line strings rather than objects: the same syntax you type at
  * `cerber trust`, readable in a diff, and short enough to explain in a tooltip.
  */
+/**
+ * The background loop `cerber serve` runs. Both knobs default ON — the cockpit
+ * is an inbox: open it and the PRs awaiting your review are already there,
+ * drafts and all. Flip them here (or in the cockpit's Settings), or per-run
+ * with `--no-poll` / `--no-auto-review`.
+ */
+export const DaemonConfigSchema = z.object({
+    /** Discover PRs awaiting your review and list them as `awaiting`. */
+    poll: z.boolean().default(true),
+    /** Draft an AI review for whatever lands in the queue. Never sends. */
+    autoReview: z.boolean().default(true),
+    intervalMinutes: z.number().int().positive().default(5),
+    parallel: z.number().int().positive().default(3),
+    /** Repos to watch (owner/repo). Empty = everything your gh account can see. */
+    repos: z.array(z.string()).default([]),
+});
 export const ConfigSchema = z.object({
     /** Whose PRs may be reviewed by running code. See core/trust.ts for syntax. */
     trust: z
@@ -30,8 +46,9 @@ export const ConfigSchema = z.object({
             }
         });
     }),
+    daemon: DaemonConfigSchema.default({}),
 });
-export const DEFAULT_CONFIG = { trust: [] };
+export const DEFAULT_CONFIG = ConfigSchema.parse({});
 export function configPath() {
     return path.join(cerberHome(), "config.json");
 }
@@ -42,7 +59,7 @@ export async function loadConfig() {
         throw err;
     });
     if (raw === null)
-        return { ...DEFAULT_CONFIG };
+        return ConfigSchema.parse({});
     try {
         return ConfigSchema.parse(JSON.parse(raw));
     }
@@ -64,7 +81,8 @@ function describeConfigError(err) {
         return `  not JSON — ${err.message}`;
     return `  ${err instanceof Error ? err.message : String(err)}`;
 }
-/** Write atomically — the cockpit and a `cerber trust` can both be writing. */
+/** Write atomically — the cockpit and a `cerber trust` can both be writing.
+ *  Accepts schema input (defaults fill the gaps), so callers may omit blocks. */
 export async function saveConfig(config) {
     const file = configPath();
     await fs.mkdir(cerberHome(), { recursive: true });

package/dist/core/gh.js

@@ -109,25 +109,32 @@ export function mapSearchResults(raw) {
                 url: r.url,
                 updatedAt: r.updatedAt,
                 isDraft: r.isDraft,
+                author: r.author?.login ?? "",
             },
         ];
     });
 }
-/** Open, non-draft PRs where the current gh user's review is requested. */
-export async function searchAwaitingMe(repoFilter, limit = 50) {
+export function searchAwaitingArgs(repoFilter, limit = 50) {
     const args = [
         "search",
         "prs",
+        // An archived repo is read-only: its PRs can never merge, close, or take a
+        // review. Without this they'd sit in the inbox forever — nothing retires them.
+        "archived:false",
         "--review-requested=@me",
         "--state=open",
         "--limit",
         String(limit),
         "--json",
-        "number,title,repository,isDraft,url,updatedAt",
+        "number,title,repository,isDraft,url,updatedAt,author",
     ];
     if (repoFilter)
         args.push("--repo", repoFilter);
-    const out = await gh(args);
+    return args;
+}
+/** Open, non-draft PRs where the current gh user's review is requested. */
+export async function searchAwaitingMe(repoFilter, limit = 50) {
+    const out = await gh(searchAwaitingArgs(repoFilter, limit));
     return mapSearchResults(JSON.parse(out));
 }
 /**

package/dist/core/state.js

@@ -67,6 +67,21 @@ export async function readAutoSendLog() {
         throw err;
     }
 }
+/**
+ * Remove an artifact file. Only ever called on pure discovery stubs (status
+ * "awaiting", no comments) — anything a human or an AI run touched stays.
+ */
+export async function deleteArtifact(id) {
+    try {
+        await fs.unlink(artifactPath(id));
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
 /** Load by key, apply a mutation, bump updatedAt, save. Returns the new artifact. */
 export async function updateArtifactByKey(key, mutate) {
     const artifact = await loadArtifactByKey(key);

package/dist/server/daemon.js

@@ -1,13 +1,63 @@
-import { artifactKey } from "../core/artifact.js";
+import { SCHEMA_VERSION, artifactId, artifactKey } from "../core/artifact.js";
 import { evaluateAutoSend } from "../core/autosend.js";
-import { searchAwaitingMe, submitReview } from "../core/gh.js";
+import { loadConfig } from "../core/config.js";
+import { fetchPrInfo, searchAwaitingMe, submitReview } from "../core/gh.js";
 import { buildReviewPayload, computeCalibration } from "../core/send.js";
-import { appendAutoSendLog, updateArtifactByKey } from "../core/state.js";
+import { appendAutoSendLog, deleteArtifact, listArtifacts, loadArtifact, saveArtifact, updateArtifactByKey, } from "../core/state.js";
 import { ReviewInProgressError } from "../runner/inflight.js";
 import { pool, reviewPr } from "../runner/review.js";
 /**
- * Poll GitHub for PRs awaiting the user's review and keep their artifacts
- * warm. Reviews are read-only; the daemon NEVER sends anything.
+ * A pure discovery stub: enough artifact for the queue to show an awaiting row.
+ * The AI run that follows (automatic or clicked) replaces it wholesale.
+ */
+export function stubArtifact(ref) {
+    const now = new Date().toISOString();
+    return {
+        schemaVersion: SCHEMA_VERSION,
+        id: artifactId(ref),
+        status: "awaiting",
+        createdAt: now,
+        updatedAt: now,
+        pr: {
+            owner: ref.owner,
+            repo: ref.repo,
+            number: ref.number,
+            title: ref.title,
+            url: ref.url,
+            author: ref.author,
+            body: "",
+            baseRefName: "",
+            headRefName: "",
+            headSha: "",
+            state: "OPEN",
+            additions: 0,
+            deletions: 0,
+            changedFiles: 0,
+        },
+        diff: "",
+        summary: "",
+        chapters: [],
+        comments: [],
+        verdict: null,
+        run: null,
+        sent: null,
+        refresh: null,
+        calibration: null,
+    };
+}
+/** An artifact nothing has touched yet — safe to delete when its PR leaves the queue. */
+export function isPureStub(artifact) {
+    return artifact.status === "awaiting" && artifact.comments.length === 0 && artifact.run === null;
+}
+/** How many open-PR artifacts to re-check against GitHub per poll, and how often each. */
+const STATE_REFRESH_CAP = 10;
+const STATE_REFRESH_MIN_MS = 30 * 60_000;
+/**
+ * The inbox loop behind `cerber serve`: poll GitHub for PRs awaiting the
+ * user's review, list them as `awaiting`, and (unless auto-review is off)
+ * draft a review for each. Merged/closed PRs are archived out of the queue.
+ * Reviews stay local; the daemon NEVER sends anything except via the
+ * explicitly opted-in auto-send path.
  */
 export function startDaemon(opts) {
     let timer = null;
@@ -17,70 +67,181 @@ export function startDaemon(opts) {
         polling: false,
         repos: opts.repos,
         intervalMs: opts.intervalMs,
+        pollEnabled: true,
+        autoReview: opts.autoReview,
+        trustedRuns: false,
         polls: 0,
         errors: 0,
         lastPollAt: null,
         nextPollAt: new Date(Date.now()).toISOString(),
         lastSummary: null,
+        lastPollError: null,
         autoSend: opts.autoSend,
         autoSendThreshold: opts.autoSendThreshold,
         autoSent: 0,
         autoSendCandidates: 0,
     };
     const log = (m) => console.log(`[daemon] ${m}`);
+    /** When GitHub last confirmed an artifact's PR state, by artifact id. In-memory:
+     *  a restart just re-checks sooner, which is harmless. */
+    const stateCheckedAt = new Map();
+    async function discover() {
+        const filters = opts.repos.length > 0 ? opts.repos : [undefined];
+        const seen = new Set();
+        return (await Promise.all(filters.map((repo) => searchAwaitingMe(repo))))
+            .flat()
+            .filter((r) => {
+            const id = artifactId(r);
+            if (seen.has(id))
+                return false;
+            seen.add(id);
+            return true;
+        });
+    }
+    /**
+     * Make the local queue mirror what's actually awaiting: stub artifacts for
+     * newly discovered PRs, archive merged/closed ones, drop stubs whose review
+     * request went away. Freshness decisions always come from local artifacts —
+     * search results lag GitHub by minutes and never override them.
+     */
+    async function syncQueue(refs) {
+        let discovered = 0;
+        for (const ref of refs) {
+            if (await loadArtifact(artifactId(ref)))
+                continue;
+            await saveArtifact(stubArtifact(ref));
+            discovered++;
+        }
+        const awaitingIds = new Set(refs.map((r) => artifactId(r)));
+        let refreshed = 0;
+        for (const artifact of await listArtifacts()) {
+            if (artifact.status === "running")
+                continue;
+            if (awaitingIds.has(artifact.id))
+                continue;
+            if (artifact.pr.state !== "OPEN")
+                continue;
+            if (isPureStub(artifact)) {
+                // Discovered earlier, gone from the search now: merged/closed (archive
+                // it), or the request was withdrawn / handled elsewhere (drop it — it
+                // holds no work, and search lag at worst re-creates it next poll).
+                try {
+                    const pr = await fetchPrInfo(artifact.pr);
+                    if (pr.state !== "OPEN") {
+                        await updateArtifactByKey(artifactKey(artifact.id), (a) => ({ ...a, pr }));
+                        log(`[${artifact.id}] ${pr.state.toLowerCase()} — archived`);
+                    }
+                    else {
+                        await deleteArtifact(artifact.id);
+                        log(`[${artifact.id}] no longer awaiting your review — removed from the queue`);
+                    }
+                }
+                catch {
+                    // GitHub unreachable — leave the stub; next poll retries.
+                }
+                continue;
+            }
+            // Anything with real work in it: periodically confirm the PR is still
+            // open, so merged/closed ones stop cluttering the queue. Capped and
+            // spaced out — this is book-keeping, not a data feed.
+            if (refreshed >= STATE_REFRESH_CAP)
+                continue;
+            const last = stateCheckedAt.get(artifact.id) ?? 0;
+            if (Date.now() - last < STATE_REFRESH_MIN_MS)
+                continue;
+            refreshed++;
+            stateCheckedAt.set(artifact.id, Date.now());
+            try {
+                const pr = await fetchPrInfo(artifact.pr);
+                if (pr.state !== "OPEN") {
+                    await updateArtifactByKey(artifactKey(artifact.id), (a) => ({
+                        ...a,
+                        pr: { ...a.pr, state: pr.state },
+                    }));
+                    log(`[${artifact.id}] ${pr.state.toLowerCase()} — archived`);
+                }
+            }
+            catch {
+                // Same: book-keeping can wait for the next poll.
+            }
+        }
+        return { discovered };
+    }
+    async function reviewAll(refs) {
+        let reviewed = 0;
+        let skipped = 0;
+        let failed = 0;
+        await pool(refs, opts.parallel, async (ref) => {
+            const label = artifactId(ref);
+            try {
+                const result = await reviewPr(ref, {
+                    model: opts.model,
+                    withSource: opts.withSource,
+                    trust: opts.trust,
+                    onProgress: (m) => log(`[${label}] ${m}`),
+                });
+                if (result.skipped)
+                    skipped++;
+                else {
+                    reviewed++;
+                    await handleAutoSend(result.artifact);
+                }
+            }
+            catch (err) {
+                if (err instanceof ReviewInProgressError) {
+                    // The cockpit (or an earlier, slower poll) is already on it.
+                    skipped++;
+                    return;
+                }
+                failed++;
+                status.errors++;
+                log(`[${label}] failed: ${err instanceof Error ? err.message : err}`);
+            }
+        });
+        return { reviewed, skipped, failed };
+    }
     async function poll() {
         if (status.polling)
             return;
         status.polling = true;
         status.lastPollAt = new Date().toISOString();
         try {
-            const filters = opts.repos.length > 0 ? opts.repos : [undefined];
-            const seen = new Set();
-            const refs = (await Promise.all(filters.map((repo) => searchAwaitingMe(repo))))
-                .flat()
-                .filter((r) => {
-                const id = `${r.owner}/${r.repo}#${r.number}`;
-                if (seen.has(id))
-                    return false;
-                seen.add(id);
-                return true;
-            });
-            let reviewed = 0;
-            let skipped = 0;
-            let failed = 0;
-            await pool(refs, opts.parallel, async (ref) => {
-                const label = `${ref.owner}/${ref.repo}#${ref.number}`;
-                try {
-                    const result = await reviewPr(ref, {
-                        model: opts.model,
-                        withSource: opts.withSource,
-                        trust: opts.trust,
-                        onProgress: (m) => log(`[${label}] ${m}`),
-                    });
-                    if (result.skipped)
-                        skipped++;
-                    else {
-                        reviewed++;
-                        await handleAutoSend(result.artifact);
-                    }
-                }
-                catch (err) {
-                    if (err instanceof ReviewInProgressError) {
-                        // The cockpit (or an earlier, slower poll) is already on it.
-                        skipped++;
-                        return;
-                    }
-                    failed++;
-                    status.errors++;
-                    log(`[${label}] failed: ${err instanceof Error ? err.message : err}`);
-                }
-            });
-            status.lastSummary = `${refs.length} awaiting; ${reviewed} reviewed, ${skipped} up to date${failed > 0 ? `, ${failed} failed` : ""}`;
+            // The config is re-read every poll, so the cockpit's Settings toggles
+            // take effect on the next tick — no restart. CLI --no-* flags cap it.
+            // loadConfig is strict on purpose (a typo must not silently change trust
+            // or the knobs), so a broken file skips the tick loudly instead of
+            // proceeding on guessed defaults.
+            const config = await loadConfig();
+            const knobs = config.daemon;
+            const autoReview = opts.autoReview && knobs.autoReview;
+            status.pollEnabled = knobs.poll;
+            status.autoReview = autoReview;
+            // Recomputed too, so a trust rule added mid-run shows up in the strip.
+            status.trustedRuns = autoReview && opts.trust !== false && config.trust.length > 0;
+            if (!knobs.poll) {
+                // Deliberately off is not an outage — don't leave a stale error up.
+                status.lastPollError = null;
+                status.lastSummary = "polling off (settings) — the queue only shows what you review by hand";
+                return;
+            }
+            const refs = await discover();
+            status.lastPollError = null;
+            const { discovered } = await syncQueue(refs);
+            if (autoReview) {
+                const { reviewed, skipped, failed } = await reviewAll(refs);
+                status.lastSummary =
+                    `${refs.length} awaiting; ${reviewed} reviewed, ${skipped} up to date` +
+                        `${failed > 0 ? `, ${failed} failed` : ""}`;
+            }
+            else {
+                status.lastSummary = `${refs.length} awaiting${discovered > 0 ? `, ${discovered} new` : ""} (auto-review off)`;
+            }
             log(status.lastSummary);
         }
         catch (err) {
             status.errors++;
-            status.lastSummary = `poll failed: ${err instanceof Error ? err.message : err}`;
+            status.lastPollError = err instanceof Error ? err.message : String(err);
+            status.lastSummary = `poll failed: ${status.lastPollError}`;
             log(status.lastSummary);
         }
         finally {

package/dist/server/index.js

@@ -9,7 +9,8 @@ import { randomUUID } from "node:crypto";
 import { ArtifactStatusSchema, VerdictSchema, artifactKey } from "../core/artifact.js";
 import { toMarkdown } from "../core/export.js";
 import { fetchPrDiff, fetchPrInfo, submitReview } from "../core/gh.js";
-import { configPath, loadConfig, saveConfig } from "../core/config.js";
+import { z } from "zod";
+import { DaemonConfigSchema, configPath, loadConfig, saveConfig } from "../core/config.js";
 import { refreshArtifact } from "../core/refresh.js";
 import { TrustRuleError, describeRule, explainRule, parseTrustRule } from "../core/trust.js";
 import { buildReviewPayload, computeCalibration } from "../core/send.js";
@@ -51,12 +52,35 @@ export async function buildApp(opts) {
     app.get("/api/config", async (c) => {
         try {
             const config = await loadConfig();
-            return c.json({ path: configPath(), trust: trustView(config.trust) });
+            return c.json({ path: configPath(), trust: trustView(config.trust), daemon: config.daemon });
         }
         catch (err) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
         }
     });
+    // The inbox knobs. The daemon re-reads the config every poll, so a toggle
+    // here applies on the next tick without restarting serve.
+    app.post("/api/config/daemon", async (c) => {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "body must be JSON" }, 400);
+        }
+        try {
+            const config = await loadConfig();
+            const daemon = DaemonConfigSchema.parse({ ...config.daemon, ...body });
+            await saveConfig({ ...config, daemon });
+            return c.json({ path: configPath(), trust: trustView(config.trust), daemon });
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                return c.json({ error: err.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ") }, 400);
+            }
+            return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+        }
+    });
     app.post("/api/config/trust", async (c) => {
         let body;
         try {
@@ -90,7 +114,9 @@ export async function buildApp(opts) {
             });
             const trust = remove === true ? without : [...without, canonical];
             await saveConfig({ ...config, trust });
-            return c.json({ path: configPath(), trust: trustView(trust) });
+            // Full ConfigView — the cockpit replaces its config state with this
+            // wholesale, so omitting daemon would crash the Settings toggles.
+            return c.json({ path: configPath(), trust: trustView(trust), daemon: config.daemon });
         }
         catch (err) {
             return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
@@ -110,6 +136,7 @@ export async function buildApp(opts) {
                 owner: a.pr.owner,
                 repo: a.pr.repo,
                 number: a.pr.number,
+                state: a.pr.state,
                 additions: a.pr.additions,
                 deletions: a.pr.deletions,
                 changedFiles: a.pr.changedFiles,
@@ -360,7 +387,10 @@ export async function startServer(opts) {
     serve({ fetch: app.fetch, port: opts.port, hostname: opts.host }, (info) => {
         const tokenHint = opts.token ? `/?token=${opts.token}` : "";
         console.log(`cerber cockpit: http://${opts.host}:${info.port}${tokenHint}`);
-        if (opts.daemon)
-            console.log("daemon: polling for PRs awaiting your review");
+        if (opts.daemon) {
+            const s = opts.daemon.status();
+            console.log(`inbox: polling every ${Math.round(s.intervalMs / 60_000)}m` +
+                `${s.autoReview ? ", drafting a review for each PR awaiting you" : " (auto-review off — click review in the queue)"}`);
+        }
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fullstackhouse/cerber",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "AI code-review cockpit: Claude reviews your PRs into local artifacts; nothing reaches GitHub until you say so.",
   "license": "MIT",
   "repository": "github:fullstackhouse/cerber",