@oss-autopilot/core 0.42.3 → 0.42.5

package/dist/cli.bundle.cjs

@@ -11213,7 +11213,24 @@ var init_pr_monitor = __esm({
         );
         const ciPromise = this.getCIStatus(owner, repo, ghPR.head.sha);
         const needCommitDate = hasUnrespondedComment || reviewDecision === "changes_requested";
-        const commitDatePromise = needCommitDate ? this.octokit.repos.getCommit({ owner, repo, ref: ghPR.head.sha }).then((res) => res.data.commit.author?.date).catch(() => void 0) : Promise.resolve(void 0);
+        const commitDatePromise = needCommitDate ? this.octokit.repos.getCommit({ owner, repo, ref: ghPR.head.sha }).then((res) => res.data.commit.author?.date).catch((err) => {
+          const status2 = getHttpStatusCode(err);
+          if (status2 === 429) throw err;
+          if (status2 === 403) {
+            const msg = errorMessage(err).toLowerCase();
+            if (msg.includes("rate limit") || msg.includes("abuse detection")) throw err;
+            warn(
+              "pr-monitor",
+              `403 fetching commit date for ${owner}/${repo}@${ghPR.head.sha.slice(0, 7)}: ${errorMessage(err)}`
+            );
+            return void 0;
+          }
+          warn(
+            "pr-monitor",
+            `Failed to fetch commit date for ${owner}/${repo}@${ghPR.head.sha.slice(0, 7)}: ${errorMessage(err)}`
+          );
+          return void 0;
+        }) : Promise.resolve(void 0);
         const [{ status: ciStatus, failingCheckNames, failingCheckConclusions }, latestCommitDate] = await Promise.all([
           ciPromise,
           commitDatePromise
@@ -12926,7 +12943,7 @@ function buildRepoMap(prs, label) {
   const repoMap = /* @__PURE__ */ new Map();
   for (const pr of prs) {
     if (!pr.repo) {
-      console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+      warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
       continue;
     }
     const existing = repoMap.get(pr.repo) || [];
@@ -13331,6 +13348,7 @@ var init_daily_logic = __esm({
   "src/core/daily-logic.ts"() {
     "use strict";
     init_utils();
+    init_logger();
     CRITICAL_STATUSES = /* @__PURE__ */ new Set([
       "needs_response",
       "needs_changes",
@@ -13685,11 +13703,12 @@ function generateDigestOutput(digest, activePRs, shelvedPRs, commentedIssues, fa
       const dismissTime = new Date(dismissedAt).getTime();
       if (isNaN(responseTime) || isNaN(dismissTime)) {
         console.error(`[DAILY] Invalid timestamp in dismiss check for ${issue.url}, including issue`);
-        stateManager2.undismissIssue(issue.url);
-        hasAutoUndismissed = true;
         return true;
       }
       if (responseTime > dismissTime) {
+        console.error(
+          `[DAILY] Auto-undismissing issue ${issue.url}: new response at ${issue.lastResponseAt} after dismiss at ${dismissedAt}`
+        );
         stateManager2.undismissIssue(issue.url);
         hasAutoUndismissed = true;
         return true;
@@ -13697,9 +13716,6 @@ function generateDigestOutput(digest, activePRs, shelvedPRs, commentedIssues, fa
     }
     return false;
   });
-  if (hasAutoUndismissed) {
-    stateManager2.save();
-  }
   const issueResponses = filteredCommentedIssues.filter(
     (i) => i.status === "new_response"
   );
@@ -13707,8 +13723,32 @@ function generateDigestOutput(digest, activePRs, shelvedPRs, commentedIssues, fa
   const snoozedUrls = new Set(
     Object.keys(stateManager2.getState().config.snoozedPRs ?? {}).filter((url) => stateManager2.isSnoozed(url))
   );
-  const dismissedUrls = new Set(Object.keys(stateManager2.getState().config.dismissedIssues ?? {}));
-  const nonDismissedPRs = activePRs.filter((pr) => !dismissedUrls.has(pr.url));
+  const nonDismissedPRs = activePRs.filter((pr) => {
+    const dismissedAt = stateManager2.getIssueDismissedAt(pr.url);
+    if (!dismissedAt) return true;
+    const activityTime = new Date(pr.updatedAt).getTime();
+    const dismissTime = new Date(dismissedAt).getTime();
+    if (isNaN(activityTime) || isNaN(dismissTime)) {
+      console.error(`[DAILY] Invalid timestamp in PR dismiss check for ${pr.url}, including PR`);
+      return true;
+    }
+    if (activityTime > dismissTime) {
+      console.error(
+        `[DAILY] Auto-undismissing PR ${pr.url}: new activity at ${pr.updatedAt} after dismiss at ${dismissedAt}`
+      );
+      stateManager2.undismissIssue(pr.url);
+      hasAutoUndismissed = true;
+      return true;
+    }
+    return false;
+  });
+  if (hasAutoUndismissed) {
+    try {
+      stateManager2.save();
+    } catch (error) {
+      console.error("[DAILY] Failed to persist auto-undismissed state:", errorMessage(error));
+    }
+  }
   const actionableIssues = collectActionableIssues(nonDismissedPRs, snoozedUrls);
   digest.summary.totalNeedingAttention = actionableIssues.length;
   const briefSummary = formatBriefSummary(digest, actionableIssues.length, issueResponses.length);
@@ -13908,12 +13948,13 @@ function validateGitHubUsername(username) {
   }
   return trimmed;
 }
-var PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
+var PR_URL_PATTERN, ISSUE_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
 var init_validation = __esm({
   "src/commands/validation.ts"() {
     "use strict";
     init_errors();
     PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+$/;
+    ISSUE_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/issues\/\d+$/;
     ISSUE_OR_PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/(issues|pull)\/\d+$/;
     MAX_URL_LENGTH = 2048;
     MAX_MESSAGE_LENGTH = 1e3;
@@ -14033,6 +14074,7 @@ __export(comments_exports, {
 });
 async function runComments(options) {
   validateUrl(options.prUrl);
+  validateGitHubUrl(options.prUrl, PR_URL_PATTERN, "PR");
   const token = requireGitHubToken();
   const stateManager2 = getStateManager();
   const octokit = getOctokit(token);
@@ -14116,6 +14158,7 @@ async function runComments(options) {
 }
 async function runPost(options) {
   validateUrl(options.url);
+  validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, "issue or PR");
   if (!options.message.trim()) {
     throw new Error("No message provided");
   }
@@ -14140,6 +14183,7 @@ async function runPost(options) {
 }
 async function runClaim(options) {
   validateUrl(options.issueUrl);
+  validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, "issue");
   const token = requireGitHubToken();
   const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
   validateMessage(message);
@@ -14155,20 +14199,26 @@ async function runClaim(options) {
     issue_number: number,
     body: message
   });
-  const stateManager2 = getStateManager();
-  stateManager2.addIssue({
-    id: number,
-    url: options.issueUrl,
-    repo: `${owner}/${repo}`,
-    number,
-    title: "(claimed)",
-    status: "claimed",
-    labels: [],
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    vetted: false
-  });
-  stateManager2.save();
+  try {
+    const stateManager2 = getStateManager();
+    stateManager2.addIssue({
+      id: number,
+      url: options.issueUrl,
+      repo: `${owner}/${repo}`,
+      number,
+      title: "(claimed)",
+      status: "claimed",
+      labels: [],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      vetted: false
+    });
+    stateManager2.save();
+  } catch (error) {
+    console.error(
+      `Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`
+    );
+  }
   return {
     commentUrl: comment.html_url,
     issueUrl: options.issueUrl
@@ -14281,6 +14331,13 @@ __export(setup_exports, {
   runCheckSetup: () => runCheckSetup,
   runSetup: () => runSetup
 });
+function parsePositiveInt(value, settingName) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+    throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+  }
+  return parsed;
+}
 async function runSetup(options) {
   const stateManager2 = getStateManager();
   const config = stateManager2.getState().config;
@@ -14296,18 +14353,24 @@ async function runSetup(options) {
           stateManager2.updateConfig({ githubUsername: value });
           results[key] = value;
           break;
-        case "maxActivePRs":
-          stateManager2.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-          results[key] = value;
+        case "maxActivePRs": {
+          const maxPRs = parsePositiveInt(value, "maxActivePRs");
+          stateManager2.updateConfig({ maxActivePRs: maxPRs });
+          results[key] = String(maxPRs);
           break;
-        case "dormantDays":
-          stateManager2.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-          results[key] = value;
+        }
+        case "dormantDays": {
+          const dormant = parsePositiveInt(value, "dormantDays");
+          stateManager2.updateConfig({ dormantThresholdDays: dormant });
+          results[key] = String(dormant);
           break;
-        case "approachingDays":
-          stateManager2.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-          results[key] = value;
+        }
+        case "approachingDays": {
+          const approaching = parsePositiveInt(value, "approachingDays");
+          stateManager2.updateConfig({ approachingDormantDays: approaching });
+          results[key] = String(approaching);
           break;
+        }
         case "languages":
           stateManager2.updateConfig({ languages: value.split(",").map((l) => l.trim()) });
           results[key] = value;
@@ -14330,9 +14393,12 @@ async function runSetup(options) {
           }
           break;
         case "minStars": {
-          const parsed = parseInt(value);
-          stateManager2.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-          results[key] = value;
+          const stars = Number(value);
+          if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+            throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+          }
+          stateManager2.updateConfig({ minStars: stars });
+          results[key] = String(stars);
           break;
         }
         case "includeDocIssues":
@@ -14456,6 +14522,7 @@ var init_setup = __esm({
   "src/commands/setup.ts"() {
     "use strict";
     init_core();
+    init_errors();
     init_validation();
   }
 });
@@ -14531,7 +14598,11 @@ async function fetchDashboardData(token) {
   digest.autoUnshelvedPRs = [];
   digest.summary.totalActivePRs = prs.length - freshShelved.length;
   stateManager2.setLastDigest(digest);
-  stateManager2.save();
+  try {
+    stateManager2.save();
+  } catch (error) {
+    console.error("Warning: Failed to save dashboard digest to state:", errorMessage(error));
+  }
   console.error(`Refreshed: ${prs.length} PRs fetched`);
   return { digest, commentedIssues };
 }
@@ -16325,6 +16396,38 @@ async function startDashboardServer(options) {
       sendError(res, 400, 'Missing or invalid "url" field');
       return;
     }
+    try {
+      validateUrl(body.url);
+      validateGitHubUrl(body.url, PR_URL_PATTERN, "PR");
+    } catch (err) {
+      if (err instanceof ValidationError) {
+        sendError(res, 400, err.message);
+      } else {
+        console.error("Unexpected error during URL validation:", err);
+        sendError(res, 400, "Invalid URL");
+      }
+      return;
+    }
+    if (body.action === "snooze") {
+      const days = body.days ?? 7;
+      if (typeof days !== "number" || !Number.isFinite(days) || days <= 0) {
+        sendError(res, 400, "Snooze days must be a positive finite number");
+        return;
+      }
+      if (body.reason !== void 0) {
+        try {
+          validateMessage(String(body.reason));
+        } catch (err) {
+          if (err instanceof ValidationError) {
+            sendError(res, 400, err.message);
+          } else {
+            console.error("Unexpected error during message validation:", err);
+            sendError(res, 400, "Invalid reason");
+          }
+          return;
+        }
+      }
+    }
     try {
       switch (body.action) {
         case "shelve":
@@ -16334,7 +16437,7 @@ async function startDashboardServer(options) {
           stateManager2.unshelvePR(body.url);
           break;
         case "snooze":
-          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days || 7);
+          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days ?? 7);
           break;
         case "unsnooze":
           stateManager2.unsnoozePR(body.url);
@@ -16488,6 +16591,7 @@ var init_dashboard_server = __esm({
     path5 = __toESM(require("path"), 1);
     init_core();
     init_errors();
+    init_validation();
     init_dashboard_data();
     init_dashboard_templates();
     VALID_ACTIONS = /* @__PURE__ */ new Set(["shelve", "unshelve", "snooze", "unsnooze"]);
@@ -16541,6 +16645,8 @@ async function runDashboard(options) {
       digest = stateManager2.getState().lastDigest;
     }
   } else {
+    console.error("Warning: No GitHub token found. Using cached data (may be stale).");
+    console.error("Set GITHUB_TOKEN or run `gh auth login` for fresh data.");
     digest = stateManager2.getState().lastDigest;
   }
   if (!digest) {
@@ -16579,7 +16685,6 @@ async function runDashboard(options) {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state, issueResponses);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   if (options.offline) {
     const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
     console.log(`
@@ -16615,7 +16720,6 @@ function writeDashboardFromState() {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   return dashboardPath;
 }
 function resolveAssetsDir() {
@@ -17004,7 +17108,7 @@ async function runLocalRepos(options) {
     stateManager2.save();
   } catch (error) {
     const msg = errorMessage(error);
-    debug("local-repos", `Failed to cache scan results: ${msg}`);
+    console.error(`Warning: Failed to cache scan results: ${msg}`);
   }
   return {
     repos,
@@ -17385,12 +17489,20 @@ Last Run: ${data.lastRunAt || "Never"}`);
 program2.command("search [count]").description("Search for new issues to work on").option("--json", "Output as JSON").action(async (count, options) => {
   try {
     const { runSearch: runSearch2 } = await Promise.resolve().then(() => (init_search(), search_exports));
+    let maxResults = 5;
+    if (count !== void 0) {
+      const parsed = Number(count);
+      if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+      }
+      maxResults = parsed;
+    }
     if (!options.json) {
       console.log(`
-Searching for issues (max ${parseInt(count) || 5})...
+Searching for issues (max ${maxResults})...
 `);
     }
-    const data = await runSearch2({ maxResults: parseInt(count) || 5 });
+    const data = await runSearch2({ maxResults });
     if (options.json) {
       outputJson(data);
     } else {
@@ -17689,17 +17801,25 @@ program2.command("checkSetup").description("Check if setup is complete").option(
 });
 var dashboardCmd = program2.command("dashboard").description("Dashboard commands");
 dashboardCmd.command("serve").description("Start interactive dashboard server").option("--port <port>", "Port to listen on", "3000").option("--no-open", "Do not open browser automatically").action(async (options) => {
-  const port = parseInt(options.port, 10);
-  if (isNaN(port) || port < 1 || port > 65535) {
-    console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-    process.exit(1);
+  try {
+    const port = parseInt(options.port, 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+      console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+      process.exit(1);
+    }
+    const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await serveDashboard2({ port, open: options.open });
+  } catch (err) {
+    handleCommandError(err);
   }
-  const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await serveDashboard2({ port, open: options.open });
 });
 dashboardCmd.option("--open", "Open in browser").option("--json", "Output as JSON").option("--offline", "Use cached data only (no GitHub API calls)").action(async (options) => {
-  const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  try {
+    const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  } catch (err) {
+    handleCommandError(err, options.json);
+  }
 });
 program2.command("parse-issue-list <path>").description("Parse a markdown issue list into structured JSON").option("--json", "Output as JSON").action(async (filePath, options) => {
   try {

package/dist/cli.js

@@ -127,10 +127,18 @@ program
     .action(async (count, options) => {
     try {
         const { runSearch } = await import('./commands/search.js');
+        let maxResults = 5;
+        if (count !== undefined) {
+            const parsed = Number(count);
+            if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+                throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+            }
+            maxResults = parsed;
+        }
         if (!options.json) {
-            console.log(`\nSearching for issues (max ${parseInt(count) || 5})...\n`);
+            console.log(`\nSearching for issues (max ${maxResults})...\n`);
         }
-        const data = await runSearch({ maxResults: parseInt(count) || 5 });
+        const data = await runSearch({ maxResults });
         if (options.json) {
             outputJson(data);
         }
@@ -516,13 +524,18 @@ dashboardCmd
     .option('--port <port>', 'Port to listen on', '3000')
     .option('--no-open', 'Do not open browser automatically')
     .action(async (options) => {
-    const port = parseInt(options.port, 10);
-    if (isNaN(port) || port < 1 || port > 65535) {
-        console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-        process.exit(1);
+    try {
+        const port = parseInt(options.port, 10);
+        if (isNaN(port) || port < 1 || port > 65535) {
+            console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+            process.exit(1);
+        }
+        const { serveDashboard } = await import('./commands/dashboard.js');
+        await serveDashboard({ port, open: options.open });
+    }
+    catch (err) {
+        handleCommandError(err);
     }
-    const { serveDashboard } = await import('./commands/dashboard.js');
-    await serveDashboard({ port, open: options.open });
 });
 // Keep bare `dashboard` (no subcommand) for backward compat — generates static HTML
 dashboardCmd
@@ -530,8 +543,13 @@ dashboardCmd
     .option('--json', 'Output as JSON')
     .option('--offline', 'Use cached data only (no GitHub API calls)')
     .action(async (options) => {
-    const { runDashboard } = await import('./commands/dashboard.js');
-    await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    try {
+        const { runDashboard } = await import('./commands/dashboard.js');
+        await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    }
+    catch (err) {
+        handleCommandError(err, options.json);
+    }
 });
 // Parse issue list command (#82)
 program

package/dist/commands/comments.js

@@ -4,9 +4,10 @@
  */
 import { getStateManager, getOctokit, parseGitHubUrl, requireGitHubToken } from '../core/index.js';
 import { paginateAll } from '../core/pagination.js';
-import { validateUrl, validateMessage } from './validation.js';
+import { validateUrl, validateMessage, validateGitHubUrl, PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, ISSUE_URL_PATTERN, } from './validation.js';
 export async function runComments(options) {
     validateUrl(options.prUrl);
+    validateGitHubUrl(options.prUrl, PR_URL_PATTERN, 'PR');
     const token = requireGitHubToken();
     const stateManager = getStateManager();
     const octokit = getOctokit(token);
@@ -97,6 +98,7 @@ export async function runComments(options) {
 }
 export async function runPost(options) {
     validateUrl(options.url);
+    validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, 'issue or PR');
     if (!options.message.trim()) {
         throw new Error('No message provided');
     }
@@ -122,6 +124,7 @@ export async function runPost(options) {
 }
 export async function runClaim(options) {
     validateUrl(options.issueUrl);
+    validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, 'issue');
     const token = requireGitHubToken();
     // Default claim message or custom
     const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
@@ -139,21 +142,26 @@ export async function runClaim(options) {
         issue_number: number,
         body: message,
     });
-    // Add to tracked issues
-    const stateManager = getStateManager();
-    stateManager.addIssue({
-        id: number,
-        url: options.issueUrl,
-        repo: `${owner}/${repo}`,
-        number,
-        title: '(claimed)',
-        status: 'claimed',
-        labels: [],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-        vetted: false,
-    });
-    stateManager.save();
+    // Add to tracked issues — non-fatal if state save fails (comment already posted)
+    try {
+        const stateManager = getStateManager();
+        stateManager.addIssue({
+            id: number,
+            url: options.issueUrl,
+            repo: `${owner}/${repo}`,
+            number,
+            title: '(claimed)',
+            status: 'claimed',
+            labels: [],
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            vetted: false,
+        });
+        stateManager.save();
+    }
+    catch (error) {
+        console.error(`Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`);
+    }
     return {
         commentUrl: comment.html_url,
         issueUrl: options.issueUrl,

package/dist/commands/daily.js

@@ -305,14 +305,14 @@ function generateDigestOutput(digest, activePRs, shelvedPRs, commentedIssues, fa
             const responseTime = new Date(issue.lastResponseAt).getTime();
             const dismissTime = new Date(dismissedAt).getTime();
             if (isNaN(responseTime) || isNaN(dismissTime)) {
-                // Invalid timestamp — fail open (include issue to be safe)
+                // Invalid timestamp — fail open (include issue to be safe) without
+                // permanently removing dismiss record (may be a transient data issue)
                 console.error(`[DAILY] Invalid timestamp in dismiss check for ${issue.url}, including issue`);
-                stateManager.undismissIssue(issue.url);
-                hasAutoUndismissed = true;
                 return true;
             }
             if (responseTime > dismissTime) {
                 // New activity after dismiss — auto-undismiss and resurface
+                console.error(`[DAILY] Auto-undismissing issue ${issue.url}: new response at ${issue.lastResponseAt} after dismiss at ${dismissedAt}`);
                 stateManager.undismissIssue(issue.url);
                 hasAutoUndismissed = true;
                 return true;
@@ -321,15 +321,41 @@ function generateDigestOutput(digest, activePRs, shelvedPRs, commentedIssues, fa
         // Still dismissed (last response is at or before dismiss timestamp)
         return false;
     });
-    if (hasAutoUndismissed) {
-        stateManager.save();
-    }
     const issueResponses = filteredCommentedIssues.filter((i) => i.status === 'new_response');
     const summary = formatSummary(digest, capacity, issueResponses);
     const snoozedUrls = new Set(Object.keys(stateManager.getState().config.snoozedPRs ?? {}).filter((url) => stateManager.isSnoozed(url)));
-    // Filter dismissed PR URLs from actionable issues (#416)
-    const dismissedUrls = new Set(Object.keys(stateManager.getState().config.dismissedIssues ?? {}));
-    const nonDismissedPRs = activePRs.filter((pr) => !dismissedUrls.has(pr.url));
+    // Filter dismissed PRs: suppress if dismissed after last activity, auto-undismiss if new activity (#416, #468)
+    const nonDismissedPRs = activePRs.filter((pr) => {
+        const dismissedAt = stateManager.getIssueDismissedAt(pr.url);
+        if (!dismissedAt)
+            return true; // Not dismissed — include
+        const activityTime = new Date(pr.updatedAt).getTime();
+        const dismissTime = new Date(dismissedAt).getTime();
+        if (isNaN(activityTime) || isNaN(dismissTime)) {
+            // Invalid timestamp — fail open (include PR to be safe) without
+            // permanently removing dismiss record (may be a transient data issue)
+            console.error(`[DAILY] Invalid timestamp in PR dismiss check for ${pr.url}, including PR`);
+            return true;
+        }
+        if (activityTime > dismissTime) {
+            // New activity after dismiss — auto-undismiss and resurface
+            console.error(`[DAILY] Auto-undismissing PR ${pr.url}: new activity at ${pr.updatedAt} after dismiss at ${dismissedAt}`);
+            stateManager.undismissIssue(pr.url);
+            hasAutoUndismissed = true;
+            return true;
+        }
+        // Still dismissed (last activity is at or before dismiss timestamp)
+        return false;
+    });
+    // Persist auto-undismiss state changes (issue + PR combined into one save)
+    if (hasAutoUndismissed) {
+        try {
+            stateManager.save();
+        }
+        catch (error) {
+            console.error('[DAILY] Failed to persist auto-undismissed state:', errorMessage(error));
+        }
+    }
     const actionableIssues = collectActionableIssues(nonDismissedPRs, snoozedUrls);
     digest.summary.totalNeedingAttention = actionableIssues.length;
     const briefSummary = formatBriefSummary(digest, actionableIssues.length, issueResponses.length);

package/dist/commands/dashboard-data.js

@@ -88,7 +88,12 @@ export async function fetchDashboardData(token) {
     digest.autoUnshelvedPRs = [];
     digest.summary.totalActivePRs = prs.length - freshShelved.length;
     stateManager.setLastDigest(digest);
-    stateManager.save();
+    try {
+        stateManager.save();
+    }
+    catch (error) {
+        console.error('Warning: Failed to save dashboard digest to state:', errorMessage(error));
+    }
     console.error(`Refreshed: ${prs.length} PRs fetched`);
     return { digest, commentedIssues };
 }

package/dist/commands/dashboard-server.js

@@ -9,7 +9,8 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { getStateManager, getGitHubToken } from '../core/index.js';
-import { errorMessage } from '../core/errors.js';
+import { errorMessage, ValidationError } from '../core/errors.js';
+import { validateUrl, validateGitHubUrl, validateMessage, PR_URL_PATTERN } from './validation.js';
 import { fetchDashboardData, computePRsByRepo, computeTopRepos, getMonthlyData } from './dashboard-data.js';
 import { buildDashboardStats } from './dashboard-templates.js';
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -185,6 +186,44 @@ export async function startDashboardServer(options) {
             sendError(res, 400, 'Missing or invalid "url" field');
             return;
         }
+        // Validate URL format — same checks as CLI commands
+        try {
+            validateUrl(body.url);
+            validateGitHubUrl(body.url, PR_URL_PATTERN, 'PR');
+        }
+        catch (err) {
+            if (err instanceof ValidationError) {
+                sendError(res, 400, err.message);
+            }
+            else {
+                console.error('Unexpected error during URL validation:', err);
+                sendError(res, 400, 'Invalid URL');
+            }
+            return;
+        }
+        // Validate snooze-specific fields
+        if (body.action === 'snooze') {
+            const days = body.days ?? 7;
+            if (typeof days !== 'number' || !Number.isFinite(days) || days <= 0) {
+                sendError(res, 400, 'Snooze days must be a positive finite number');
+                return;
+            }
+            if (body.reason !== undefined) {
+                try {
+                    validateMessage(String(body.reason));
+                }
+                catch (err) {
+                    if (err instanceof ValidationError) {
+                        sendError(res, 400, err.message);
+                    }
+                    else {
+                        console.error('Unexpected error during message validation:', err);
+                        sendError(res, 400, 'Invalid reason');
+                    }
+                    return;
+                }
+            }
+        }
         try {
             switch (body.action) {
                 case 'shelve':
@@ -194,7 +233,7 @@ export async function startDashboardServer(options) {
                     stateManager.unshelvePR(body.url);
                     break;
                 case 'snooze':
-                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days || 7);
+                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days ?? 7);
                     break;
                 case 'unsnooze':
                     stateManager.unsnoozePR(body.url);

package/dist/commands/dashboard.js

@@ -46,7 +46,9 @@ export async function runDashboard(options) {
         }
     }
     else {
-        // No token and not offline — fall back to cached digest
+        // No token and not offline — fall back to cached digest with warning
+        console.error('Warning: No GitHub token found. Using cached data (may be stale).');
+        console.error('Set GITHUB_TOKEN or run `gh auth login` for fresh data.');
         digest = stateManager.getState().lastDigest;
     }
     // Check if we have a digest to display
@@ -89,7 +91,6 @@ export async function runDashboard(options) {
     // Write to file in ~/.oss-autopilot/
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     if (options.offline) {
         const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
         console.log(`\n📊 Dashboard generated (offline, cached data from ${lastUpdated}): ${dashboardPath}`);
@@ -131,7 +132,6 @@ export function writeDashboardFromState() {
     const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     return dashboardPath;
 }
 /**

package/dist/commands/local-repos.js

@@ -117,7 +117,7 @@ export async function runLocalRepos(options) {
     }
     catch (error) {
         const msg = errorMessage(error);
-        debug('local-repos', `Failed to cache scan results: ${msg}`);
+        console.error(`Warning: Failed to cache scan results: ${msg}`);
     }
     return {
         repos,

package/dist/commands/setup.js

@@ -3,7 +3,16 @@
  * Interactive setup / configuration
  */
 import { getStateManager, DEFAULT_CONFIG } from '../core/index.js';
+import { ValidationError } from '../core/errors.js';
 import { validateGitHubUsername } from './validation.js';
+/** Parse and validate a positive integer setting value. */
+function parsePositiveInt(value, settingName) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+    }
+    return parsed;
+}
 export async function runSetup(options) {
     const stateManager = getStateManager();
     const config = stateManager.getState().config;
@@ -20,18 +29,24 @@ export async function runSetup(options) {
                     stateManager.updateConfig({ githubUsername: value });
                     results[key] = value;
                     break;
-                case 'maxActivePRs':
-                    stateManager.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-                    results[key] = value;
+                case 'maxActivePRs': {
+                    const maxPRs = parsePositiveInt(value, 'maxActivePRs');
+                    stateManager.updateConfig({ maxActivePRs: maxPRs });
+                    results[key] = String(maxPRs);
                     break;
-                case 'dormantDays':
-                    stateManager.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-                    results[key] = value;
+                }
+                case 'dormantDays': {
+                    const dormant = parsePositiveInt(value, 'dormantDays');
+                    stateManager.updateConfig({ dormantThresholdDays: dormant });
+                    results[key] = String(dormant);
                     break;
-                case 'approachingDays':
-                    stateManager.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-                    results[key] = value;
+                }
+                case 'approachingDays': {
+                    const approaching = parsePositiveInt(value, 'approachingDays');
+                    stateManager.updateConfig({ approachingDormantDays: approaching });
+                    results[key] = String(approaching);
                     break;
+                }
                 case 'languages':
                     stateManager.updateConfig({ languages: value.split(',').map((l) => l.trim()) });
                     results[key] = value;
@@ -55,9 +70,12 @@ export async function runSetup(options) {
                     }
                     break;
                 case 'minStars': {
-                    const parsed = parseInt(value);
-                    stateManager.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-                    results[key] = value;
+                    const stars = Number(value);
+                    if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+                        throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+                    }
+                    stateManager.updateConfig({ minStars: stars });
+                    results[key] = String(stars);
                     break;
                 }
                 case 'includeDocIssues':

package/dist/core/daily-logic.js

@@ -11,6 +11,7 @@
  *   - formatBriefSummary / formatSummary / printDigest — rendering
  */
 import { formatRelativeTime } from './utils.js';
+import { warn } from './logger.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -45,7 +46,7 @@ function buildRepoMap(prs, label) {
     const repoMap = new Map();
     for (const pr of prs) {
         if (!pr.repo) {
-            console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+            warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
             continue;
         }
         const existing = repoMap.get(pr.repo) || [];

package/dist/core/pr-monitor.js

@@ -204,7 +204,23 @@ export class PRMonitor {
             ? this.octokit.repos
                 .getCommit({ owner, repo, ref: ghPR.head.sha })
                 .then((res) => res.data.commit.author?.date)
-                .catch(() => undefined)
+                .catch((err) => {
+                // Rate limit errors must propagate — silently swallowing them produces
+                // misleading status (e.g. needs_changes when changes were addressed) (#469).
+                const status = getHttpStatusCode(err);
+                if (status === 429)
+                    throw err;
+                if (status === 403) {
+                    const msg = errorMessage(err).toLowerCase();
+                    if (msg.includes('rate limit') || msg.includes('abuse detection'))
+                        throw err;
+                    // Non-rate-limit 403 (DMCA, private repo, SSO) — degrade gracefully
+                    warn('pr-monitor', `403 fetching commit date for ${owner}/${repo}@${ghPR.head.sha.slice(0, 7)}: ${errorMessage(err)}`);
+                    return undefined;
+                }
+                warn('pr-monitor', `Failed to fetch commit date for ${owner}/${repo}@${ghPR.head.sha.slice(0, 7)}: ${errorMessage(err)}`);
+                return undefined;
+            })
             : Promise.resolve(undefined);
         const [{ status: ciStatus, failingCheckNames, failingCheckConclusions }, latestCommitDate] = await Promise.all([
             ciPromise,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "0.42.3",
+  "version": "0.42.5",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {