@oss-autopilot/core 0.42.4 → 0.42.5

package/dist/cli.bundle.cjs

@@ -12943,7 +12943,7 @@ function buildRepoMap(prs, label) {
   const repoMap = /* @__PURE__ */ new Map();
   for (const pr of prs) {
     if (!pr.repo) {
-      console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+      warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
       continue;
     }
     const existing = repoMap.get(pr.repo) || [];
@@ -13348,6 +13348,7 @@ var init_daily_logic = __esm({
   "src/core/daily-logic.ts"() {
     "use strict";
     init_utils();
+    init_logger();
     CRITICAL_STATUSES = /* @__PURE__ */ new Set([
       "needs_response",
       "needs_changes",
@@ -13947,12 +13948,13 @@ function validateGitHubUsername(username) {
   }
   return trimmed;
 }
-var PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
+var PR_URL_PATTERN, ISSUE_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
 var init_validation = __esm({
   "src/commands/validation.ts"() {
     "use strict";
     init_errors();
     PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+$/;
+    ISSUE_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/issues\/\d+$/;
     ISSUE_OR_PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/(issues|pull)\/\d+$/;
     MAX_URL_LENGTH = 2048;
     MAX_MESSAGE_LENGTH = 1e3;
@@ -14072,6 +14074,7 @@ __export(comments_exports, {
 });
 async function runComments(options) {
   validateUrl(options.prUrl);
+  validateGitHubUrl(options.prUrl, PR_URL_PATTERN, "PR");
   const token = requireGitHubToken();
   const stateManager2 = getStateManager();
   const octokit = getOctokit(token);
@@ -14155,6 +14158,7 @@ async function runComments(options) {
 }
 async function runPost(options) {
   validateUrl(options.url);
+  validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, "issue or PR");
   if (!options.message.trim()) {
     throw new Error("No message provided");
   }
@@ -14179,6 +14183,7 @@ async function runPost(options) {
 }
 async function runClaim(options) {
   validateUrl(options.issueUrl);
+  validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, "issue");
   const token = requireGitHubToken();
   const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
   validateMessage(message);
@@ -14194,20 +14199,26 @@ async function runClaim(options) {
     issue_number: number,
     body: message
   });
-  const stateManager2 = getStateManager();
-  stateManager2.addIssue({
-    id: number,
-    url: options.issueUrl,
-    repo: `${owner}/${repo}`,
-    number,
-    title: "(claimed)",
-    status: "claimed",
-    labels: [],
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    vetted: false
-  });
-  stateManager2.save();
+  try {
+    const stateManager2 = getStateManager();
+    stateManager2.addIssue({
+      id: number,
+      url: options.issueUrl,
+      repo: `${owner}/${repo}`,
+      number,
+      title: "(claimed)",
+      status: "claimed",
+      labels: [],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      vetted: false
+    });
+    stateManager2.save();
+  } catch (error) {
+    console.error(
+      `Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`
+    );
+  }
   return {
     commentUrl: comment.html_url,
     issueUrl: options.issueUrl
@@ -14320,6 +14331,13 @@ __export(setup_exports, {
   runCheckSetup: () => runCheckSetup,
   runSetup: () => runSetup
 });
+function parsePositiveInt(value, settingName) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+    throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+  }
+  return parsed;
+}
 async function runSetup(options) {
   const stateManager2 = getStateManager();
   const config = stateManager2.getState().config;
@@ -14335,18 +14353,24 @@ async function runSetup(options) {
           stateManager2.updateConfig({ githubUsername: value });
           results[key] = value;
           break;
-        case "maxActivePRs":
-          stateManager2.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-          results[key] = value;
+        case "maxActivePRs": {
+          const maxPRs = parsePositiveInt(value, "maxActivePRs");
+          stateManager2.updateConfig({ maxActivePRs: maxPRs });
+          results[key] = String(maxPRs);
           break;
-        case "dormantDays":
-          stateManager2.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-          results[key] = value;
+        }
+        case "dormantDays": {
+          const dormant = parsePositiveInt(value, "dormantDays");
+          stateManager2.updateConfig({ dormantThresholdDays: dormant });
+          results[key] = String(dormant);
           break;
-        case "approachingDays":
-          stateManager2.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-          results[key] = value;
+        }
+        case "approachingDays": {
+          const approaching = parsePositiveInt(value, "approachingDays");
+          stateManager2.updateConfig({ approachingDormantDays: approaching });
+          results[key] = String(approaching);
           break;
+        }
         case "languages":
           stateManager2.updateConfig({ languages: value.split(",").map((l) => l.trim()) });
           results[key] = value;
@@ -14369,9 +14393,12 @@ async function runSetup(options) {
           }
           break;
         case "minStars": {
-          const parsed = parseInt(value);
-          stateManager2.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-          results[key] = value;
+          const stars = Number(value);
+          if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+            throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+          }
+          stateManager2.updateConfig({ minStars: stars });
+          results[key] = String(stars);
           break;
         }
         case "includeDocIssues":
@@ -14495,6 +14522,7 @@ var init_setup = __esm({
   "src/commands/setup.ts"() {
     "use strict";
     init_core();
+    init_errors();
     init_validation();
   }
 });
@@ -14570,7 +14598,11 @@ async function fetchDashboardData(token) {
   digest.autoUnshelvedPRs = [];
   digest.summary.totalActivePRs = prs.length - freshShelved.length;
   stateManager2.setLastDigest(digest);
-  stateManager2.save();
+  try {
+    stateManager2.save();
+  } catch (error) {
+    console.error("Warning: Failed to save dashboard digest to state:", errorMessage(error));
+  }
   console.error(`Refreshed: ${prs.length} PRs fetched`);
   return { digest, commentedIssues };
 }
@@ -16364,6 +16396,38 @@ async function startDashboardServer(options) {
       sendError(res, 400, 'Missing or invalid "url" field');
       return;
     }
+    try {
+      validateUrl(body.url);
+      validateGitHubUrl(body.url, PR_URL_PATTERN, "PR");
+    } catch (err) {
+      if (err instanceof ValidationError) {
+        sendError(res, 400, err.message);
+      } else {
+        console.error("Unexpected error during URL validation:", err);
+        sendError(res, 400, "Invalid URL");
+      }
+      return;
+    }
+    if (body.action === "snooze") {
+      const days = body.days ?? 7;
+      if (typeof days !== "number" || !Number.isFinite(days) || days <= 0) {
+        sendError(res, 400, "Snooze days must be a positive finite number");
+        return;
+      }
+      if (body.reason !== void 0) {
+        try {
+          validateMessage(String(body.reason));
+        } catch (err) {
+          if (err instanceof ValidationError) {
+            sendError(res, 400, err.message);
+          } else {
+            console.error("Unexpected error during message validation:", err);
+            sendError(res, 400, "Invalid reason");
+          }
+          return;
+        }
+      }
+    }
     try {
       switch (body.action) {
         case "shelve":
@@ -16373,7 +16437,7 @@ async function startDashboardServer(options) {
           stateManager2.unshelvePR(body.url);
           break;
         case "snooze":
-          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days || 7);
+          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days ?? 7);
           break;
         case "unsnooze":
           stateManager2.unsnoozePR(body.url);
@@ -16527,6 +16591,7 @@ var init_dashboard_server = __esm({
     path5 = __toESM(require("path"), 1);
     init_core();
     init_errors();
+    init_validation();
     init_dashboard_data();
     init_dashboard_templates();
     VALID_ACTIONS = /* @__PURE__ */ new Set(["shelve", "unshelve", "snooze", "unsnooze"]);
@@ -16580,6 +16645,8 @@ async function runDashboard(options) {
       digest = stateManager2.getState().lastDigest;
     }
   } else {
+    console.error("Warning: No GitHub token found. Using cached data (may be stale).");
+    console.error("Set GITHUB_TOKEN or run `gh auth login` for fresh data.");
     digest = stateManager2.getState().lastDigest;
   }
   if (!digest) {
@@ -16618,7 +16685,6 @@ async function runDashboard(options) {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state, issueResponses);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   if (options.offline) {
     const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
     console.log(`
@@ -16654,7 +16720,6 @@ function writeDashboardFromState() {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   return dashboardPath;
 }
 function resolveAssetsDir() {
@@ -17043,7 +17108,7 @@ async function runLocalRepos(options) {
     stateManager2.save();
   } catch (error) {
     const msg = errorMessage(error);
-    debug("local-repos", `Failed to cache scan results: ${msg}`);
+    console.error(`Warning: Failed to cache scan results: ${msg}`);
   }
   return {
     repos,
@@ -17424,12 +17489,20 @@ Last Run: ${data.lastRunAt || "Never"}`);
 program2.command("search [count]").description("Search for new issues to work on").option("--json", "Output as JSON").action(async (count, options) => {
   try {
     const { runSearch: runSearch2 } = await Promise.resolve().then(() => (init_search(), search_exports));
+    let maxResults = 5;
+    if (count !== void 0) {
+      const parsed = Number(count);
+      if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+      }
+      maxResults = parsed;
+    }
     if (!options.json) {
       console.log(`
-Searching for issues (max ${parseInt(count) || 5})...
+Searching for issues (max ${maxResults})...
 `);
     }
-    const data = await runSearch2({ maxResults: parseInt(count) || 5 });
+    const data = await runSearch2({ maxResults });
     if (options.json) {
       outputJson(data);
     } else {
@@ -17728,17 +17801,25 @@ program2.command("checkSetup").description("Check if setup is complete").option(
 });
 var dashboardCmd = program2.command("dashboard").description("Dashboard commands");
 dashboardCmd.command("serve").description("Start interactive dashboard server").option("--port <port>", "Port to listen on", "3000").option("--no-open", "Do not open browser automatically").action(async (options) => {
-  const port = parseInt(options.port, 10);
-  if (isNaN(port) || port < 1 || port > 65535) {
-    console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-    process.exit(1);
+  try {
+    const port = parseInt(options.port, 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+      console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+      process.exit(1);
+    }
+    const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await serveDashboard2({ port, open: options.open });
+  } catch (err) {
+    handleCommandError(err);
   }
-  const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await serveDashboard2({ port, open: options.open });
 });
 dashboardCmd.option("--open", "Open in browser").option("--json", "Output as JSON").option("--offline", "Use cached data only (no GitHub API calls)").action(async (options) => {
-  const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  try {
+    const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  } catch (err) {
+    handleCommandError(err, options.json);
+  }
 });
 program2.command("parse-issue-list <path>").description("Parse a markdown issue list into structured JSON").option("--json", "Output as JSON").action(async (filePath, options) => {
   try {

package/dist/cli.js

@@ -127,10 +127,18 @@ program
     .action(async (count, options) => {
     try {
         const { runSearch } = await import('./commands/search.js');
+        let maxResults = 5;
+        if (count !== undefined) {
+            const parsed = Number(count);
+            if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+                throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+            }
+            maxResults = parsed;
+        }
         if (!options.json) {
-            console.log(`\nSearching for issues (max ${parseInt(count) || 5})...\n`);
+            console.log(`\nSearching for issues (max ${maxResults})...\n`);
         }
-        const data = await runSearch({ maxResults: parseInt(count) || 5 });
+        const data = await runSearch({ maxResults });
         if (options.json) {
             outputJson(data);
         }
@@ -516,13 +524,18 @@ dashboardCmd
     .option('--port <port>', 'Port to listen on', '3000')
     .option('--no-open', 'Do not open browser automatically')
     .action(async (options) => {
-    const port = parseInt(options.port, 10);
-    if (isNaN(port) || port < 1 || port > 65535) {
-        console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-        process.exit(1);
+    try {
+        const port = parseInt(options.port, 10);
+        if (isNaN(port) || port < 1 || port > 65535) {
+            console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+            process.exit(1);
+        }
+        const { serveDashboard } = await import('./commands/dashboard.js');
+        await serveDashboard({ port, open: options.open });
+    }
+    catch (err) {
+        handleCommandError(err);
     }
-    const { serveDashboard } = await import('./commands/dashboard.js');
-    await serveDashboard({ port, open: options.open });
 });
 // Keep bare `dashboard` (no subcommand) for backward compat — generates static HTML
 dashboardCmd
@@ -530,8 +543,13 @@ dashboardCmd
     .option('--json', 'Output as JSON')
     .option('--offline', 'Use cached data only (no GitHub API calls)')
     .action(async (options) => {
-    const { runDashboard } = await import('./commands/dashboard.js');
-    await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    try {
+        const { runDashboard } = await import('./commands/dashboard.js');
+        await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    }
+    catch (err) {
+        handleCommandError(err, options.json);
+    }
 });
 // Parse issue list command (#82)
 program

package/dist/commands/comments.js

@@ -4,9 +4,10 @@
  */
 import { getStateManager, getOctokit, parseGitHubUrl, requireGitHubToken } from '../core/index.js';
 import { paginateAll } from '../core/pagination.js';
-import { validateUrl, validateMessage } from './validation.js';
+import { validateUrl, validateMessage, validateGitHubUrl, PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, ISSUE_URL_PATTERN, } from './validation.js';
 export async function runComments(options) {
     validateUrl(options.prUrl);
+    validateGitHubUrl(options.prUrl, PR_URL_PATTERN, 'PR');
     const token = requireGitHubToken();
     const stateManager = getStateManager();
     const octokit = getOctokit(token);
@@ -97,6 +98,7 @@ export async function runComments(options) {
 }
 export async function runPost(options) {
     validateUrl(options.url);
+    validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, 'issue or PR');
     if (!options.message.trim()) {
         throw new Error('No message provided');
     }
@@ -122,6 +124,7 @@ export async function runPost(options) {
 }
 export async function runClaim(options) {
     validateUrl(options.issueUrl);
+    validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, 'issue');
     const token = requireGitHubToken();
     // Default claim message or custom
     const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
@@ -139,21 +142,26 @@ export async function runClaim(options) {
         issue_number: number,
         body: message,
     });
-    // Add to tracked issues
-    const stateManager = getStateManager();
-    stateManager.addIssue({
-        id: number,
-        url: options.issueUrl,
-        repo: `${owner}/${repo}`,
-        number,
-        title: '(claimed)',
-        status: 'claimed',
-        labels: [],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-        vetted: false,
-    });
-    stateManager.save();
+    // Add to tracked issues — non-fatal if state save fails (comment already posted)
+    try {
+        const stateManager = getStateManager();
+        stateManager.addIssue({
+            id: number,
+            url: options.issueUrl,
+            repo: `${owner}/${repo}`,
+            number,
+            title: '(claimed)',
+            status: 'claimed',
+            labels: [],
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            vetted: false,
+        });
+        stateManager.save();
+    }
+    catch (error) {
+        console.error(`Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`);
+    }
     return {
         commentUrl: comment.html_url,
         issueUrl: options.issueUrl,

package/dist/commands/dashboard-data.js

@@ -88,7 +88,12 @@ export async function fetchDashboardData(token) {
     digest.autoUnshelvedPRs = [];
     digest.summary.totalActivePRs = prs.length - freshShelved.length;
     stateManager.setLastDigest(digest);
-    stateManager.save();
+    try {
+        stateManager.save();
+    }
+    catch (error) {
+        console.error('Warning: Failed to save dashboard digest to state:', errorMessage(error));
+    }
     console.error(`Refreshed: ${prs.length} PRs fetched`);
     return { digest, commentedIssues };
 }

package/dist/commands/dashboard-server.js

@@ -9,7 +9,8 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { getStateManager, getGitHubToken } from '../core/index.js';
-import { errorMessage } from '../core/errors.js';
+import { errorMessage, ValidationError } from '../core/errors.js';
+import { validateUrl, validateGitHubUrl, validateMessage, PR_URL_PATTERN } from './validation.js';
 import { fetchDashboardData, computePRsByRepo, computeTopRepos, getMonthlyData } from './dashboard-data.js';
 import { buildDashboardStats } from './dashboard-templates.js';
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -185,6 +186,44 @@ export async function startDashboardServer(options) {
             sendError(res, 400, 'Missing or invalid "url" field');
             return;
         }
+        // Validate URL format — same checks as CLI commands
+        try {
+            validateUrl(body.url);
+            validateGitHubUrl(body.url, PR_URL_PATTERN, 'PR');
+        }
+        catch (err) {
+            if (err instanceof ValidationError) {
+                sendError(res, 400, err.message);
+            }
+            else {
+                console.error('Unexpected error during URL validation:', err);
+                sendError(res, 400, 'Invalid URL');
+            }
+            return;
+        }
+        // Validate snooze-specific fields
+        if (body.action === 'snooze') {
+            const days = body.days ?? 7;
+            if (typeof days !== 'number' || !Number.isFinite(days) || days <= 0) {
+                sendError(res, 400, 'Snooze days must be a positive finite number');
+                return;
+            }
+            if (body.reason !== undefined) {
+                try {
+                    validateMessage(String(body.reason));
+                }
+                catch (err) {
+                    if (err instanceof ValidationError) {
+                        sendError(res, 400, err.message);
+                    }
+                    else {
+                        console.error('Unexpected error during message validation:', err);
+                        sendError(res, 400, 'Invalid reason');
+                    }
+                    return;
+                }
+            }
+        }
         try {
             switch (body.action) {
                 case 'shelve':
@@ -194,7 +233,7 @@ export async function startDashboardServer(options) {
                     stateManager.unshelvePR(body.url);
                     break;
                 case 'snooze':
-                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days || 7);
+                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days ?? 7);
                     break;
                 case 'unsnooze':
                     stateManager.unsnoozePR(body.url);

package/dist/commands/dashboard.js

@@ -46,7 +46,9 @@ export async function runDashboard(options) {
         }
     }
     else {
-        // No token and not offline — fall back to cached digest
+        // No token and not offline — fall back to cached digest with warning
+        console.error('Warning: No GitHub token found. Using cached data (may be stale).');
+        console.error('Set GITHUB_TOKEN or run `gh auth login` for fresh data.');
         digest = stateManager.getState().lastDigest;
     }
     // Check if we have a digest to display
@@ -89,7 +91,6 @@ export async function runDashboard(options) {
     // Write to file in ~/.oss-autopilot/
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     if (options.offline) {
         const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
         console.log(`\n📊 Dashboard generated (offline, cached data from ${lastUpdated}): ${dashboardPath}`);
@@ -131,7 +132,6 @@ export function writeDashboardFromState() {
     const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     return dashboardPath;
 }
 /**

package/dist/commands/local-repos.js

@@ -117,7 +117,7 @@ export async function runLocalRepos(options) {
     }
     catch (error) {
         const msg = errorMessage(error);
-        debug('local-repos', `Failed to cache scan results: ${msg}`);
+        console.error(`Warning: Failed to cache scan results: ${msg}`);
     }
     return {
         repos,

package/dist/commands/setup.js

@@ -3,7 +3,16 @@
  * Interactive setup / configuration
  */
 import { getStateManager, DEFAULT_CONFIG } from '../core/index.js';
+import { ValidationError } from '../core/errors.js';
 import { validateGitHubUsername } from './validation.js';
+/** Parse and validate a positive integer setting value. */
+function parsePositiveInt(value, settingName) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+    }
+    return parsed;
+}
 export async function runSetup(options) {
     const stateManager = getStateManager();
     const config = stateManager.getState().config;
@@ -20,18 +29,24 @@ export async function runSetup(options) {
                     stateManager.updateConfig({ githubUsername: value });
                     results[key] = value;
                     break;
-                case 'maxActivePRs':
-                    stateManager.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-                    results[key] = value;
+                case 'maxActivePRs': {
+                    const maxPRs = parsePositiveInt(value, 'maxActivePRs');
+                    stateManager.updateConfig({ maxActivePRs: maxPRs });
+                    results[key] = String(maxPRs);
                     break;
-                case 'dormantDays':
-                    stateManager.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-                    results[key] = value;
+                }
+                case 'dormantDays': {
+                    const dormant = parsePositiveInt(value, 'dormantDays');
+                    stateManager.updateConfig({ dormantThresholdDays: dormant });
+                    results[key] = String(dormant);
                     break;
-                case 'approachingDays':
-                    stateManager.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-                    results[key] = value;
+                }
+                case 'approachingDays': {
+                    const approaching = parsePositiveInt(value, 'approachingDays');
+                    stateManager.updateConfig({ approachingDormantDays: approaching });
+                    results[key] = String(approaching);
                     break;
+                }
                 case 'languages':
                     stateManager.updateConfig({ languages: value.split(',').map((l) => l.trim()) });
                     results[key] = value;
@@ -55,9 +70,12 @@ export async function runSetup(options) {
                     }
                     break;
                 case 'minStars': {
-                    const parsed = parseInt(value);
-                    stateManager.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-                    results[key] = value;
+                    const stars = Number(value);
+                    if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+                        throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+                    }
+                    stateManager.updateConfig({ minStars: stars });
+                    results[key] = String(stars);
                     break;
                 }
                 case 'includeDocIssues':

package/dist/core/daily-logic.js

@@ -11,6 +11,7 @@
  *   - formatBriefSummary / formatSummary / printDigest — rendering
  */
 import { formatRelativeTime } from './utils.js';
+import { warn } from './logger.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -45,7 +46,7 @@ function buildRepoMap(prs, label) {
     const repoMap = new Map();
     for (const pr of prs) {
         if (!pr.repo) {
-            console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+            warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
             continue;
         }
         const existing = repoMap.get(pr.repo) || [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "0.42.4",
+  "version": "0.42.5",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {