@oss-autopilot/core 0.42.4 → 0.42.6

package/dist/cli.bundle.cjs

@@ -10847,6 +10847,9 @@ var init_display_utils = __esm({
 });
 
 // src/core/github-stats.ts
+function emptyPRCountsResult() {
+  return { repos: /* @__PURE__ */ new Map(), monthlyCounts: {}, monthlyOpenedCounts: {}, dailyActivityCounts: {} };
+}
 function isCachedPRCounts(v) {
   if (typeof v !== "object" || v === null) return false;
   const obj = v;
@@ -10854,7 +10857,7 @@ function isCachedPRCounts(v) {
 }
 async function fetchUserPRCounts(octokit, githubUsername, query, label, accumulateRepo) {
   if (!githubUsername) {
-    return { repos: /* @__PURE__ */ new Map(), monthlyCounts: {}, monthlyOpenedCounts: {}, dailyActivityCounts: {} };
+    return emptyPRCountsResult();
   }
   const cache = getHttpCache();
   const cacheKey = `pr-counts:${label}:${githubUsername}`;
@@ -10875,6 +10878,7 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
   const dailyActivityCounts = {};
   let page = 1;
   let fetched = 0;
+  let totalCount;
   while (true) {
     const { data } = await octokit.search.issuesAndPullRequests({
       q: `is:pr ${query} author:${githubUsername}`,
@@ -10883,6 +10887,7 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
       per_page: 100,
       page
     });
+    totalCount = data.total_count;
     for (const item of data.items) {
       const parsed = extractOwnerRepo(item.html_url);
       if (!parsed) {
@@ -10907,11 +10912,17 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
       }
     }
     fetched += data.items.length;
-    if (fetched >= data.total_count || fetched >= 1e3 || data.items.length === 0) {
+    if (fetched >= data.total_count || fetched >= 1e3 || data.items.length === 0 || page >= MAX_PAGINATION_PAGES) {
       break;
     }
     page++;
   }
+  if (fetched < totalCount && page >= MAX_PAGINATION_PAGES) {
+    warn(
+      MODULE6,
+      `Pagination capped at ${MAX_PAGINATION_PAGES} pages: fetched ${fetched} of ${totalCount} ${label} PRs. Stats may be incomplete for prolific contributors.`
+    );
+  }
   debug(MODULE6, `Found ${fetched} ${label} PRs across ${repos.size} repos`);
   cache.set(cacheKey, "", {
     reposEntries: Array.from(repos.entries()),
@@ -11020,7 +11031,7 @@ async function fetchRecentlyMergedPRs(octokit, config, days = 7) {
     }
   );
 }
-var MODULE6, PR_COUNTS_CACHE_TTL_MS;
+var MODULE6, PR_COUNTS_CACHE_TTL_MS, MAX_PAGINATION_PAGES;
 var init_github_stats = __esm({
   "src/core/github-stats.ts"() {
     "use strict";
@@ -11028,7 +11039,8 @@ var init_github_stats = __esm({
     init_logger();
     init_http_cache();
     MODULE6 = "github-stats";
-    PR_COUNTS_CACHE_TTL_MS = 60 * 60 * 1e3;
+    PR_COUNTS_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+    MAX_PAGINATION_PAGES = 3;
   }
 });
 
@@ -12943,7 +12955,7 @@ function buildRepoMap(prs, label) {
   const repoMap = /* @__PURE__ */ new Map();
   for (const pr of prs) {
     if (!pr.repo) {
-      console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+      warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
       continue;
     }
     const existing = repoMap.get(pr.repo) || [];
@@ -13348,6 +13360,7 @@ var init_daily_logic = __esm({
   "src/core/daily-logic.ts"() {
     "use strict";
     init_utils();
+    init_logger();
     CRITICAL_STATUSES = /* @__PURE__ */ new Set([
       "needs_response",
       "needs_changes",
@@ -13475,8 +13488,14 @@ async function fetchPRData(prMonitor, token) {
   const issueMonitor = new IssueConversationMonitor(token);
   const [mergedResult, closedResult, recentlyClosedPRs, recentlyMergedPRs, issueConversationResult] = await Promise.all(
     [
-      prMonitor.fetchUserMergedPRCounts(),
-      prMonitor.fetchUserClosedPRCounts(),
+      prMonitor.fetchUserMergedPRCounts().catch((err) => {
+        console.error(`Warning: Failed to fetch merged PR counts: ${errorMessage(err)}`);
+        return emptyPRCountsResult();
+      }),
+      prMonitor.fetchUserClosedPRCounts().catch((err) => {
+        console.error(`Warning: Failed to fetch closed PR counts: ${errorMessage(err)}`);
+        return emptyPRCountsResult();
+      }),
       prMonitor.fetchRecentlyClosedPRs().catch((err) => {
         console.error(`Warning: Failed to fetch recently closed PRs: ${errorMessage(err)}`);
         return [];
@@ -13625,12 +13644,16 @@ async function updateRepoScores(prMonitor, prs, mergedCounts, closedCounts) {
 function updateAnalytics(prs, monthlyCounts, monthlyClosedCounts, openedFromMerged, openedFromClosed) {
   const stateManager2 = getStateManager();
   try {
-    stateManager2.setMonthlyMergedCounts(monthlyCounts);
+    if (Object.keys(monthlyCounts).length > 0) {
+      stateManager2.setMonthlyMergedCounts(monthlyCounts);
+    }
   } catch (error) {
     console.error("[DAILY] Failed to store monthly merged counts:", errorMessage(error));
   }
   try {
-    stateManager2.setMonthlyClosedCounts(monthlyClosedCounts);
+    if (Object.keys(monthlyClosedCounts).length > 0) {
+      stateManager2.setMonthlyClosedCounts(monthlyClosedCounts);
+    }
   } catch (error) {
     console.error("[DAILY] Failed to store monthly closed counts:", errorMessage(error));
   }
@@ -13645,7 +13668,9 @@ function updateAnalytics(prs, monthlyCounts, monthlyClosedCounts, openedFromMerg
         combinedOpenedCounts[month] = (combinedOpenedCounts[month] || 0) + 1;
       }
     }
-    stateManager2.setMonthlyOpenedCounts(combinedOpenedCounts);
+    if (Object.keys(combinedOpenedCounts).length > 0) {
+      stateManager2.setMonthlyOpenedCounts(combinedOpenedCounts);
+    }
   } catch (error) {
     console.error("[DAILY] Failed to compute/store monthly opened counts:", errorMessage(error));
   }
@@ -13815,6 +13840,7 @@ var init_daily = __esm({
     "use strict";
     init_core();
     init_errors();
+    init_github_stats();
     init_json();
     init_core();
   }
@@ -13947,12 +13973,13 @@ function validateGitHubUsername(username) {
   }
   return trimmed;
 }
-var PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
+var PR_URL_PATTERN, ISSUE_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, MAX_URL_LENGTH, MAX_MESSAGE_LENGTH, MAX_USERNAME_LENGTH, USERNAME_CHARS_PATTERN, CONSECUTIVE_HYPHENS_PATTERN;
 var init_validation = __esm({
   "src/commands/validation.ts"() {
     "use strict";
     init_errors();
     PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+$/;
+    ISSUE_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/issues\/\d+$/;
     ISSUE_OR_PR_URL_PATTERN = /^https:\/\/github\.com\/[^/]+\/[^/]+\/(issues|pull)\/\d+$/;
     MAX_URL_LENGTH = 2048;
     MAX_MESSAGE_LENGTH = 1e3;
@@ -14072,6 +14099,7 @@ __export(comments_exports, {
 });
 async function runComments(options) {
   validateUrl(options.prUrl);
+  validateGitHubUrl(options.prUrl, PR_URL_PATTERN, "PR");
   const token = requireGitHubToken();
   const stateManager2 = getStateManager();
   const octokit = getOctokit(token);
@@ -14155,6 +14183,7 @@ async function runComments(options) {
 }
 async function runPost(options) {
   validateUrl(options.url);
+  validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, "issue or PR");
   if (!options.message.trim()) {
     throw new Error("No message provided");
   }
@@ -14179,6 +14208,7 @@ async function runPost(options) {
 }
 async function runClaim(options) {
   validateUrl(options.issueUrl);
+  validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, "issue");
   const token = requireGitHubToken();
   const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
   validateMessage(message);
@@ -14194,20 +14224,26 @@ async function runClaim(options) {
     issue_number: number,
     body: message
   });
-  const stateManager2 = getStateManager();
-  stateManager2.addIssue({
-    id: number,
-    url: options.issueUrl,
-    repo: `${owner}/${repo}`,
-    number,
-    title: "(claimed)",
-    status: "claimed",
-    labels: [],
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    vetted: false
-  });
-  stateManager2.save();
+  try {
+    const stateManager2 = getStateManager();
+    stateManager2.addIssue({
+      id: number,
+      url: options.issueUrl,
+      repo: `${owner}/${repo}`,
+      number,
+      title: "(claimed)",
+      status: "claimed",
+      labels: [],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      vetted: false
+    });
+    stateManager2.save();
+  } catch (error) {
+    console.error(
+      `Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`
+    );
+  }
   return {
     commentUrl: comment.html_url,
     issueUrl: options.issueUrl
@@ -14320,6 +14356,13 @@ __export(setup_exports, {
   runCheckSetup: () => runCheckSetup,
   runSetup: () => runSetup
 });
+function parsePositiveInt(value, settingName) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+    throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+  }
+  return parsed;
+}
 async function runSetup(options) {
   const stateManager2 = getStateManager();
   const config = stateManager2.getState().config;
@@ -14335,18 +14378,24 @@ async function runSetup(options) {
           stateManager2.updateConfig({ githubUsername: value });
           results[key] = value;
           break;
-        case "maxActivePRs":
-          stateManager2.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-          results[key] = value;
+        case "maxActivePRs": {
+          const maxPRs = parsePositiveInt(value, "maxActivePRs");
+          stateManager2.updateConfig({ maxActivePRs: maxPRs });
+          results[key] = String(maxPRs);
           break;
-        case "dormantDays":
-          stateManager2.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-          results[key] = value;
+        }
+        case "dormantDays": {
+          const dormant = parsePositiveInt(value, "dormantDays");
+          stateManager2.updateConfig({ dormantThresholdDays: dormant });
+          results[key] = String(dormant);
           break;
-        case "approachingDays":
-          stateManager2.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-          results[key] = value;
+        }
+        case "approachingDays": {
+          const approaching = parsePositiveInt(value, "approachingDays");
+          stateManager2.updateConfig({ approachingDormantDays: approaching });
+          results[key] = String(approaching);
           break;
+        }
         case "languages":
           stateManager2.updateConfig({ languages: value.split(",").map((l) => l.trim()) });
           results[key] = value;
@@ -14369,9 +14418,12 @@ async function runSetup(options) {
           }
           break;
         case "minStars": {
-          const parsed = parseInt(value);
-          stateManager2.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-          results[key] = value;
+          const stars = Number(value);
+          if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+            throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+          }
+          stateManager2.updateConfig({ minStars: stars });
+          results[key] = String(stars);
           break;
         }
         case "includeDocIssues":
@@ -14495,6 +14547,7 @@ var init_setup = __esm({
   "src/commands/setup.ts"() {
     "use strict";
     init_core();
+    init_errors();
     init_validation();
   }
 });
@@ -14514,8 +14567,14 @@ async function fetchDashboardData(token) {
       console.error(`Warning: Failed to fetch recently merged PRs: ${errorMessage(err)}`);
       return [];
     }),
-    prMonitor.fetchUserMergedPRCounts(),
-    prMonitor.fetchUserClosedPRCounts(),
+    prMonitor.fetchUserMergedPRCounts().catch((err) => {
+      console.error(`Warning: Failed to fetch merged PR counts: ${errorMessage(err)}`);
+      return emptyPRCountsResult();
+    }),
+    prMonitor.fetchUserClosedPRCounts().catch((err) => {
+      console.error(`Warning: Failed to fetch closed PR counts: ${errorMessage(err)}`);
+      return emptyPRCountsResult();
+    }),
     issueMonitor.fetchCommentedIssues().catch((error) => {
       const msg = errorMessage(error);
       if (msg.includes("No GitHub username configured")) {
@@ -14539,12 +14598,16 @@ async function fetchDashboardData(token) {
   const { monthlyCounts, monthlyOpenedCounts: openedFromMerged } = mergedResult;
   const { monthlyCounts: monthlyClosedCounts, monthlyOpenedCounts: openedFromClosed } = closedResult;
   try {
-    stateManager2.setMonthlyMergedCounts(monthlyCounts);
+    if (Object.keys(monthlyCounts).length > 0) {
+      stateManager2.setMonthlyMergedCounts(monthlyCounts);
+    }
   } catch (error) {
     console.error("[DASHBOARD] Failed to store monthly merged counts:", errorMessage(error));
   }
   try {
-    stateManager2.setMonthlyClosedCounts(monthlyClosedCounts);
+    if (Object.keys(monthlyClosedCounts).length > 0) {
+      stateManager2.setMonthlyClosedCounts(monthlyClosedCounts);
+    }
   } catch (error) {
     console.error("[DASHBOARD] Failed to store monthly closed counts:", errorMessage(error));
   }
@@ -14559,7 +14622,9 @@ async function fetchDashboardData(token) {
         combinedOpenedCounts[month] = (combinedOpenedCounts[month] || 0) + 1;
       }
     }
-    stateManager2.setMonthlyOpenedCounts(combinedOpenedCounts);
+    if (Object.keys(combinedOpenedCounts).length > 0) {
+      stateManager2.setMonthlyOpenedCounts(combinedOpenedCounts);
+    }
   } catch (error) {
     console.error("[DASHBOARD] Failed to store monthly opened counts:", errorMessage(error));
   }
@@ -14570,7 +14635,11 @@ async function fetchDashboardData(token) {
   digest.autoUnshelvedPRs = [];
   digest.summary.totalActivePRs = prs.length - freshShelved.length;
   stateManager2.setLastDigest(digest);
-  stateManager2.save();
+  try {
+    stateManager2.save();
+  } catch (error) {
+    console.error("Warning: Failed to save dashboard digest to state:", errorMessage(error));
+  }
   console.error(`Refreshed: ${prs.length} PRs fetched`);
   return { digest, commentedIssues };
 }
@@ -14602,6 +14671,7 @@ var init_dashboard_data = __esm({
     "use strict";
     init_core();
     init_errors();
+    init_github_stats();
     init_daily();
   }
 });
@@ -16364,6 +16434,38 @@ async function startDashboardServer(options) {
       sendError(res, 400, 'Missing or invalid "url" field');
       return;
     }
+    try {
+      validateUrl(body.url);
+      validateGitHubUrl(body.url, PR_URL_PATTERN, "PR");
+    } catch (err) {
+      if (err instanceof ValidationError) {
+        sendError(res, 400, err.message);
+      } else {
+        console.error("Unexpected error during URL validation:", err);
+        sendError(res, 400, "Invalid URL");
+      }
+      return;
+    }
+    if (body.action === "snooze") {
+      const days = body.days ?? 7;
+      if (typeof days !== "number" || !Number.isFinite(days) || days <= 0) {
+        sendError(res, 400, "Snooze days must be a positive finite number");
+        return;
+      }
+      if (body.reason !== void 0) {
+        try {
+          validateMessage(String(body.reason));
+        } catch (err) {
+          if (err instanceof ValidationError) {
+            sendError(res, 400, err.message);
+          } else {
+            console.error("Unexpected error during message validation:", err);
+            sendError(res, 400, "Invalid reason");
+          }
+          return;
+        }
+      }
+    }
     try {
       switch (body.action) {
         case "shelve":
@@ -16373,7 +16475,7 @@ async function startDashboardServer(options) {
           stateManager2.unshelvePR(body.url);
           break;
         case "snooze":
-          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days || 7);
+          stateManager2.snoozePR(body.url, body.reason || "Snoozed via dashboard", body.days ?? 7);
           break;
         case "unsnooze":
           stateManager2.unsnoozePR(body.url);
@@ -16527,6 +16629,7 @@ var init_dashboard_server = __esm({
     path5 = __toESM(require("path"), 1);
     init_core();
     init_errors();
+    init_validation();
     init_dashboard_data();
     init_dashboard_templates();
     VALID_ACTIONS = /* @__PURE__ */ new Set(["shelve", "unshelve", "snooze", "unsnooze"]);
@@ -16580,6 +16683,8 @@ async function runDashboard(options) {
       digest = stateManager2.getState().lastDigest;
     }
   } else {
+    console.error("Warning: No GitHub token found. Using cached data (may be stale).");
+    console.error("Set GITHUB_TOKEN or run `gh auth login` for fresh data.");
     digest = stateManager2.getState().lastDigest;
   }
   if (!digest) {
@@ -16618,7 +16723,6 @@ async function runDashboard(options) {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state, issueResponses);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   if (options.offline) {
     const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
     console.log(`
@@ -16654,7 +16758,6 @@ function writeDashboardFromState() {
   const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
   const dashboardPath = getDashboardPath();
   fs6.writeFileSync(dashboardPath, html, { mode: 420 });
-  fs6.chmodSync(dashboardPath, 420);
   return dashboardPath;
 }
 function resolveAssetsDir() {
@@ -17043,7 +17146,7 @@ async function runLocalRepos(options) {
     stateManager2.save();
   } catch (error) {
     const msg = errorMessage(error);
-    debug("local-repos", `Failed to cache scan results: ${msg}`);
+    console.error(`Warning: Failed to cache scan results: ${msg}`);
   }
   return {
     repos,
@@ -17424,12 +17527,20 @@ Last Run: ${data.lastRunAt || "Never"}`);
 program2.command("search [count]").description("Search for new issues to work on").option("--json", "Output as JSON").action(async (count, options) => {
   try {
     const { runSearch: runSearch2 } = await Promise.resolve().then(() => (init_search(), search_exports));
+    let maxResults = 5;
+    if (count !== void 0) {
+      const parsed = Number(count);
+      if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+      }
+      maxResults = parsed;
+    }
     if (!options.json) {
       console.log(`
-Searching for issues (max ${parseInt(count) || 5})...
+Searching for issues (max ${maxResults})...
 `);
     }
-    const data = await runSearch2({ maxResults: parseInt(count) || 5 });
+    const data = await runSearch2({ maxResults });
     if (options.json) {
       outputJson(data);
     } else {
@@ -17728,17 +17839,25 @@ program2.command("checkSetup").description("Check if setup is complete").option(
 });
 var dashboardCmd = program2.command("dashboard").description("Dashboard commands");
 dashboardCmd.command("serve").description("Start interactive dashboard server").option("--port <port>", "Port to listen on", "3000").option("--no-open", "Do not open browser automatically").action(async (options) => {
-  const port = parseInt(options.port, 10);
-  if (isNaN(port) || port < 1 || port > 65535) {
-    console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-    process.exit(1);
+  try {
+    const port = parseInt(options.port, 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+      console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+      process.exit(1);
+    }
+    const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await serveDashboard2({ port, open: options.open });
+  } catch (err) {
+    handleCommandError(err);
   }
-  const { serveDashboard: serveDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await serveDashboard2({ port, open: options.open });
 });
 dashboardCmd.option("--open", "Open in browser").option("--json", "Output as JSON").option("--offline", "Use cached data only (no GitHub API calls)").action(async (options) => {
-  const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
-  await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  try {
+    const { runDashboard: runDashboard2 } = await Promise.resolve().then(() => (init_dashboard(), dashboard_exports));
+    await runDashboard2({ open: options.open, json: options.json, offline: options.offline });
+  } catch (err) {
+    handleCommandError(err, options.json);
+  }
 });
 program2.command("parse-issue-list <path>").description("Parse a markdown issue list into structured JSON").option("--json", "Output as JSON").action(async (filePath, options) => {
   try {

package/dist/cli.js

@@ -127,10 +127,18 @@ program
     .action(async (count, options) => {
     try {
         const { runSearch } = await import('./commands/search.js');
+        let maxResults = 5;
+        if (count !== undefined) {
+            const parsed = Number(count);
+            if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+                throw new Error(`Invalid count "${count}". Must be a positive integer.`);
+            }
+            maxResults = parsed;
+        }
         if (!options.json) {
-            console.log(`\nSearching for issues (max ${parseInt(count) || 5})...\n`);
+            console.log(`\nSearching for issues (max ${maxResults})...\n`);
         }
-        const data = await runSearch({ maxResults: parseInt(count) || 5 });
+        const data = await runSearch({ maxResults });
         if (options.json) {
             outputJson(data);
         }
@@ -516,13 +524,18 @@ dashboardCmd
     .option('--port <port>', 'Port to listen on', '3000')
     .option('--no-open', 'Do not open browser automatically')
     .action(async (options) => {
-    const port = parseInt(options.port, 10);
-    if (isNaN(port) || port < 1 || port > 65535) {
-        console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
-        process.exit(1);
+    try {
+        const port = parseInt(options.port, 10);
+        if (isNaN(port) || port < 1 || port > 65535) {
+            console.error(`Invalid port number: "${options.port}". Must be an integer between 1 and 65535.`);
+            process.exit(1);
+        }
+        const { serveDashboard } = await import('./commands/dashboard.js');
+        await serveDashboard({ port, open: options.open });
+    }
+    catch (err) {
+        handleCommandError(err);
     }
-    const { serveDashboard } = await import('./commands/dashboard.js');
-    await serveDashboard({ port, open: options.open });
 });
 // Keep bare `dashboard` (no subcommand) for backward compat — generates static HTML
 dashboardCmd
@@ -530,8 +543,13 @@ dashboardCmd
     .option('--json', 'Output as JSON')
     .option('--offline', 'Use cached data only (no GitHub API calls)')
     .action(async (options) => {
-    const { runDashboard } = await import('./commands/dashboard.js');
-    await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    try {
+        const { runDashboard } = await import('./commands/dashboard.js');
+        await runDashboard({ open: options.open, json: options.json, offline: options.offline });
+    }
+    catch (err) {
+        handleCommandError(err, options.json);
+    }
 });
 // Parse issue list command (#82)
 program

package/dist/commands/comments.js

@@ -4,9 +4,10 @@
  */
 import { getStateManager, getOctokit, parseGitHubUrl, requireGitHubToken } from '../core/index.js';
 import { paginateAll } from '../core/pagination.js';
-import { validateUrl, validateMessage } from './validation.js';
+import { validateUrl, validateMessage, validateGitHubUrl, PR_URL_PATTERN, ISSUE_OR_PR_URL_PATTERN, ISSUE_URL_PATTERN, } from './validation.js';
 export async function runComments(options) {
     validateUrl(options.prUrl);
+    validateGitHubUrl(options.prUrl, PR_URL_PATTERN, 'PR');
     const token = requireGitHubToken();
     const stateManager = getStateManager();
     const octokit = getOctokit(token);
@@ -97,6 +98,7 @@ export async function runComments(options) {
 }
 export async function runPost(options) {
     validateUrl(options.url);
+    validateGitHubUrl(options.url, ISSUE_OR_PR_URL_PATTERN, 'issue or PR');
     if (!options.message.trim()) {
         throw new Error('No message provided');
     }
@@ -122,6 +124,7 @@ export async function runPost(options) {
 }
 export async function runClaim(options) {
     validateUrl(options.issueUrl);
+    validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, 'issue');
     const token = requireGitHubToken();
     // Default claim message or custom
     const message = options.message || "Hi! I'd like to work on this issue. Could you assign it to me?";
@@ -139,21 +142,26 @@ export async function runClaim(options) {
         issue_number: number,
         body: message,
     });
-    // Add to tracked issues
-    const stateManager = getStateManager();
-    stateManager.addIssue({
-        id: number,
-        url: options.issueUrl,
-        repo: `${owner}/${repo}`,
-        number,
-        title: '(claimed)',
-        status: 'claimed',
-        labels: [],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-        vetted: false,
-    });
-    stateManager.save();
+    // Add to tracked issues — non-fatal if state save fails (comment already posted)
+    try {
+        const stateManager = getStateManager();
+        stateManager.addIssue({
+            id: number,
+            url: options.issueUrl,
+            repo: `${owner}/${repo}`,
+            number,
+            title: '(claimed)',
+            status: 'claimed',
+            labels: [],
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            vetted: false,
+        });
+        stateManager.save();
+    }
+    catch (error) {
+        console.error(`Warning: Comment posted on ${options.issueUrl} but failed to save to local state: ${error instanceof Error ? error.message : error}`);
+    }
     return {
         commentUrl: comment.html_url,
         issueUrl: options.issueUrl,

package/dist/commands/daily.js

@@ -8,6 +8,7 @@
  */
 import { getStateManager, PRMonitor, IssueConversationMonitor, requireGitHubToken, CRITICAL_STATUSES, computeRepoSignals, groupPRsByRepo, assessCapacity, collectActionableIssues, computeActionMenu, toShelvedPRRef, formatBriefSummary, formatSummary, } from '../core/index.js';
 import { errorMessage } from '../core/errors.js';
+import { emptyPRCountsResult } from '../core/github-stats.js';
 import { deduplicateDigest, compactActionableIssues, compactRepoGroups, } from '../formatters/json.js';
 // Re-export domain functions so existing consumers (tests, dashboard, startup)
 // can continue importing from './daily.js' without changes.
@@ -28,11 +29,17 @@ async function fetchPRData(prMonitor, token) {
         console.error(`Warning: ${failures.length} PR fetch(es) failed`);
     }
     // Fetch merged PR counts, closed PR counts, recently closed PRs, recently merged PRs, and commented issues in parallel
-    // Recently closed/merged are non-critical (cosmetic sections), so isolate their failure
+    // All stats fetches are non-critical (cosmetic/scoring), so isolate their failure
     const issueMonitor = new IssueConversationMonitor(token);
     const [mergedResult, closedResult, recentlyClosedPRs, recentlyMergedPRs, issueConversationResult] = await Promise.all([
-        prMonitor.fetchUserMergedPRCounts(),
-        prMonitor.fetchUserClosedPRCounts(),
+        prMonitor.fetchUserMergedPRCounts().catch((err) => {
+            console.error(`Warning: Failed to fetch merged PR counts: ${errorMessage(err)}`);
+            return emptyPRCountsResult();
+        }),
+        prMonitor.fetchUserClosedPRCounts().catch((err) => {
+            console.error(`Warning: Failed to fetch closed PR counts: ${errorMessage(err)}`);
+            return emptyPRCountsResult();
+        }),
         prMonitor.fetchRecentlyClosedPRs().catch((err) => {
             console.error(`Warning: Failed to fetch recently closed PRs: ${errorMessage(err)}`);
             return [];
@@ -195,15 +202,21 @@ async function updateRepoScores(prMonitor, prs, mergedCounts, closedCounts) {
  */
 function updateAnalytics(prs, monthlyCounts, monthlyClosedCounts, openedFromMerged, openedFromClosed) {
     const stateManager = getStateManager();
-    // Store monthly chart data (non-critical — each metric isolated so partial failures don't leave inconsistent state)
+    // Store monthly chart data (non-critical — each metric isolated so partial failures don't leave inconsistent state).
+    // Guard: skip overwriting when the data is empty to avoid wiping existing chart data on transient API failures.
+    // An empty object means the fetch failed and fell back to emptyPRCountsResult(), so we preserve previous state.
     try {
-        stateManager.setMonthlyMergedCounts(monthlyCounts);
+        if (Object.keys(monthlyCounts).length > 0) {
+            stateManager.setMonthlyMergedCounts(monthlyCounts);
+        }
     }
     catch (error) {
         console.error('[DAILY] Failed to store monthly merged counts:', errorMessage(error));
     }
     try {
-        stateManager.setMonthlyClosedCounts(monthlyClosedCounts);
+        if (Object.keys(monthlyClosedCounts).length > 0) {
+            stateManager.setMonthlyClosedCounts(monthlyClosedCounts);
+        }
     }
     catch (error) {
         console.error('[DAILY] Failed to store monthly closed counts:', errorMessage(error));
@@ -221,7 +234,9 @@ function updateAnalytics(prs, monthlyCounts, monthlyClosedCounts, openedFromMerg
                 combinedOpenedCounts[month] = (combinedOpenedCounts[month] || 0) + 1;
             }
         }
-        stateManager.setMonthlyOpenedCounts(combinedOpenedCounts);
+        if (Object.keys(combinedOpenedCounts).length > 0) {
+            stateManager.setMonthlyOpenedCounts(combinedOpenedCounts);
+        }
     }
     catch (error) {
         console.error('[DAILY] Failed to compute/store monthly opened counts:', errorMessage(error));

package/dist/commands/dashboard-data.js

@@ -5,6 +5,7 @@
  */
 import { getStateManager, PRMonitor, IssueConversationMonitor } from '../core/index.js';
 import { errorMessage } from '../core/errors.js';
+import { emptyPRCountsResult } from '../core/github-stats.js';
 import { toShelvedPRRef } from './daily.js';
 /**
  * Fetch fresh dashboard data from GitHub.
@@ -25,8 +26,14 @@ export async function fetchDashboardData(token) {
             console.error(`Warning: Failed to fetch recently merged PRs: ${errorMessage(err)}`);
             return [];
         }),
-        prMonitor.fetchUserMergedPRCounts(),
-        prMonitor.fetchUserClosedPRCounts(),
+        prMonitor.fetchUserMergedPRCounts().catch((err) => {
+            console.error(`Warning: Failed to fetch merged PR counts: ${errorMessage(err)}`);
+            return emptyPRCountsResult();
+        }),
+        prMonitor.fetchUserClosedPRCounts().catch((err) => {
+            console.error(`Warning: Failed to fetch closed PR counts: ${errorMessage(err)}`);
+            return emptyPRCountsResult();
+        }),
         issueMonitor.fetchCommentedIssues().catch((error) => {
             const msg = errorMessage(error);
             if (msg.includes('No GitHub username configured')) {
@@ -51,14 +58,19 @@ export async function fetchDashboardData(token) {
     // Store monthly chart data (opened/merged/closed) so charts have data
     const { monthlyCounts, monthlyOpenedCounts: openedFromMerged } = mergedResult;
     const { monthlyCounts: monthlyClosedCounts, monthlyOpenedCounts: openedFromClosed } = closedResult;
+    // Guard: skip overwriting when data is empty to avoid wiping chart data on transient API failures.
     try {
-        stateManager.setMonthlyMergedCounts(monthlyCounts);
+        if (Object.keys(monthlyCounts).length > 0) {
+            stateManager.setMonthlyMergedCounts(monthlyCounts);
+        }
     }
     catch (error) {
         console.error('[DASHBOARD] Failed to store monthly merged counts:', errorMessage(error));
     }
     try {
-        stateManager.setMonthlyClosedCounts(monthlyClosedCounts);
+        if (Object.keys(monthlyClosedCounts).length > 0) {
+            stateManager.setMonthlyClosedCounts(monthlyClosedCounts);
+        }
     }
     catch (error) {
         console.error('[DASHBOARD] Failed to store monthly closed counts:', errorMessage(error));
@@ -74,7 +86,9 @@ export async function fetchDashboardData(token) {
                 combinedOpenedCounts[month] = (combinedOpenedCounts[month] || 0) + 1;
             }
         }
-        stateManager.setMonthlyOpenedCounts(combinedOpenedCounts);
+        if (Object.keys(combinedOpenedCounts).length > 0) {
+            stateManager.setMonthlyOpenedCounts(combinedOpenedCounts);
+        }
     }
     catch (error) {
         console.error('[DASHBOARD] Failed to store monthly opened counts:', errorMessage(error));
@@ -88,7 +102,12 @@ export async function fetchDashboardData(token) {
     digest.autoUnshelvedPRs = [];
     digest.summary.totalActivePRs = prs.length - freshShelved.length;
     stateManager.setLastDigest(digest);
-    stateManager.save();
+    try {
+        stateManager.save();
+    }
+    catch (error) {
+        console.error('Warning: Failed to save dashboard digest to state:', errorMessage(error));
+    }
     console.error(`Refreshed: ${prs.length} PRs fetched`);
     return { digest, commentedIssues };
 }

package/dist/commands/dashboard-server.js

@@ -9,7 +9,8 @@ import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { getStateManager, getGitHubToken } from '../core/index.js';
-import { errorMessage } from '../core/errors.js';
+import { errorMessage, ValidationError } from '../core/errors.js';
+import { validateUrl, validateGitHubUrl, validateMessage, PR_URL_PATTERN } from './validation.js';
 import { fetchDashboardData, computePRsByRepo, computeTopRepos, getMonthlyData } from './dashboard-data.js';
 import { buildDashboardStats } from './dashboard-templates.js';
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -185,6 +186,44 @@ export async function startDashboardServer(options) {
             sendError(res, 400, 'Missing or invalid "url" field');
             return;
         }
+        // Validate URL format — same checks as CLI commands
+        try {
+            validateUrl(body.url);
+            validateGitHubUrl(body.url, PR_URL_PATTERN, 'PR');
+        }
+        catch (err) {
+            if (err instanceof ValidationError) {
+                sendError(res, 400, err.message);
+            }
+            else {
+                console.error('Unexpected error during URL validation:', err);
+                sendError(res, 400, 'Invalid URL');
+            }
+            return;
+        }
+        // Validate snooze-specific fields
+        if (body.action === 'snooze') {
+            const days = body.days ?? 7;
+            if (typeof days !== 'number' || !Number.isFinite(days) || days <= 0) {
+                sendError(res, 400, 'Snooze days must be a positive finite number');
+                return;
+            }
+            if (body.reason !== undefined) {
+                try {
+                    validateMessage(String(body.reason));
+                }
+                catch (err) {
+                    if (err instanceof ValidationError) {
+                        sendError(res, 400, err.message);
+                    }
+                    else {
+                        console.error('Unexpected error during message validation:', err);
+                        sendError(res, 400, 'Invalid reason');
+                    }
+                    return;
+                }
+            }
+        }
         try {
             switch (body.action) {
                 case 'shelve':
@@ -194,7 +233,7 @@ export async function startDashboardServer(options) {
                     stateManager.unshelvePR(body.url);
                     break;
                 case 'snooze':
-                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days || 7);
+                    stateManager.snoozePR(body.url, body.reason || 'Snoozed via dashboard', body.days ?? 7);
                     break;
                 case 'unsnooze':
                     stateManager.unsnoozePR(body.url);

package/dist/commands/dashboard.js

@@ -46,7 +46,9 @@ export async function runDashboard(options) {
         }
     }
     else {
-        // No token and not offline — fall back to cached digest
+        // No token and not offline — fall back to cached digest with warning
+        console.error('Warning: No GitHub token found. Using cached data (may be stale).');
+        console.error('Set GITHUB_TOKEN or run `gh auth login` for fresh data.');
         digest = stateManager.getState().lastDigest;
     }
     // Check if we have a digest to display
@@ -89,7 +91,6 @@ export async function runDashboard(options) {
     // Write to file in ~/.oss-autopilot/
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     if (options.offline) {
         const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
         console.log(`\n📊 Dashboard generated (offline, cached data from ${lastUpdated}): ${dashboardPath}`);
@@ -131,7 +132,6 @@ export function writeDashboardFromState() {
     const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state);
     const dashboardPath = getDashboardPath();
     fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    fs.chmodSync(dashboardPath, 0o644);
     return dashboardPath;
 }
 /**

package/dist/commands/local-repos.js

@@ -117,7 +117,7 @@ export async function runLocalRepos(options) {
     }
     catch (error) {
         const msg = errorMessage(error);
-        debug('local-repos', `Failed to cache scan results: ${msg}`);
+        console.error(`Warning: Failed to cache scan results: ${msg}`);
     }
     return {
         repos,

package/dist/commands/setup.js

@@ -3,7 +3,16 @@
  * Interactive setup / configuration
  */
 import { getStateManager, DEFAULT_CONFIG } from '../core/index.js';
+import { ValidationError } from '../core/errors.js';
 import { validateGitHubUsername } from './validation.js';
+/** Parse and validate a positive integer setting value. */
+function parsePositiveInt(value, settingName) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
+        throw new ValidationError(`Invalid value for ${settingName}: "${value}". Must be a positive integer.`);
+    }
+    return parsed;
+}
 export async function runSetup(options) {
     const stateManager = getStateManager();
     const config = stateManager.getState().config;
@@ -20,18 +29,24 @@ export async function runSetup(options) {
                     stateManager.updateConfig({ githubUsername: value });
                     results[key] = value;
                     break;
-                case 'maxActivePRs':
-                    stateManager.updateConfig({ maxActivePRs: parseInt(value) || 10 });
-                    results[key] = value;
+                case 'maxActivePRs': {
+                    const maxPRs = parsePositiveInt(value, 'maxActivePRs');
+                    stateManager.updateConfig({ maxActivePRs: maxPRs });
+                    results[key] = String(maxPRs);
                     break;
-                case 'dormantDays':
-                    stateManager.updateConfig({ dormantThresholdDays: parseInt(value) || 30 });
-                    results[key] = value;
+                }
+                case 'dormantDays': {
+                    const dormant = parsePositiveInt(value, 'dormantDays');
+                    stateManager.updateConfig({ dormantThresholdDays: dormant });
+                    results[key] = String(dormant);
                     break;
-                case 'approachingDays':
-                    stateManager.updateConfig({ approachingDormantDays: parseInt(value) || 25 });
-                    results[key] = value;
+                }
+                case 'approachingDays': {
+                    const approaching = parsePositiveInt(value, 'approachingDays');
+                    stateManager.updateConfig({ approachingDormantDays: approaching });
+                    results[key] = String(approaching);
                     break;
+                }
                 case 'languages':
                     stateManager.updateConfig({ languages: value.split(',').map((l) => l.trim()) });
                     results[key] = value;
@@ -55,9 +70,12 @@ export async function runSetup(options) {
                     }
                     break;
                 case 'minStars': {
-                    const parsed = parseInt(value);
-                    stateManager.updateConfig({ minStars: isNaN(parsed) ? 50 : parsed });
-                    results[key] = value;
+                    const stars = Number(value);
+                    if (!Number.isFinite(stars) || !Number.isInteger(stars) || stars < 0) {
+                        throw new ValidationError(`Invalid value for minStars: "${value}". Must be a non-negative integer.`);
+                    }
+                    stateManager.updateConfig({ minStars: stars });
+                    results[key] = String(stars);
                     break;
                 }
                 case 'includeDocIssues':

package/dist/core/daily-logic.js

@@ -11,6 +11,7 @@
  *   - formatBriefSummary / formatSummary / printDigest — rendering
  */
 import { formatRelativeTime } from './utils.js';
+import { warn } from './logger.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -45,7 +46,7 @@ function buildRepoMap(prs, label) {
     const repoMap = new Map();
     for (const pr of prs) {
         if (!pr.repo) {
-            console.warn(`[${label}] Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
+            warn(label, `Skipping PR #${pr.number} (${pr.url}) with empty repo field`);
             continue;
         }
         const existing = repoMap.get(pr.repo) || [];

package/dist/core/github-stats.d.ts

@@ -4,7 +4,7 @@
  */
 import { Octokit } from '@octokit/rest';
 import { ClosedPR, MergedPR } from './types.js';
-/** TTL for cached PR count results (1 hour). */
+/** TTL for cached PR count results (24 hours — these stats change slowly). */
 export declare const PR_COUNTS_CACHE_TTL_MS: number;
 /** Return type shared by both merged and closed PR count functions. */
 export interface PRCountsResult<R> {
@@ -13,6 +13,8 @@ export interface PRCountsResult<R> {
     monthlyOpenedCounts: Record<string, number>;
     dailyActivityCounts: Record<string, number>;
 }
+/** Returns an empty PRCountsResult. Used as the fallback when stats fetches fail or username is empty. */
+export declare function emptyPRCountsResult<R>(): PRCountsResult<R>;
 /**
  * Fetch merged PR counts and latest merge dates per repository for the configured user.
  * Also builds a monthly histogram of all merges for the contribution timeline.

package/dist/core/github-stats.js

@@ -6,8 +6,18 @@ import { extractOwnerRepo, parseGitHubUrl, isOwnRepo } from './utils.js';
 import { debug, warn } from './logger.js';
 import { getHttpCache } from './http-cache.js';
 const MODULE = 'github-stats';
-/** TTL for cached PR count results (1 hour). */
-export const PR_COUNTS_CACHE_TTL_MS = 60 * 60 * 1000;
+/** TTL for cached PR count results (24 hours — these stats change slowly). */
+export const PR_COUNTS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Maximum number of pages to fetch during paginated PR count searches.
+ * GitHub's Search API becomes unreliable (500s, ECONNRESET) at deep pages (4-5+).
+ * 3 pages × 100 per_page = 300 results, which covers the vast majority of users.
+ */
+const MAX_PAGINATION_PAGES = 3;
+/** Returns an empty PRCountsResult. Used as the fallback when stats fetches fail or username is empty. */
+export function emptyPRCountsResult() {
+    return { repos: new Map(), monthlyCounts: {}, monthlyOpenedCounts: {}, dailyActivityCounts: {} };
+}
 /** Type guard for deserialized cache data — prevents crashes on corrupt/stale cache. */
 function isCachedPRCounts(v) {
     if (typeof v !== 'object' || v === null)
@@ -31,7 +41,7 @@ function isCachedPRCounts(v) {
  */
 async function fetchUserPRCounts(octokit, githubUsername, query, label, accumulateRepo) {
     if (!githubUsername) {
-        return { repos: new Map(), monthlyCounts: {}, monthlyOpenedCounts: {}, dailyActivityCounts: {} };
+        return emptyPRCountsResult();
     }
     // Check for a fresh cached result (avoids 10-20 paginated API calls)
     const cache = getHttpCache();
@@ -53,6 +63,7 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
     const dailyActivityCounts = {};
     let page = 1;
     let fetched = 0;
+    let totalCount;
     while (true) {
         const { data } = await octokit.search.issuesAndPullRequests({
             q: `is:pr ${query} author:${githubUsername}`,
@@ -61,6 +72,7 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
             per_page: 100,
             page,
         });
+        totalCount = data.total_count;
         for (const item of data.items) {
             const parsed = extractOwnerRepo(item.html_url);
             if (!parsed) {
@@ -95,14 +107,22 @@ async function fetchUserPRCounts(octokit, githubUsername, query, label, accumula
             }
         }
         fetched += data.items.length;
-        // Stop if we've fetched all results or hit the API limit (1000)
-        if (fetched >= data.total_count || fetched >= 1000 || data.items.length === 0) {
+        // Stop if we've fetched all results, hit the API limit (1000), or reached max pages
+        // GitHub Search API returns 500/ECONNRESET on deep pagination (page 4-5+),
+        // so we cap at MAX_PAGINATION_PAGES to avoid taking down the entire startup flow.
+        if (fetched >= data.total_count || fetched >= 1000 || data.items.length === 0 || page >= MAX_PAGINATION_PAGES) {
             break;
         }
         page++;
     }
+    if (fetched < totalCount && page >= MAX_PAGINATION_PAGES) {
+        warn(MODULE, `Pagination capped at ${MAX_PAGINATION_PAGES} pages: fetched ${fetched} of ${totalCount} ${label} PRs. Stats may be incomplete for prolific contributors.`);
+    }
     debug(MODULE, `Found ${fetched} ${label} PRs across ${repos.size} repos`);
-    // Cache the aggregated result (Map → entries array for JSON serialization)
+    // Cache the aggregated result (Map → entries array for JSON serialization).
+    // Note: truncated results (from pagination cap) are cached with the same TTL. This is an
+    // accepted tradeoff — prolific contributors (300+ PRs) may see slightly incomplete stats
+    // for up to 24 hours, but these are cosmetic and self-heal on the next cache expiry.
     cache.set(cacheKey, '', {
         reposEntries: Array.from(repos.entries()),
         monthlyCounts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "0.42.4",
+  "version": "0.42.6",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {