@oss-autopilot/core 0.43.0 → 0.44.0

package/dist/commands/dashboard-templates.d.ts

@@ -6,6 +6,7 @@
  * Pure functions with no side effects — all data is passed in as arguments.
  */
 import type { DailyDigest, AgentState, CommentedIssueWithResponse } from '../core/types.js';
-import { type DashboardStats } from './dashboard-formatters.js';
-export { escapeHtml, buildDashboardStats, type DashboardStats } from './dashboard-formatters.js';
+import type { DashboardStats } from './dashboard-data.js';
+export { escapeHtml } from './dashboard-formatters.js';
+export { buildDashboardStats, type DashboardStats } from './dashboard-data.js';
 export declare function generateDashboardHtml(stats: DashboardStats, monthlyMerged: Record<string, number>, monthlyClosed: Record<string, number>, monthlyOpened: Record<string, number>, digest: DailyDigest, state: Readonly<AgentState>, issueResponses?: CommentedIssueWithResponse[]): string;

package/dist/commands/dashboard-templates.js

@@ -9,8 +9,9 @@ import { escapeHtml } from './dashboard-formatters.js';
 import { DASHBOARD_CSS } from './dashboard-styles.js';
 import { SVG_ICONS, truncateTitle, renderHealthItems, titleMeta } from './dashboard-components.js';
 import { generateDashboardScripts } from './dashboard-scripts.js';
-// Re-export public API so existing consumers don't break
-export { escapeHtml, buildDashboardStats } from './dashboard-formatters.js';
+// Re-export public API so consumers can import from this module
+export { escapeHtml } from './dashboard-formatters.js';
+export { buildDashboardStats } from './dashboard-data.js';
 export function generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state, issueResponses = []) {
     const approachingDormantDays = state.config?.approachingDormantDays ?? 25;
     const shelvedPRs = digest.shelvedPRs || [];

package/dist/commands/dashboard.d.ts

@@ -1,18 +1,14 @@
 /**
- * Dashboard command — thin orchestrator.
- * Coordinates data fetching, template generation, and file output.
- * v2: Fetches fresh data from GitHub if token available, otherwise uses cached lastDigest.
+ * Dashboard command — serves the interactive Preact SPA dashboard.
+ * Also provides writeDashboardFromState() for generating a static HTML fallback
+ * when the SPA cannot be launched (e.g., assets not built).
  */
-interface DashboardOptions {
-    open?: boolean;
-    json?: boolean;
-    offline?: boolean;
-}
-export declare function runDashboard(options: DashboardOptions): Promise<void>;
 /**
  * Generate dashboard HTML from state (no GitHub fetch).
  * Call after executeDailyCheck() which saves fresh data to state.
  * Returns the path to the generated dashboard HTML file.
+ *
+ * Used as a safety net when the interactive SPA dashboard cannot be launched.
  */
 export declare function writeDashboardFromState(): string;
 interface ServeOptions {

package/dist/commands/dashboard.js

@@ -1,124 +1,20 @@
 /**
- * Dashboard command — thin orchestrator.
- * Coordinates data fetching, template generation, and file output.
- * v2: Fetches fresh data from GitHub if token available, otherwise uses cached lastDigest.
+ * Dashboard command — serves the interactive Preact SPA dashboard.
+ * Also provides writeDashboardFromState() for generating a static HTML fallback
+ * when the SPA cannot be launched (e.g., assets not built).
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { execFile } from 'child_process';
 import { getStateManager, getDashboardPath, getGitHubToken } from '../core/index.js';
-import { errorMessage } from '../core/errors.js';
-import { outputJson } from '../formatters/json.js';
-import { fetchDashboardData, computePRsByRepo, computeTopRepos, getMonthlyData } from './dashboard-data.js';
+import { getMonthlyData } from './dashboard-data.js';
 import { buildDashboardStats, generateDashboardHtml } from './dashboard-templates.js';
-export async function runDashboard(options) {
-    const stateManager = getStateManager();
-    const token = options.offline ? null : getGitHubToken();
-    let digest;
-    let commentedIssues = [];
-    // In offline mode, skip all GitHub API calls
-    if (options.offline) {
-        const state = stateManager.getState();
-        digest = state.lastDigest;
-        if (!digest) {
-            if (options.json) {
-                outputJson({ error: 'No cached data found. Run without --offline first.', offline: true });
-            }
-            else {
-                console.error('No cached data found. Run without --offline first.');
-            }
-            return;
-        }
-        const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
-        console.error(`Offline mode: using cached data from ${lastUpdated}`);
-    }
-    else if (token) {
-        console.error('Fetching fresh data from GitHub...');
-        try {
-            const result = await fetchDashboardData(token);
-            digest = result.digest;
-            commentedIssues = result.commentedIssues;
-        }
-        catch (error) {
-            console.error('Failed to fetch fresh data:', errorMessage(error));
-            console.error('Falling back to cached data (issue conversations unavailable)...');
-            digest = stateManager.getState().lastDigest;
-        }
-    }
-    else {
-        // No token and not offline — fall back to cached digest with warning
-        console.error('Warning: No GitHub token found. Using cached data (may be stale).');
-        console.error('Set GITHUB_TOKEN or run `gh auth login` for fresh data.');
-        digest = stateManager.getState().lastDigest;
-    }
-    // Check if we have a digest to display
-    if (!digest) {
-        if (options.json) {
-            outputJson({ error: 'No data available. Run daily check first with GITHUB_TOKEN.' });
-        }
-        else {
-            console.error('No dashboard data available. Run the daily check first:');
-            console.error('  GITHUB_TOKEN=$(gh auth token) npm start -- daily');
-        }
-        return;
-    }
-    const state = stateManager.getState();
-    // Gather data for charts from digest
-    const prsByRepo = computePRsByRepo(digest, state);
-    const topRepos = computeTopRepos(prsByRepo);
-    const { monthlyMerged, monthlyClosed, monthlyOpened } = getMonthlyData(state);
-    const stats = buildDashboardStats(digest, state);
-    if (options.json) {
-        const issueResponses = commentedIssues.filter((i) => i.status === 'new_response');
-        const jsonData = {
-            stats,
-            prsByRepo,
-            topRepos: topRepos.map(([repo, data]) => ({ repo, ...data })),
-            monthlyMerged,
-            activePRs: digest.openPRs || [],
-            commentedIssues,
-            issueResponses,
-        };
-        if (options.offline) {
-            jsonData.offline = true;
-            jsonData.lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
-        }
-        outputJson(jsonData);
-        return;
-    }
-    const issueResponses = commentedIssues.filter((i) => i.status === 'new_response');
-    const html = generateDashboardHtml(stats, monthlyMerged, monthlyClosed, monthlyOpened, digest, state, issueResponses);
-    // Write to file in ~/.oss-autopilot/
-    const dashboardPath = getDashboardPath();
-    fs.writeFileSync(dashboardPath, html, { mode: 0o644 });
-    if (options.offline) {
-        const lastUpdated = digest.generatedAt || state.lastDigestAt || state.lastRunAt;
-        console.log(`\n📊 Dashboard generated (offline, cached data from ${lastUpdated}): ${dashboardPath}`);
-    }
-    else {
-        console.log(`\n📊 Dashboard generated: ${dashboardPath}`);
-    }
-    if (options.open) {
-        // Use platform-specific open command - path is hardcoded, not user input
-        const isWindows = process.platform === 'win32';
-        const openCmd = process.platform === 'darwin' ? 'open' : isWindows ? 'cmd' : 'xdg-open';
-        const args = isWindows ? ['/c', 'start', '', dashboardPath] : [dashboardPath];
-        console.log(`Dashboard: ${dashboardPath}`);
-        execFile(openCmd, args, (error) => {
-            if (error) {
-                console.error('Failed to open browser:', error.message);
-                console.error(`Open manually: ${dashboardPath}`);
-            }
-        });
-    }
-    else {
-        console.log('Run with --open to open in browser');
-    }
-}
+// ── Static HTML fallback ────────────────────────────────────────────────────
 /**
  * Generate dashboard HTML from state (no GitHub fetch).
  * Call after executeDailyCheck() which saves fresh data to state.
  * Returns the path to the generated dashboard HTML file.
+ *
+ * Used as a safety net when the interactive SPA dashboard cannot be launched.
  */
 export function writeDashboardFromState() {
     const stateManager = getStateManager();

package/dist/commands/startup.d.ts

@@ -1,7 +1,7 @@
 /**
  * Startup command
  * Combines all pre-flight checks into a single CLI invocation:
- * auth check, setup check, daily fetch, dashboard generation, version detection, issue list detection.
+ * auth check, setup check, daily fetch, dashboard launch, version detection, issue list detection.
  *
  * Replaces the ~100-line inline bash script in commands/oss.md with a single
  * `node cli.bundle.cjs startup --json` call, reducing UI noise in Claude Code.
@@ -26,12 +26,13 @@ export declare function countIssueListItems(content: string): {
  * Returns IssueListInfo or undefined if no list found.
  */
 export declare function detectIssueList(): IssueListInfo | undefined;
+export declare function openInBrowser(url: string): void;
 /**
  * Run startup checks and return structured output.
  * Returns StartupOutput with one of three shapes:
  * 1. Setup incomplete: { version, setupComplete: false }
  * 2. Auth failure: { version, setupComplete: true, authError: "..." }
- * 3. Success: { version, setupComplete: true, daily, dashboardPath?, dashboardUrl?, issueList? }
+ * 3. Success: { version, setupComplete: true, daily, dashboardUrl?, dashboardPath?, issueList? }
  *
  * Errors from the daily check propagate to the caller.
  */

package/dist/commands/startup.js

@@ -1,7 +1,7 @@
 /**
  * Startup command
  * Combines all pre-flight checks into a single CLI invocation:
- * auth check, setup check, daily fetch, dashboard generation, version detection, issue list detection.
+ * auth check, setup check, daily fetch, dashboard launch, version detection, issue list detection.
  *
  * Replaces the ~100-line inline bash script in commands/oss.md with a single
  * `node cli.bundle.cjs startup --json` call, reducing UI noise in Claude Code.
@@ -11,8 +11,8 @@ import { execFile } from 'child_process';
 import { getStateManager, getGitHubToken, getCLIVersion } from '../core/index.js';
 import { errorMessage } from '../core/errors.js';
 import { executeDailyCheck } from './daily.js';
-import { writeDashboardFromState } from './dashboard.js';
 import { launchDashboardServer } from './dashboard-lifecycle.js';
+import { writeDashboardFromState } from './dashboard.js';
 /**
  * Parse issueListPath from a config file's YAML frontmatter.
  * Returns the path string or undefined if not found.
@@ -93,21 +93,21 @@ export function detectIssueList() {
         return { path: issueListPath, source, availableCount: 0, completedCount: 0 };
     }
 }
-function openInBrowser(filePath) {
+export function openInBrowser(url) {
     let openCmd;
     let args;
     switch (process.platform) {
         case 'darwin':
             openCmd = 'open';
-            args = [filePath];
+            args = [url];
             break;
         case 'win32':
             openCmd = 'cmd';
-            args = ['/c', 'start', '', filePath];
+            args = ['/c', 'start', '', url];
             break;
         default:
             openCmd = 'xdg-open';
-            args = [filePath];
+            args = [url];
             break;
     }
     execFile(openCmd, args, (error) => {
@@ -121,7 +121,7 @@ function openInBrowser(filePath) {
  * Returns StartupOutput with one of three shapes:
  * 1. Setup incomplete: { version, setupComplete: false }
  * 2. Auth failure: { version, setupComplete: true, authError: "..." }
- * 3. Success: { version, setupComplete: true, daily, dashboardPath?, dashboardUrl?, issueList? }
+ * 3. Success: { version, setupComplete: true, daily, dashboardUrl?, dashboardPath?, issueList? }
  *
  * Errors from the daily check propagate to the caller.
  */
@@ -143,49 +143,52 @@ export async function runStartup() {
     }
     // 3. Run daily check
     const daily = await executeDailyCheck(token);
-    // 4. Generate static HTML dashboard (always — serves as fallback + snapshot)
-    let dashboardPath;
-    try {
-        dashboardPath = writeDashboardFromState();
-    }
-    catch (error) {
-        console.error('[STARTUP] Dashboard generation failed:', errorMessage(error));
-    }
-    // 5. Launch interactive SPA dashboard (preferred) with static HTML fallback
+    // 4. Launch interactive SPA dashboard (with static HTML fallback)
     // Skip opening on first run (0 PRs) — the welcome flow handles onboarding
     let dashboardUrl;
+    let dashboardPath;
     let dashboardOpened = false;
+    function tryStaticHtmlFallback() {
+        try {
+            dashboardPath = writeDashboardFromState();
+            openInBrowser(dashboardPath);
+            return true;
+        }
+        catch (htmlError) {
+            console.error('[STARTUP] Static HTML dashboard fallback also failed:', errorMessage(htmlError));
+            return false;
+        }
+    }
     if (daily.digest.summary.totalActivePRs > 0) {
-        let spaResult = null;
         try {
-            spaResult = await launchDashboardServer();
+            const spaResult = await launchDashboardServer();
+            if (spaResult) {
+                dashboardUrl = spaResult.url;
+                openInBrowser(spaResult.url);
+                dashboardOpened = true;
+            }
+            else {
+                console.error('[STARTUP] Dashboard SPA assets not found, falling back to static HTML dashboard');
+                dashboardOpened = tryStaticHtmlFallback();
+            }
         }
         catch (error) {
             console.error('[STARTUP] SPA dashboard launch failed:', errorMessage(error));
-        }
-        if (spaResult) {
-            dashboardUrl = spaResult.url;
-            openInBrowser(spaResult.url);
-            dashboardOpened = true;
-        }
-        else if (dashboardPath) {
-            // SPA unavailable (assets not built) — fall back to static HTML
-            openInBrowser(dashboardPath);
-            dashboardOpened = true;
+            dashboardOpened = tryStaticHtmlFallback();
         }
     }
     // Append dashboard status to brief summary (only startup opens the browser, not daily)
     if (dashboardOpened) {
         daily.briefSummary += ' | Dashboard opened in browser';
     }
-    // 6. Detect issue list
+    // 5. Detect issue list
     const issueList = detectIssueList();
     return {
         version,
         setupComplete: true,
         daily,
-        dashboardPath,
         dashboardUrl,
+        dashboardPath,
         issueList,
     };
 }

package/dist/commands/vet.js

@@ -3,9 +3,10 @@
  * Vets a specific issue before working on it
  */
 import { IssueDiscovery, requireGitHubToken } from '../core/index.js';
-import { validateUrl } from './validation.js';
+import { ISSUE_URL_PATTERN, validateGitHubUrl, validateUrl } from './validation.js';
 export async function runVet(options) {
     validateUrl(options.issueUrl);
+    validateGitHubUrl(options.issueUrl, ISSUE_URL_PATTERN, 'issue');
     const token = requireGitHubToken();
     const discovery = new IssueDiscovery(token);
     const candidate = await discovery.vetIssue(options.issueUrl);

package/dist/core/concurrency.d.ts

@@ -1,5 +1,6 @@
 /**
  * Runs a worker pool that processes items with bounded concurrency.
- * N workers consume from a shared index — simpler than Promise.race + splice.
+ * N workers consume from a shared index. On any worker error, remaining
+ * workers are aborted via a shared flag and the error is propagated.
  */
 export declare function runWorkerPool<T>(items: T[], worker: (item: T) => Promise<void>, concurrency: number): Promise<void>;

package/dist/core/concurrency.js

@@ -1,13 +1,23 @@
 /**
  * Runs a worker pool that processes items with bounded concurrency.
- * N workers consume from a shared index — simpler than Promise.race + splice.
+ * N workers consume from a shared index. On any worker error, remaining
+ * workers are aborted via a shared flag and the error is propagated.
  */
 export async function runWorkerPool(items, worker, concurrency) {
     let index = 0;
+    let aborted = false;
     const poolWorker = async () => {
         while (index < items.length) {
+            if (aborted)
+                break;
             const item = items[index++];
-            await worker(item);
+            try {
+                await worker(item);
+            }
+            catch (err) {
+                aborted = true;
+                throw err;
+            }
         }
     };
     const workerCount = Math.min(concurrency, items.length);

package/dist/core/daily-logic.js

@@ -509,5 +509,5 @@ export function printDigest(digest, capacity, commentedIssues = []) {
         console.log('');
     }
     console.log('Run with --json for structured output');
-    console.log('Run "dashboard --open" for browser view');
+    console.log('Run "dashboard serve" for browser view');
 }

package/dist/core/pr-monitor.js

@@ -350,11 +350,7 @@ export class PRMonitor {
      * Check if PR has merge conflict
      */
     hasMergeConflict(mergeable, mergeableState) {
-        if (mergeable === false)
-            return true;
-        if (mergeableState === 'dirty')
-            return true;
-        return false;
+        return mergeable === false || mergeableState === 'dirty';
     }
     /**
      * Get CI status from combined status API and check runs.
@@ -371,6 +367,14 @@ export class PRMonitor {
                 // 404 is expected for repos without check runs configured; log other errors for debugging
                 this.octokit.checks.listForRef({ owner, repo, ref: sha }).catch((err) => {
                     const status = getHttpStatusCode(err);
+                    // Rate limit errors must propagate — matches listReviewComments pattern (#481)
+                    if (status === 429)
+                        throw err;
+                    if (status === 403) {
+                        const msg = errorMessage(err).toLowerCase();
+                        if (msg.includes('rate limit') || msg.includes('abuse detection'))
+                            throw err;
+                    }
                     if (status === 404) {
                         debug('pr-monitor', `Check runs 404 for ${owner}/${repo}@${sha.slice(0, 7)} (no checks configured)`);
                     }
@@ -400,12 +404,8 @@ export class PRMonitor {
         }
         catch (error) {
             const statusCode = getHttpStatusCode(error);
-            const errMsg = errorMessage(error);
-            if (statusCode === 401) {
-                warn('pr-monitor', `CI check failed for ${owner}/${repo}: Invalid token`);
-            }
-            else if (statusCode === 403) {
-                warn('pr-monitor', `CI check failed for ${owner}/${repo}: Rate limit exceeded`);
+            if (statusCode === 401 || statusCode === 403 || statusCode === 429) {
+                throw error;
             }
             else if (statusCode === 404) {
                 // Repo might not have CI configured, this is normal
@@ -413,7 +413,7 @@ export class PRMonitor {
                 return { status: 'unknown', failingCheckNames: [], failingCheckConclusions: new Map() };
             }
             else {
-                warn('pr-monitor', `Failed to check CI for ${owner}/${repo}@${sha.slice(0, 7)}: ${errMsg}`);
+                warn('pr-monitor', `Failed to check CI for ${owner}/${repo}@${sha.slice(0, 7)}: ${errorMessage(error)}`);
             }
             return { status: 'unknown', failingCheckNames: [], failingCheckConclusions: new Map() };
         }

package/dist/core/utils.d.ts

@@ -5,7 +5,7 @@
  * Returns the oss-autopilot data directory path, creating it if it does not exist.
  *
  * The directory is located at `~/.oss-autopilot/` and serves as the root for
- * all persisted user data (state, backups, dashboard).
+ * all persisted user data (state, backups, cache).
  *
  * @returns Absolute path to the data directory (e.g., `/Users/you/.oss-autopilot`)
  *
@@ -53,11 +53,8 @@ export declare function getBackupDir(): string;
  */
 export declare function getCacheDir(): string;
 /**
- * Returns the path to the generated HTML dashboard file (`~/.oss-autopilot/dashboard.html`).
- *
- * Implicitly creates the data directory via {@link getDataDir} if it does not exist.
- *
- * @returns Absolute path to `dashboard.html`
+ * Returns the path to the static HTML dashboard file (~/.oss-autopilot/dashboard.html).
+ * Used as a fallback when the interactive SPA dashboard cannot be launched.
  *
  * @example
  * const dashPath = getDashboardPath();
@@ -144,10 +141,9 @@ export declare function daysBetween(from: Date, to?: Date): number;
 /**
  * Splits an `"owner/repo"` string into its owner and repo components.
  *
- * Does not validate the input format; if no `/` is present, `repo` will be `undefined`.
- *
  * @param repoFullName - Full repository name in `"owner/repo"` format
  * @returns Object with `owner` and `repo` string properties
+ * @throws {Error} If the input does not contain both an owner and repo separated by `/`
  *
  * @example
  * splitRepo('facebook/react')

package/dist/core/utils.js

@@ -15,7 +15,7 @@ let tokenFetchAttempted = false;
  * Returns the oss-autopilot data directory path, creating it if it does not exist.
  *
  * The directory is located at `~/.oss-autopilot/` and serves as the root for
- * all persisted user data (state, backups, dashboard).
+ * all persisted user data (state, backups, cache).
  *
  * @returns Absolute path to the data directory (e.g., `/Users/you/.oss-autopilot`)
  *
@@ -83,11 +83,8 @@ export function getCacheDir() {
     return dir;
 }
 /**
- * Returns the path to the generated HTML dashboard file (`~/.oss-autopilot/dashboard.html`).
- *
- * Implicitly creates the data directory via {@link getDataDir} if it does not exist.
- *
- * @returns Absolute path to `dashboard.html`
+ * Returns the path to the static HTML dashboard file (~/.oss-autopilot/dashboard.html).
+ * Used as a fallback when the interactive SPA dashboard cannot be launched.
  *
  * @example
  * const dashPath = getDashboardPath();
@@ -215,10 +212,9 @@ export function daysBetween(from, to = new Date()) {
 /**
  * Splits an `"owner/repo"` string into its owner and repo components.
  *
- * Does not validate the input format; if no `/` is present, `repo` will be `undefined`.
- *
  * @param repoFullName - Full repository name in `"owner/repo"` format
  * @returns Object with `owner` and `repo` string properties
+ * @throws {Error} If the input does not contain both an owner and repo separated by `/`
  *
  * @example
  * splitRepo('facebook/react')
@@ -226,6 +222,9 @@ export function daysBetween(from, to = new Date()) {
  */
 export function splitRepo(repoFullName) {
     const [owner, repo] = repoFullName.split('/');
+    if (!owner || !repo) {
+        throw new Error(`Invalid repo format: expected "owner/repo", got "${repoFullName}"`);
+    }
     return { owner, repo };
 }
 /**

package/dist/formatters/json.d.ts

@@ -200,16 +200,17 @@ export interface IssueListInfo {
  * Three valid shapes:
  * 1. Setup incomplete: { version, setupComplete: false }
  * 2. Auth failure: { version, setupComplete: true, authError: "..." }
- * 3. Success: { version, setupComplete: true, daily, dashboardPath?, dashboardUrl?, issueList? }
+ * 3. Success: { version, setupComplete: true, daily, dashboardUrl?, issueList? }
  */
 export interface StartupOutput {
     version: string;
     setupComplete: boolean;
     authError?: string;
     daily?: DailyOutput;
-    dashboardPath?: string;
     /** URL of the interactive SPA dashboard server, when running (e.g., "http://localhost:3000") */
     dashboardUrl?: string;
+    /** Path to the static HTML dashboard file (fallback when SPA cannot launch) */
+    dashboardPath?: string;
     issueList?: IssueListInfo;
 }
 /** A single parsed issue from a markdown list (#82) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {
@@ -60,7 +60,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "bundle": "esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/cli.bundle.cjs",
+    "bundle": "esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --minify --outfile=dist/cli.bundle.cjs",
     "start": "tsx src/cli.ts",
     "dev": "tsx watch src/cli.ts",
     "typecheck": "tsc --noEmit",