@oss-autopilot/core 3.13.4 → 3.14.0

package/dist/core/pr-comments-fetcher.js

@@ -1,4 +1,4 @@
-import { paginateAll } from './pagination.js';
+import { paginateAllDetailed } from './pagination.js';
 import { wrapUntrustedContent } from './untrusted-content.js';
 import { isBotAuthor } from './comment-utils.js';
 import { parseGitHubUrl } from './urls.js';
@@ -18,26 +18,29 @@ export async function fetchPRCommentBundle(octokit, prUrl, githubUsername) {
     }
     const { owner, repo, number: pull_number } = parsed;
     const repoFull = `${owner}/${repo}`;
-    // Fetch the PR + all three comment streams in parallel. We always fetch
-    // every page — corpus quality depends on having every reviewer voice, not
-    // just the first 100 comments.
-    const [{ data: pr }, reviews, reviewComments, issueComments] = await Promise.all([
+    // Fetch the PR + all three comment streams in parallel. We fetch every
+    // page up to the pagination cap — corpus quality depends on having every
+    // reviewer voice, not just the first 100 comments. When a stream still
+    // truncates (1000+ entries), the bundle is flagged `truncated` so callers
+    // can surface the partial-corpus signal instead of silently dropping the
+    // newest comments (#1456).
+    const [{ data: pr }, reviewsResult, reviewCommentsResult, issueCommentsResult] = await Promise.all([
         octokit.pulls.get({ owner, repo, pull_number }),
-        paginateAll((page) => octokit.pulls.listReviews({
+        paginateAllDetailed((page) => octokit.pulls.listReviews({
             owner,
             repo,
             pull_number,
             per_page: 100,
             page,
         })),
-        paginateAll((page) => octokit.pulls.listReviewComments({
+        paginateAllDetailed((page) => octokit.pulls.listReviewComments({
             owner,
             repo,
             pull_number,
             per_page: 100,
             page,
         })),
-        paginateAll((page) => octokit.issues.listComments({
+        paginateAllDetailed((page) => octokit.issues.listComments({
             owner,
             repo,
             issue_number: pull_number,
@@ -45,6 +48,13 @@ export async function fetchPRCommentBundle(octokit, prUrl, githubUsername) {
             page,
         })),
     ]);
+    const { items: reviews } = reviewsResult;
+    const { items: reviewComments } = reviewCommentsResult;
+    const { items: issueComments } = issueCommentsResult;
+    const truncated = reviewsResult.truncated || reviewCommentsResult.truncated || issueCommentsResult.truncated;
+    if (truncated) {
+        warn(MODULE, `Comment streams truncated at pagination cap for ${repoFull}#${pull_number}; bundle is partial`);
+    }
     const ownLogin = githubUsername.toLowerCase();
     /**
      * Drop entries that aren't useful corpus: the user's own comments, bots,
@@ -97,6 +107,7 @@ export async function fetchPRCommentBundle(octokit, prUrl, githubUsername) {
             body: fence(c.body ?? '', 'pr-issue-comment', c.user?.login ?? '', c.author_association ?? 'NONE'),
             createdAt: c.created_at ?? '',
         })),
+        ...(truncated ? { truncated: true } : {}),
     };
 }
 export async function fetchPRCommentBundlesBatch(octokit, prUrls, githubUsername, concurrency = DEFAULT_BATCH_CONCURRENCY) {

package/dist/core/pr-monitor.d.ts

@@ -40,6 +40,8 @@ export interface FetchPRsResult {
      * - Post-fetch viewer-mismatch guardrail (configured username differs
      *   from the authenticated viewer when the search returned zero PRs).
      * - Search API 1000-result truncation (#1057 M25).
+     * - Per-PR comment pagination truncation (#1456) — newest comments
+     *   dropped, so unresponded-comment detection may be incomplete.
      * Callers (daily, dashboard) surface these so users see the signal.
      */
     warnings?: string[];

package/dist/core/pr-monitor.js

@@ -19,11 +19,11 @@ import { parseGitHubUrl, extractOwnerRepo, isOwnRepo } from './urls.js';
 import { DEFAULT_CONCURRENCY, runWorkerPool } from './concurrency.js';
 import { determineStatus } from './status-determination.js';
 import { ConfigurationError, ValidationError, errorMessage, getHttpStatusCode, isInvalidUserSearchError, isRateLimitOrAuthError, } from './errors.js';
-import { paginateAll } from './pagination.js';
+import { paginateAllDetailed } from './pagination.js';
 import { debug, warn, timed } from './logger.js';
 import { getHttpCache, cachedRequest } from './http-cache.js';
 import { categorizeCIStatus, classifyFailingChecks, getCIStatus } from './ci-analysis.js';
-import { determineReviewDecision, getLatestChangesRequestedDate, checkUnrespondedComments, } from './review-analysis.js';
+import { determineReviewDecision, getLatestChangesRequestedDate, checkUnrespondedComments, getFirstMaintainerResponseAt, } from './review-analysis.js';
 import { analyzeChecklist } from './checklist-analysis.js';
 import { extractMaintainerActionHints } from './maintainer-analysis.js';
 import { computeDisplayLabel } from './display-utils.js';
@@ -239,7 +239,7 @@ export class PRMonitor {
             await runWorkerPool(filteredItems, async (item) => {
                 try {
                     debug('pr-monitor', `Fetching details for ${item.html_url}`);
-                    const pr = await this.fetchPRDetails(item.html_url);
+                    const pr = await this.fetchPRDetails(item.html_url, warnings);
                     if (pr)
                         prs.push(pr);
                 }
@@ -261,7 +261,7 @@ export class PRMonitor {
     /**
      * Fetch detailed information for a single PR
      */
-    async fetchPRDetails(prUrl) {
+    async fetchPRDetails(prUrl, warnings) {
         const parsed = parseGitHubUrl(prUrl);
         if (!parsed || parsed.type !== 'pull') {
             throw new ValidationError(`Invalid PR URL format: ${prUrl}`);
@@ -271,11 +271,11 @@ export class PRMonitor {
         // Fetch PR data, comments, reviews, and inline review comments in parallel.
         // listReviewComments is non-critical (used for self-reply detection), so degrade
         // gracefully on failure rather than dropping the entire PR (#199).
-        const [prResponse, comments, reviewsResponse, reviewComments] = await Promise.all([
+        const [prResponse, commentsResult, reviewsResponse, reviewCommentsResult] = await Promise.all([
             this.octokit.pulls.get({ owner, repo, pull_number: number }),
-            paginateAll((page) => this.octokit.issues.listComments({ owner, repo, issue_number: number, per_page: 100, page })),
+            paginateAllDetailed((page) => this.octokit.issues.listComments({ owner, repo, issue_number: number, per_page: 100, page })),
             this.octokit.pulls.listReviews({ owner, repo, pull_number: number }),
-            paginateAll((page) => this.octokit.pulls.listReviewComments({ owner, repo, pull_number: number, per_page: 100, page })).catch((err) => {
+            paginateAllDetailed((page) => this.octokit.pulls.listReviewComments({ owner, repo, pull_number: number, per_page: 100, page })).catch((err) => {
                 const status = getHttpStatusCode(err);
                 // Rate limit errors must propagate — silently swallowing them hides
                 // a systemic problem and produces misleading results (#229).
@@ -289,7 +289,7 @@ export class PRMonitor {
                     }
                     // Non-rate-limit 403 (DMCA, private repo, SSO) — degrade gracefully
                     warn('pr-monitor', `403 fetching review comments for ${owner}/${repo}#${number}: ${msg}`);
-                    return [];
+                    return { items: [], truncated: false };
                 }
                 if (status === 404) {
                     debug('pr-monitor', `Review comments 404 for ${owner}/${repo}#${number} (likely no inline comments)`);
@@ -297,9 +297,21 @@ export class PRMonitor {
                 else {
                     warn('pr-monitor', `Failed to fetch review comments for ${owner}/${repo}#${number} (status ${status ?? 'unknown'}): self-reply detection will be skipped`);
                 }
-                return [];
+                return { items: [], truncated: false };
             }),
         ]);
+        const { items: comments } = commentsResult;
+        const { items: reviewComments } = reviewCommentsResult;
+        // Surface pagination truncation through the caller's warnings channel
+        // (#1456): comments arrive oldest-first, so hitting the cap drops the
+        // NEWEST maintainer feedback — status determination (unresponded-comment
+        // detection) may be wrong for this PR.
+        if (commentsResult.truncated || reviewCommentsResult.truncated) {
+            const message = `Comment pagination cap reached for ${owner}/${repo}#${number}; the newest comments were not ` +
+                `fetched and unresponded-comment detection may be incomplete.`;
+            warnings?.push(message);
+            warn(MODULE, message);
+        }
         const ghPR = prResponse.data;
         const reviews = reviewsResponse.data;
         // Determine review decision (delegated to review-analysis module)
@@ -308,6 +320,10 @@ export class PRMonitor {
         const mergeConflict = hasMergeConflict(ghPR.mergeable, ghPR.mergeable_state);
         // Check if there's an unresponded maintainer comment (delegated to review-analysis module)
         const { hasUnrespondedComment, lastMaintainerComment } = checkUnrespondedComments(comments, reviews, reviewComments, config.githubUsername);
+        // Earliest maintainer response, computed from the comment/review timeline
+        // already in memory (#1461). Rides into the persisted digest so the
+        // outcome ledger can recover it after the PR merges or closes.
+        const firstMaintainerResponseAt = getFirstMaintainerResponseAt(comments, reviews, config.githubUsername);
         // Fetch CI status and (conditionally) latest commit date in parallel
         // We need the commit date when hasUnrespondedComment is true (to distinguish
         // "needs_response" from "waiting_on_maintainer") OR when reviewDecision is "changes_requested"
@@ -391,6 +407,7 @@ export class PRMonitor {
             actionReasons,
             createdAt: ghPR.created_at,
             updatedAt: ghPR.updated_at,
+            firstMaintainerResponseAt,
             daysSinceActivity,
             ciStatus,
             failingCheckNames,

package/dist/core/repo-score-manager.d.ts

@@ -4,7 +4,7 @@
  * and computing aggregate statistics. Mutation functions modify
  * the passed state object in place; query functions are pure.
  *
- * **User-facing reference:** `docs/repo-scoring.md` — plain-language
+ * **User-facing reference:** `docs/repo-scores.md` — plain-language
  * explanation of the formula and what a given score means.
  */
 import { AgentState, RepoScore, RepoScoreUpdate, StoredMergedPR, StoredClosedPR } from './types.js';
@@ -21,7 +21,7 @@ import { AgentState, RepoScore, RepoScoreUpdate, StoredMergedPR, StoredClosedPR
  *     − (hasHostileComments ? HOSTILITY_PENALTY : 0)
  *   clamped to [SCORE_MIN, SCORE_MAX].
  *
- * See `docs/repo-scoring.md` for user-facing intent and what a given
+ * See `docs/repo-scores.md` for user-facing intent and what a given
  * score means in practice.
  */
 export declare function calculateScore(repoScore: RepoScore): number;

package/dist/core/repo-score-manager.js

@@ -4,7 +4,7 @@
  * and computing aggregate statistics. Mutation functions modify
  * the passed state object in place; query functions are pure.
  *
- * **User-facing reference:** `docs/repo-scoring.md` — plain-language
+ * **User-facing reference:** `docs/repo-scores.md` — plain-language
  * explanation of the formula and what a given score means.
  */
 import { isBelowMinStars } from './types.js';
@@ -14,7 +14,7 @@ const MODULE = 'scoring';
 // ── Scoring constants (#1054) ─────────────────────────────────────────
 // Previously inlined as magic numbers in `calculateScore`. Extracted with
 // rationale comments so the formula is auditable without source spelunking.
-// Changing any of these is a behavior change — update docs/repo-scoring.md
+// Changing any of these is a behavior change — update docs/repo-scores.md
 // and the tests below in lockstep.
 /** Starting point before any signals are applied. Deliberately optimistic so first-time repos aren't punished. */
 const BASE_SCORE = 5;
@@ -66,7 +66,7 @@ function createDefaultRepoScore(repo) {
  *     − (hasHostileComments ? HOSTILITY_PENALTY : 0)
  *   clamped to [SCORE_MIN, SCORE_MAX].
  *
- * See `docs/repo-scoring.md` for user-facing intent and what a given
+ * See `docs/repo-scores.md` for user-facing intent and what a given
  * score means in practice.
  */
 export function calculateScore(repoScore) {

package/dist/core/repo-vet.d.ts

@@ -11,7 +11,7 @@
  * supply pre-fetched repo signals so the score is reproducible
  * against fixture data and offline replays.
  *
- * Rubric reference: docs/repo-rubric.md.
+ * Rubric reference: docs/repo-scores.md.
  */
 export interface RepoVetInput {
     /** Star count from the GitHub repo metadata. */
@@ -78,7 +78,7 @@ export interface RepoVetResult {
         prTemplate: boolean;
         codeOfConduct: boolean;
     };
-    /** Weighted 1-10 score per docs/repo-rubric.md. */
+    /** Weighted 1-10 score per docs/repo-scores.md. */
     rubricScore: number;
     /** Top-line verdict derived from the score and red-flag overrides. */
     rubricVerdict: RepoVetVerdict;

package/dist/core/repo-vet.js

@@ -11,7 +11,7 @@
  * supply pre-fetched repo signals so the score is reproducible
  * against fixture data and offline replays.
  *
- * Rubric reference: docs/repo-rubric.md.
+ * Rubric reference: docs/repo-scores.md.
  */
 const WEIGHTS = {
     activity: 0.25,

package/dist/core/review-analysis.d.ts

@@ -53,6 +53,25 @@ export declare function getInlineCommentBody(reviewId: number, reviewComments: R
  * that also posted inline comments (#829).
  */
 export declare function reviewHasInlineComments(reviewId: number, reviewComments: ReviewComment[]): boolean;
+/**
+ * Earliest maintainer response timestamp across issue comments and submitted
+ * reviews (#1461). A "response" is any comment or review by a non-bot
+ * account other than the contributor — acknowledgments and approvals count,
+ * since for latency purposes any human maintainer reply is a response.
+ * Computed from data fetchPRDetails already holds in memory (zero extra API
+ * calls). Returns undefined when no maintainer has responded yet.
+ */
+export declare function getFirstMaintainerResponseAt(comments: Array<{
+    user?: {
+        login?: string;
+    } | null;
+    created_at: string;
+}>, reviews: Array<{
+    user?: {
+        login?: string;
+    } | null;
+    submitted_at?: string | null;
+}>, username: string): string | undefined;
 /**
  * Check if there are unresponded comments from maintainers.
  * Combines issue comments and review comments into a timeline,

package/dist/core/review-analysis.js

@@ -97,6 +97,34 @@ export function getInlineCommentBody(reviewId, reviewComments) {
 export function reviewHasInlineComments(reviewId, reviewComments) {
     return reviewComments.some((c) => c.pull_request_review_id === reviewId);
 }
+/**
+ * Earliest maintainer response timestamp across issue comments and submitted
+ * reviews (#1461). A "response" is any comment or review by a non-bot
+ * account other than the contributor — acknowledgments and approvals count,
+ * since for latency purposes any human maintainer reply is a response.
+ * Computed from data fetchPRDetails already holds in memory (zero extra API
+ * calls). Returns undefined when no maintainer has responded yet.
+ */
+export function getFirstMaintainerResponseAt(comments, reviews, username) {
+    const usernameLower = username.toLowerCase();
+    let earliest;
+    const consider = (author, createdAt) => {
+        if (!author || !createdAt)
+            return;
+        if (author.toLowerCase() === usernameLower)
+            return;
+        if (isBotAuthor(author))
+            return;
+        if (!earliest || new Date(createdAt).getTime() < new Date(earliest).getTime()) {
+            earliest = createdAt;
+        }
+    };
+    for (const comment of comments)
+        consider(comment.user?.login, comment.created_at);
+    for (const review of reviews)
+        consider(review.user?.login, review.submitted_at);
+    return earliest;
+}
 /**
  * Check if there are unresponded comments from maintainers.
  * Combines issue comments and review comments into a timeline,

package/dist/core/state-schema.d.ts

@@ -9,6 +9,7 @@
  * Unknown keys are stripped by default (Zod 4 behavior).
  */
 import { z } from 'zod';
+import type { FetchedPR } from './types.js';
 export declare const IssueStatusSchema: z.ZodEnum<{
     candidate: "candidate";
     claimed: "claimed";
@@ -63,6 +64,8 @@ export declare const StoredMergedPRSchema: z.ZodObject<{
     url: z.ZodString;
     title: z.ZodString;
     mergedAt: z.ZodString;
+    openedAt: z.ZodOptional<z.ZodString>;
+    firstMaintainerResponseAt: z.ZodOptional<z.ZodString>;
     commentsFetchedAt: z.ZodOptional<z.ZodString>;
     learningsExtractedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -70,6 +73,8 @@ export declare const StoredClosedPRSchema: z.ZodObject<{
     url: z.ZodString;
     title: z.ZodString;
     closedAt: z.ZodString;
+    openedAt: z.ZodOptional<z.ZodString>;
+    firstMaintainerResponseAt: z.ZodOptional<z.ZodString>;
     commentsFetchedAt: z.ZodOptional<z.ZodString>;
     learningsExtractedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -251,6 +256,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
     }>>>;
     excludeRepos: z.ZodDefault<z.ZodArray<z.ZodString>>;
     excludeOrgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    avoidRepos: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    boostIssueTypes: z.ZodDefault<z.ZodArray<z.ZodString>>;
     trustedProjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
     githubUsername: z.ZodDefault<z.ZodString>;
     minRepoScoreThreshold: z.ZodDefault<z.ZodNumber>;
@@ -311,6 +318,7 @@ export declare const ClosedPRSchema: z.ZodObject<{
     title: z.ZodString;
     closedAt: z.ZodString;
     closedBy: z.ZodOptional<z.ZodString>;
+    openedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const MergedPRSchema: z.ZodObject<{
     url: z.ZodString;
@@ -318,6 +326,7 @@ export declare const MergedPRSchema: z.ZodObject<{
     number: z.ZodNumber;
     title: z.ZodString;
     mergedAt: z.ZodString;
+    openedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const DailyDigestSummarySchema: z.ZodObject<{
     totalActivePRs: z.ZodNumber;
@@ -325,11 +334,29 @@ export declare const DailyDigestSummarySchema: z.ZodObject<{
     totalMergedAllTime: z.ZodNumber;
     mergeRate: z.ZodNumber;
 }, z.core.$strip>;
+/**
+ * Minimal FetchedPR validation for persisted digest arrays (#1456). The
+ * persisted digest is rendered by the dashboard from cold start (before any
+ * refresh), so the fields it dereferences must be guaranteed present. Only
+ * the identity/status core is pinned — required on every real `FetchedPR`
+ * since the type's introduction — and `.passthrough()` keeps the dozens of
+ * volatile enrichment fields (CI, review, staleness) from rejecting digests
+ * persisted by older or newer producers.
+ */
+export declare const FetchedPRSchema: z.ZodObject<{
+    url: z.ZodString;
+    repo: z.ZodString;
+    number: z.ZodNumber;
+    status: z.ZodEnum<{
+        needs_addressing: "needs_addressing";
+        waiting_on_maintainer: "waiting_on_maintainer";
+    }>;
+}, z.core.$loose>;
 export declare const DailyDigestSchema: z.ZodObject<{
     generatedAt: z.ZodString;
-    openPRs: z.ZodArray<z.ZodAny>;
-    needsAddressingPRs: z.ZodArray<z.ZodAny>;
-    waitingOnMaintainerPRs: z.ZodArray<z.ZodAny>;
+    openPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
+    needsAddressingPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
+    waitingOnMaintainerPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
     recentlyClosedPRs: z.ZodArray<z.ZodObject<{
         url: z.ZodString;
         repo: z.ZodString;
@@ -337,6 +364,7 @@ export declare const DailyDigestSchema: z.ZodObject<{
         title: z.ZodString;
         closedAt: z.ZodString;
         closedBy: z.ZodOptional<z.ZodString>;
+        openedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     recentlyMergedPRs: z.ZodArray<z.ZodObject<{
         url: z.ZodString;
@@ -344,6 +372,7 @@ export declare const DailyDigestSchema: z.ZodObject<{
         number: z.ZodNumber;
         title: z.ZodString;
         mergedAt: z.ZodString;
+        openedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     shelvedPRs: z.ZodArray<z.ZodObject<{
         number: z.ZodNumber;
@@ -413,6 +442,8 @@ export declare const AgentStateSchema: z.ZodObject<{
         }>>>;
         excludeRepos: z.ZodDefault<z.ZodArray<z.ZodString>>;
         excludeOrgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        avoidRepos: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        boostIssueTypes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         trustedProjects: z.ZodDefault<z.ZodArray<z.ZodString>>;
         githubUsername: z.ZodDefault<z.ZodString>;
         minRepoScoreThreshold: z.ZodDefault<z.ZodNumber>;
@@ -462,9 +493,9 @@ export declare const AgentStateSchema: z.ZodObject<{
     lastStrategyAt: z.ZodOptional<z.ZodString>;
     lastDigest: z.ZodOptional<z.ZodObject<{
         generatedAt: z.ZodString;
-        openPRs: z.ZodArray<z.ZodAny>;
-        needsAddressingPRs: z.ZodArray<z.ZodAny>;
-        waitingOnMaintainerPRs: z.ZodArray<z.ZodAny>;
+        openPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
+        needsAddressingPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
+        waitingOnMaintainerPRs: z.ZodType<FetchedPR[], unknown, z.core.$ZodTypeInternals<FetchedPR[], unknown>>;
         recentlyClosedPRs: z.ZodArray<z.ZodObject<{
             url: z.ZodString;
             repo: z.ZodString;
@@ -472,6 +503,7 @@ export declare const AgentStateSchema: z.ZodObject<{
             title: z.ZodString;
             closedAt: z.ZodString;
             closedBy: z.ZodOptional<z.ZodString>;
+            openedAt: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         recentlyMergedPRs: z.ZodArray<z.ZodObject<{
             url: z.ZodString;
@@ -479,6 +511,7 @@ export declare const AgentStateSchema: z.ZodObject<{
             number: z.ZodNumber;
             title: z.ZodString;
             mergedAt: z.ZodString;
+            openedAt: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         shelvedPRs: z.ZodArray<z.ZodObject<{
             number: z.ZodNumber;
@@ -525,6 +558,8 @@ export declare const AgentStateSchema: z.ZodObject<{
         url: z.ZodString;
         title: z.ZodString;
         mergedAt: z.ZodString;
+        openedAt: z.ZodOptional<z.ZodString>;
+        firstMaintainerResponseAt: z.ZodOptional<z.ZodString>;
         commentsFetchedAt: z.ZodOptional<z.ZodString>;
         learningsExtractedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
@@ -532,6 +567,8 @@ export declare const AgentStateSchema: z.ZodObject<{
         url: z.ZodString;
         title: z.ZodString;
         closedAt: z.ZodString;
+        openedAt: z.ZodOptional<z.ZodString>;
+        firstMaintainerResponseAt: z.ZodOptional<z.ZodString>;
         commentsFetchedAt: z.ZodOptional<z.ZodString>;
         learningsExtractedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;

package/dist/core/state-schema.js

@@ -44,6 +44,20 @@ export const StoredMergedPRSchema = z.object({
     url: z.string(),
     title: z.string(),
     mergedAt: z.string(),
+    /**
+     * When the PR was opened (#1461). Optional: entries persisted before the
+     * outcome ledger existed don't carry it. Sourced from the Search API's
+     * `created_at` at merge-detection time — zero extra API calls.
+     */
+    openedAt: z.string().optional(),
+    /**
+     * Earliest maintainer (non-bot, non-author) comment or review on the
+     * PR (#1461). Best-effort: only derivable when the PR was enriched while
+     * open (looked up from the previous run's persisted digest at detection
+     * time), so it is absent for PRs that merged before ever appearing in an
+     * enriched run.
+     */
+    firstMaintainerResponseAt: z.string().optional(),
     /** When the raw review-comment bundle for this PR was last fetched (#867). */
     // ISO-8601 datetime guards against `markPRCommentsFetched(url, "garbage")`
     // poisoning state through the stamping API (#1209 L4).
@@ -55,6 +69,13 @@ export const StoredClosedPRSchema = z.object({
     url: z.string(),
     title: z.string(),
     closedAt: z.string(),
+    /** When the PR was opened (#1461). See StoredMergedPRSchema.openedAt. */
+    openedAt: z.string().optional(),
+    /**
+     * Earliest maintainer response (#1461). See
+     * StoredMergedPRSchema.firstMaintainerResponseAt.
+     */
+    firstMaintainerResponseAt: z.string().optional(),
     /** When the raw review-comment bundle for this PR was last fetched (#867). */
     // ISO-8601 datetime guards against `markPRCommentsFetched(url, "garbage")`
     // poisoning state through the stamping API (#1209 L4).
@@ -176,6 +197,21 @@ export const AgentConfigSchema = z.object({
     scope: z.array(IssueScopeSchema).optional(),
     excludeRepos: z.array(z.string()).default([]),
     excludeOrgs: z.array(z.string()).optional(),
+    /**
+     * Repos (owner/repo) to softly downrank in discovery results (#1464).
+     * Milder than `excludeRepos`' hard filter: scout pushes matches below
+     * equally-recommended candidates but does not remove them, and a strong
+     * affinity boost can still outweigh the penalty (scout #168).
+     * Threaded to scout via `scout-bridge.ts`.
+     */
+    avoidRepos: z.array(z.string()).default([]),
+    /**
+     * Issue label types (e.g. "bug", "good first issue") to softly boost in
+     * discovery ranking, matched case-insensitively against issue labels
+     * (scout #168 / #1464). Does not filter results or change viability
+     * scores. Threaded to scout via `scout-bridge.ts`.
+     */
+    boostIssueTypes: z.array(z.string()).default([]),
     trustedProjects: z.array(z.string()).default([]),
     githubUsername: z.string().default(''),
     minRepoScoreThreshold: z.number().default(4),
@@ -251,6 +287,12 @@ export const ClosedPRSchema = z.object({
     title: z.string(),
     closedAt: z.string(),
     closedBy: z.string().optional(),
+    /**
+     * When the PR was opened (#1461). Carried from the Search API's
+     * `created_at` so close detection can persist it into the outcome ledger.
+     * Optional: digests persisted by older producers don't have it.
+     */
+    openedAt: z.string().optional(),
 });
 export const MergedPRSchema = z.object({
     url: z.string(),
@@ -258,6 +300,12 @@ export const MergedPRSchema = z.object({
     number: z.number(),
     title: z.string(),
     mergedAt: z.string(),
+    /**
+     * When the PR was opened (#1461). Carried from the Search API's
+     * `created_at` so merge detection can persist it into the outcome ledger.
+     * Optional: digests persisted by older producers don't have it.
+     */
+    openedAt: z.string().optional(),
 });
 export const DailyDigestSummarySchema = z.object({
     totalActivePRs: z.number(),
@@ -265,12 +313,41 @@ export const DailyDigestSummarySchema = z.object({
     totalMergedAllTime: z.number(),
     mergeRate: z.number(),
 });
+/**
+ * Minimal FetchedPR validation for persisted digest arrays (#1456). The
+ * persisted digest is rendered by the dashboard from cold start (before any
+ * refresh), so the fields it dereferences must be guaranteed present. Only
+ * the identity/status core is pinned — required on every real `FetchedPR`
+ * since the type's introduction — and `.passthrough()` keeps the dozens of
+ * volatile enrichment fields (CI, review, staleness) from rejecting digests
+ * persisted by older or newer producers.
+ */
+export const FetchedPRSchema = z
+    .object({
+    url: z.string(),
+    repo: z.string(),
+    number: z.number(),
+    status: FetchedPRStatusSchema,
+})
+    .passthrough();
+/**
+ * The digest arrays hold full `FetchedPR` objects at runtime; validation is
+ * intentionally limited to the identity/status core above (everything else
+ * is ephemeral enrichment that older/newer producers legitimately differ
+ * on), so the inferred type is widened back to `FetchedPR[]` for consumers.
+ * The cast is sound in both directions: every real `FetchedPR` satisfies the
+ * core schema, and `.passthrough()` preserves the enrichment fields on parse
+ * output. This mirrors the pre-#1456 `z.array(z.any())` static contract
+ * while actually validating the fields the dashboard dereferences.
+ */
+const FetchedPRArraySchema = z.array(FetchedPRSchema);
 export const DailyDigestSchema = z.object({
     generatedAt: z.string(),
-    // FetchedPR arrays — ephemeral, regenerated each run. Validated loosely.
-    openPRs: z.array(z.any()),
-    needsAddressingPRs: z.array(z.any()),
-    waitingOnMaintainerPRs: z.array(z.any()),
+    // FetchedPR arrays — ephemeral, regenerated each run. Validated for the
+    // identity/status core the dashboard dereferences; loose on the rest.
+    openPRs: FetchedPRArraySchema,
+    needsAddressingPRs: FetchedPRArraySchema,
+    waitingOnMaintainerPRs: FetchedPRArraySchema,
     recentlyClosedPRs: z.array(ClosedPRSchema),
     recentlyMergedPRs: z.array(MergedPRSchema),
     shelvedPRs: z.array(ShelvedPRRefSchema),