@prism-d1/cli 1.8.0 → 1.9.0

package/dist/assets/kirocrew-app/scripts/page_model.py

@@ -0,0 +1,298 @@
+"""What the PRISM page shows, built from `prism-cli dashboard --json`. Stdlib only, no I/O
+except the small file reads named below, so it is unit-tested without Kiro Crew.
+
+Port of the editor extension's machine mode (editor-extension/src/panel-model.ts,
+machine.ts, text.ts). The page receives only the model; paths stay in the
+targets list, which the page addresses by index.
+"""
+from __future__ import annotations
+
+import datetime as _dt
+import json
+import os
+import re
+import time
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+COMMIT_LOOKUP_MAX = 30
+COMMIT_LOOKUP_CONCURRENCY = 4
+ROW_FINDINGS_MAX = 20
+MAX_TEXT = 2000
+REPORT_MAX_AGE_S = 24 * 3600
+USAGE_CACHE_SCHEMA = "prism.usage-cache.v1"
+RESULT_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$")
+REPORT_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src data:"
+
+# C0/C1 controls (except tab and newline) and bidi controls.
+_UNSAFE = re.compile("[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]")
+
+
+def plain(s: Any, max_len: int = MAX_TEXT, one_line: bool = True) -> str:
+    t = "" if s is None else str(s)
+    t = _UNSAFE.sub("", t.replace("\r\n", "\n").replace("\r", "\n"))
+    if one_line:
+        t = re.sub(r"\s*\n\s*", " ", t)
+    return t if len(t) <= max_len else t[: max_len - 1] + "…"
+
+
+def money(n: Any, currency: str) -> str:
+    v = f"{float(n or 0):.2f}"
+    return f"${v}" if currency == "USD" else f"{v} {plain(currency, 8)}"
+
+
+def count(n: int, word: str) -> str:
+    return f"{n} {word}{'' if n == 1 else 's'}"
+
+
+def _time(iso: Any) -> Optional[float]:
+    if not isinstance(iso, str) or not iso:
+        return None
+    try:
+        return _dt.datetime.fromisoformat(iso.replace("Z", "+00:00")).timestamp()
+    except ValueError:
+        return None
+
+
+def base_name(s: Any) -> str:
+    parts = [p for p in re.split(r"[\\/]", str(s or "")) if p]
+    return plain(parts[-1] if parts else "", 120)
+
+
+# ---- usage cache -----------------------------------------------------------
+
+def usage_cached_today(home: Path, today: Optional[str] = None) -> bool:
+    """True when ~/.prism/cache/usage.json holds today's usage, so `dashboard --json` will not run a cold codeburn export."""
+    try:
+        c = json.loads((home / ".prism" / "cache" / "usage.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return False
+    today = today or _dt.date.today().isoformat()
+    return isinstance(c, dict) and c.get("schema") == USAGE_CACHE_SCHEMA and c.get("day") == today and isinstance(c.get("panel"), dict)
+
+
+# ---- repos -----------------------------------------------------------------
+
+def commit_lookup_paths(p: Dict[str, Any], max_n: int = COMMIT_LOOKUP_MAX) -> List[str]:
+    """Repos whose last commit is looked up: codewatch results only, newest review first, capped."""
+    repos = [r for r in p.get("repos") or [] if (r.get("codewatch") or {}).get("hasResults")]
+    repos.sort(key=lambda r: _time((r.get("codewatch") or {}).get("lastRunAt")) or 0, reverse=True)
+    return [r["path"] for r in repos[:max_n] if isinstance(r.get("path"), str)]
+
+
+def parse_last_commit(out: str) -> Optional[Dict[str, str]]:
+    """`git log -1 --format=%cI%x00%h%x00%s` output, or None."""
+    parts = out.rstrip("\n").split("\0")
+    if len(parts) < 2 or _time(parts[0]) is None or not parts[1]:
+        return None
+    return {"at": parts[0], "sha": parts[1], "subject": parts[2] if len(parts) > 2 else ""}
+
+
+def last_commit_args(repo: str) -> List[str]:
+    return ["git", "-C", repo, "log", "-1", "--format=%cI%x00%h%x00%s"]
+
+
+def machine_repos(p: Dict[str, Any], commits: Dict[str, Optional[Dict[str, str]]]) -> List[Dict[str, Any]]:
+    """'Repositories with codewatch', newest last commit first; no commit time: last review time; neither: last."""
+    by_path = {r.get("path"): r for r in p.get("repos") or []}
+    rows = []
+    for row in (p.get("overview") or {}).get("codewatch") or []:
+        repo = by_path.get(row.get("path"))
+        found = sorted((repo or {}).get("codewatch", {}).get("findings") or [], key=lambda f: _time(f.get("started_at")) or 0, reverse=True)
+        rows.append({"row": row, "repo": repo, "commit": commits.get(row.get("path")),
+                     "findings": found[:ROW_FINDINGS_MAX], "more": max(0, len(found) - ROW_FINDINGS_MAX)})
+
+    def key(m: Dict[str, Any]) -> float:
+        t = _time((m["commit"] or {}).get("at")) or _time(m["row"].get("lastRunAt"))
+        return t if t is not None else float("-inf")
+
+    rows.sort(key=key, reverse=True)
+    return rows
+
+
+def latest_review_of(repo: Optional[Dict[str, Any]]) -> Optional[Dict[str, Optional[str]]]:
+    """The branch and commit of the repo's latest review, for the --id fallback report."""
+    cw = (repo or {}).get("codewatch") or {}
+    rid = cw.get("lastReviewId")
+    if not rid:
+        return None
+    scan = next((s for s in cw.get("scans") or [] if s.get("id") == rid), None)
+    lb = next((b for b in cw.get("latestByBranch") or [] if scan and (b.get("review") or {}).get("started_at") == scan.get("started_at")), None)
+    return {"id": rid, "branch": (scan or {}).get("branch") or (lb or {}).get("branch"), "commit": ((lb or {}).get("review") or {}).get("commit")}
+
+
+def findings_badge(row: Dict[str, Any]) -> Dict[str, str]:
+    """The repo row's badge from its latest review; the row's left border uses the same tone."""
+    if not row.get("lastRunAt"):
+        return {"text": "no review", "tone": "none"}
+    high, med, low = (int(row.get(k) or 0) for k in ("high", "medium", "low"))
+    if high:
+        return {"text": f"{high} high", "tone": "error"}
+    if med:
+        return {"text": f"{med} med", "tone": "warn"}
+    if low:
+        return {"text": f"{low} low", "tone": "none"}
+    return {"text": "clean", "tone": "ok"}
+
+
+def hooks_text(status: Any) -> str:
+    """Codewatch hook status, shown as small muted text: it says the hooks run, not that the code is clean."""
+    s = plain(status or "unknown", 20)
+    return {"ok": "hooks on", "missing": "hooks off"}.get(s, "hooks " + s)
+
+
+def _check_item(i: Dict[str, Any]) -> Dict[str, str]:
+    help_text = (i.get("help") or {}).get("text")
+    return {"key": "m:" + plain(i.get("id"), 60), "label": plain(i.get("label"), 120), "status": plain(i.get("status"), 20),
+            "detail": plain(help_text or i.get("detail"), 500), "fix": plain(i.get("fix"), 500)}
+
+
+def build_model(p: Dict[str, Any], commits: Dict[str, Optional[Dict[str, str]]], version: str,
+                digest: Optional[Dict[str, Any]]) -> Tuple[Dict[str, Any], List[Dict[str, Any]]]:
+    """(model for the page, targets kept by the backend). The model holds no path; times stay ISO."""
+    u = p.get("usage") or {}
+    summary = p.get("summary") or {}
+    cur = u.get("currency") or (summary.get("spend") or {}).get("currency") or "USD"
+
+    def totals(title: str, t: Optional[Dict[str, Any]], extra: str = "") -> Dict[str, str]:
+        if not t:
+            return {"title": title, "value": "no data", "detail": ""}
+        return {"title": title, "value": money(t.get("cost"), cur),
+                "detail": f"{count(int(t.get('calls') or 0), 'call')} · {count(int(t.get('sessions') or 0), 'session')}{extra}"}
+
+    if u.get("status") == "ok":
+        m = u.get("month") or None
+        cards = [totals("AI spend today", u.get("today")),
+                 totals("AI spend this month", m, f" · {plain(m.get('from'), 10)} to {plain(m.get('to'), 10)}" if m else "")]
+    else:
+        cards = [{"title": "AI spend", "value": plain(u.get("status") or "unknown", 20), "detail": plain(u.get("message") or "", 300)}]
+    warn = summary.get("warnings") or {}
+    cards.append({"title": "Setup warnings", "value": str(int(warn.get("count") or 0)), "detail": plain(warn.get("first") or "nothing to fix", 300)})
+    cards.append({"title": "Sync mode", "value": plain(((p.get("machine") or {}).get("codeburnSync") or {}).get("mode") or "unknown", 20), "detail": "where codeburn usage goes"})
+
+    setup_of = {r.get("path"): r.get("status") for r in (p.get("overview") or {}).get("setup") or []}
+    rows: List[Dict[str, Any]] = []
+    targets: List[Dict[str, Any]] = []
+    for mr in machine_repos(p, commits):
+        r, c = mr["row"], mr["commit"]
+        name = plain(r.get("label") or r.get("name"), 120)
+        latest = latest_review_of(mr["repo"])
+        badge = findings_badge(r)
+        rows.append({
+            "name": name,
+            "review": f"{int(r.get('high') or 0)} high · {int(r.get('medium') or 0)} med · {int(r.get('low') or 0)} low" if r.get("lastRunAt") else "no review yet",
+            # Raw ISO times: the page shows them relative and re-renders them on its own clock.
+            "reviewAt": plain(r.get("lastRunAt") or "", 40),
+            "badge": badge,
+            "tone": badge["tone"],
+            "hooks": hooks_text(setup_of.get(r.get("path"))),
+            "commit": {"sha": plain(c["sha"], 12), "at": plain(c["at"], 40), "subject": plain(c["subject"], 80)} if c else None,
+            "findings": [{"severity": plain(f.get("severity"), 10),
+                          "location": plain(f.get("file"), 200) + (f":{f['line']}" if isinstance(f.get("line"), int) and not isinstance(f.get("line"), bool) else ""),
+                          "message": plain(f.get("message"), 300), "branch": plain(f.get("branch") or "(detached)", 80)} for f in mr["findings"]],
+            "more": f"{count(mr['more'], 'more finding')} not listed; open the report for all of them." if mr["more"] else "",
+            "hasReport": bool(latest),
+        })
+        targets.append({"path": r.get("path"), "name": name, "commit": c, "latest": latest})
+
+    counts = (p.get("overview") or {}).get("counts") or {}
+    model = {
+        "generatedAt": plain(p.get("generated_at"), 40),
+        "version": plain(version or "unknown", 40),
+        "usageUpdatedAt": plain(u.get("updatedAt") or "", 40),
+        "usageStale": bool(u.get("stale")),
+        "cards": cards,
+        "topModels": [{"name": plain(x.get("name"), 120), "value": f"{money(x.get('cost'), cur)} · {count(int(x.get('calls') or 0), 'call')}"} for x in u.get("topModels") or []],
+        "topProjects": [{"name": base_name(x.get("name")), "value": f"{money(x.get('cost'), cur)} · {count(int(x.get('sessions') or 0), 'session')}"} for x in u.get("topProjects") or []],
+        "checklist": [_check_item(i) for i in (p.get("machine") or {}).get("setup") or []],
+        "repos": rows,
+        "reposNote": f"{counts.get('codewatch', 0)} of {counts.get('repos', 0)} repos found under your home folder have codewatch. Newest commit first." if counts else "",
+        "digest": digest_view(digest),
+    }
+    return model, targets
+
+
+# ---- index resolution and report -------------------------------------------
+
+def parse_index(v: Any) -> Optional[int]:
+    """A non-negative integer from a query value, else None. No sign, no spaces, at most 6 digits."""
+    if isinstance(v, str) and re.fullmatch(r"\d{1,6}", v):
+        return int(v)
+    return None
+
+
+def target_for(targets: List[Dict[str, Any]], v: Any) -> Optional[Dict[str, Any]]:
+    """The backend's own target for a page-supplied index, or None when it is not an index into the last result."""
+    i = parse_index(v)
+    return targets[i] if i is not None and i < len(targets) else None
+
+
+def report_plan(target: Dict[str, Any], output: str) -> Dict[str, Any]:
+    """Primary: the review covering HEAD. Fallback: the latest review by id, with a note saying which branch and commit it covers."""
+    repo = target["path"]
+    primary = ["codewatch", "report", "--repo", repo, "--commit", "HEAD", "--format", "html", "--output", output]
+    c = target.get("commit")
+    head = f"commit {plain(c['sha'], 12)}" if c else "its last commit"
+    plan: Dict[str, Any] = {"primary": primary, "primaryNote": f"Review covering {plain(target['name'], 120)}'s last commit ({head}).", "fallback": None, "fallbackNote": ""}
+    latest = target.get("latest")
+    if latest and isinstance(latest.get("id"), str) and RESULT_ID.match(latest["id"]):
+        plan["fallback"] = ["codewatch", "report", "--repo", repo, "--id", latest["id"], "--format", "html", "--output", output]
+        commit = plain(latest.get("commit"), 40)[:12] if latest.get("commit") else "(unknown)"
+        plan["fallbackNote"] = (f"No review in {plain(target['name'], 120)} covers {head}. Showing the latest review instead: "
+                                f"branch {plain(latest.get('branch') or '(unknown)', 80)}, commit {commit}.")
+    return plan
+
+
+_META_REFRESH = re.compile(r"<meta\b[^>]*http-equiv\s*=\s*[\"']?\s*refresh[^>]*>", re.I)
+
+
+def with_report_csp(html: str) -> str:
+    """The report with a CSP meta tag (its inline styles only, no script, nothing remote) and no
+    meta refresh, which a CSP does not stop from navigating the frame."""
+    html = _META_REFRESH.sub("", html)
+    meta = f'<meta http-equiv="Content-Security-Policy" content="{REPORT_CSP}">'
+    m = re.search(r"<head(?:\s[^>]*)?>", html, re.I)  # not <header>
+    if m:
+        return html[: m.end()] + meta + html[m.end():]
+    return f"<!DOCTYPE html><html><head>{meta}</head><body>{html}</body></html>"
+
+
+def cleanup_reports(report_dir: Path, now: Optional[float] = None, max_age: int = REPORT_MAX_AGE_S) -> int:
+    """Delete this app's report files older than max_age. Only *.html directly in report_dir; links are left alone."""
+    now = time.time() if now is None else now
+    removed = 0
+    try:
+        entries = list(os.scandir(report_dir))
+    except OSError:
+        return 0
+    for e in entries:
+        try:
+            if e.name.endswith(".html") and e.is_file(follow_symlinks=False) and now - e.stat(follow_symlinks=False).st_mtime > max_age:
+                os.unlink(e.path)
+                removed += 1
+        except OSError:
+            continue
+    return removed
+
+
+# ---- digest ----------------------------------------------------------------
+
+def read_digest(data_dir: Path) -> Optional[Dict[str, Any]]:
+    """The digest cron's saved state (digest-state.json), or None when missing or unreadable."""
+    try:
+        d = json.loads((data_dir / "digest-state.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    return d if isinstance(d, dict) else None
+
+
+def digest_view(d: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    """Raw digest fields; the page turns them into 'Not run yet' / 'Last run 3 h ago · ...'."""
+    if not d:
+        return {"recorded": False, "lastRunAt": "", "lastNotifiedAt": "", "lastMessage": ""}
+    return {
+        "recorded": True,
+        "lastRunAt": plain(d.get("lastRunAt") or "", 40),
+        "lastNotifiedAt": plain(d.get("lastNotifiedAt") or "", 40),
+        "lastMessage": plain(d.get("lastMessage") or "", 1500, one_line=False),
+    }

package/dist/assets/kirocrew-app/scripts/page_routes.py

@@ -0,0 +1,241 @@
+"""The PRISM page's backend: in-gateway routes (app.json backend.hooks.routes).
+
+They are served by the gateway at /api/apps/prism/<path>, behind its token
+middleware (a dashboard session or an app token scoped to this app's
+permissions.api). Each handler also requires the dashboard owner, or this app's
+own token. No port, no process of our own. Everything is read-only: the routes
+run `prism-cli dashboard --json`, `prism-cli --version`, `git log -1` and
+`prism-cli codewatch report` (argv lists, no shell, timeouts).
+
+The page sends only indexes; paths come from this module's own last result.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import uuid
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+from aiohttp import web
+
+from . import page_model as pm
+from .prism_cli_path import cli_env, load_config, resolve_cli
+
+DASHBOARD_TIMEOUT_S = 110
+REAP_TIMEOUT_S = 180
+VERSION_TIMEOUT_S = 10
+GIT_TIMEOUT_S = 10
+REPORT_TIMEOUT_S = 60
+MAX_JSON_BYTES = 64 * 1024 * 1024
+MAX_REPORT_BYTES = 5 * 1024 * 1024
+
+_state: Dict[str, Any] = {"targets": [], "gen": None}
+_lock = asyncio.Lock()
+_reaping: Set["asyncio.Task[None]"] = set()
+
+
+class _Route:
+    def __init__(self, method: str, path: str, handler: Any) -> None:
+        self.method, self.path, self.handler = method, path, handler
+
+
+def register_routes(ctx: Any) -> List[_Route]:
+    return [_Route("GET", "/data", handle_data), _Route("GET", "/report", handle_report)]
+
+
+def _err(status: int, msg: str) -> web.Response:
+    return web.json_response({"error": msg}, status=status)
+
+
+async def _gate(request: web.Request, ctx: Any, op: str) -> Optional[web.Response]:
+    """None when the caller is the dashboard owner or this app's own token; else the refusal."""
+    app = request.get("app")
+    if app:
+        # The gateway's token middleware set this after verifying the app token.
+        return None if app == ctx.name else _err(403, "not this app's token")
+    gate = getattr(ctx, "require_owner", None)
+    if gate is None:
+        return web.json_response({"error": "owner authorization required", "code": "owner_only"}, status=403)  # fail closed
+    return await gate(request, op)
+
+
+def _data_dir(ctx: Any) -> Path:
+    return Path(ctx.data_dir)
+
+
+def _cli(ctx: Any) -> Tuple[Optional[str], str]:
+    setting = load_config(_data_dir(ctx)).get("cliPath")
+    return resolve_cli(setting if isinstance(setting, str) else None, os.environ)
+
+
+async def _run(argv: List[str], cwd: str, env: Dict[str, str], timeout: float) -> Tuple[int, bytes]:
+    proc = await asyncio.create_subprocess_exec(*argv, cwd=cwd, env=env, stdin=asyncio.subprocess.DEVNULL,
+                                                stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.DEVNULL)
+    try:
+        out, _ = await asyncio.wait_for(proc.communicate(), timeout)
+    except asyncio.TimeoutError:
+        proc.kill()
+        await proc.wait()
+        raise
+    return proc.returncode or 0, out
+
+
+async def _reap(proc: "asyncio.subprocess.Process") -> None:
+    async def drain() -> None:
+        assert proc.stdout is not None
+        while await proc.stdout.read(65536):
+            pass
+        await proc.wait()
+
+    try:
+        await asyncio.wait_for(drain(), REAP_TIMEOUT_S)  # one deadline for the whole tail
+    except Exception:  # timeout or a broken pipe: make sure the child does not outlive us
+        if proc.returncode is None:
+            proc.kill()
+            await proc.wait()
+
+
+async def _dashboard(cli: str, env: Dict[str, str]) -> Dict[str, Any]:
+    """`dashboard --json`, returned as soon as the document is printed.
+
+    With a stale usage cache the CLI prints the cached data, then waits for
+    its background codeburn refresh before exiting; that tail is left to
+    finish in the background (and killed after REAP_TIMEOUT_S).
+    """
+    proc = await asyncio.create_subprocess_exec(cli, "dashboard", "--json", cwd=str(Path.home()), env=env,
+                                                stdin=asyncio.subprocess.DEVNULL, stdout=asyncio.subprocess.PIPE,
+                                                stderr=asyncio.subprocess.DEVNULL)
+    assert proc.stdout is not None
+    chunks: List[bytes] = []
+
+    async def read_doc() -> None:
+        size = 0
+        while True:
+            line = await proc.stdout.readline()
+            if not line:
+                return
+            size += len(line)
+            if size > MAX_JSON_BYTES:
+                raise ValueError("prism-cli dashboard --json output is too large")
+            chunks.append(line)
+            if line == b"}\n":  # the document is pretty-printed; this closes it
+                return
+
+    try:
+        await asyncio.wait_for(read_doc(), DASHBOARD_TIMEOUT_S)
+    except BaseException:
+        proc.kill()
+        await proc.wait()
+        raise
+    task = asyncio.ensure_future(_reap(proc))
+    _reaping.add(task)
+    task.add_done_callback(_reaping.discard)
+    payload = json.loads(b"".join(chunks).decode("utf-8"))
+    if not isinstance(payload, dict) or not str(payload.get("schema", "")).startswith("prism.dashboard."):
+        raise ValueError("prism-cli dashboard --json returned an unexpected document")
+    return payload
+
+
+async def _version(cli: str, env: Dict[str, str]) -> str:
+    try:
+        rc, out = await _run([cli, "--version"], str(Path.home()), env, VERSION_TIMEOUT_S)
+    except (OSError, asyncio.TimeoutError):
+        return "unknown"
+    return out.decode("utf-8", "replace").strip().splitlines()[0] if rc == 0 and out.strip() else "unknown"
+
+
+async def _commits(paths: List[str]) -> Dict[str, Optional[Dict[str, str]]]:
+    sem = asyncio.Semaphore(pm.COMMIT_LOOKUP_CONCURRENCY)
+    env = {**os.environ, "GIT_TERMINAL_PROMPT": "0"}
+
+    async def one(path: str) -> Optional[Dict[str, str]]:
+        async with sem:
+            try:
+                rc, out = await _run(pm.last_commit_args(path), path, env, GIT_TIMEOUT_S)
+            except (OSError, asyncio.TimeoutError):
+                return None
+            return pm.parse_last_commit(out.decode("utf-8", "replace")) if rc == 0 else None
+
+    found = await asyncio.gather(*(one(p) for p in paths))
+    return dict(zip(paths, found))
+
+
+async def handle_data(request: web.Request, ctx: Any) -> web.Response:
+    denied = await _gate(request, ctx, "data")
+    if denied is not None:
+        return denied
+    cli, reason = _cli(ctx)
+    if not cli:
+        return _err(503, reason)
+    # Never start a cold codeburn export on our own: only the page's explicit button sets allowExport.
+    if request.query.get("allowExport") != "1" and not pm.usage_cached_today(Path.home()):
+        return web.json_response({"needsUsageCache": True})
+    env = cli_env(cli, os.environ)
+    async with _lock:
+        try:
+            payload = await _dashboard(cli, env)
+        except (OSError, ValueError, asyncio.TimeoutError) as e:
+            return _err(502, "prism-cli dashboard --json failed: " + pm.plain(e, 200))
+        version, commits = await asyncio.gather(_version(cli, env), _commits(pm.commit_lookup_paths(payload)))
+        try:
+            model, targets = pm.build_model(payload, commits, version, pm.read_digest(_data_dir(ctx)))
+        except (ValueError, TypeError, KeyError) as e:
+            return _err(502, "prism-cli dashboard --json returned data this page cannot read: " + pm.plain(e, 200))
+        # The page sends this back with each index, so an index always means the list it was drawn from.
+        _state["gen"] = model["gen"] = uuid.uuid4().hex
+        _state["targets"] = targets
+    return web.json_response(model)
+
+
+async def handle_report(request: web.Request, ctx: Any) -> web.Response:
+    denied = await _gate(request, ctx, "report")
+    if denied is not None:
+        return denied
+    if request.query.get("gen") != _state.get("gen"):
+        return _err(409, "the data changed since this page loaded; refresh and try again")
+    target = pm.target_for(_state["targets"], request.query.get("repoIndex"))
+    if target is None:
+        return _err(400, "unknown repo; refresh the page")
+    cli, reason = _cli(ctx)
+    if not cli:
+        return _err(503, reason)
+    report_dir = _data_dir(ctx) / "reports"
+    try:
+        report_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+    except OSError as e:
+        return _err(502, "could not create the report folder: " + pm.plain(e, 200))
+    pm.cleanup_reports(report_dir)
+    out = report_dir / f"report-{uuid.uuid4().hex}.html"
+    plan = pm.report_plan(target, str(out))
+    env = cli_env(cli, os.environ)
+    attempts = [(plan["primary"], plan["primaryNote"])] + ([(plan["fallback"], plan["fallbackNote"])] if plan["fallback"] else [])
+    causes: List[str] = []
+    for args, note in attempts:
+        try:
+            rc, _ = await _run([cli, *args], target["path"], env, REPORT_TIMEOUT_S)
+        except asyncio.TimeoutError:
+            causes.append(f"timed out after {REPORT_TIMEOUT_S} s")
+            continue
+        except OSError as e:
+            causes.append(pm.plain(e, 200))
+            continue
+        if rc != 0 or not out.is_file():
+            causes.append(f"exit {rc}")
+            continue
+        try:
+            if out.stat().st_size > MAX_REPORT_BYTES:
+                return _err(502, "the report is too large to show here; run prism-cli codewatch report in a terminal")
+            html = out.read_text(encoding="utf-8", errors="replace")
+        except OSError as e:
+            return _err(502, "could not read the report: " + pm.plain(e, 200))
+        finally:
+            # Read once, then gone; cleanup_reports catches files a crash left behind.
+            try:
+                out.unlink()
+            except OSError:
+                pass
+        return web.json_response({"repo": target["name"], "note": note, "html": pm.with_report_csp(html)})
+    ctx.logger.warning("prism report for %s failed: %s", target["name"], "; ".join(causes))
+    return _err(502, f"prism-cli codewatch report found no review for {target['name']} ({'; '.join(causes)})")

package/dist/assets/kirocrew-app/scripts/prism_cli_path.py

@@ -0,0 +1,131 @@
+"""Find prism-cli the way the PRISM editor extension does (editor-extension/src/cli.ts).
+
+The gateway and kiro-cli often start without nvm's bin folder on PATH (a
+service unit or a desktop launcher does not read .bashrc), so a plain PATH
+lookup misses an nvm or Volta install. No shell is run to find it.
+
+Order: the `cliPath` setting (absolute, executable), PATH, $NVM_BIN,
+~/.nvm/versions/node/*/bin (alias default first, then newest), Volta,
+~/.local/bin, ~/.npm-global/bin, $NPM_CONFIG_PREFIX/bin.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+from pathlib import Path
+from typing import Callable, Dict, List, Mapping, Optional, Tuple
+
+CLI_NAME = "prism-cli"
+MAX_ALIAS_HOPS = 4  # default -> lts/* -> lts/<name> -> version
+_VERSION_DIR = re.compile(r"^v\d+\.\d+\.\d+$")
+
+
+def app_data_dir() -> Path:
+    """The app's data folder: <app dir>/data, or $PRISM_APP_DATA (for tests and smoke runs)."""
+    override = os.environ.get("PRISM_APP_DATA", "")
+    if override:
+        return Path(override)
+    # Installed layout: <data home>/apps/<app>/scripts/this_file.py -> <data home>/apps/<app>/data
+    return Path(__file__).absolute().parent.parent / "data"
+
+
+def load_config(data_dir: Path) -> dict:
+    """data/config.json as a dict; {} when missing or unreadable."""
+    try:
+        cfg = json.loads((data_dir / "config.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return {}
+    return cfg if isinstance(cfg, dict) else {}
+
+
+def is_executable_file(p: str) -> bool:
+    return os.path.isfile(p) and os.access(p, os.X_OK)
+
+
+def _version_key(v: str) -> Tuple[int, ...]:
+    return tuple(int(x) for x in v[1:].split("."))
+
+
+def _read_text(p: Path) -> Optional[str]:
+    try:
+        return p.read_text(encoding="utf-8").strip()
+    except OSError:
+        return None
+
+
+def _nvm_default(home: Path, versions: List[str]) -> Optional[str]:
+    """The installed version ~/.nvm/alias/default names (following a few alias hops), or None."""
+    alias = _read_text(home / ".nvm" / "alias" / "default")
+    for _ in range(MAX_ALIAS_HOPS):
+        if not alias:
+            return None
+        if alias in ("node", "stable"):
+            return versions[0] if versions else None
+        m = re.match(r"^v?(\d+(?:\.\d+){0,2})$", alias)
+        if m:
+            want = "v" + m.group(1)
+            return next((v for v in versions if v == want or v.startswith(want + ".")), None)
+        if os.path.isabs(alias) or ".." in alias.split("/"):
+            return None
+        alias = _read_text(home / ".nvm" / "alias" / alias)
+    return None
+
+
+def nvm_bin_dirs(home: Path) -> List[str]:
+    root = home / ".nvm" / "versions" / "node"
+    try:
+        versions = sorted((v for v in os.listdir(root) if _VERSION_DIR.match(v)), key=_version_key, reverse=True)
+    except OSError:
+        return []
+    default = _nvm_default(home, versions)
+    if default:
+        versions = [default] + [v for v in versions if v != default]
+    return [str(root / v / "bin") for v in versions]
+
+
+def user_install_dirs(home: Path, env: Mapping[str, str]) -> List[str]:
+    dirs = [
+        env.get("NVM_BIN"),
+        *nvm_bin_dirs(home),
+        os.path.join(env["VOLTA_HOME"], "bin") if env.get("VOLTA_HOME") else str(home / ".volta" / "bin"),
+        str(home / ".local" / "bin"),
+        str(home / ".npm-global" / "bin"),
+        os.path.join(env["NPM_CONFIG_PREFIX"], "bin") if env.get("NPM_CONFIG_PREFIX") else None,
+    ]
+    out: List[str] = []
+    for d in dirs:
+        if d and os.path.isabs(d) and d not in out:
+            out.append(d)
+    return out
+
+
+def resolve_cli(
+    setting: Optional[str],
+    env: Mapping[str, str],
+    home: Optional[Path] = None,
+    is_exec: Callable[[str], bool] = is_executable_file,
+) -> Tuple[Optional[str], str]:
+    """(path, "") when found, else (None, reason)."""
+    if setting:
+        if not os.path.isabs(setting):
+            return None, "cliPath must be an absolute path"
+        return (setting, "") if is_exec(setting) else (None, "cliPath is not an executable file")
+    for d in env.get("PATH", "").split(os.pathsep):
+        # A relative PATH entry would resolve against whatever the working directory is.
+        if d and os.path.isabs(d) and is_exec(os.path.join(d, CLI_NAME)):
+            return os.path.join(d, CLI_NAME), ""
+    home = home or Path.home()
+    for d in user_install_dirs(home, env):
+        p = os.path.join(d, CLI_NAME)
+        if is_exec(p):
+            return p, ""
+    return None, f"{CLI_NAME} is not on PATH or in the usual install folders (nvm, Volta, ~/.local/bin, npm prefix); set cliPath in the app's data/config.json"
+
+
+def cli_env(cli_path: str, env: Mapping[str, str]) -> Dict[str, str]:
+    """env with prism-cli's folder first on PATH, so its `#!/usr/bin/env node` finds the node next to it."""
+    out = dict(env)
+    d = os.path.dirname(cli_path)
+    out["PATH"] = d + os.pathsep + env["PATH"] if env.get("PATH") else d
+    return out