@quickchatai/quickreview 1.1.0 → 1.3.1

package/src/tui/remote.ts

@@ -337,8 +337,16 @@ export function killInFlightSsh(): number {
   return killed;
 }
 
+/** What the ssh runner answers for an empty host — spawned, `ssh "" …` would
+ * die on "Could not resolve hostname" and every surface would print an ssh
+ * remedy with no host in it. */
+export const NO_SSH_HOST_STDERR =
+  '[tui] ssh_host is empty — set it to the VM\'s ssh alias, or set [tui] target = "local"';
+
 export const realSshRunner: SshRunner = (host, argv, opts) =>
-  runChild("ssh", ["-o", "BatchMode=yes", host, argv.map(shellQuote).join(" ")], opts);
+  host.trim() === ""
+    ? Promise.resolve({ ok: false, stdout: "", stderr: NO_SSH_HOST_STDERR, code: null })
+    : runChild("ssh", ["-o", "BatchMode=yes", host, argv.map(shellQuote).join(" ")], opts);
 
 /**
  * The laptop topology's runner — the same argv every builder above

package/src/tui/route.ts

@@ -0,0 +1,173 @@
+// The TUI's route — which daemon the board reads, and how — resolved ONCE,
+// before the first frame, from config.toml's [tui] block plus three local
+// facts that cost no docker, network or directory walk: the compose
+// project's `.env`, the onboarding checklist, and whether this user can open
+// the Docker socket without sudo.
+//
+// Why a resolution step at all. `[tui]` ships VM-shaped defaults (target
+// "ssh", sudo docker, the VM host's state path), and on one box a fresh
+// install opens the TUI before onboarding's config_fill has written its
+// local values — or with a hand-written config that never names them. Every
+// builder in remote.ts reads the config it is handed, and the transport is
+// still decided by the explicit `target` knob alone (`transportOf`); this
+// module only decides which config that is, and says so once when it departs
+// from the file:
+//
+//   * `target = "ssh"` with an EMPTY `ssh_host` cannot reach anything. When
+//     this checkout is a compose project (the checklist recorded the local
+//     topology, or none was recorded and the project `.env` pins a release)
+//     the route is the local stack, said once; otherwise the route is
+//     `unconfigured` and every surface shows the one precise remedy instead
+//     of an ssh command with no host in it.
+//   * On the local route the state dir is the release image's
+//     (`/opt/qcr/state`, the compose `qcr-state` volume) whenever the knob
+//     still holds the VM default, the daemon's `-daemon-N` container implies
+//     its `-memory-N` sidecar for the memory forward, and sudo is dropped
+//     when the socket answers this user without it (a non-interactive
+//     `sudo docker` behind the alt screen can only fail).
+//
+// An operator's explicit, non-default value always wins: nothing here
+// overwrites a value the file states differently from the shipped default.
+import { accessSync, constants, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { TUI_DEFAULTS, type TuiConfig } from "../config.js";
+import { readChecklist, type ChecklistFile } from "../onboard/engine.js";
+import { CHOICE_KEYS } from "../onboard/choices.js";
+import { NO_SSH_HOST_STDERR } from "./remote.js";
+
+/** The release image's state dir inside the daemon container (the compose
+ * `qcr-state` volume; src/onboard/steps/ingress.ts CONTAINER_STATE_DIR). */
+export const RELEASE_STATE_DIR = "/opt/qcr/state";
+
+/** The bundled compose project's daemon and memory containers
+ * (docker-compose.yml `name: quickreview`). */
+export const COMPOSE_DAEMON_CONTAINER = "quickreview-daemon-1";
+export const COMPOSE_MEMORY_CONTAINER = "quickreview-memory-1";
+
+/** The legacy daemon container (no `qcr.layout` label): the one container whose
+ * in-container state dir is still the VM-shaped default. */
+const LEGACY_CONTAINER = "quickreview-sandbox";
+
+export interface RouteFacts {
+  /** The compose project directory (this checkout): remedy text names it. */
+  projectDir: string;
+  /** `<project>/.env`, or null when there is none. */
+  projectEnv: string | null;
+  /** The onboarding checklist, or null when absent or unreadable. */
+  checklist: ChecklistFile | null;
+  /** Can this user open the Docker socket without sudo? undefined = no socket
+   * found to ask (no local Docker, or a remote DOCKER_HOST). */
+  dockerSocketAccess: boolean | undefined;
+}
+
+export interface TuiRoute {
+  /** The config every TUI remote op is built from. */
+  cfg: TuiConfig;
+  /** One-time lines for the notice line: where the route departs from the file. */
+  notes: string[];
+  /** Set when nothing can be reached: the precise reason and remedy, shown in
+   * place of any ssh diagnosis. */
+  unconfigured?: string;
+}
+
+/** The precise message for `target = "ssh"` with no host and no local stack —
+ * the same words the ssh runner answers an empty host with. */
+export const EMPTY_SSH_HOST = NO_SSH_HOST_STDERR;
+
+/** `QCR_VERSION=` from a project `.env` — "" when absent. */
+export function pinnedVersion(envText: string | null): string {
+  if (envText === null) return "";
+  const m = /^QCR_VERSION=(.*)$/m.exec(envText);
+  return m ? (m[1] ?? "").trim().replace(/^["']|["']$/g, "") : "";
+}
+
+/** The recorded topology, or null when the checklist recorded none. */
+function recordedTopology(checklist: ChecklistFile | null): "local" | "vm" | null {
+  const raw = checklist?.choices[CHOICE_KEYS.topology];
+  return raw === "local" || raw === "vm" ? raw : null;
+}
+
+/** The `-memory-N` sidecar a compose `-daemon-N` container implies, or "". */
+export function composeMemoryFor(container: string): string {
+  const m = /^(.+)-daemon-(\d+)$/.exec(container);
+  return m ? `${m[1]}-memory-${m[2]}` : "";
+}
+
+/** Pure: the effective [tui] config for these facts. */
+export function resolveTuiRoute(file: TuiConfig, facts: RouteFacts): TuiRoute {
+  const notes: string[] = [];
+  let cfg: TuiConfig = { ...file };
+  if (cfg.target === "ssh" && cfg.ssh_host.trim() === "") {
+    const topology = recordedTopology(facts.checklist);
+    const composeProject = pinnedVersion(facts.projectEnv) !== "";
+    if (topology === "local" || (topology === null && composeProject)) {
+      cfg = {
+        ...cfg,
+        target: "local",
+        container:
+          cfg.container === TUI_DEFAULTS.container ? COMPOSE_DAEMON_CONTAINER : cfg.container,
+      };
+      notes.push(
+        `[tui] target is "ssh" with no ssh_host — reading the local compose stack in ${facts.projectDir} instead ` +
+          '(set [tui] target = "local" to make it explicit)',
+      );
+    } else {
+      return {
+        cfg,
+        notes,
+        unconfigured:
+          topology === "vm"
+            ? "[tui] ssh_host is empty — set it to the VM's ssh alias in config.toml"
+            : EMPTY_SSH_HOST,
+      };
+    }
+  }
+  if (cfg.target !== "local") return { cfg, notes };
+  if (cfg.remote_state_dir === TUI_DEFAULTS.remote_state_dir && cfg.container !== LEGACY_CONTAINER)
+    cfg = { ...cfg, remote_state_dir: RELEASE_STATE_DIR };
+  if ((cfg.memory_container ?? "").trim() === "") {
+    const memory = composeMemoryFor(cfg.container);
+    if (memory !== "") cfg = { ...cfg, memory_container: memory };
+  }
+  if (cfg.sudo_docker && facts.dockerSocketAccess === true) cfg = { ...cfg, sudo_docker: false };
+  return { cfg, notes };
+}
+
+/** The Docker socket this process would talk to: `DOCKER_HOST` when it is a
+ * unix socket, the default path otherwise; undefined for a remote daemon. */
+export function dockerSocketPath(env: NodeJS.ProcessEnv): string | undefined {
+  const host = (env["DOCKER_HOST"] ?? "").trim();
+  if (host === "") return "/var/run/docker.sock";
+  return host.startsWith("unix://") ? host.slice("unix://".length) : undefined;
+}
+
+/** One `access(2)` on the socket — no docker call, no walk. */
+export function probeSocketAccess(
+  path: string | undefined,
+  access: (p: string, mode: number) => void = accessSync,
+): boolean | undefined {
+  if (path === undefined) return undefined;
+  try {
+    access(path, constants.R_OK | constants.W_OK);
+    return true;
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    return code === "EACCES" || code === "EPERM" ? false : undefined;
+  }
+}
+
+/** The facts, read from this checkout: two small files and one access(2). */
+export function readRouteFacts(root: string, env: NodeJS.ProcessEnv = process.env): RouteFacts {
+  let projectEnv: string | null = null;
+  try {
+    projectEnv = readFileSync(join(root, ".env"), "utf8");
+  } catch {
+    projectEnv = null;
+  }
+  return {
+    projectDir: root,
+    projectEnv,
+    checklist: readChecklist(join(root, "state")),
+    dockerSocketAccess: probeSocketAccess(dockerSocketPath(env)),
+  };
+}

package/src/tui/setupstate.ts

@@ -0,0 +1,56 @@
+// Is setup finished? Read from the checklist file switch-on and Advanced keep
+// (src/onboard/engine.ts), so a TUI opened halfway through says so on its
+// first frame instead of troubleshooting a daemon nobody has started yet.
+//
+// Only a checklist that EXISTS and is not complete counts: an install that
+// never switched auto-review on (a hand-written config, the VM operator's own
+// setup) has no checklist and gets no banner. Setup is finished in the home
+// (a bare `qcr`), so the steps judged are the home's: switch-on's and
+// Advanced's registry (src/home/advanced.ts), with the engine's own
+// predicates. The next step is the first enabled, required one the file does
+// not record as done; when there is none, nothing is left that the home could
+// finish, and there is no banner (the home never runs the wizard's finish, so
+// its checklist need not carry the wizard's completion marker).
+import { type ChecklistFile } from "../onboard/engine.js";
+
+export interface SetupState {
+  /** The title of the first pending step, or undefined when it could not be
+   * computed. */
+  next: string | undefined;
+}
+
+/** The one sentence every surface uses. */
+export function setupLine(s: SetupState): string {
+  return `setup not finished — run \`qcr\` to finish setting up${s.next ? ` (next: ${s.next})` : ""}`;
+}
+
+/** Complete now: finished once and not reopened since (engine.ts `completeNow`). */
+function completeNow(file: ChecklistFile): boolean {
+  return typeof file.completed_at === "string" && !file.reopened_at;
+}
+
+/** undefined = nothing to say (no checklist, setup is complete, or the home
+ * has no step left to finish). */
+export async function setupStateOf(
+  checklist: ChecklistFile | null,
+): Promise<SetupState | undefined> {
+  if (checklist === null || completeNow(checklist)) return undefined;
+  let next: string | undefined;
+  try {
+    const { advancedRegistry } = await import("../home/advanced.js");
+    const steps = [...advancedRegistry().steps()].sort((a, b) => a.order - b.order);
+    const pending = steps.find(
+      (s) =>
+        !s.optional &&
+        (s.enabled ? s.enabled(checklist.choices) : true) &&
+        checklist.steps[s.id]?.status !== "done",
+    );
+    if (pending === undefined) return undefined;
+    next = pending.title;
+  } catch {
+    // The step registry could not be loaded: the banner still says setup is
+    // unfinished, without naming a step it could not compute.
+    next = undefined;
+  }
+  return { next };
+}

package/src/tui/sshtriage.ts

@@ -25,13 +25,22 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import type { TuiConfig } from "../config.js";
 import { masterCheckArgv } from "./connect.js";
-import { shellQuote, transportOf } from "./remote.js";
+import { NO_SSH_HOST_STDERR, shellQuote, transportOf } from "./remote.js";
 
 export type ConnectionClass =
   /** The VM answers — master alive, or a fresh connection succeeded. */
   | "ok"
-  /** `[tui] target = "local"`: there is no ssh anywhere. */
+  /** `[tui] target = "local"`: there is no ssh anywhere, and the daemon
+   * container is running on this machine. */
   | "local"
+  /** Local route: Docker answers, but the daemon container is absent or not
+   * running (the stack is not up yet, or it stopped). */
+  | "local-down"
+  /** Local route: the local Docker itself did not answer this user. */
+  | "local-docker"
+  /** Nothing to connect to: `target = "ssh"` with no `ssh_host` (onboarding
+   * has not written the route yet). No ssh is ever spawned for it. */
+  | "unconfigured"
   /** The agent cannot offer the key ssh wants for this host. */
   | "no-agent-key"
   /** A ControlMaster socket is there and does not answer. */
@@ -413,6 +422,112 @@ export interface TriageDeps {
   run?: ProbeRunner;
   exists?: (path: string) => boolean;
   home?: string;
+  /** The compose project directory, for the local route's remedy line. */
+  projectDir?: string;
+  /** The route resolver's reason nothing can be reached (src/tui/route.ts);
+   * defaults to the empty-ssh_host sentence. */
+  unconfigured?: string;
+}
+
+/** Is this a local-route diagnosis (no ssh anywhere)? */
+export function isLocalDiagnosis(d: Pick<ConnectionDiagnosis, "kind">): boolean {
+  return d.kind === "local" || d.kind === "local-down" || d.kind === "local-docker";
+}
+
+/** A diagnosis under which the daemon can answer: the board's "connected". */
+export function connectionUsable(d: Pick<ConnectionDiagnosis, "kind">): boolean {
+  return d.kind === "ok" || d.kind === "local";
+}
+
+/** `docker inspect` of the daemon container's state, for the local route.
+ * `sudo -n` when sudo is configured: a password prompt behind the alt screen
+ * is a hang, so a sudo that would ask fails instead. */
+export function localDaemonProbeArgv(cfg: TuiConfig): { cmd: string; argv: string[] } {
+  const inspect = ["inspect", "-f", "{{.State.Status}}", cfg.container];
+  return cfg.sudo_docker
+    ? { cmd: "sudo", argv: ["-n", "docker", ...inspect] }
+    : { cmd: "docker", argv: inspect };
+}
+
+/** How to bring the stack up from here. */
+export function composeUpRemedy(projectDir: string | undefined, container: string): string {
+  return projectDir
+    ? `docker compose --project-directory ${shellQuote(projectDir)} up -d`
+    : `docker start ${shellQuote(container)}`;
+}
+
+/** Pure: the local route's diagnosis from one `docker inspect`. */
+export function classifyLocal(
+  cfg: TuiConfig,
+  res: ProbeResult,
+  projectDir?: string,
+): ConnectionDiagnosis {
+  const c = cfg.container;
+  const out = res.stdout.trim();
+  const evidence = firstLine(res.stderr);
+  const detail = evidence ? { detail: evidence } : {};
+  if (res.status === 0 && out === "running") {
+    return {
+      kind: "local",
+      cause: `local docker — the daemon container ${c} is running on this machine (no ssh)`,
+      remedy: "",
+    };
+  }
+  if (res.status === 0) {
+    return {
+      kind: "local-down",
+      cause: `the daemon container ${c} is ${out || "not running"} — start it`,
+      remedy: composeUpRemedy(projectDir, c),
+    };
+  }
+  if (res.timedOut) {
+    return {
+      kind: "local-docker",
+      cause: "local Docker did not answer in time",
+      remedy: "docker info",
+      ...detail,
+    };
+  }
+  const text = `${res.stderr}
+${res.stdout}`;
+  if (/no such (object|container)/i.test(text)) {
+    return {
+      kind: "local-down",
+      cause: `no daemon container ${c} on this machine — the compose stack is not up (it starts at onboarding's bring-up step)`,
+      remedy: composeUpRemedy(projectDir, c),
+    };
+  }
+  if (/a password is required|a terminal is required/i.test(text)) {
+    return {
+      kind: "local-docker",
+      cause: "[tui] sudo_docker is on and sudo wants a password the TUI cannot type",
+      remedy:
+        'sudo usermod -aG docker "$USER"   # then log in again, and set [tui] sudo_docker = false',
+      ...detail,
+    };
+  }
+  if (/permission denied/i.test(text)) {
+    return {
+      kind: "local-docker",
+      cause: "this user cannot open the local Docker socket",
+      remedy: 'sudo usermod -aG docker "$USER"   # then log in again',
+      ...detail,
+    };
+  }
+  if (/ENOENT|not found|no such file/i.test(text) && !/daemon/i.test(text)) {
+    return {
+      kind: "local-docker",
+      cause: "there is no docker command on this machine",
+      remedy: "docker --version",
+      ...detail,
+    };
+  }
+  return {
+    kind: "local-docker",
+    cause: `local Docker is not answering — ${evidence || "no error text"}`,
+    remedy: "docker info",
+    ...detail,
+  };
 }
 
 const CONFIG_TIMEOUT_MS = 5_000;
@@ -458,14 +573,20 @@ export async function triageConnection(
   cfg: TuiConfig,
   deps: TriageDeps = {},
 ): Promise<ConnectionDiagnosis> {
+  const run = deps.run ?? realProbeRunner;
   if (transportOf(cfg) === "local") {
+    // No ssh anywhere: the one probe is local docker's own answer about the
+    // daemon container.
+    const probe = localDaemonProbeArgv(cfg);
+    return classifyLocal(cfg, await run(probe.cmd, probe.argv, CONFIG_TIMEOUT_MS), deps.projectDir);
+  }
+  if (cfg.ssh_host.trim() === "") {
     return {
-      kind: "local",
-      cause: "local transport — the daemon runs on this machine, no ssh involved",
-      remedy: "",
+      kind: "unconfigured",
+      cause: deps.unconfigured ?? NO_SSH_HOST_STDERR,
+      remedy: "set [tui] ssh_host in config.toml",
     };
   }
-  const run = deps.run ?? realProbeRunner;
   const exists = deps.exists ?? existsSync;
   const home = deps.home ?? homedir();
   const host = cfg.ssh_host;

package/src/tui/theme.ts

@@ -3,7 +3,7 @@
 // legend — a glance at the color tells the state without reading. Verdicts
 // and anomalies get their own fixed colors.
 import { ACCENT, MUTED } from "./design.js";
-import { STATE_GLYPHS } from "./model.js";
+import { OFFERED_GLYPH, STATE_GLYPHS } from "./model.js";
 import { ESC, rgb } from "./paint.js";
 
 export const FG = {
@@ -78,6 +78,7 @@ export function legendLine(): string {
     [STATE_GLYPHS.queued, "queued", FG.queued],
     [STATE_GLYPHS.awaiting_author, "author", FG.awaiting_author],
     [STATE_GLYPHS.tracked, "tracked", FG.tracked],
+    [OFFERED_GLYPH, "not reviewed", FG.dim],
     ["↻", "stale", FG.accent],
   ];
   return parts

package/src/tui/unwedge.ts

@@ -26,6 +26,7 @@ import type { App } from "./app.js";
 import { sanitizeText } from "./paint.js";
 import type { SshRunner } from "./remote.js";
 import { remoteSandboxRoot, resolveLayout } from "./layout.js";
+import { operatorCommandWriteScriptAt } from "../operatorwrite.js";
 
 /** The commands this channel may produce. Deliberately a closed set: the
  * daemon's whitelist is the authority, and this is the narrower subset that
@@ -94,20 +95,7 @@ export function commandFileName(now: Date, seq: number, client?: string): string
  * (`tests/levers.test.ts`).
  */
 export function operatorCommandWriteScript(cfg: TuiConfig, name: string): string {
-  const root = commandDirFor(cfg);
-  const dir = operatorCommandDirFor(cfg);
-  const tmp = `.${name}.tmp`;
-  return (
-    `[ -d '${root}' ] || { echo 'daemon commands dir ${root} missing - is the daemon running?' >&2; exit 1; }; ` +
-    `mkdir -p '${dir}' || exit 1; ` +
-    `[ ! -L '${dir}' ] || { echo '${dir} is a symlink - refusing to write the operator command' >&2; exit 1; }; ` +
-    `R=$(cd -P '${root}' && pwd -P) || exit 1; ` +
-    `cd -P '${dir}' || exit 1; ` +
-    `[ "$(pwd -P)" = "$R/operator" ] || { echo '${dir} was replaced while writing - refusing to write the operator command' >&2; exit 1; }; ` +
-    `chown -h 0:0 . && chmod 0755 . || exit 1; ` +
-    `find . -maxdepth 1 -name '*.json' -mmin +1440 -delete 2>/dev/null; ` +
-    `rm -f '${tmp}' '${name}' && cat > '${tmp}' && chmod 0644 '${tmp}' && mv '${tmp}' '${name}'`
-  );
+  return operatorCommandWriteScriptAt(commandDirFor(cfg), name);
 }
 
 /** argv for the atomic command write. The payload rides STDIN, never the

package/src/verdicts.ts

@@ -15,6 +15,11 @@ import {
 // write the companion inbox. There is no path here that touches an existing review:
 // the invariant against retracting an approval is structural, not prompted
 // (AGENTS.md invariant 2).
+import {
+  botAccountLogin,
+  isPersonMode,
+  ownLogins,
+} from "@quickchatai/pi-quickreview/src/identity.js";
 import {
   normalizePassPhase,
   normalizeSweepClaim,
@@ -406,6 +411,15 @@ export function decidedVerdictFromReceipt(receipt: PostingReceipt): ReceiptDecis
     return { verdict: "REQUEST_CHANGES" };
   if (receipt.intended_event === "APPROVE" && receipt.actual_event === "APPROVE")
     return { verdict: "APPROVE" };
+  // Person mode posts every review as a COMMENT: the approval the session
+  // asked for is the decision, and it was not withheld.
+  if (
+    receipt.person_mode === true &&
+    receipt.intended_event === "APPROVE" &&
+    receipt.actual_event === "COMMENT" &&
+    receipt.reconciled !== true
+  )
+    return { verdict: "APPROVE" };
   if (
     receipt.intended_event === "COMMENT" &&
     receipt.actual_event === "COMMENT" &&
@@ -1537,12 +1551,11 @@ export class VerdictWatcher {
     if (!this.deps.cfg.dry_run && this.deps.adapter.listReviewsFull) {
       try {
         const marker = postingMarker(round.posting_key);
-        const bot = this.deps.cfg.github.bot_login;
         const reviews = await this.deps.adapter.listReviewsFull(round.pr);
         reconciled = true;
         const matches = reviews.filter(
           (review) =>
-            (review.user === bot || review.user === `${this.deps.cfg.github.app_slug}[bot]`) &&
+            ownLogins(this.deps.cfg.github).includes(review.user) &&
             review.commit_id?.toLowerCase() === expectedHead.toLowerCase() &&
             review.body.includes(marker),
         );
@@ -1596,6 +1609,7 @@ export class VerdictWatcher {
             gh_commit_id: match.commit_id,
             gh_state: match.state,
             ...(verifiedIntent ? {} : { reconciled: true }),
+            ...(isPersonMode(this.deps.cfg.github) ? { person_mode: true as const } : {}),
           };
           if (verdict && !receiptMatchesVerdict(synthetic, verdict)) {
             return {
@@ -1804,7 +1818,7 @@ export class VerdictWatcher {
         );
       }
       const restored = restoreStandingLifecycle(store, round.pr, standing, {
-        botLogin: cfg.github.bot_login,
+        botLogin: botAccountLogin(cfg.github),
         now: () => this.now(),
         reason: standing
           ? `posting-guarded-noop:${standing}`
@@ -2339,7 +2353,11 @@ export class VerdictWatcher {
       v.pr,
       { type: "verdict", verdict: v.verdict },
       { head_sha: v.head_sha },
-      { botLogin: cfg.github.bot_login, now: () => this.now(), reason: `verdict:${v.verdict}` },
+      {
+        botLogin: botAccountLogin(cfg.github),
+        now: () => this.now(),
+        reason: `verdict:${v.verdict}`,
+      },
     );
     store.logEvent("verdict_applied", v.pr, {
       file: name,
@@ -3486,7 +3504,7 @@ export class VerdictWatcher {
       pr,
       { type: "round_overdue", standing },
       {},
-      { botLogin: cfg.github.bot_login, now: () => this.now(), reason: `anomaly:${kind}` },
+      { botLogin: botAccountLogin(cfg.github), now: () => this.now(), reason: `anomaly:${kind}` },
     );
     const command = round ? store.sessionCommandForRound(pr, round.round_no) : undefined;
     const successor = store.successorFor(pr);

package/src/version.ts

@@ -8,7 +8,7 @@ import {
   SCAN_SCHEMA_VERSION,
   VERSION_SCHEMA_VERSION,
 } from "@quickchatai/pi-quickreview/src/contract.js";
-import { piPinFromPackageJson } from "./onboard/launch.js";
+import { piPinFromPackageJson } from "./onboard/pipin.js";
 
 export interface VersionInfo {
   schema_version: number;

package/src/webhook.ts

@@ -9,6 +9,7 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { captureFromEvent, recordCapturedComment } from "./capture.js";
 import { reviewTeamSlug, type Config } from "./config.js";
+import { botAccountLogin } from "@quickchatai/pi-quickreview/src/identity.js";
 import { interpretReviewEvent, isFeedbackBody, ledgerFeedbackSignal } from "./feedback.js";
 import { applyEvent as applyEventFor, mergedOverBlock } from "./statemachine.js";
 import type { StateStore, StatusSnapshot } from "./state.js";
@@ -20,6 +21,8 @@ import { blockedPrAuthor } from "./pr-conversation.js";
  * header, a wrong prefix, or a length mismatch (timingSafeEqual throws on
  * unequal lengths — we must not let that leak as a 500). */
 export function verifySignature(raw: Buffer, header: string | undefined, secret: string): boolean {
+  // An empty secret signs nothing: anyone can compute that HMAC.
+  if (secret === "") return false;
   if (!header || !header.startsWith("sha256=")) return false;
   const expected = Buffer.from(signBody(raw, secret), "utf8");
   const given = Buffer.from(header, "utf8");
@@ -499,6 +502,10 @@ export function handleDelivery(
   raw: Buffer,
 ): WebhookHandleResult {
   const log = deps.log ?? (() => {});
+  // The polling shape (and so `[github] auth = "user"`) takes no webhooks:
+  // the daemon hands no secret, and every delivery is refused unread. The
+  // reconcile poll is that install's only trigger.
+  if (deps.secret === "") return { status: 404, reason: "webhooks-disabled" };
   if (!verifySignature(raw, headers.signature, deps.secret)) {
     logRejection(deps, log, headers);
     return { status: 403, reason: "bad-signature" };
@@ -810,7 +817,9 @@ export async function applyInterpretation(
   i: Interpretation,
 ): Promise<void> {
   const { store, cfg } = deps;
-  const opts = { botLogin: cfg.github.bot_login };
+  // The bot ACCOUNT for PR authorship. Person mode has none; no webhook
+  // arrives there, but the state machine reads one rule everywhere.
+  const opts = { botLogin: botAccountLogin(cfg.github) };
   const local = <T>(run: () => T): T => store.webhookLocalOnce(deps.deliveryGuid, run);
   switch (i.kind) {
     case "trigger":