@satanwagen/reviewkit 0.1.1 → 0.1.2

package/cli/emblema-sync.mjs

@@ -296,11 +296,15 @@ export function cmdServe(cwd) {
     findings.set(item.id, toFinding(item, seq));
     queuePush(item);
   };
+  // Tombstone unconditionally: a delete for an id this process never saw (a
+  // ghost row left in the Emblema tile by an older/restarted agent) must still
+  // be reportable under `deleted`, or the row can never be cleared.
   const dropItem = (id) => {
-    if (findings.delete(id)) {
-      seq += 1;
-      deletedIds.set(id, seq);
-    }
+    // Already tombstoned and not live: nothing changed — don't churn the
+    // cursor (rooms replay their `deleted` list on every reconnect).
+    if (!findings.delete(id) && deletedIds.has(id)) return;
+    seq += 1;
+    deletedIds.set(id, seq);
   };
 
   /* -- realtime push to the Emblema intake (headers per contract v2) -- */
@@ -438,7 +442,7 @@ export function cmdServe(cwd) {
   /* -- HTTP API -- */
   const CORS = {
     'access-control-allow-origin': '*',
-    'access-control-allow-methods': 'GET, POST, OPTIONS',
+    'access-control-allow-methods': 'GET, POST, DELETE, OPTIONS',
     'access-control-allow-headers': 'content-type, authorization, x-reviewkit-key-id',
   };
   const send = (res, status, body) => {
@@ -555,7 +559,15 @@ export function cmdServe(cwd) {
           return send(res, 400, { ok: false, error: 'invalid JSON' });
         }
         const mapped = STATUS_MAP[status];
-        if (!mapped) return send(res, 400, { ok: false, error: 'status must be open|accepted|dismissed|fixed' });
+        if (!mapped) {
+          // Echo what arrived: the live 400s on `open` were an OLD installed
+          // agent, and a bare "must be …" message made that undiagnosable.
+          return send(res, 400, {
+            ok: false,
+            error: `status must be open|accepted|dismissed|fixed (received ${JSON.stringify(status ?? null)})`,
+            received: status ?? null,
+          });
+        }
         const finding = findings.get(decodeURIComponent(statusMatch[1]));
         if (!finding) return send(res, 404, { ok: false, error: 'unknown finding' });
         const ws = sockets.get(finding._route);
@@ -567,6 +579,24 @@ export function cmdServe(cwd) {
       });
       return;
     }
+    // DELETE /findings/{id} (POST …/delete for clients that cannot send DELETE).
+    // IDEMPOTENT: an unknown id still answers 200 and is tombstoned, so a ghost
+    // row left in the tile by an older/restarted agent can always be cleared.
+    // No body is read — the id is entirely in the path.
+    const deleteMatch =
+      (req.method === 'DELETE' && url.pathname.match(/^\/api\/emblema\/findings\/([^/]+)$/)) ||
+      (req.method === 'POST' && url.pathname.match(/^\/api\/emblema\/findings\/([^/]+)\/delete$/));
+    if (deleteMatch) {
+      const id = decodeURIComponent(deleteMatch[1]);
+      const finding = findings.get(id);
+      // Write-back first, while _route is still known: the site pin must
+      // disappear for every reviewer, not just in the tile.
+      const ws = finding && sockets.get(finding._route);
+      if (ws && ws.readyState === 1) ws.send(JSON.stringify({ t: 'item:delete', id }));
+      dropItem(id);
+      send(res, 200, { ok: true, id, known: !!finding });
+      return;
+    }
     send(res, 404, { ok: false, error: 'not found' });
   });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@satanwagen/reviewkit",
-  "version": "0.1.1",
-  "description": "Drop-in visual review & feedback layer for React sites. Reviewers annotate the live page; nothing is ever applied \u2014 changes are recorded as a portable session for a coding agent.",
+  "version": "0.1.2",
+  "description": "Drop-in visual review & feedback layer for React sites. Reviewers annotate the live page; nothing is ever applied — changes are recorded as a portable session for a coding agent.",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -69,4 +69,4 @@
   "bin": {
     "reviewkit-emblema": "./cli/emblema-sync.mjs"
   }
-}
+}