claude-plan-review 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 pavlo.p@mate.academy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,119 @@
+# claude-plan-review
+
+Review Claude Code **plans** in a local, GitHub-style web UI — leave persistent
+comments, approve or send changes back to Claude, and keep every plan iteration
+with its comments and diffs. All from the browser; no console needed.
+
+When Claude finishes a plan in **plan mode**, a `PreToolUse` hook on the
+`ExitPlanMode` tool intercepts it, opens the plan in your browser, and **blocks**
+until you decide:
+
+- **Approve** → Claude exits plan mode and starts implementing.
+- **Request changes** → your line + general comments are sent back as the denial
+  reason; Claude stays in plan mode and revises, producing a new version.
+
+Everything is stored **outside your repo** (`~/.claude/plan-review/`), keyed by
+the worktree path — so no `.gitignore` churn and no risk of committing review data.
+Git worktrees are scoped separately automatically.
+
+## Features
+
+- 📄 GitHub-style **rendered preview** of the plan markdown
+- 💬 **Line comments** + general comments, **persistent** across reloads
+- 🕑 **Version history** — every `ExitPlanMode` is an immutable snapshot
+- 🔀 **Diff** current vs any previous version — **side-by-side or unified** (toggle)
+- ✅ **Approve / request-changes** straight from the UI, fed back to Claude
+- 🗂 Per-worktree scoping; per-project opt-in (only runs where you enable the hook)
+- ⚡ Tiny, zero-framework UI; Bun server; one dependency (`marked`)
+
+## Requirements
+
+- **Either** [Bun](https://bun.sh) ≥ 1.1 **or** [Node](https://nodejs.org) ≥ 18 — the
+  tool is plain ESM JavaScript and runs unchanged on both. `init` auto-detects which
+  you have (preferring Bun) and writes the matching hook command; override with `--runtime`.
+- Claude Code ≥ 2.1 (verified against 2.1.185)
+
+## Setup
+
+Two ways to install, depending on whether it's been published to npm.
+
+### Option A — published (recommended for end users)
+
+No clone, no checkout. From inside the project you want to enable:
+
+```bash
+cd /path/to/your/project
+bunx claude-plan-review init --published     # if you have Bun
+npx  claude-plan-review init --published     # if you have Node
+#   add --local to write .claude/settings.local.json instead (personal, gitignored)
+```
+
+`--published` makes the hook run via the package runner (`bunx`/`npx`), so it works on
+any machine — nothing to keep in your repo but the one settings entry.
+
+### Option B — from a local clone (for hacking on it)
+
+```bash
+git clone https://github.com/pavlo-petrychenko/claude-plan-preview-local
+cd claude-plan-review
+bun install                                  # or: npm install
+bun  src/cli.js init /path/to/your/project   # …or…
+node src/cli.js init /path/to/your/project   # writes an absolute-path hook command
+```
+
+### Either way
+
+**Reopen the `/hooks` menu once (or restart Claude Code)** in that project so the
+new hook is picked up. Next time you finish a plan in plan mode, your browser opens
+to the review. The server auto-starts on first use; nothing else to run.
+
+## Usage
+
+Use `bun` or `node` interchangeably (or `bunx`/`npx claude-plan-review …` when published):
+
+| Command | What it does |
+| --- | --- |
+| `… cli.js init [dir] [--local] [--published] [--runtime bun\|node]` | Wire the `ExitPlanMode` hook into a project |
+| `… cli.js serve [port]` | Start the review server manually (default `4607`) |
+| `… cli.js stop` | Stop the running server |
+
+The server auto-starts on the first plan and stays up, so you can browse history
+anytime at `http://localhost:4607`.
+
+## Configuration (env vars)
+
+| Var | Default | Meaning |
+| --- | --- | --- |
+| `PLAN_REVIEW_HOME` | `~/.claude/plan-review` | Where versions + comments are stored |
+| `PLAN_REVIEW_PORT` | `4607` | Server port |
+| `PLAN_REVIEW_TIMEOUT` | `1800` | Seconds the hook blocks waiting for your decision before falling back to Claude's normal approval prompt |
+
+> The hook entry sets `timeout: 1800` so Claude Code waits while you review.
+
+## How it works
+
+```
+Claude finishes plan ──> PreToolUse hook (ExitPlanMode)
+                          │  reads {plan, planFilePath, cwd, session_id} from stdin
+                          │  stores a new version under ~/.claude/plan-review/<cwd-key>/
+                          │  ensures the server is up, opens the browser
+                          │  BLOCKS, polling for your decision
+   browser (you) ─────────┘
+     approve  ──> hook emits {permissionDecision:"allow"}            ──> Claude implements
+     request  ──> hook emits {permissionDecision:"deny", reason:...} ──> Claude revises (new version)
+```
+
+## Storage layout
+
+```
+~/.claude/plan-review/
+  projects/<sanitized-cwd>/
+    meta.json
+    versions/0001.md  0001.json  0002.md  0002.json   # immutable snapshots
+    comments/0001.json  0002.json                     # comments per version
+  reviews/<id>.json                                    # pending/resolved review requests
+```
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "claude-plan-review",
+  "version": "0.1.0",
+  "description": "Review, comment on, and approve/reject Claude Code plans in a local GitHub-style web UI — with persistent comments, version history, and diffs.",
+  "type": "module",
+  "bin": {
+    "claude-plan-review": "src/cli.js"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "serve": "node src/server.js",
+    "hook": "node src/hook.js",
+    "stop": "node src/cli.js stop"
+  },
+  "dependencies": {
+    "marked": "^14.1.3"
+  },
+  "engines": {
+    "node": ">=18",
+    "bun": ">=1.1.0"
+  },
+  "keywords": [
+    "claude",
+    "claude-code",
+    "plan",
+    "plan-mode",
+    "code-review",
+    "hooks",
+    "exitplanmode"
+  ],
+  "homepage": "https://github.com/pavlo-petrychenko/claude-plan-preview-local#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pavlo-petrychenko/claude-plan-preview-local.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pavlo-petrychenko/claude-plan-preview-local/issues"
+  },
+  "author": "pavlo.p@mate.academy",
+  "license": "MIT"
+}

package/src/cli.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_PORT, SERVER_FILE } from "./paths.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const HOOK_SCRIPT = join(HERE, "hook.js");
+
+function canRun(bin) {
+  try {
+    return spawnSync(bin, ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+
+function resolveBin(bin) {
+  const finder = process.platform === "win32" ? "where" : "which";
+  try {
+    const r = spawnSync(finder, [bin], { encoding: "utf8" });
+    if (r.status === 0) return r.stdout.split(/\r?\n/)[0].trim() || bin;
+  } catch {}
+  return bin; // fall back to bare name (resolved via PATH at hook time)
+}
+
+function chooseRuntime(args) {
+  const i = args.indexOf("--runtime");
+  if (i >= 0 && args[i + 1]) return args[i + 1];
+  // prefer Bun when present, else Node
+  return canRun("bun") ? "bun" : "node";
+}
+
+function hookCommand(args) {
+  const runtime = chooseRuntime(args);
+  if (args.includes("--published") || args.includes("--bunx")) {
+    // portable command using the runtime's package runner
+    return runtime === "node" ? "npx claude-plan-review hook" : "bunx claude-plan-review hook";
+  }
+  return `${resolveBin(runtime)} ${HOOK_SCRIPT}`;
+}
+
+function readJSON(path, fallback) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function cmdInit(args) {
+  const local = args.includes("--local");
+  const dirArg = args.find((a) => !a.startsWith("--") && a !== chooseRuntime(args));
+  const projectDir = resolve(dirArg || process.cwd());
+  const settingsFile = join(projectDir, ".claude", local ? "settings.local.json" : "settings.json");
+  mkdirSync(dirname(settingsFile), { recursive: true });
+
+  const settings = readJSON(settingsFile, {});
+  settings.hooks ??= {};
+  settings.hooks.PreToolUse ??= [];
+
+  const command = hookCommand(args);
+  const already = settings.hooks.PreToolUse.some(
+    (entry) =>
+      entry?.matcher === "ExitPlanMode" &&
+      (entry.hooks || []).some((h) => h?.command?.includes("hook.js") || h?.command === command),
+  );
+
+  if (already) {
+    console.log(`✓ ExitPlanMode plan-review hook already present in ${settingsFile}`);
+  } else {
+    settings.hooks.PreToolUse.push({
+      matcher: "ExitPlanMode",
+      hooks: [{ type: "command", command, timeout: 1800 }],
+    });
+    writeFileSync(settingsFile, JSON.stringify(settings, null, 2) + "\n");
+    console.log(`✓ Wrote ExitPlanMode plan-review hook to ${settingsFile}`);
+  }
+  console.log(`\nRuntime: ${chooseRuntime(args)}\nCommand: ${command}`);
+  console.log(
+    `\nReopen the /hooks menu once (or restart Claude Code) in this project so the new hook is picked up.\n` +
+      `Then finish a plan in plan mode — your browser will open the review.`,
+  );
+}
+
+async function cmdServe(args) {
+  const port = Number(args.find((a) => /^\d+$/.test(a))) || DEFAULT_PORT;
+  const { startServer } = await import("./server.js");
+  startServer(port);
+  console.log(`Open http://localhost:${port}  (Ctrl+C to stop)`);
+}
+
+function cmdStop() {
+  const info = readJSON(SERVER_FILE, null);
+  if (!info?.pid) {
+    console.log("No running plan-review server recorded.");
+    return;
+  }
+  try {
+    process.kill(info.pid, "SIGTERM");
+    console.log(`Stopped plan-review server (pid ${info.pid}).`);
+  } catch {
+    console.log("Server not running; clearing stale record.");
+  }
+  rmSync(SERVER_FILE, { force: true });
+}
+
+function usage() {
+  console.log(`claude-plan-review — review Claude Code plans in your browser (runs on Bun or Node ≥18)
+
+Usage:
+  claude-plan-review init [dir] [--local] [--published] [--runtime bun|node]
+                                  Wire the ExitPlanMode hook into a project.
+                                  Runtime auto-detects (Bun if installed, else Node).
+                                  --local      → .claude/settings.local.json
+                                  --published  → portable bunx/npx command (after npm publish)
+                                  --runtime    → force a runtime
+  claude-plan-review serve [port] Start the review server (default ${DEFAULT_PORT})
+  claude-plan-review stop         Stop the running server
+  claude-plan-review hook         (internal) the PreToolUse hook entry
+`);
+}
+
+const [sub, ...rest] = process.argv.slice(2);
+switch (sub) {
+  case "init":
+    cmdInit(rest);
+    break;
+  case "serve":
+    await cmdServe(rest);
+    break;
+  case "stop":
+    cmdStop();
+    break;
+  case "hook":
+    await import("./hook.js");
+    break;
+  default:
+    usage();
+}

package/src/hook.js

@@ -0,0 +1,135 @@
+/**
+ * Claude Code PreToolUse hook for the ExitPlanMode tool. Runs on Bun or Node ≥18.
+ *
+ * Verified mechanics (Claude Code 2.1.185):
+ *   stdin  = { tool_name:"ExitPlanMode", tool_input:{ plan, planFilePath }, cwd, session_id, tool_use_id, ... }
+ *   stdout = { hookSpecificOutput:{ hookEventName:"PreToolUse",
+ *                                   permissionDecision:"allow"|"deny",
+ *                                   permissionDecisionReason: string } }
+ *   deny + reason  → reason is fed back to Claude, which stays in plan mode and revises.
+ *   allow          → plan approved, exits plan mode.
+ */
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_PORT, SERVER_FILE } from "./paths.js";
+import { getReview, recordPlan } from "./store.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SERVER_SCRIPT = join(HERE, "server.js");
+const TIMEOUT_MS = Number(process.env.PLAN_REVIEW_TIMEOUT || 1800) * 1000;
+const POLL_MS = 700;
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function out(decision, reason, sys) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: decision,
+        permissionDecisionReason: reason,
+      },
+      systemMessage: sys,
+    }),
+  );
+}
+
+function serverPort() {
+  try {
+    return JSON.parse(readFileSync(SERVER_FILE, "utf8")).port || DEFAULT_PORT;
+  } catch {
+    return DEFAULT_PORT;
+  }
+}
+
+async function isUp(port) {
+  try {
+    const res = await fetch(`http://localhost:${port}/api/health`, {
+      signal: AbortSignal.timeout(500),
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+async function ensureServer() {
+  const port = serverPort();
+  if (await isUp(port)) return port;
+  // spawn detached with the SAME runtime that's running this hook (node or bun)
+  const child = spawn(process.execPath, [SERVER_SCRIPT, String(port)], {
+    detached: true,
+    stdio: "ignore",
+  });
+  child.unref();
+  for (let i = 0; i < 40; i++) {
+    if (await isUp(port)) return port;
+    await sleep(150);
+  }
+  return port; // best effort
+}
+
+function openBrowser(targetUrl) {
+  const cmd =
+    process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", targetUrl] : [targetUrl];
+  try {
+    spawn(cmd, args, { detached: true, stdio: "ignore" }).unref();
+  } catch {
+    /* non-fatal */
+  }
+}
+
+async function main() {
+  let input = {};
+  try {
+    input = JSON.parse(readFileSync(0, "utf8")); // fd 0 = stdin (works on node + bun)
+  } catch {
+    process.exit(0); // can't parse → don't interfere
+  }
+
+  if (input.tool_name !== "ExitPlanMode") process.exit(0);
+
+  const plan = input.tool_input?.plan ?? "";
+  if (!plan.trim()) process.exit(0);
+
+  const { key, version, reviewId } = recordPlan({
+    cwd: input.cwd || process.cwd(),
+    plan,
+    planFilePath: input.tool_input?.planFilePath,
+    sessionId: input.session_id,
+    toolUseId: input.tool_use_id,
+  });
+
+  const port = await ensureServer();
+  const reviewUrl = `http://localhost:${port}/?project=${encodeURIComponent(
+    key,
+  )}&version=${version}&review=${reviewId}`;
+  openBrowser(reviewUrl);
+
+  // block until the UI resolves the review (or we time out)
+  const deadline = Date.now() + TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const review = getReview(reviewId);
+    if (review && review.status === "approved") {
+      out("allow", "Approved in the plan-review UI.", "✅ Plan approved via plan-review");
+      process.exit(0);
+    }
+    if (review && review.status === "rejected") {
+      out(
+        "deny",
+        review.reason || "Changes requested in the plan-review UI.",
+        "📝 Changes requested via plan-review",
+      );
+      process.exit(0);
+    }
+    await sleep(POLL_MS);
+  }
+
+  process.stderr.write(`plan-review: timed out after ${TIMEOUT_MS / 1000}s — falling back\n`);
+  process.exit(0);
+}
+
+main();

package/src/paths.js

@@ -0,0 +1,25 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/** Top-level storage root — NOT inside any project repo (no gitignore needed). */
+export const ROOT =
+  process.env.PLAN_REVIEW_HOME || join(homedir(), ".claude", "plan-review");
+
+export const PROJECTS_DIR = join(ROOT, "projects");
+export const REVIEWS_DIR = join(ROOT, "reviews");
+export const SERVER_FILE = join(ROOT, "server.json");
+
+export const DEFAULT_PORT = Number(process.env.PLAN_REVIEW_PORT || 4607);
+
+/**
+ * Derive a stable per-worktree key from an absolute cwd, mirroring the
+ * sanitized-path convention Claude Code itself uses for ~/.claude/projects/.
+ * Distinct git worktrees have distinct paths → distinct keys automatically.
+ */
+export function projectKey(cwd) {
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
+}
+
+export function projectDir(key) {
+  return join(PROJECTS_DIR, key);
+}

package/src/server.js

@@ -0,0 +1,187 @@
+import http from "node:http";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, realpathSync } from "node:fs";
+import { dirname, extname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { marked } from "marked";
+import { DEFAULT_PORT, ROOT, SERVER_FILE } from "./paths.js";
+import {
+  addComment,
+  deleteComment,
+  getProjectMeta,
+  getReview,
+  getVersion,
+  listComments,
+  listProjects,
+  listReviews,
+  listVersions,
+  pruneResolvedReviews,
+  resolveReview,
+} from "./store.js";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const UI_DIR = join(HERE, "ui");
+const pkg = JSON.parse(readFileSync(join(HERE, "..", "package.json"), "utf8"));
+
+marked.setOptions({ gfm: true, breaks: false });
+
+function renderMarkdown(md) {
+  const html = marked.parse(md, { async: false });
+  // light sanitization — local tool, content authored by your own Claude session
+  return html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "");
+}
+
+const CONTENT_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+};
+
+function sendJSON(res, data, status = 200) {
+  const body = JSON.stringify(data);
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(body);
+}
+
+function sendStatic(res, name) {
+  const file = join(UI_DIR, name);
+  if (!existsSync(file)) {
+    res.writeHead(404);
+    res.end("Not found");
+    return;
+  }
+  res.writeHead(200, { "content-type": CONTENT_TYPES[extname(name)] || "application/octet-stream" });
+  res.end(readFileSync(file));
+}
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    let data = "";
+    req.on("data", (c) => (data += c));
+    req.on("end", () => resolve(data));
+  });
+}
+
+export function startServer(port = DEFAULT_PORT) {
+  mkdirSync(ROOT, { recursive: true });
+  pruneResolvedReviews();
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://${req.headers.host || "localhost"}`);
+    const p = url.pathname;
+    const seg = p.split("/").filter(Boolean);
+    try {
+      if (p === "/") return sendStatic(res, "index.html");
+      if (p === "/app.js") return sendStatic(res, "app.js");
+      if (p === "/style.css") return sendStatic(res, "style.css");
+      if (seg[0] === "api") return await handleApi(req, res, seg.slice(1), url);
+      res.writeHead(404);
+      res.end("Not found");
+    } catch (e) {
+      sendJSON(res, { error: String(e?.message || e) }, 500);
+    }
+  });
+
+  server.on("error", (e) => {
+    if (e.code === "EADDRINUSE") {
+      // another instance already owns the port — fine.
+      console.log(`plan-review server already running on :${port}`);
+      process.exit(0);
+    }
+    throw e;
+  });
+
+  server.listen(port, () => {
+    writeFileSync(
+      SERVER_FILE,
+      JSON.stringify({ port, pid: process.pid, startedAt: new Date().toISOString() }, null, 2),
+    );
+    console.log(`plan-review server on http://localhost:${port}`);
+  });
+
+  const cleanup = () => {
+    try {
+      rmSync(SERVER_FILE, { force: true });
+    } catch {}
+    process.exit(0);
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  return server;
+}
+
+async function handleApi(req, res, seg, url) {
+  const [a, b, c, d, e] = seg;
+  const method = req.method;
+
+  if (a === "health") return sendJSON(res, { ok: true });
+  if (a === "version") return sendJSON(res, { version: pkg.version });
+
+  if (a === "projects" && !b) return sendJSON(res, listProjects());
+
+  if (a === "projects" && b && !c) {
+    const meta = getProjectMeta(b);
+    if (!meta) return sendJSON(res, { error: "no such project" }, 404);
+    return sendJSON(res, { meta, versions: listVersions(b) });
+  }
+
+  // /api/projects/:key/diff?from=&to=
+  if (a === "projects" && b && c === "diff") {
+    const from = Number(url.searchParams.get("from"));
+    const to = Number(url.searchParams.get("to"));
+    return sendJSON(res, {
+      from: { n: from, markdown: getVersion(b, from)?.markdown ?? "" },
+      to: { n: to, markdown: getVersion(b, to)?.markdown ?? "" },
+    });
+  }
+
+  // /api/projects/:key/versions/:n ...
+  if (a === "projects" && b && c === "versions" && d) {
+    const key = b;
+    const n = Number(d);
+    if (!e) {
+      const v = getVersion(key, n);
+      if (!v) return sendJSON(res, { error: "no such version" }, 404);
+      return sendJSON(res, { n, markdown: v.markdown, html: renderMarkdown(v.markdown), meta: v.meta });
+    }
+    if (e === "comments" && !seg[5]) {
+      if (method === "GET") return sendJSON(res, listComments(key, n));
+      if (method === "POST") {
+        const body = JSON.parse((await readBody(req)) || "{}");
+        if (!body.body?.trim()) return sendJSON(res, { error: "empty comment" }, 400);
+        return sendJSON(
+          res,
+          addComment(key, n, {
+            line: body.line ?? null,
+            lineEnd: body.lineEnd ?? null,
+            body: body.body.trim(),
+          }),
+        );
+      }
+    }
+    // /api/projects/:key/versions/:n/comments/:id  (DELETE)
+    if (e === "comments" && seg[5] && method === "DELETE") {
+      return sendJSON(res, { ok: deleteComment(key, n, seg[5]) });
+    }
+  }
+
+  // /api/reviews ...
+  if (a === "reviews" && !b) return sendJSON(res, listReviews());
+  if (a === "reviews" && b === "pending")
+    return sendJSON(res, listReviews().filter((r) => r.status === "pending"));
+  if (a === "reviews" && b && !c) {
+    const r = getReview(b);
+    return r ? sendJSON(res, r) : sendJSON(res, { error: "no such review" }, 404);
+  }
+  if (a === "reviews" && b && c === "decision" && method === "POST") {
+    const body = JSON.parse((await readBody(req)) || "{}");
+    const r = resolveReview(b, body.decision);
+    return r ? sendJSON(res, r) : sendJSON(res, { error: "no such review" }, 404);
+  }
+
+  return sendJSON(res, { error: "unknown endpoint" }, 404);
+}
+
+// run directly: `node src/server.js [port]` (or bun)
+const invokedDirectly =
+  process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+if (invokedDirectly) startServer(Number(process.argv[2]) || DEFAULT_PORT);