co-maintainer 0.4.0-beta.1

package/dist/src/server/api/jobs.js

@@ -0,0 +1,86 @@
+/** The log stream is meant to be consumed with `fetch()` and a manual
+ * reader, not the native `EventSource` API — `EventSource` cannot set an
+ * `Authorization` header, and every other `/api/*` route needs one. */
+import { errorResponse } from "../errors.js";
+import { cancel, getLogsSince, subscribeToLogs } from "../../services/jobs.js";
+import { getJob, listJobs } from "../../store/jobs.js";
+const ROUTE = /^\/api\/jobs(?:\/([^/]+)(?:\/(logs\/stream|cancel))?)?$/;
+export function handleJobsRoute(request, url) {
+    const match = ROUTE.exec(url.pathname);
+    if (!match) {
+        return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+    }
+    const [, jobId, sub] = match;
+    if (!jobId && request.method === "GET") {
+        return Response.json({
+            items: listJobs({
+                status: url.searchParams.get("status") ?? undefined,
+                repo: url.searchParams.get("repo") ?? undefined,
+            }),
+        });
+    }
+    if (jobId && !sub && request.method === "GET") {
+        const job = getJob(jobId);
+        if (!job)
+            return errorResponse(404, "not_found", "no such job");
+        return Response.json({ ...job, logs: getLogsSince(jobId).slice(-50) });
+    }
+    if (jobId && sub === "cancel" && request.method === "POST") {
+        if (!getJob(jobId))
+            return errorResponse(404, "not_found", "no such job");
+        return Response.json({ ok: cancel(jobId, "dashboard_canceled") });
+    }
+    if (jobId && sub === "logs/stream" && request.method === "GET") {
+        const from = Number(url.searchParams.get("from") ?? 0);
+        return streamLogs(jobId, Number.isFinite(from) ? from : 0);
+    }
+    return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+}
+function streamLogs(jobId, fromSeq) {
+    const job = getJob(jobId);
+    if (!job)
+        return errorResponse(404, "not_found", "no such job");
+    const encoder = new TextEncoder();
+    let closed = false;
+    let unsubscribe;
+    const body = new ReadableStream({
+        start(controller) {
+            const send = (line) => {
+                if (closed)
+                    return;
+                try {
+                    controller.enqueue(encoder.encode(`id: ${line.seq}\ndata: ${JSON.stringify(line)}\n\n`));
+                }
+                catch {
+                    closed = true;
+                }
+            };
+            for (const line of getLogsSince(jobId, fromSeq))
+                send(line);
+            const current = getJob(jobId);
+            if (current && ["done", "failed", "canceled"].includes(current.status)) {
+                closed = true;
+                try {
+                    controller.close();
+                }
+                catch {
+                    // already closed by the client disconnecting
+                }
+                return;
+            }
+            unsubscribe = subscribeToLogs(jobId, send);
+        },
+        cancel() {
+            // The client disconnected — stop pushing to it.
+            closed = true;
+            unsubscribe?.();
+        },
+    });
+    return new Response(body, {
+        headers: {
+            "content-type": "text/event-stream",
+            "cache-control": "no-cache",
+            connection: "keep-alive",
+        },
+    });
+}

package/dist/src/server/api/json_body.d.ts

@@ -0,0 +1 @@
+export declare function readJsonObject(request: Request): Promise<Record<string, unknown> | Response>;

package/dist/src/server/api/json_body.js

@@ -0,0 +1,14 @@
+import { errorResponse } from "../errors.js";
+export async function readJsonObject(request) {
+    let value;
+    try {
+        value = await request.json();
+    }
+    catch {
+        return errorResponse(400, "bad_request", "expected a JSON body");
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return errorResponse(400, "bad_request", "expected a JSON object");
+    }
+    return value;
+}

package/dist/src/server/api/remote_tokens.d.ts

@@ -0,0 +1 @@
+export declare function handleRemoteTokensRoute(request: Request, url: URL): Promise<Response>;

package/dist/src/server/api/remote_tokens.js

@@ -0,0 +1,71 @@
+import { readJsonObject } from "./json_body.js";
+import { errorResponse } from "../errors.js";
+import { createRemoteToken, deleteRemoteToken, listRemoteTokens, setRemoteTokenActive, } from "../../services/remote_tokens.js";
+import { cancelRemoteJobsForToken } from "../../services/remote_token_jobs.js";
+import { remoteTokenUsageSince } from "../../store/reviews.js";
+import { getRemoteToken } from "../../store/remote_tokens.js";
+import { daysAgoIso } from "../../util/time.js";
+export async function handleRemoteTokensRoute(request, url) {
+    if (url.pathname === "/api/remote-tokens" && request.method === "GET") {
+        const since = daysAgoIso(30);
+        const items = listRemoteTokens().map((row) => {
+            const usage = remoteTokenUsageSince(row.id, since);
+            return {
+                id: row.id,
+                name: row.name,
+                active: row.active === 1,
+                createdAt: row.created_at,
+                lastUsedAt: row.last_used_at,
+                reviews30d: usage.reviews,
+                cost30d: usage.cost,
+            };
+        });
+        return Response.json(items);
+    }
+    if (url.pathname === "/api/remote-tokens" && request.method === "POST") {
+        const body = await readJsonObject(request);
+        if (body instanceof Response)
+            return body;
+        if (typeof body.name !== "string") {
+            return errorResponse(400, "bad_request", "name is required");
+        }
+        try {
+            const created = await createRemoteToken(body.name);
+            return Response.json(created, { status: 201 });
+        }
+        catch (error) {
+            const message = String(error);
+            if (message.includes("name_taken")) {
+                return errorResponse(409, "name_taken", "token name is already in use");
+            }
+            return errorResponse(400, "bad_request", message.replace(/^Error: /, ""));
+        }
+    }
+    const itemMatch = /^\/api\/remote-tokens\/([^/]+)$/.exec(url.pathname);
+    if (!itemMatch) {
+        return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+    }
+    const id = itemMatch[1];
+    const row = getRemoteToken(id);
+    if (!row) {
+        return errorResponse(404, "not_found", "token not found");
+    }
+    if (request.method === "PATCH") {
+        const body = await readJsonObject(request);
+        if (body instanceof Response)
+            return body;
+        if (typeof body.active !== "boolean") {
+            return errorResponse(400, "bad_request", "active must be a boolean");
+        }
+        setRemoteTokenActive(id, body.active);
+        if (!body.active)
+            cancelRemoteJobsForToken(id, "token_deactivated");
+        return Response.json({ ok: true });
+    }
+    if (request.method === "DELETE") {
+        cancelRemoteJobsForToken(id, "token_deleted");
+        deleteRemoteToken(id);
+        return new Response(null, { status: 204 });
+    }
+    return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+}

package/dist/src/server/api/repos.d.ts

@@ -0,0 +1,4 @@
+export declare function handleReposRoute(request: Request, url: URL, githubApp?: {
+    appId: string;
+    privateKeyPem: string;
+}): Promise<Response>;

package/dist/src/server/api/repos.js

@@ -0,0 +1,136 @@
+import { errorResponse } from "../errors.js";
+import { findInstallationForRepo } from "../../github/app.js";
+import { activateRepo, deactivateRepo, listActiveRepos, updateRepoSettings, } from "../../store/repos.js";
+import { writeRepoConfig } from "../../config.js";
+import { enqueueSetup } from "../../services/setup.js";
+import { enqueueManualReview } from "../../services/review.js";
+import { prDetail, repoKnowledge, RepoNotFound, repoOverview, repoPulls, requireActiveRepo, } from "../../services/dashboard.js";
+const REPO = /^\/api\/repos\/([^/]+)\/([^/]+)(?:\/(remake|knowledge|pulls)(?:\/(\d+)(?:\/(review))?)?)?$/;
+export async function handleReposRoute(request, url, githubApp) {
+    if (url.pathname === "/api/repos" && request.method === "GET") {
+        return Response.json({ items: listActiveRepos() });
+    }
+    if (url.pathname === "/api/repos" && request.method === "POST") {
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return errorResponse(400, "bad_request", "expected a JSON body");
+        }
+        const repo = String(body.repo ?? "");
+        if (!/^[^/]+\/[^/]+$/.test(repo)) {
+            return errorResponse(400, "bad_request", "repo must look like owner/repo");
+        }
+        let installationId;
+        if (githubApp) {
+            try {
+                installationId = await findInstallationForRepo(githubApp.appId, githubApp.privateKeyPem, repo);
+            }
+            catch {
+                return errorResponse(422, "app_lookup_failed", "Could not verify the GitHub App's repository access.");
+            }
+            if (installationId === undefined) {
+                return errorResponse(422, "app_access_denied", `The GitHub App cannot access ${repo}.`);
+            }
+        }
+        activateRepo(repo, installationId);
+        try {
+            const { id } = enqueueSetup(repo, "init");
+            return Response.json({ jobId: id });
+        }
+        catch (error) {
+            return errorResponse(422, "setup_incomplete", String(error));
+        }
+    }
+    const match = REPO.exec(url.pathname);
+    if (!match) {
+        return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+    }
+    const fullName = `${decodeURIComponent(match[1])}/${decodeURIComponent(match[2])}`;
+    const sub = match[3];
+    const pr = match[4] ? Number(match[4]) : undefined;
+    const action = match[5];
+    try {
+        if (!sub && request.method === "GET") {
+            return Response.json(repoOverview(fullName));
+        }
+        if (!sub && request.method === "PATCH") {
+            requireActiveRepo(fullName);
+            let body;
+            try {
+                body = await request.json();
+            }
+            catch {
+                return errorResponse(400, "bad_request", "expected a JSON body");
+            }
+            const patch = {};
+            if (typeof body.autoReview === "boolean") {
+                patch.auto_review = body.autoReview ? 1 : 0;
+            }
+            if (typeof body.skipDrafts === "boolean") {
+                patch.skip_drafts = body.skipDrafts ? 1 : 0;
+            }
+            if (typeof body.skipBots === "boolean") {
+                patch.skip_bots = body.skipBots ? 1 : 0;
+            }
+            if (typeof body.useCodegraph === "boolean") {
+                patch.use_codegraph = body.useCodegraph ? 1 : 0;
+            }
+            if (body.reviewScope === "whole-pr" ||
+                body.reviewScope === "incremental") {
+                patch.review_scope = body.reviewScope;
+            }
+            updateRepoSettings(fullName, patch);
+            const init = {};
+            for (const key of [
+                "maxPrMonths",
+                "maxCommits",
+                "maxPullRequestChangeLines",
+                "maxComments",
+            ]) {
+                if (typeof body[key] === "number" && Number.isFinite(body[key])) {
+                    init[key] = body[key];
+                }
+            }
+            if (Object.keys(init).length > 0)
+                await writeRepoConfig(fullName, init);
+            return Response.json({ ok: true });
+        }
+        if (!sub && request.method === "DELETE") {
+            requireActiveRepo(fullName);
+            deactivateRepo(fullName);
+            return Response.json({ ok: true });
+        }
+        if (sub === "remake" && request.method === "POST") {
+            const { id } = enqueueSetup(fullName, "remake");
+            return Response.json({ jobId: id });
+        }
+        if (sub === "knowledge" && request.method === "GET") {
+            return Response.json(await repoKnowledge(fullName));
+        }
+        if (sub === "pulls" &&
+            pr &&
+            action === "review" &&
+            request.method === "POST") {
+            requireActiveRepo(fullName);
+            const { id } = enqueueManualReview(fullName, pr);
+            return Response.json({ jobId: id });
+        }
+        if (sub === "pulls" && pr && request.method === "GET") {
+            return Response.json(prDetail(fullName, pr));
+        }
+        if (sub === "pulls" && request.method === "GET") {
+            const page = Number(url.searchParams.get("page") ?? 1);
+            const per = Number(url.searchParams.get("per") ?? 20);
+            return Response.json(repoPulls(fullName, page, per));
+        }
+    }
+    catch (error) {
+        if (error instanceof RepoNotFound) {
+            return errorResponse(404, "not_found", error.message);
+        }
+        return errorResponse(422, "setup_incomplete", String(error));
+    }
+    return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+}

package/dist/src/server/api/settings.d.ts

@@ -0,0 +1 @@
+export declare function handleSettingsRoute(request: Request, url: URL, webhookUrl: string): Promise<Response>;

package/dist/src/server/api/settings.js

@@ -0,0 +1,210 @@
+import { errorResponse } from "../errors.js";
+import { readConfig, writeUserConfig } from "../../config.js";
+import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
+function validateWebhookUrl(value) {
+    if (typeof value !== "string" || !value.trim()) {
+        return "webhook URL is required";
+    }
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol !== "http:" && url.protocol !== "https:") {
+            return "webhook URL must use http or https";
+        }
+    }
+    catch {
+        return "webhook URL must be an absolute http(s) URL";
+    }
+    return undefined;
+}
+export async function handleSettingsRoute(request, url, webhookUrl) {
+    if (url.pathname === "/api/settings" && request.method === "GET") {
+        const config = readConfig();
+        return Response.json({
+            auth: config.auth ?? "gh",
+            ai: config.ai ?? "none",
+            lowModel: config.lowModel ?? "",
+            highModel: config.highModel ?? "",
+            githubAppId: config.githubAppId ?? "",
+            defaults: config.defaults ?? {},
+            hasAiToken: Boolean(config.token),
+            hasPat: Boolean(config.githubPat),
+            hasAppKey: Boolean(config.githubAppPrivateKey),
+            hasWebhookSecret: Boolean(config.githubWebhookSecret),
+            webhookUrl: config.webhookUrl || webhookUrl,
+            githubOAuthClientId: config.githubOAuthClientId ?? "",
+            hasOAuthClientSecret: Boolean(config.githubOAuthClientSecret),
+            githubOAuthAllowedUser: config.githubOAuthAllowedUser ?? "",
+            passwordAuthDisabled: Boolean(config.passwordAuthDisabled),
+            githubAuthEnabled: Boolean(config.githubAuthEnabled),
+            maxConcurrentJobs: config.maxConcurrentJobs ?? null,
+            remoteSyncTimeoutSeconds: config.remoteSyncTimeoutSeconds ?? null,
+            maxConcurrentRemoteReviewsPerToken: config.maxConcurrentRemoteReviewsPerToken ?? null,
+            remoteToolOutputMaxChars: config.remoteToolOutputMaxChars ?? null,
+        });
+    }
+    if (url.pathname === "/api/settings" && request.method === "PUT") {
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return errorResponse(400, "bad_request", "expected a JSON body");
+        }
+        const current = readConfig();
+        const patch = {};
+        const text = (key) => {
+            const value = body[key];
+            if (typeof value !== "string")
+                return;
+            if (value === "")
+                return;
+            patch[key] = value;
+        };
+        text("auth");
+        text("ai");
+        text("lowModel");
+        text("highModel");
+        text("token");
+        text("githubPat");
+        text("githubAppId");
+        text("githubAppPrivateKey");
+        text("githubWebhookSecret");
+        text("githubOAuthClientId");
+        text("githubOAuthClientSecret");
+        text("githubOAuthAllowedUser");
+        if (typeof body.passwordAuthDisabled === "boolean") {
+            patch.passwordAuthDisabled = body.passwordAuthDisabled;
+        }
+        if (typeof body.githubAuthEnabled === "boolean") {
+            patch.githubAuthEnabled = body.githubAuthEnabled;
+        }
+        if ("webhookUrl" in body) {
+            const webhookError = validateWebhookUrl(body.webhookUrl);
+            if (webhookError) {
+                return errorResponse(400, "invalid_webhook_url", webhookError);
+            }
+            patch.webhookUrl = body.webhookUrl.trim();
+        }
+        if ("maxConcurrentJobs" in body) {
+            const raw = body.maxConcurrentJobs;
+            if (raw === null || raw === "") {
+                patch.maxConcurrentJobs = undefined;
+            }
+            else if (typeof raw === "number" && Number.isInteger(raw) && raw > 0) {
+                patch.maxConcurrentJobs = raw;
+            }
+            else {
+                return errorResponse(422, "invalid_setting", "maxConcurrentJobs must be a positive integer or null");
+            }
+        }
+        const positiveIntOrNull = (key, label) => {
+            if (!(key in body))
+                return;
+            const raw = body[key];
+            if (raw === null || raw === "") {
+                patch[key] = undefined;
+                return;
+            }
+            if (typeof raw === "number" && Number.isInteger(raw) && raw > 0) {
+                patch[key] = raw;
+                return;
+            }
+            return errorResponse(422, "invalid_setting", `${label} must be a positive integer or null`);
+        };
+        const remoteTimeout = positiveIntOrNull("remoteSyncTimeoutSeconds", "remoteSyncTimeoutSeconds");
+        if (remoteTimeout)
+            return remoteTimeout;
+        const remotePerToken = positiveIntOrNull("maxConcurrentRemoteReviewsPerToken", "maxConcurrentRemoteReviewsPerToken");
+        if (remotePerToken)
+            return remotePerToken;
+        const remoteToolOut = positiveIntOrNull("remoteToolOutputMaxChars", "remoteToolOutputMaxChars");
+        if (remoteToolOut)
+            return remoteToolOut;
+        if (body.defaults && typeof body.defaults === "object") {
+            const defaults = body.defaults;
+            const next = { ...current.defaults };
+            const intKeys = [
+                "maxPrMonths",
+                "maxCommits",
+                "maxPullRequestChangeLines",
+            ];
+            const intKeySet = new Set(intKeys);
+            for (const key of intKeys) {
+                if (!(key in defaults))
+                    continue;
+                const raw = defaults[key];
+                if (raw === null || raw === "") {
+                    delete next[key];
+                    continue;
+                }
+                if (typeof raw === "number" && Number.isInteger(raw) && raw > 0) {
+                    next[key] = raw;
+                    continue;
+                }
+                return errorResponse(422, "invalid_setting", `${key} must be a positive integer or null`);
+            }
+            for (const [key, value] of Object.entries(defaults)) {
+                if (intKeySet.has(key))
+                    continue;
+                if (value === "" || value === null || value === undefined)
+                    continue;
+                next[key] = value;
+            }
+            patch.defaults = next;
+        }
+        const merged = { ...current, ...patch };
+        if (merged.passwordAuthDisabled && !merged.githubAuthEnabled) {
+            return errorResponse(422, "no_auth_method", "at least one sign-in method is required");
+        }
+        if (merged.githubAuthEnabled &&
+            (!merged.githubOAuthClientId ||
+                !merged.githubOAuthClientSecret ||
+                !merged.githubOAuthAllowedUser)) {
+            return errorResponse(422, "oauth_incomplete", "GitHub sign-in needs a client ID, client secret, and allowed username");
+        }
+        const touchingGithub = patch.auth !== undefined || patch.githubPat !== undefined;
+        const touchingApp = patch.githubAppId !== undefined ||
+            patch.githubAppPrivateKey !== undefined;
+        if (touchingGithub) {
+            const github = await testGithubAccess({
+                auth: merged.auth === "pat" ? "pat" : "gh",
+                githubPat: merged.githubPat,
+            });
+            if (!github.ok) {
+                return errorResponse(422, "github_access", github.message);
+            }
+        }
+        if (touchingApp) {
+            const app = await testAppAccess({
+                appId: merged.githubAppId ?? "",
+                privateKeyPem: merged.githubAppPrivateKey ?? "",
+            });
+            if (!app.ok) {
+                return errorResponse(422, "app_access", app.message);
+            }
+        }
+        await writeUserConfig(patch);
+        return Response.json({ ok: true });
+    }
+    if (url.pathname === "/api/settings/test" && request.method === "POST") {
+        const config = readConfig();
+        const github = await testGithubAccess({
+            auth: config.auth === "pat" ? "pat" : "gh",
+            githubPat: config.githubPat,
+        });
+        const app = await testAppAccess({
+            appId: config.githubAppId ?? "",
+            privateKeyPem: config.githubAppPrivateKey ?? "",
+        });
+        return Response.json({
+            ai: { ok: Boolean(config.ai && config.ai !== "none" && config.token) },
+            github: github.ok
+                ? { ok: true, login: github.login }
+                : { ok: false, message: github.message },
+            app: app.ok
+                ? { ok: true, installations: app.installations }
+                : { ok: false, message: app.message },
+        });
+    }
+    return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+}

package/dist/src/server/app.d.ts

@@ -0,0 +1,27 @@
+import type { AuthMethods } from "./auth.ts";
+/** `password` is the dashboard password `serve` generates or takes via
+ * `--password`. `githubApp` is unset until `co-maintainer set` has both
+ * the App ID and private key. */
+export type AppDeps = {
+    password: string;
+    githubApp?: {
+        appId: string;
+        privateKeyPem: string;
+    };
+    webhookSecret?: string;
+    webhookUrl?: string;
+    secureCookie?: boolean;
+    inject500?: boolean;
+    /** Defaults to password-only when omitted, matching every caller that
+     * pre-dates GitHub sign-in. */
+    auth?: AuthMethods;
+    githubOAuth?: {
+        clientId: string;
+        clientSecret: string;
+        allowedUser: string;
+    };
+};
+export type App = {
+    fetch(request: Request, remoteAddr?: string): Promise<Response>;
+};
+export declare function createApp(deps: AppDeps): App;