co-maintainer 0.4.13 → 0.5.0-beta.1

package/dist/src/server/api/repos.js

@@ -1,16 +1,90 @@
 import { errorResponse } from "../errors.js";
-import { findInstallationForRepo } from "../../github/app.js";
-import { activateRepo, deactivateRepo, listActiveRepos, updateRepoSettings, } from "../../store/repos.js";
-import { writeRepoConfig } from "../../config.js";
+import { AppClient, findInstallationForRepo } from "../../github/app.js";
+import { activateRepo, deactivateRepo, getRepo, listActiveRepos, updateRepoSettings, } from "../../store/repos.js";
+import { readConfig, writeRepoConfig } from "../../config.js";
 import { parseRemakeCron } from "../../services/remake_cron.js";
 import { enqueueSetup } from "../../services/setup.js";
 import { enqueueManualReview } from "../../services/review.js";
+import { probePlan, recommendationPatch } from "../../services/probe.js";
+import { estimateInit, readJobHistory } from "../../ai/estimate.js";
+import { loadPrices } from "../../ai/pricing.js";
 import { prDetail, repoKnowledge, RepoNotFound, repoOverview, repoPulls, requireActiveRepo, } from "../../services/dashboard.js";
 const REPO = /^\/api\/repos\/([^/]+)\/([^/]+)(?:\/(remake|knowledge|pulls)(?:\/(\d+)(?:\/(review))?)?)?$/;
 export async function handleReposRoute(request, url, githubApp) {
     if (url.pathname === "/api/repos" && request.method === "GET") {
         return Response.json({ items: listActiveRepos() });
     }
+    if (url.pathname === "/api/repos/preview" && request.method === "POST") {
+        if (!githubApp) {
+            return errorResponse(422, "no_github_app", "Configure the GitHub App in Settings to preview a repository.");
+        }
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return errorResponse(400, "bad_request", "expected a JSON body");
+        }
+        const repo = String(body.repo ?? "");
+        if (!/^[^/]+\/[^/]+$/.test(repo)) {
+            return errorResponse(400, "bad_request", "repo must look like owner/repo");
+        }
+        let installationId;
+        try {
+            installationId = await findInstallationForRepo(githubApp.appId, githubApp.privateKeyPem, repo);
+        }
+        catch {
+            return errorResponse(422, "app_lookup_failed", "Could not verify the GitHub App's repository access.");
+        }
+        if (installationId === undefined) {
+            return errorResponse(422, "app_access_denied", `The GitHub App cannot access ${repo}.`);
+        }
+        if (getRepo(repo)?.active) {
+            return errorResponse(409, "already_added", `${repo} is already added.`);
+        }
+        const client = new AppClient(githubApp.appId, githubApp.privateKeyPem, installationId);
+        try {
+            const plan = await probePlan(client, repo, {
+                ghConcurrent: 1,
+                log: () => { },
+            });
+            const config = readConfig();
+            const needsPrices = config.ai === "openrouter" &&
+                Boolean(config.lowModel && config.highModel);
+            const [prices, history] = await Promise.all([
+                needsPrices
+                    ? loadPrices()
+                    : Promise.resolve({
+                        prices: new Map(),
+                        source: "unavailable",
+                    }),
+                readJobHistory(repo),
+            ]);
+            const estimate = estimateInit({
+                pullRequests: plan.analysis.includePullRequests
+                    ? Number(plan.analysis.report.pullRequests ?? 0)
+                    : 0,
+                includeCodebase: plan.analysis.includePullRequests,
+                lowModel: config.lowModel,
+                highModel: config.highModel,
+                prices: prices.prices,
+                history,
+            });
+            return Response.json({
+                repo,
+                command: plan.command,
+                recommendation: plan.recommendation,
+                patch: recommendationPatch(plan.recommendation),
+                reasons: plan.analysis.reasons,
+                report: plan.report,
+                estimate,
+                estimateBasis: estimate.basis,
+            });
+        }
+        catch (error) {
+            return errorResponse(422, "probe_failed", error instanceof Error ? error.message : String(error));
+        }
+    }
     if (url.pathname === "/api/repos" && request.method === "POST") {
         let body;
         try {
@@ -35,6 +109,15 @@ export async function handleReposRoute(request, url, githubApp) {
                 return errorResponse(422, "app_access_denied", `The GitHub App cannot access ${repo}.`);
             }
         }
+        // `patch` is the confirmed preview. It is optional so a caller that
+        // never opened the preview keeps the old behavior; when present it is
+        // written before `activateRepo` so the enqueued init reads it.
+        const patch = body.patch && typeof body.patch === "object"
+            ? body.patch
+            : undefined;
+        if (patch && Object.keys(patch).length > 0) {
+            await writeRepoConfig(repo, patch);
+        }
         activateRepo(repo, installationId);
         try {
             const { id } = enqueueSetup(repo, "init");

package/dist/src/server/api/settings.js

@@ -1,5 +1,5 @@
 import { errorResponse } from "../errors.js";
-import { readConfig, writeUserConfig } from "../../config.js";
+import { readConfig, resolveAppPrivateKey, writeUserConfig, } from "../../config.js";
 import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
 import { checkPassword, readSessionToken, revokeOtherSessions, } from "../auth.js";
 import { passwordProblem } from "../../util/password.js";
@@ -201,7 +201,7 @@ export async function handleSettingsRoute(request, url, webhookUrl, passwords, i
         if (touchingApp) {
             const app = await testAppAccess({
                 appId: merged.githubAppId ?? "",
-                privateKeyPem: merged.githubAppPrivateKey ?? "",
+                privateKeyPem: resolveAppPrivateKey(merged) ?? "",
             });
             if (!app.ok) {
                 return errorResponse(422, "app_access", app.message);
@@ -218,7 +218,7 @@ export async function handleSettingsRoute(request, url, webhookUrl, passwords, i
         });
         const app = await testAppAccess({
             appId: config.githubAppId ?? "",
-            privateKeyPem: config.githubAppPrivateKey ?? "",
+            privateKeyPem: resolveAppPrivateKey(config) ?? "",
         });
         return Response.json({
             ai: { ok: Boolean(config.ai && config.ai !== "none" && config.token) },

package/dist/src/server/app.d.ts

@@ -9,6 +9,9 @@ export type AppDeps = {
     /** Behind a reverse proxy this process trusts, the client address and the
      * scheme come from `x-forwarded-for` and `x-forwarded-proto`. */
     trustProxy?: boolean;
+    /** `CM_LOGIN_HINT`, shown on the sign-in page in place of the default
+     * "printed when serve started" line. */
+    loginHint?: string;
     inject500?: boolean;
     /** Defaults to password-only when omitted, matching every caller that
      * pre-dates GitHub sign-in. */

package/dist/src/server/app.js

@@ -5,7 +5,7 @@ import { errorResponse } from "./errors.js";
 import { hasCsrfHeader, login, logout, readSessionToken, sessionCookieHeader, verifySession, } from "./auth.js";
 import { memoryPasswordStore } from "./auth.js";
 import { clientAddress, forwardedHttps } from "./proxy_headers.js";
-import { readConfig } from "../config.js";
+import { readConfig, resolveAppPrivateKey } from "../config.js";
 import { listJobs } from "../store/jobs.js";
 import { handleJobsRoute } from "./api/jobs.js";
 import { handleReposRoute } from "./api/repos.js";
@@ -21,7 +21,7 @@ function setupStatus() {
     const config = readConfig();
     const ai = Boolean(config.ai && config.ai !== "none" && config.token);
     const github = Boolean(config.auth === "gh" || (config.auth === "pat" && config.githubPat));
-    const app = Boolean(config.githubAppId && config.githubAppPrivateKey);
+    const app = Boolean(config.githubAppId && resolveAppPrivateKey(config));
     const missing = [
         !ai && "ai",
         !github && "github",
@@ -84,11 +84,12 @@ function health() {
  * without restarting `serve`. */
 function liveGithubConfig() {
     const config = readConfig();
+    const privateKeyPem = resolveAppPrivateKey(config);
     return {
-        githubApp: config.githubAppId && config.githubAppPrivateKey
+        githubApp: config.githubAppId && privateKeyPem
             ? {
                 appId: config.githubAppId,
-                privateKeyPem: config.githubAppPrivateKey,
+                privateKeyPem,
             }
             : undefined,
         webhookSecret: config.githubWebhookSecret,
@@ -112,7 +113,13 @@ export function createApp(deps) {
             if (url.pathname === "/github/webhook" && request.method === "POST") {
                 return await handleWebhookRequest(request, webhookSecret);
             }
-            const page = await handlePageRequest(request, { ...deps, githubApp, passwordStore: passwords, secureCookie }, remoteAddr);
+            const page = await handlePageRequest(request, {
+                ...deps,
+                githubApp,
+                passwordStore: passwords,
+                secureCookie,
+                trustProxy: deps.trustProxy,
+            }, remoteAddr);
             if (page)
                 return page;
             if (url.pathname.startsWith("/api/remote/")) {

package/dist/src/server/pages/activity.d.ts

@@ -1,4 +1,5 @@
 import type { activityFeed, runningJobs, skippedDeliveries } from "../../services/dashboard.ts";
 import type { JobLogRow, JobRow } from "../../store/rows.ts";
+export declare function jobLabel(job: JobRow): string;
 export declare function renderActivity(username: string, running: ReturnType<typeof runningJobs>, feed: ReturnType<typeof activityFeed>, skipped: ReturnType<typeof skippedDeliveries>): Response;
 export declare function renderJob(username: string, job: JobRow, logs: JobLogRow[]): Response;

package/dist/src/server/pages/activity.js

@@ -20,11 +20,11 @@ function skipReason(reason) {
             return reason ?? "Skipped";
     }
 }
-function jobLabel(job) {
+export function jobLabel(job) {
     if (job.type === "init")
         return "Set up repository";
     if (job.type === "remake")
-        return "Updated knowledge";
+        return "Synced knowledge";
     if (job.type === "review") {
         return job.pr_number ? `Review #${job.pr_number}` : "Review";
     }

package/dist/src/server/pages/add_repo.js

@@ -26,7 +26,7 @@ export function renderAddRepo(username, picker) {
   <div class="crumbs"><a href="/">Repositories</a> / Add</div>
   <div class="pagehead">
     <div><h1>Add repository</h1>
-      <p class="lead">Pick a repository this App can access.</p></div>
+      <p class="lead">Pick a repository this App can access. Nothing is read or written until you confirm the plan.</p></div>
   </div>
   ${notice}
   <div class="card" data-async>
@@ -37,18 +37,86 @@ export function renderAddRepo(username, picker) {
         <label>Repository</label>
         ${select}
       </div>
-      <button class="primary" id="add"${canAdd ? "" : " disabled"}>Add repository</button>
+      <button class="primary" id="preview"${canAdd ? "" : " disabled"}>Preview</button>
     </div>
+    <div id="plan" hidden></div>
   </div></div>
 </div>
 <script>
-document.getElementById("add").addEventListener("click", function() {
+var plan = null;
+function showPlan(data) {
+  plan = data;
+  var box = document.getElementById("plan");
+  box.hidden = false;
+  box.replaceChildren();
+  var heading = document.createElement("h2");
+  heading.textContent = "Plan for " + data.repo;
+  box.appendChild(heading);
+  var cmd = document.createElement("p");
+  cmd.className = "mono";
+  cmd.style.wordBreak = "break-all";
+  cmd.textContent = data.command;
+  box.appendChild(cmd);
+  var est = data.estimate;
+  var facts = document.createElement("p");
+  facts.className = "muted";
+  facts.textContent =
+    "AI jobs: " + est.extract + " extract + " + est.synth + " synth" +
+    ". Tokens: " + est.tokensIn[0].toLocaleString("en-US") + "-" +
+    est.tokensIn[1].toLocaleString("en-US") + " in, " +
+    est.tokensOut[0].toLocaleString("en-US") + "-" +
+    est.tokensOut[1].toLocaleString("en-US") + " out" +
+    ". Time: " + Math.round(est.seconds[0]) + "-" + Math.round(est.seconds[1]) + "s" +
+    (est.usd
+      ? ". Cost: $" + est.usd[0].toFixed(4) + "-$" + est.usd[1].toFixed(4)
+      : ". Cost: unknown") +
+    ". Basis: " + (est.estimateBasis === "history"
+      ? "this repository's recorded jobs"
+      : "the cm-dx-lab calibration") + ", an estimate, not a bill.";
+  box.appendChild(facts);
+  if (data.reasons && data.reasons.length) {
+    var ul = document.createElement("ul");
+    ul.className = "muted";
+    data.reasons.forEach(function(reason) {
+      var li = document.createElement("li");
+      li.textContent = reason;
+      ul.appendChild(li);
+    });
+    box.appendChild(ul);
+  }
+  var row = document.createElement("div");
+  row.style.display = "flex";
+  row.style.gap = "8px";
+  row.style.marginTop = "14px";
+  var confirm = document.createElement("button");
+  confirm.className = "primary";
+  confirm.id = "confirm";
+  confirm.textContent = "Add and start init";
+  var cancel = document.createElement("button");
+  cancel.className = "btn";
+  cancel.type = "button";
+  cancel.textContent = "Cancel";
+  cancel.addEventListener("click", function() {
+    plan = null;
+    box.hidden = true;
+    box.replaceChildren();
+  });
+  row.appendChild(confirm);
+  row.appendChild(cancel);
+  box.appendChild(row);
+  confirm.addEventListener("click", function() {
+    var repo = document.getElementById("repo").value.trim();
+    if (!repo || !plan) return;
+    postAndGo("/api/repos", { repo: repo, patch: plan.patch }, "/activity", confirm);
+  });
+}
+document.getElementById("preview").addEventListener("click", function() {
   var btn = this;
   var repo = document.getElementById("repo").value.trim();
   if (!repo) return;
   run(btn, btn.closest("[data-async]"), async function() {
-    await api("POST", "/api/repos", { repo: repo });
-    location.href = "/activity";
+    var data = await api("POST", "/api/repos/preview", { repo: repo });
+    showPlan(data);
   });
 });
 </script>`,

package/dist/src/server/pages/client.d.ts

@@ -1,2 +1,2 @@
 /** Generated from src/server/pages/client.js by scripts/embed_assets.mjs — do not edit. */
-export declare const client = "function toast(message) {\n  const host = document.getElementById(\"toasts\");\n  if (!host) return;\n  const el = document.createElement(\"div\");\n  el.className = \"toast\";\n  el.setAttribute(\"role\", \"status\");\n  el.textContent = message;\n  host.appendChild(el);\n  setTimeout(function () {\n    el.remove();\n  }, 5000);\n}\n\nfunction fail(card, message, retry) {\n  toast(message);\n  if (!card) return;\n  let box = card.querySelector(\"[data-fail]\");\n  if (!box) {\n    box = document.createElement(\"div\");\n    box.setAttribute(\"data-fail\", \"1\");\n    box.className = \"fail\";\n    card.appendChild(box);\n  }\n  box.replaceChildren();\n  const p = document.createElement(\"p\");\n  p.textContent = message;\n  const btn = document.createElement(\"button\");\n  btn.className = \"btn sm\";\n  btn.type = \"button\";\n  btn.textContent = \"Retry\";\n  btn.addEventListener(\"click\", retry);\n  box.appendChild(p);\n  box.appendChild(btn);\n}\n\nfunction clearFail(card) {\n  const box = card && card.querySelector(\"[data-fail]\");\n  if (box) box.remove();\n}\n\nfunction skeleton(card, on) {\n  if (!card) return;\n  card.classList.toggle(\"busy\", on);\n}\n\nasync function api(method, url, body) {\n  const res = await fetch(url, {\n    method: method,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"x-requested-with\": \"co-maintainer\",\n    },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  if (!res.ok) {\n    let message = \"Request failed\";\n    try {\n      const data = await res.json();\n      if (data.error && data.error.message) message = data.error.message;\n    } catch {\n      // body was not JSON; keep the generic message\n    }\n    throw new Error(message);\n  }\n  if (res.status === 204) return null;\n  return await res.json();\n}\n\nasync function run(btn, card, fn) {\n  if (btn) btn.disabled = true;\n  skeleton(card, true);\n  clearFail(card);\n  try {\n    await fn();\n  } catch (err) {\n    fail(card, err.message, function () {\n      run(btn, card, fn);\n    });\n  } finally {\n    if (btn) btn.disabled = false;\n    skeleton(card, false);\n  }\n}\n\nasync function postAndGo(url, body, next, btn) {\n  const card = btn && btn.closest(\"[data-async]\");\n  await run(btn, card, async function () {\n    await api(\"POST\", url, body);\n    location.href = next;\n  });\n}\n\n// Called from the inline scripts on the repo list and repo pages, which deno lint\n// cannot see, so it looks unused from inside this file.\n// deno-lint-ignore no-unused-vars\nfunction bindToggle(btn, url, field) {\n  btn.addEventListener(\"click\", async function () {\n    if (btn.disabled) return;\n    const on = !btn.classList.contains(\"on\");\n    btn.classList.toggle(\"on\", on);\n    btn.setAttribute(\"data-on\", on ? \"1\" : \"0\");\n    btn.disabled = true;\n    const card = btn.closest(\"[data-async]\");\n    try {\n      const payload = {};\n      payload[field] = on;\n      await api(\"PATCH\", url, payload);\n    } catch (err) {\n      btn.classList.toggle(\"on\", !on);\n      btn.setAttribute(\"data-on\", on ? \"0\" : \"1\");\n      fail(card, err.message, function () {\n        btn.click();\n      });\n    } finally {\n      btn.disabled = false;\n    }\n  });\n}\n\naddEventListener(\"error\", function (ev) {\n  toast((ev.error && ev.error.message) || \"Something broke\");\n});\naddEventListener(\"unhandledrejection\", function (ev) {\n  toast((ev.reason && ev.reason.message) || \"Something broke\");\n});\n\ndocument.addEventListener(\"click\", function (ev) {\n  const btn =\n    ev.target && ev.target.closest\n      ? ev.target.closest(\"[data-cancel], [data-post]\")\n      : null;\n  if (!btn) return;\n  ev.preventDefault();\n  if (btn.hasAttribute(\"data-cancel\")) {\n    postAndGo(\n      \"/api/jobs/\" + btn.getAttribute(\"data-cancel\") + \"/cancel\",\n      {},\n      \"/activity\",\n      btn,\n    );\n    return;\n  }\n  const body = btn.getAttribute(\"data-body\");\n  postAndGo(\n    btn.getAttribute(\"data-post\"),\n    body ? JSON.parse(body) : {},\n    \"/activity\",\n    btn,\n  );\n});\n\n(function pollActivity() {\n  if (!document.getElementById(\"activity-root\")) return;\n  setInterval(async function () {\n    if (document.hidden) return;\n    if (document.querySelector(\"[data-async].busy\")) return;\n    const root = document.getElementById(\"activity-root\");\n    if (!root) return;\n    try {\n      const res = await fetch(location.pathname + location.search, {\n        headers: { accept: \"text/html\" },\n      });\n      if (!res.ok) return;\n      const doc = new DOMParser().parseFromString(\n        await res.text(),\n        \"text/html\",\n      );\n      const next = doc.getElementById(\"activity-root\");\n      if (!next || next.innerHTML === root.innerHTML) return;\n      root.replaceWith(next);\n    } catch {\n      // a failed poll just waits for the next tick\n    }\n  }, 5000);\n})();\n";
+export declare const client = "function toast(message) {\n  const host = document.getElementById(\"toasts\");\n  if (!host) return;\n  const el = document.createElement(\"div\");\n  el.className = \"toast\";\n  el.setAttribute(\"role\", \"status\");\n  el.textContent = message;\n  host.appendChild(el);\n  setTimeout(function () {\n    el.remove();\n  }, 5000);\n}\n\nfunction fail(card, message, retry) {\n  toast(message);\n  if (!card) return;\n  let box = card.querySelector(\"[data-fail]\");\n  if (!box) {\n    box = document.createElement(\"div\");\n    box.setAttribute(\"data-fail\", \"1\");\n    box.className = \"fail\";\n    card.appendChild(box);\n  }\n  box.replaceChildren();\n  const p = document.createElement(\"p\");\n  p.textContent = message;\n  const btn = document.createElement(\"button\");\n  btn.className = \"btn sm\";\n  btn.type = \"button\";\n  btn.textContent = \"Retry\";\n  btn.addEventListener(\"click\", retry);\n  box.appendChild(p);\n  box.appendChild(btn);\n}\n\nfunction clearFail(card) {\n  const box = card && card.querySelector(\"[data-fail]\");\n  if (box) box.remove();\n}\n\nfunction skeleton(card, on) {\n  if (!card) return;\n  card.classList.toggle(\"busy\", on);\n}\n\nasync function api(method, url, body) {\n  const res = await fetch(url, {\n    method: method,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"x-requested-with\": \"co-maintainer\",\n    },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  if (!res.ok) {\n    let message = \"Request failed\";\n    try {\n      const data = await res.json();\n      if (data.error && data.error.message) message = data.error.message;\n    } catch {\n      // body was not JSON; keep the generic message\n    }\n    throw new Error(message);\n  }\n  if (res.status === 204) return null;\n  return await res.json();\n}\n\nasync function run(btn, card, fn) {\n  if (btn) btn.disabled = true;\n  skeleton(card, true);\n  clearFail(card);\n  try {\n    await fn();\n  } catch (err) {\n    fail(card, err.message, function () {\n      run(btn, card, fn);\n    });\n  } finally {\n    if (btn) btn.disabled = false;\n    skeleton(card, false);\n  }\n}\n\nasync function postAndGo(url, body, next, btn) {\n  const card = btn && btn.closest(\"[data-async]\");\n  await run(btn, card, async function () {\n    await api(\"POST\", url, body);\n    location.href = next;\n  });\n}\n\n// Called from the inline scripts on the repo list and repo pages, which deno lint\n// cannot see, so it looks unused from inside this file.\n// deno-lint-ignore no-unused-vars\nfunction bindToggle(btn, url, field) {\n  btn.addEventListener(\"click\", async function () {\n    if (btn.disabled) return;\n    const on = !btn.classList.contains(\"on\");\n    btn.classList.toggle(\"on\", on);\n    btn.setAttribute(\"data-on\", on ? \"1\" : \"0\");\n    btn.disabled = true;\n    const card = btn.closest(\"[data-async]\");\n    try {\n      const payload = {};\n      payload[field] = on;\n      await api(\"PATCH\", url, payload);\n    } catch (err) {\n      btn.classList.toggle(\"on\", !on);\n      btn.setAttribute(\"data-on\", on ? \"0\" : \"1\");\n      fail(card, err.message, function () {\n        btn.click();\n      });\n    } finally {\n      btn.disabled = false;\n    }\n  });\n}\n\n// The helper is inlined into `<head>` by `layout.ts`, before any page script\n// runs, so this is the one place that can close over both `toast()` and\n// `bindToggle` without depending on point-in-time globals.\ndocument.addEventListener(\"DOMContentLoaded\", function () {\n  // Client errors bubble to `window` from `document`.\n  addEventListener(\"error\", function (ev) {\n    toast((ev.error && ev.error.message) || \"Something broke\");\n  });\n  addEventListener(\"unhandledrejection\", function (ev) {\n    toast((ev.reason && ev.reason.message) || \"Something broke\");\n  });\n\n  document.addEventListener(\"click\", function (ev) {\n    const btn =\n      ev.target && ev.target.closest\n        ? ev.target.closest(\"[data-cancel], [data-post]\")\n        : null;\n    if (!btn) return;\n    ev.preventDefault();\n    if (btn.hasAttribute(\"data-cancel\")) {\n      postAndGo(\n        \"/api/jobs/\" + btn.getAttribute(\"data-cancel\") + \"/cancel\",\n        {},\n        \"/activity\",\n        btn,\n      );\n      return;\n    }\n    const body = btn.getAttribute(\"data-body\");\n    postAndGo(\n      btn.getAttribute(\"data-post\"),\n      body ? JSON.parse(body) : {},\n      \"/activity\",\n      btn,\n    );\n  });\n\n  // Reads `activity-root` at call time, so it has to wait for the body even\n  // though this file itself is already parsed.\n  if (!document.getElementById(\"activity-root\")) return;\n  setInterval(async function () {\n    if (document.hidden) return;\n    if (document.querySelector(\"[data-async].busy\")) return;\n    const root = document.getElementById(\"activity-root\");\n    if (!root) return;\n    try {\n      const res = await fetch(location.pathname + location.search, {\n        headers: { accept: \"text/html\" },\n      });\n      if (!res.ok) return;\n      const doc = new DOMParser().parseFromString(\n        await res.text(),\n        \"text/html\",\n      );\n      const next = doc.getElementById(\"activity-root\");\n      if (!next || next.innerHTML === root.innerHTML) return;\n      root.replaceWith(next);\n    } catch {\n      // a failed poll just waits for the next tick\n    }\n  }, 5000);\n});\n";

package/dist/src/server/pages/client.js

@@ -1,2 +1,2 @@
 /** Generated from src/server/pages/client.js by scripts/embed_assets.mjs — do not edit. */
-export const client = "function toast(message) {\n  const host = document.getElementById(\"toasts\");\n  if (!host) return;\n  const el = document.createElement(\"div\");\n  el.className = \"toast\";\n  el.setAttribute(\"role\", \"status\");\n  el.textContent = message;\n  host.appendChild(el);\n  setTimeout(function () {\n    el.remove();\n  }, 5000);\n}\n\nfunction fail(card, message, retry) {\n  toast(message);\n  if (!card) return;\n  let box = card.querySelector(\"[data-fail]\");\n  if (!box) {\n    box = document.createElement(\"div\");\n    box.setAttribute(\"data-fail\", \"1\");\n    box.className = \"fail\";\n    card.appendChild(box);\n  }\n  box.replaceChildren();\n  const p = document.createElement(\"p\");\n  p.textContent = message;\n  const btn = document.createElement(\"button\");\n  btn.className = \"btn sm\";\n  btn.type = \"button\";\n  btn.textContent = \"Retry\";\n  btn.addEventListener(\"click\", retry);\n  box.appendChild(p);\n  box.appendChild(btn);\n}\n\nfunction clearFail(card) {\n  const box = card && card.querySelector(\"[data-fail]\");\n  if (box) box.remove();\n}\n\nfunction skeleton(card, on) {\n  if (!card) return;\n  card.classList.toggle(\"busy\", on);\n}\n\nasync function api(method, url, body) {\n  const res = await fetch(url, {\n    method: method,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"x-requested-with\": \"co-maintainer\",\n    },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  if (!res.ok) {\n    let message = \"Request failed\";\n    try {\n      const data = await res.json();\n      if (data.error && data.error.message) message = data.error.message;\n    } catch {\n      // body was not JSON; keep the generic message\n    }\n    throw new Error(message);\n  }\n  if (res.status === 204) return null;\n  return await res.json();\n}\n\nasync function run(btn, card, fn) {\n  if (btn) btn.disabled = true;\n  skeleton(card, true);\n  clearFail(card);\n  try {\n    await fn();\n  } catch (err) {\n    fail(card, err.message, function () {\n      run(btn, card, fn);\n    });\n  } finally {\n    if (btn) btn.disabled = false;\n    skeleton(card, false);\n  }\n}\n\nasync function postAndGo(url, body, next, btn) {\n  const card = btn && btn.closest(\"[data-async]\");\n  await run(btn, card, async function () {\n    await api(\"POST\", url, body);\n    location.href = next;\n  });\n}\n\n// Called from the inline scripts on the repo list and repo pages, which deno lint\n// cannot see, so it looks unused from inside this file.\n// deno-lint-ignore no-unused-vars\nfunction bindToggle(btn, url, field) {\n  btn.addEventListener(\"click\", async function () {\n    if (btn.disabled) return;\n    const on = !btn.classList.contains(\"on\");\n    btn.classList.toggle(\"on\", on);\n    btn.setAttribute(\"data-on\", on ? \"1\" : \"0\");\n    btn.disabled = true;\n    const card = btn.closest(\"[data-async]\");\n    try {\n      const payload = {};\n      payload[field] = on;\n      await api(\"PATCH\", url, payload);\n    } catch (err) {\n      btn.classList.toggle(\"on\", !on);\n      btn.setAttribute(\"data-on\", on ? \"0\" : \"1\");\n      fail(card, err.message, function () {\n        btn.click();\n      });\n    } finally {\n      btn.disabled = false;\n    }\n  });\n}\n\naddEventListener(\"error\", function (ev) {\n  toast((ev.error && ev.error.message) || \"Something broke\");\n});\naddEventListener(\"unhandledrejection\", function (ev) {\n  toast((ev.reason && ev.reason.message) || \"Something broke\");\n});\n\ndocument.addEventListener(\"click\", function (ev) {\n  const btn =\n    ev.target && ev.target.closest\n      ? ev.target.closest(\"[data-cancel], [data-post]\")\n      : null;\n  if (!btn) return;\n  ev.preventDefault();\n  if (btn.hasAttribute(\"data-cancel\")) {\n    postAndGo(\n      \"/api/jobs/\" + btn.getAttribute(\"data-cancel\") + \"/cancel\",\n      {},\n      \"/activity\",\n      btn,\n    );\n    return;\n  }\n  const body = btn.getAttribute(\"data-body\");\n  postAndGo(\n    btn.getAttribute(\"data-post\"),\n    body ? JSON.parse(body) : {},\n    \"/activity\",\n    btn,\n  );\n});\n\n(function pollActivity() {\n  if (!document.getElementById(\"activity-root\")) return;\n  setInterval(async function () {\n    if (document.hidden) return;\n    if (document.querySelector(\"[data-async].busy\")) return;\n    const root = document.getElementById(\"activity-root\");\n    if (!root) return;\n    try {\n      const res = await fetch(location.pathname + location.search, {\n        headers: { accept: \"text/html\" },\n      });\n      if (!res.ok) return;\n      const doc = new DOMParser().parseFromString(\n        await res.text(),\n        \"text/html\",\n      );\n      const next = doc.getElementById(\"activity-root\");\n      if (!next || next.innerHTML === root.innerHTML) return;\n      root.replaceWith(next);\n    } catch {\n      // a failed poll just waits for the next tick\n    }\n  }, 5000);\n})();\n";
+export const client = "function toast(message) {\n  const host = document.getElementById(\"toasts\");\n  if (!host) return;\n  const el = document.createElement(\"div\");\n  el.className = \"toast\";\n  el.setAttribute(\"role\", \"status\");\n  el.textContent = message;\n  host.appendChild(el);\n  setTimeout(function () {\n    el.remove();\n  }, 5000);\n}\n\nfunction fail(card, message, retry) {\n  toast(message);\n  if (!card) return;\n  let box = card.querySelector(\"[data-fail]\");\n  if (!box) {\n    box = document.createElement(\"div\");\n    box.setAttribute(\"data-fail\", \"1\");\n    box.className = \"fail\";\n    card.appendChild(box);\n  }\n  box.replaceChildren();\n  const p = document.createElement(\"p\");\n  p.textContent = message;\n  const btn = document.createElement(\"button\");\n  btn.className = \"btn sm\";\n  btn.type = \"button\";\n  btn.textContent = \"Retry\";\n  btn.addEventListener(\"click\", retry);\n  box.appendChild(p);\n  box.appendChild(btn);\n}\n\nfunction clearFail(card) {\n  const box = card && card.querySelector(\"[data-fail]\");\n  if (box) box.remove();\n}\n\nfunction skeleton(card, on) {\n  if (!card) return;\n  card.classList.toggle(\"busy\", on);\n}\n\nasync function api(method, url, body) {\n  const res = await fetch(url, {\n    method: method,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"x-requested-with\": \"co-maintainer\",\n    },\n    body: body === undefined ? undefined : JSON.stringify(body),\n  });\n  if (!res.ok) {\n    let message = \"Request failed\";\n    try {\n      const data = await res.json();\n      if (data.error && data.error.message) message = data.error.message;\n    } catch {\n      // body was not JSON; keep the generic message\n    }\n    throw new Error(message);\n  }\n  if (res.status === 204) return null;\n  return await res.json();\n}\n\nasync function run(btn, card, fn) {\n  if (btn) btn.disabled = true;\n  skeleton(card, true);\n  clearFail(card);\n  try {\n    await fn();\n  } catch (err) {\n    fail(card, err.message, function () {\n      run(btn, card, fn);\n    });\n  } finally {\n    if (btn) btn.disabled = false;\n    skeleton(card, false);\n  }\n}\n\nasync function postAndGo(url, body, next, btn) {\n  const card = btn && btn.closest(\"[data-async]\");\n  await run(btn, card, async function () {\n    await api(\"POST\", url, body);\n    location.href = next;\n  });\n}\n\n// Called from the inline scripts on the repo list and repo pages, which deno lint\n// cannot see, so it looks unused from inside this file.\n// deno-lint-ignore no-unused-vars\nfunction bindToggle(btn, url, field) {\n  btn.addEventListener(\"click\", async function () {\n    if (btn.disabled) return;\n    const on = !btn.classList.contains(\"on\");\n    btn.classList.toggle(\"on\", on);\n    btn.setAttribute(\"data-on\", on ? \"1\" : \"0\");\n    btn.disabled = true;\n    const card = btn.closest(\"[data-async]\");\n    try {\n      const payload = {};\n      payload[field] = on;\n      await api(\"PATCH\", url, payload);\n    } catch (err) {\n      btn.classList.toggle(\"on\", !on);\n      btn.setAttribute(\"data-on\", on ? \"0\" : \"1\");\n      fail(card, err.message, function () {\n        btn.click();\n      });\n    } finally {\n      btn.disabled = false;\n    }\n  });\n}\n\n// The helper is inlined into `<head>` by `layout.ts`, before any page script\n// runs, so this is the one place that can close over both `toast()` and\n// `bindToggle` without depending on point-in-time globals.\ndocument.addEventListener(\"DOMContentLoaded\", function () {\n  // Client errors bubble to `window` from `document`.\n  addEventListener(\"error\", function (ev) {\n    toast((ev.error && ev.error.message) || \"Something broke\");\n  });\n  addEventListener(\"unhandledrejection\", function (ev) {\n    toast((ev.reason && ev.reason.message) || \"Something broke\");\n  });\n\n  document.addEventListener(\"click\", function (ev) {\n    const btn =\n      ev.target && ev.target.closest\n        ? ev.target.closest(\"[data-cancel], [data-post]\")\n        : null;\n    if (!btn) return;\n    ev.preventDefault();\n    if (btn.hasAttribute(\"data-cancel\")) {\n      postAndGo(\n        \"/api/jobs/\" + btn.getAttribute(\"data-cancel\") + \"/cancel\",\n        {},\n        \"/activity\",\n        btn,\n      );\n      return;\n    }\n    const body = btn.getAttribute(\"data-body\");\n    postAndGo(\n      btn.getAttribute(\"data-post\"),\n      body ? JSON.parse(body) : {},\n      \"/activity\",\n      btn,\n    );\n  });\n\n  // Reads `activity-root` at call time, so it has to wait for the body even\n  // though this file itself is already parsed.\n  if (!document.getElementById(\"activity-root\")) return;\n  setInterval(async function () {\n    if (document.hidden) return;\n    if (document.querySelector(\"[data-async].busy\")) return;\n    const root = document.getElementById(\"activity-root\");\n    if (!root) return;\n    try {\n      const res = await fetch(location.pathname + location.search, {\n        headers: { accept: \"text/html\" },\n      });\n      if (!res.ok) return;\n      const doc = new DOMParser().parseFromString(\n        await res.text(),\n        \"text/html\",\n      );\n      const next = doc.getElementById(\"activity-root\");\n      if (!next || next.innerHTML === root.innerHTML) return;\n      root.replaceWith(next);\n    } catch {\n      // a failed poll just waits for the next tick\n    }\n  }, 5000);\n});\n";

package/dist/src/server/pages/home.d.ts

@@ -1,8 +1,13 @@
+import type { SetupItem } from "../../services/setup_checklist.ts";
 export declare function renderLogin(opts: {
     next: string;
     error?: string;
     showPassword: boolean;
     showGithub: boolean;
+    /** `CM_LOGIN_HINT`, for a deployment that hands out its own password (the
+     * Cloud image seeds one), so this page can point at it instead of the
+     * generic "printed when serve started". Falls back to the default line. */
+    hint?: string;
 }): Response;
 export declare function renderHome(username: string, rows: {
     fullName: string;
@@ -13,4 +18,4 @@ export declare function renderHome(username: string, rows: {
     autoOn: boolean;
     reviews: string;
     cost: string;
-}[]): Response;
+}[], checklist: SetupItem[]): Response;

package/dist/src/server/pages/home.js

@@ -18,7 +18,8 @@ export function renderLogin(opts) {
         ? `<p class="muted" style="text-align:center;margin:16px 0">or</p>`
         : "";
     const lead = opts.showPassword
-        ? "Use the dashboard password printed when serve started."
+        ? opts.hint?.trim() ||
+            "Use the dashboard password printed when serve started."
         : "Sign in with your GitHub account.";
     return html(layout({
         title: "Sign in · co-maintainer",
@@ -33,11 +34,32 @@ export function renderLogin(opts) {
 </div>`,
     }));
 }
-export function renderHome(username, rows) {
+export function renderHome(username, rows, checklist) {
     const autoCount = rows.filter((row) => row.autoOn).length;
     const lead = rows.length === 0
         ? "No repositories yet. Add one to start."
         : `${rows.length} repositories · ${autoCount} reviewing pull requests automatically`;
+    const remaining = checklist.filter((item) => !item.done);
+    // The card is hidden entirely once everything is done, so a finished
+    // install is not told to "finish" anything.
+    const setupCard = remaining.length === 0
+        ? ""
+        : `<div class="card" id="finish-setup">
+    <div class="hd"><h2>Finish setup</h2>
+      <span class="muted" style="margin-left:auto">${checklist.length - remaining.length}/${checklist.length} done</span></div>
+    <div class="bd">
+      <ul class="steps">
+        ${checklist
+            .map((item, index) => `<li class="${item.done ? "done" : ""}">
+          <span class="n">${item.done ? "✓" : index + 1}</span>
+          <div class="body"><b>${text(item.title)}</b>
+            <span class="muted">${text(item.detail)}</span></div>
+          <a class="btn sm" href="${item.href}">${text(item.linkLabel)}</a>
+        </li>`)
+            .join("")}
+      </ul>
+    </div>
+  </div>`;
     const body = rows.length === 0
         ? empty("No repositories", "Add a repository to generate knowledge and review pull requests.")
         : `<div class="card" data-async>
@@ -76,6 +98,7 @@ export function renderHome(username, rows) {
     <div><h1>Repositories</h1><p class="lead">${text(lead)}</p></div>
     <div class="actions">${rows.length === 0 ? `<a class="btn" href="/setup">Get started</a>` : ""}<a class="btn primary" href="/repos/new">Add repository</a></div>
   </div>
+  ${setupCard}
   ${body}
 </div>
 <script>

package/dist/src/server/pages/knowledge.js

@@ -44,7 +44,7 @@ export function renderKnowledge(username, data, viewId) {
     <div class="pagehead">
       <div><h1>Knowledge</h1>
         <p class="lead">What co-maintainer learned about this repository, and checks every pull request against.</p></div>
-      <div class="actions"><button class="primary" id="update">Update</button></div>
+      <div class="actions"><button class="primary" id="update">Sync</button></div>
     </div>
     ${notice}
     <div class="card"><div class="bd flush">${table}</div></div>

package/dist/src/server/pages/layout.js

@@ -1,5 +1,6 @@
 import { safeCopy } from "../../util/redact.js";
 import { relativeTime } from "../../util/time.js";
+import { client } from "./client.js";
 export function escapeHtml(value) {
     return String(value ?? "").replace(/[&<>"']/g, (char) => ({
         "&": "&amp;",
@@ -191,14 +192,13 @@ export function layout(opts) {
   </div>`
         : "";
     return `<!doctype html><html lang="en"><head><meta charset="utf-8">
-<title>${text(opts.title)}</title><link rel="stylesheet" href="/styles.css"><link rel="icon" href="/logo.png" type="image/png"></head><body>
+<title>${text(opts.title)}</title><link rel="stylesheet" href="/styles.css"><link rel="icon" href="/logo.png" type="image/png"><script>${client}</script></head><body>
 <div class="top"><div class="in">
   <a class="logo" href="/"><img src="/logo.png" alt="">co-maintainer</a>
   ${right}
 </div></div>
 ${opts.body}
 <div id="toasts"></div>
-<script src="/client.js"></script>
 </body></html>`;
 }
 export function html(body, status = 200) {

package/dist/src/server/pages/repo.d.ts

@@ -1,2 +1,2 @@
 import type { repoOverview } from "../../services/dashboard.ts";
-export declare function renderRepo(username: string, data: ReturnType<typeof repoOverview>): Response;
+export declare function renderRepo(username: string, data: ReturnType<typeof repoOverview>, webhookUrl: string): Response;

package/dist/src/server/pages/repo.js

@@ -1,6 +1,8 @@
 import { capped, empty, html, layout, money, repoNav, skSlot, text, when, } from "./layout.js";
 import { COMPARE_FILE_CAP, MAX_COMMITS_COUNTED } from "../../services/drift.js";
-export function renderRepo(username, data) {
+import { webhookReachabilityProblem } from "../../util/webhook_reachability.js";
+import { lastDeliveryForRepo } from "../../store/deliveries.js";
+export function renderRepo(username, data, webhookUrl) {
     const name = data.repo.full_name;
     const stats = data.stats;
     const drift = data.drift;
@@ -10,7 +12,7 @@ export function renderRepo(username, data) {
       ${skSlot()}
       <div class="txt"><b>Update recommended.</b> Since the guide was built:
         ${drift.prs_since} new pull requests, ${drift.prs_updated} changed pull requests, ${capped(drift.commits_since, MAX_COMMITS_COUNTED)} commits, ${capped(drift.files_changed, COMPARE_FILE_CAP)} files changed.</div>
-      <button class="btn primary" id="remake">Update now</button>
+      <button class="btn primary" id="remake">Sync now</button>
     </div>`
         : "";
     const pulls = data.recentPulls.length === 0
@@ -25,6 +27,22 @@ export function renderRepo(username, data) {
             .join("")}
           </tbody>
         </table>`;
+    const reach = webhookReachabilityProblem(webhookUrl);
+    const last = lastDeliveryForRepo(name);
+    const delivery = last ? when(last.received_at) : "never";
+    const webhook = reach
+        ? `<div class="notice bad">
+      <div class="txt"><b>GitHub cannot reach this address, so automatic reviews will not arrive.</b>
+        ${text(reach)} The webhook URL is <code>${text(webhookUrl)}</code>. Change it in <a href="/settings">Settings</a>.
+        Last webhook delivery: ${delivery}.</div>
+    </div>`
+        : !last
+            ? `<div class="notice info">
+      <div class="txt"><b>No webhook delivery yet.</b> GitHub has not reached this repository
+        and the last webhook delivery is never. Open a pull request, or check the webhook URL
+        <code>${text(webhookUrl)}</code> in <a href="/settings">Settings</a>.</div>
+    </div>`
+            : `<p class="muted" style="margin:0 0 18px">Last webhook delivery: ${delivery}.</p>`;
     const auto = data.repo.auto_review === 1;
     return html(layout({
         title: `${name} · co-maintainer`,
@@ -47,6 +65,7 @@ export function renderRepo(username, data) {
       </div>
     </div>
     ${notice}
+    ${webhook}
     <div class="card">
       <div class="hd"><h2>Last 30 days</h2></div>
       <div class="bd">

package/dist/src/server/pages/repo_prs.d.ts

@@ -1,2 +1,6 @@
 import type { repoPulls } from "../../services/dashboard.ts";
-export declare function renderRepoPulls(username: string, fullName: string, data: ReturnType<typeof repoPulls>): Response;
+import type { OpenPull } from "../../github/app.ts";
+export declare function renderRepoPulls(username: string, fullName: string, data: ReturnType<typeof repoPulls>, open: {
+    pulls: OpenPull[] | undefined;
+    appConfigured: boolean;
+}): Response;

package/dist/src/server/pages/repo_prs.js

@@ -1,5 +1,5 @@
 import { empty, html, layout, money, repoNav, skSlot, text, when, } from "./layout.js";
-export function renderRepoPulls(username, fullName, data) {
+export function renderRepoPulls(username, fullName, data, open) {
     const start = (data.page - 1) * data.per + 1;
     const end = Math.min(data.page * data.per, data.total);
     const pager = data.total === 0
@@ -30,6 +30,32 @@ export function renderRepoPulls(username, fullName, data) {
         </table>${pager}`;
     const [owner, repo] = fullName.split("/");
     const reviewBase = `/api/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/`;
+    const escape = (value) => value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+    const openList = open.pulls
+        ? open.pulls.length === 0
+            ? `<div class="empty"><h2>No open pull requests</h2><p>Open one on GitHub and it will appear here.</p></div>`
+            : `<table>
+          <thead><tr><th>Pull request</th><th>Author</th><th>Branch</th>
+            <th>Updated</th><th></th></tr></thead>
+          <tbody>
+            ${open.pulls
+                .map((pull) => `<tr><td><a href="/repos/${text(fullName)}/pulls/${pull.number}">#${pull.number}</a>
+              ${escape(pull.title)}</td>
+              <td class="muted">${escape(pull.author)}</td>
+              <td class="muted mono">${escape(pull.headRef)}</td>
+              <td class="muted">${when(pull.updatedAt)}</td>
+              <td class="num"><button class="btn sm" type="button"
+                data-review-pr="${pull.number}">Review</button></td></tr>`)
+                .join("")}
+          </tbody>
+        </table>`
+        : open.appConfigured
+            ? `<div class="empty"><h2>Open pull requests are unavailable</h2><p>GitHub did not return a list. You can still start a review by number below.</p></div>`
+            : `<div class="empty"><h2>Configure the GitHub App to list open pull requests</h2><p>Without it, start a review by number below.</p></div>`;
     return html(layout({
         title: `Pull requests · ${fullName}`,
         username,
@@ -42,6 +68,10 @@ export function renderRepoPulls(username, fullName, data) {
       <div><h1>Pull requests</h1>
         <p class="lead">${data.stats.pullRequests} reviewed in the last 30 days</p></div>
     </div>
+    <div data-async>
+      ${skSlot()}
+      <div class="card"><div class="bd flush">${openList}</div></div>
+    </div>
     <div data-async>
       ${skSlot()}
       <div class="card"><div class="bd">
@@ -70,6 +100,11 @@ document.getElementById("manual-review").addEventListener("submit", function(eve
   }
   postAndGo(${JSON.stringify(reviewBase)} + number + "/review", {}, "/activity", this.querySelector("button"));
 });
+document.querySelectorAll("[data-review-pr]").forEach(function(btn) {
+  btn.addEventListener("click", function() {
+    postAndGo(${JSON.stringify(reviewBase)} + btn.getAttribute("data-review-pr") + "/review", {}, "/activity", btn);
+  });
+});
 </script>`,
     }));
 }

package/dist/src/server/pages/repo_remote.js

@@ -8,8 +8,8 @@ export function renderRepoRemote(username, fullName, data) {
         <tbody>
           ${data.items
             .map((review) => `<tr>
-            <td>${text(review.branch ?? "—")}</td>
-            <td>${text(review.token_name ?? "—")}</td>
+            <td>${text(review.branch ?? "none")}</td>
+            <td>${text(review.token_name ?? "none")}</td>
             <td>${text(review.status)}</td>
             <td class="num">${review.findings_count ?? 0}</td>
             <td class="num">${money(review.cost ?? 0)}</td>