co-maintainer 0.5.0 → 0.5.1-beta.2

package/dist/src/services/webhook.js

@@ -5,7 +5,10 @@ import { deactivateRepo, deactivateReposForInstallation, getRepo, setInstallatio
 import { findFindingByPostedComment } from "../store/findings.js";
 import { createReplyRequestAndJob, findReplyByPostedComment, } from "../store/replies.js";
 import { latestPostedReview } from "../store/reviews.js";
+import { getQueuedJob } from "../store/jobs.js";
 import { markInstallationRemoved, markInstallationSuspended, upsertInstallation, } from "../store/installations.js";
+import { readConfig } from "../config.js";
+import { carriesEarlierRequest, evaluatePolicy, isRequestCommand, legacyPolicy, parsePolicy, } from "./review_policy.js";
 export const REVIEW_DEBOUNCE_MS = 20_000;
 const PR_ACTIONS = new Set([
     "opened",
@@ -13,6 +16,34 @@ const PR_ACTIONS = new Set([
     "synchronize",
     "ready_for_review",
 ]);
+/** The policy that governs a repository. A repository pinned to `"legacy"`, and
+ * one with nothing stored and no server default, follow the three old
+ * switches. A stored value that no longer parses does too, so a bad edit
+ * degrades to today's behavior rather than to a silent stop. */
+export function policySource(row) {
+    const switches = { policy: legacyPolicy(row), legacy: true };
+    let value;
+    if (row.review_policy_json !== null) {
+        try {
+            value = JSON.parse(row.review_policy_json);
+        }
+        catch {
+            return switches;
+        }
+        if (value === "legacy")
+            return switches;
+    }
+    else {
+        value = readConfig().reviewPolicy;
+        if (value === undefined)
+            return switches;
+    }
+    const parsed = parsePolicy(value);
+    return parsed.ok ? { policy: parsed.value, legacy: false } : switches;
+}
+export function policyForRepo(row) {
+    return policySource(row).policy;
+}
 function asRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         return undefined;
@@ -49,6 +80,25 @@ function isBot(user) {
     const login = asString(user.login) ?? "";
     return login.endsWith("[bot]");
 }
+function labelNames(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value
+        .map((label) => asString(asRecord(label)?.name))
+        .filter((name) => Boolean(name));
+}
+/** The policy facts a pull request object carries. `fork` is true when the head
+ * lives in another repository, or in none because the fork was deleted. */
+function pullRequestFacts(pr, repo) {
+    const head = asRecord(pr?.head);
+    const headRepo = asString(asRecord(head?.repo)?.full_name);
+    return {
+        association: asString(pr?.author_association),
+        fork: head ? headRepo?.toLowerCase() !== repo.toLowerCase() : undefined,
+        labels: labelNames(pr?.labels),
+        targetBranch: asString(asRecord(pr?.base)?.ref),
+    };
+}
 export function maybeEnqueueReview(input) {
     const row = getRepo(input.repo);
     if (!row || row.active !== 1) {
@@ -59,29 +109,31 @@ export function maybeEnqueueReview(input) {
             prNumber: input.prNumber,
         };
     }
-    if (row.auto_review !== 1) {
-        return {
-            outcome: "skipped",
-            reason: "auto-review-off",
-            repo: input.repo,
-            prNumber: input.prNumber,
-        };
-    }
-    if (row.skip_drafts === 1 && input.draft) {
-        return {
-            outcome: "skipped",
-            reason: "draft",
-            repo: input.repo,
-            prNumber: input.prNumber,
-        };
-    }
-    if (row.skip_bots === 1 && input.bot) {
-        return {
-            outcome: "skipped",
-            reason: "bot-author",
-            repo: input.repo,
-            prNumber: input.prNumber,
-        };
+    const policy = policyForRepo(row);
+    const decision = evaluatePolicy(policy, {
+        association: input.association,
+        fork: input.fork,
+        draft: input.draft,
+        bot: input.bot,
+        labels: input.labels,
+        targetBranch: input.targetBranch,
+        changedLines: input.changedFiles >= 0 ? input.additions + input.deletions : undefined,
+    });
+    const skipped = (reason) => ({
+        outcome: "skipped",
+        reason,
+        repo: input.repo,
+        prNumber: input.prNumber,
+    });
+    const earlier = latestPostedReview(input.repo, input.prNumber);
+    if (decision.action === "skip")
+        return skipped(decision.reason);
+    if (decision.action === "on-request" && !input.request) {
+        const asked = earlier !== undefined ||
+            getQueuedJob(input.repo, input.prNumber) !== undefined;
+        if (!carriesEarlierRequest(policy, asked)) {
+            return skipped(decision.reason);
+        }
     }
     if (!row.knowledge_built_at) {
         return {
@@ -110,17 +162,16 @@ export function maybeEnqueueReview(input) {
     }
     if ((input.trigger === "review" || input.trigger === "review-comment") &&
         input.headSha) {
-        const last = latestPostedReview(input.repo, input.prNumber);
-        if (last && last.head_sha === input.headSha) {
-            return {
-                outcome: "skipped",
-                reason: "nothing-new-since-last-round",
-                repo: input.repo,
-                prNumber: input.prNumber,
-            };
+        if (earlier && earlier.head_sha === input.headSha) {
+            return skipped("nothing-new-since-last-round");
         }
     }
-    const last = latestPostedReview(input.repo, input.prNumber);
+    if (policy.maxRounds !== undefined &&
+        earlier &&
+        earlier.round >= policy.maxRounds) {
+        return skipped(`Round limit reached: ${earlier.round} of ${policy.maxRounds} reviews.`);
+    }
+    const last = earlier;
     const incremental = row.review_scope === "incremental" && Boolean(last?.head_sha);
     const { id } = enqueue({
         type: "review",
@@ -133,6 +184,7 @@ export function maybeEnqueueReview(input) {
             scope: incremental ? "incremental" : "whole-pr",
             sinceCommit: incremental ? last.head_sha : undefined,
             round: last ? last.round + 1 : 1,
+            requestReaction: input.request?.reaction,
         },
     });
     return {
@@ -208,9 +260,23 @@ function pullRequestEvent(payload, deliveryId, maxDiffLines) {
     const pr = asRecord(payload.pull_request);
     const repo = asString(asRecord(payload.repository)?.full_name);
     const prNumber = asNumber(pr?.number) ?? asNumber(payload.number);
-    if (!PR_ACTIONS.has(action) || !repo || prNumber === undefined) {
+    const labeled = action === "labeled";
+    if ((!PR_ACTIONS.has(action) && !labeled) ||
+        !repo ||
+        prNumber === undefined) {
         return { outcome: "ignored", repo, prNumber };
     }
+    // A label only means something when it is the repository's request label.
+    // Adding it already takes triage rights, so no further check is made.
+    if (labeled) {
+        const row = getRepo(repo);
+        const added = asString(asRecord(payload.label)?.name);
+        if (!row ||
+            !added ||
+            added.toLowerCase() !== policyForRepo(row).requestLabel.toLowerCase()) {
+            return { outcome: "ignored", repo, prNumber };
+        }
+    }
     const user = asRecord(pr?.user);
     const installationId = asNumber(asRecord(payload.installation)?.id);
     if (installationId !== undefined)
@@ -224,9 +290,13 @@ function pullRequestEvent(payload, deliveryId, maxDiffLines) {
         deletions: asNumber(pr?.deletions) ?? 0,
         changedFiles: asNumber(pr?.changed_files) ?? -1,
         deliveryId,
-        trigger: action,
+        trigger: labeled ? "request-label" : action,
         headSha: asString(asRecord(pr?.head)?.sha),
         maxDiffLines,
+        ...pullRequestFacts(pr, repo),
+        request: labeled
+            ? { reaction: `repos/${repo}/issues/${prNumber}/reactions` }
+            : undefined,
     });
 }
 function reviewWakeEvent(event, payload, deliveryId, maxDiffLines) {
@@ -266,6 +336,7 @@ function reviewWakeEvent(event, payload, deliveryId, maxDiffLines) {
         trigger: event === "pull_request_review" ? "review" : "review-comment",
         headSha: asString(asRecord(pr?.head)?.sha),
         maxDiffLines,
+        ...pullRequestFacts(pr, repo),
     });
 }
 function replyTarget(repo, prNumber, parentCommentId) {
@@ -370,6 +441,42 @@ function issueCommentEvent(payload, deliveryId) {
             prNumber,
         };
     }
+    const row = getRepo(repo);
+    if (row?.active === 1) {
+        const policy = policyForRepo(row);
+        if (isRequestCommand(body, policy.requestCommand)) {
+            const commenter = asString(comment?.author_association) ?? "NONE";
+            if (!policy.requesters.includes(commenter)) {
+                return {
+                    outcome: "skipped",
+                    reason: `Not allowed to request a review: ${commenter} is not one of ${policy.requesters.join(", ")}.`,
+                    repo,
+                    prNumber,
+                };
+            }
+            const installationId = asNumber(asRecord(payload.installation)?.id);
+            if (installationId !== undefined)
+                setInstallationId(repo, installationId);
+            // An issue payload carries no head, base or diff size, so rules about
+            // the fork, the target branch and the size do not match here.
+            return maybeEnqueueReview({
+                repo,
+                prNumber,
+                draft: asBool(issue?.draft),
+                bot: isBot(asRecord(issue?.user)),
+                additions: 0,
+                deletions: 0,
+                changedFiles: -1,
+                deliveryId,
+                trigger: "request-comment",
+                association: asString(issue?.author_association),
+                labels: labelNames(issue?.labels),
+                request: {
+                    reaction: `repos/${repo}/issues/comments/${String(sourceId)}/reactions`,
+                },
+            });
+        }
+    }
     if (!hasAppMention(body, appSlug(payload))) {
         return {
             outcome: "ignored",

package/dist/src/store/app_db.d.ts

@@ -1,7 +1,12 @@
 import { Database } from "./sqlite.ts";
+import { type BackupPaths } from "./backup.ts";
 export declare function appDbDir(): string;
 /** `CM_APP_DB` overrides the path — tests point it at a temp file. */
 export declare function appDbPath(): string;
+/** Where the backup taken before a migration lives, and what it covers. */
+export declare function backupPaths(): BackupPaths;
+/** The pid holding the database lock, or `undefined` when nothing live does. */
+export declare function liveLockPid(): Promise<number | undefined>;
 export declare function releaseLock(): Promise<void>;
 export declare function isAppDbOpen(): boolean;
 /** Opens (creating and migrating if needed) the single shared `app.db`

package/dist/src/store/app_db.js

@@ -1,6 +1,10 @@
+import { dirname } from "node:path";
 import { Database } from "./sqlite.js";
-import { getCacheDir } from "../config.js";
-import { CliError, EXIT_USAGE } from "../cli/error.js";
+import { cacheDbPath, configPath, getCacheDir } from "../config.js";
+import { VERSION } from "../version.js";
+import { log } from "../util/log.js";
+import { takeBackup } from "./backup.js";
+import { CliError, EXIT_RUNTIME, EXIT_USAGE } from "../cli/error.js";
 import { migrations } from "./migrations.js";
 import { getEnv, isNotFound, isProcessAlive, mkdir, readTextFile, remove, writeTextFile, } from "../util/runtime.js";
 export function appDbDir() {
@@ -13,23 +17,53 @@ export function appDbPath() {
 function lockPath() {
     return `${appDbPath()}.lock`;
 }
-/** A PID file next to the database is the lock: a live PID inside it
- * refuses a second start, a dead one is taken over silently. */
-async function acquireLock() {
-    const path = lockPath();
-    let existingPid;
+/** Where the backup taken before a migration lives, and what it covers. */
+export function backupPaths() {
+    return {
+        appDb: appDbPath(),
+        cacheDb: cacheDbPath(),
+        config: configPath(),
+        version: versionPath(),
+        root: `${dirname(appDbPath())}/backups`,
+    };
+}
+/** The version that last opened this database, written after every open so
+ * the next upgrade can say which version to go back to. */
+function versionPath() {
+    return `${appDbPath()}.version`;
+}
+async function lastVersion() {
+    try {
+        return (await readTextFile(versionPath())).trim() || null;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+}
+/** The pid holding the database lock, or `undefined` when nothing live does. */
+export async function liveLockPid() {
+    let pid;
     try {
-        existingPid = Number((await readTextFile(path)).trim());
+        pid = Number((await readTextFile(lockPath())).trim());
     }
     catch (error) {
         if (!isNotFound(error))
             throw error;
     }
-    if (existingPid !== undefined &&
-        Number.isInteger(existingPid) &&
-        isProcessAlive(existingPid)) {
+    return pid !== undefined && Number.isInteger(pid) && isProcessAlive(pid)
+        ? pid
+        : undefined;
+}
+/** A PID file next to the database is the lock: a live PID inside it
+ * refuses a second start, a dead one is taken over silently. */
+async function acquireLock() {
+    const path = lockPath();
+    const existingPid = await liveLockPid();
+    if (existingPid !== undefined) {
         // Says what is holding the database, what to do about it, and offers the
-        // path that does not need another process. CORE-12.
+        // path that does not need another process.
         throw new CliError("serve_already_running", `A co-maintainer serve process (pid ${existingPid}) is using this data directory.`, "Stop it, or run sync from its dashboard.", EXIT_USAGE);
     }
     await writeTextFile(path, String(process.pid));
@@ -45,7 +79,8 @@ function migrate(database) {
         ?.user_version ?? 0;
     if (current > migrations.length) {
         throw new Error(`app.db is at migration ${current}, but this build only knows ${migrations.length}. ` +
-            `Installing an older release after a newer one already migrated the database is unsupported.`);
+            `Installing an older release after a newer one already migrated the database is unsupported. ` +
+            `Run co-maintainer rollback with the newer version installed, or restore the backup in ${backupPaths().root}/previous.`);
     }
     for (let index = current; index < migrations.length; index++) {
         database.exec("BEGIN");
@@ -65,6 +100,23 @@ let db;
 export function isAppDbOpen() {
     return db !== undefined;
 }
+function userVersion(database) {
+    return (database.prepare("PRAGMA user_version").get()
+        ?.user_version ?? 0);
+}
+/** A database with something to migrate is backed up first. A fresh one has
+ * nothing to lose, and without a complete backup the migration does not run. */
+async function backupBeforeMigration(database) {
+    const current = userVersion(database);
+    if (current === 0 || current >= migrations.length)
+        return;
+    try {
+        await takeBackup(backupPaths(), { from: await lastVersion(), to: VERSION });
+    }
+    catch (error) {
+        throw new CliError("backup_failed", `Could not back up the data before upgrading it: ${error instanceof Error ? error.message : String(error)}`, "Free some disk space or check the permissions of the data directory, then try again.", EXIT_RUNTIME);
+    }
+}
 /** Opens (creating and migrating if needed) the single shared `app.db`
  * connection every store module reuses. `serve` opens it for the process.
  * `init` and `remake` open it for the run when it is not already open. */
@@ -76,7 +128,11 @@ export async function openAppDb() {
     const database = new Database(appDbPath());
     database.exec("PRAGMA journal_mode = WAL");
     database.exec("PRAGMA foreign_keys = ON");
+    await backupBeforeMigration(database);
     migrate(database);
+    // The marker only names the version to go back to. Failing to write it must
+    // not stop the server, but it should not vanish silently either.
+    await writeTextFile(versionPath(), VERSION).catch((error) => log("backup", `could not record the running version: ${error instanceof Error ? error.message : String(error)}`));
     db = database;
     return database;
 }

package/dist/src/store/backup.d.ts

@@ -0,0 +1,31 @@
+export type BackupPaths = {
+    appDb: string;
+    cacheDb: string;
+    config: string;
+    /** The file naming the version that last opened `app.db`. */
+    version: string;
+    /** Holds `previous/` and, after a rollback, `rolled-back/`. */
+    root: string;
+};
+export type BackupManifest = {
+    /** The version that ran before the upgrade, `null` when it was not recorded. */
+    fromVersion: string | null;
+    toVersion: string;
+    createdAt: string;
+    files: string[];
+};
+export declare const rolledBackDir: (paths: BackupPaths) => string;
+/** Copies the files into `previous/`, replacing the last backup only once the
+ * new one is complete, so a failure here leaves the old backup untouched. */
+export declare function takeBackup(paths: BackupPaths, versions: {
+    from: string | null;
+    to: string;
+}): Promise<void>;
+/** The previous backup, or `undefined` when there is none or it is incomplete. */
+export declare function readBackup(paths: BackupPaths): Promise<BackupManifest | undefined>;
+/** Throws the usage error a rollback refuses with, or returns the manifest. */
+export declare function checkRollback(paths: BackupPaths, runningVersion: string): Promise<BackupManifest>;
+/** Moves the current files to `rolled-back/` (so a wrong rollback can be
+ * undone by hand), then copies the backup into place. The WAL and shared
+ * memory files go too: a stale one next to a restored database corrupts it. */
+export declare function restoreBackup(paths: BackupPaths): Promise<void>;

package/dist/src/store/backup.js

@@ -0,0 +1,158 @@
+/** The safety net for an upgrade that migrates `app.db`.
+ *
+ * A release refuses an `app.db` newer than it knows, so going back after a
+ * migration cannot mean opening the new database with the old code. Instead
+ * the databases and config are copied just before the migration runs, and
+ * `co-maintainer rollback` puts that copy back. One slot, the previous
+ * version only. Data written after the upgrade is lost by design. */
+import { Database } from "./sqlite.js";
+import { CliError, EXIT_USAGE } from "../cli/error.js";
+import { isNotFound, mkdir, readFile, readTextFile, remove, rename, stat, writeFile, writeTextFile, } from "../util/runtime.js";
+const slot = (paths) => `${paths.root}/previous`;
+export const rolledBackDir = (paths) => `${paths.root}/rolled-back`;
+async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return false;
+        throw error;
+    }
+}
+/** `VACUUM INTO` writes a consistent copy even while the database is open. */
+function copyDatabase(from, to) {
+    const source = new Database(from);
+    try {
+        source.exec(`VACUUM INTO '${to.replaceAll("'", "''")}'`);
+    }
+    finally {
+        source.close();
+    }
+}
+/** Copies the files into `previous/`, replacing the last backup only once the
+ * new one is complete, so a failure here leaves the old backup untouched. */
+export async function takeBackup(paths, versions) {
+    const temp = `${slot(paths)}.tmp`;
+    await remove(temp, { recursive: true }).catch(() => { });
+    await mkdir(temp, { recursive: true });
+    const files = ["app.db"];
+    copyDatabase(paths.appDb, `${temp}/app.db`);
+    if (await exists(paths.cacheDb)) {
+        copyDatabase(paths.cacheDb, `${temp}/cache.db`);
+        files.push("cache.db");
+    }
+    if (await exists(paths.config)) {
+        await writeFile(`${temp}/config.json`, await readFile(paths.config));
+        files.push("config.json");
+    }
+    const manifest = {
+        fromVersion: versions.from,
+        toVersion: versions.to,
+        createdAt: new Date().toISOString(),
+        files,
+    };
+    // The manifest goes last: a directory without one is not a backup.
+    await writeTextFile(`${temp}/manifest.json`, JSON.stringify(manifest, null, 2));
+    // Swap through `.old` so the last backup survives a failed promotion.
+    const old = `${slot(paths)}.old`;
+    await remove(old, { recursive: true }).catch(() => { });
+    const hadPrevious = await exists(slot(paths));
+    if (hadPrevious)
+        await rename(slot(paths), old);
+    try {
+        await rename(temp, slot(paths));
+    }
+    catch (error) {
+        if (hadPrevious)
+            await rename(old, slot(paths)).catch(() => { });
+        throw error;
+    }
+    await remove(old, { recursive: true }).catch(() => { });
+}
+const KNOWN_FILES = ["app.db", "cache.db", "config.json"];
+/** A manifest that names the database and only files this module writes. */
+function isManifest(value) {
+    const manifest = value;
+    return (typeof manifest === "object" &&
+        manifest !== null &&
+        (manifest.fromVersion === null ||
+            typeof manifest.fromVersion === "string") &&
+        typeof manifest.toVersion === "string" &&
+        typeof manifest.createdAt === "string" &&
+        Array.isArray(manifest.files) &&
+        manifest.files.includes("app.db") &&
+        manifest.files.every((file) => KNOWN_FILES.includes(file)));
+}
+/** The previous backup, or `undefined` when there is none or it is incomplete. */
+export async function readBackup(paths) {
+    let manifest;
+    try {
+        manifest = JSON.parse(await readTextFile(`${slot(paths)}/manifest.json`));
+    }
+    catch (error) {
+        if (isNotFound(error) || error instanceof SyntaxError)
+            return undefined;
+        throw error;
+    }
+    if (!isManifest(manifest))
+        return undefined;
+    for (const file of manifest.files) {
+        if (!(await exists(`${slot(paths)}/${file}`)))
+            return undefined;
+    }
+    return manifest;
+}
+/** Throws the usage error a rollback refuses with, or returns the manifest. */
+export async function checkRollback(paths, runningVersion) {
+    const manifest = await readBackup(paths);
+    if (!manifest) {
+        throw new CliError("no_backup", "There is no backup to roll back to.", "A backup is taken when an upgrade migrates the database.", EXIT_USAGE);
+    }
+    if (manifest.toVersion !== runningVersion) {
+        throw new CliError("backup_version_mismatch", `The backup was taken when upgrading to ${manifest.toVersion}, but this is ${runningVersion}.`, `Run rollback with co-maintainer ${manifest.toVersion} installed.`, EXIT_USAGE);
+    }
+    return manifest;
+}
+/** Moves the current files to `rolled-back/` (so a wrong rollback can be
+ * undone by hand), then copies the backup into place. The WAL and shared
+ * memory files go too: a stale one next to a restored database corrupts it. */
+export async function restoreBackup(paths) {
+    const manifest = await readBackup(paths);
+    if (!manifest)
+        throw new Error("backup vanished before it was restored");
+    const aside = rolledBackDir(paths);
+    await remove(aside, { recursive: true }).catch(() => { });
+    await mkdir(aside, { recursive: true });
+    const targets = [
+        [paths.appDb, "app.db"],
+        [`${paths.appDb}-wal`, "app.db-wal"],
+        [`${paths.appDb}-shm`, "app.db-shm"],
+        [paths.cacheDb, "cache.db"],
+        [`${paths.cacheDb}-wal`, "cache.db-wal"],
+        [`${paths.cacheDb}-shm`, "cache.db-shm"],
+        [paths.config, "config.json"],
+    ];
+    for (const [path, name] of targets) {
+        if (await exists(path))
+            await rename(path, `${aside}/${name}`);
+    }
+    const destinations = {
+        "app.db": paths.appDb,
+        "cache.db": paths.cacheDb,
+        "config.json": paths.config,
+    };
+    for (const file of manifest.files) {
+        await writeFile(destinations[file], await readFile(`${slot(paths)}/${file}`));
+    }
+    // The version marker must match the data again, or the next upgrade would
+    // record the wrong version to go back to.
+    if (manifest.fromVersion) {
+        await writeTextFile(paths.version, manifest.fromVersion);
+    }
+    else {
+        await remove(paths.version).catch(() => { });
+    }
+    await remove(slot(paths), { recursive: true });
+}

package/dist/src/store/migrations.d.ts

@@ -1,4 +1,4 @@
-/** Numbered, forward-only migrations — PLAN.md Section 5. Each entry is a
+/** Numbered, forward-only migrations. Each entry is a
  * list of individual statements (not one multi-statement blob) run in a
  * transaction; `PRAGMA user_version` tracks how many have applied. Never
  * edit an already-released migration — add a new one instead. */

package/dist/src/store/migrations.js

@@ -1,4 +1,4 @@
-/** Numbered, forward-only migrations — PLAN.md Section 5. Each entry is a
+/** Numbered, forward-only migrations. Each entry is a
  * list of individual statements (not one multi-statement blob) run in a
  * transaction; `PRAGMA user_version` tracks how many have applied. Never
  * edit an already-released migration — add a new one instead. */
@@ -255,4 +255,24 @@ export const migrations = [
         `CREATE UNIQUE INDEX idx_remote_inputs_request
      ON remote_review_inputs(token_id, request_id)`,
     ],
+    // 9 — a missing cost is unknown, not zero. Older rows are filled in place
+    [
+        `ALTER TABLE reviews ADD COLUMN cost_status TEXT`,
+        `ALTER TABLE reviews ADD COLUMN cost_note TEXT`,
+        `ALTER TABLE reviews ADD COLUMN billed_to TEXT`,
+        `UPDATE reviews SET cost_status = 'known' WHERE cost IS NOT NULL`,
+        `UPDATE reviews SET cost_status = 'unknown', cost_note = 'recorded_before_0_5_1'
+     WHERE cost IS NULL`,
+        `UPDATE reviews SET billed_to = 'server'`,
+    ],
+    // 10 — BYOK: persist only whether a review used a client key, never the key
+    [`ALTER TABLE remote_review_inputs ADD COLUMN billed_to TEXT`],
+    // 11 — a per repository review policy. Existing repositories are
+    // pinned to the policy their three old switches amount to, so they keep
+    // behaving exactly as before and the switches keep working. A new repository
+    // starts empty and takes the server default.
+    [
+        `ALTER TABLE repos ADD COLUMN review_policy_json TEXT`,
+        `UPDATE repos SET review_policy_json = '"legacy"'`,
+    ],
 ];

package/dist/src/store/remote_review_inputs.d.ts

@@ -5,6 +5,9 @@ export declare function insertRemoteReviewInput(input: {
     capabilitiesJson: string;
     requestId: string;
     tokenId: string;
+    /** `'byok'` when the client submitted its own key, else `'server'`. The key
+     * itself is never written here. */
+    billedTo: "server" | "byok";
 }): void;
 export declare function findRemoteReviewInputByRequest(tokenId: string, requestId: string): RemoteReviewInputRow | undefined;
 export declare function getRemoteReviewInput(jobId: string): RemoteReviewInputRow | undefined;

package/dist/src/store/remote_review_inputs.js

@@ -3,9 +3,9 @@ import { nowIso } from "../util/time.js";
 export function insertRemoteReviewInput(input) {
     getAppDb()
         .prepare(`INSERT INTO remote_review_inputs
-      (job_id, revision_json, capabilities_json, request_id, token_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?)`)
-        .run(input.jobId, input.revisionJson, input.capabilitiesJson, input.requestId, input.tokenId, nowIso());
+      (job_id, revision_json, capabilities_json, request_id, token_id, created_at, billed_to)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`)
+        .run(input.jobId, input.revisionJson, input.capabilitiesJson, input.requestId, input.tokenId, nowIso(), input.billedTo);
 }
 export function findRemoteReviewInputByRequest(tokenId, requestId) {
     return getAppDb()

package/dist/src/store/remote_tokens.d.ts

@@ -6,5 +6,5 @@ export declare function findRemoteTokenByName(name: string): RemoteTokenRow | un
 export declare function listRemoteTokens(): RemoteTokenRow[];
 export declare function setRemoteTokenActive(id: string, active: boolean): void;
 export declare function deleteRemoteToken(id: string): void;
-/** At most one write per minute per token (plan §14.2). */
+/** At most one write per minute per token. */
 export declare function touchRemoteToken(id: string): void;

package/dist/src/store/remote_tokens.js

@@ -34,7 +34,7 @@ export function setRemoteTokenActive(id, active) {
 export function deleteRemoteToken(id) {
     getAppDb().prepare(`DELETE FROM remote_tokens WHERE id = ?`).run(id);
 }
-/** At most one write per minute per token (plan §14.2). */
+/** At most one write per minute per token. */
 export function touchRemoteToken(id) {
     const now = nowIso();
     const minuteAgo = new Date(Date.now() - 60_000).toISOString();