co-maintainer 0.5.0 → 0.5.1-beta.2

package/dist/src/remote/http.js

@@ -1,11 +1,23 @@
-/** Shared HTTPS plumbing for the remote endpoints (CORE-25, CORE-44).
+/** Shared HTTPS plumbing for the remote endpoints.
  *
  * `review --remote` and `view --remote` talk to the same server with the same
  * bearer token, so the base URL, the token header and the explanations for a
  * rejected token or an unreachable host live here rather than in the review
  * client alone. */
 import { CliError, EXIT_USAGE, networkFailure } from "../cli/error.js";
-/** A usage error the CLI prints with its hint and exit code (CORE-12). */
+import { getEnv } from "../util/runtime.js";
+/** Where the remote server is, as an environment variable can say it.
+ * A CI job has no config file, and a token on the command line
+ * ends up in the process list, so `CM_REMOTE_HOST` and `CM_REMOTE_TOKEN` are
+ * read here. An empty value counts as unset, so a workflow secret that did not
+ * resolve falls through to the "not configured" error instead of a blank host. */
+export function remoteFromEnv() {
+    return {
+        host: getEnv("CM_REMOTE_HOST") || undefined,
+        token: getEnv("CM_REMOTE_TOKEN") || undefined,
+    };
+}
+/** A usage error the CLI prints with its hint and exit code. */
 export function die(code, message, hint, exitCode = EXIT_USAGE) {
     throw new CliError(code, message, hint, exitCode);
 }
@@ -26,7 +38,7 @@ export async function remoteFetch(host, token, path, init) {
     try {
         const response = await fetch(url, { ...init, headers });
         // The server's 401 text is `invalid or missing token`, which does not say
-        // where the token comes from or how to get another one (CORE-12).
+        // where the token comes from or how to get another one.
         if (response.status === 401 || response.status === 403) {
             die("remote_token_rejected", `The server at ${baseUrl(host)} rejected the remote review token.`, "Create one in its dashboard under Settings, Remote review tokens.", EXIT_USAGE);
         }

package/dist/src/remote/schema.d.ts

@@ -1,8 +1,8 @@
-/** Remote review wire protocol — plan §15.1–15.2. */
+/** Remote review wire protocol. */
 export declare const REMOTE_SCHEMA_VERSION = 1;
 export declare const MIN_CLIENT_SCHEMA = 1;
 export declare const MIN_SERVER_SCHEMA = 1;
-/** README install line for 426 responses (plan §14.4). */
+/** README install line for 426 responses. */
 export declare const REMOTE_CLI_UPGRADE_COMMAND = "npm install -g co-maintainer@latest";
 export declare const REMOTE_MAX_BODY_BYTES = 52428800;
 export declare const REMOTE_SYNC_INTERVAL_SECONDS = 3;
@@ -11,5 +11,5 @@ export declare const REMOTE_SYNC_INTERVAL_SECONDS = 3;
 export declare const REMOTE_FIXTURE_HASH: Record<number, string>;
 export declare const REMOTE_SYNC_STATUSES: readonly ["queued", "running", "done", "failed", "canceled"];
 export type RemoteSyncStatus = (typeof REMOTE_SYNC_STATUSES)[number];
-/** Tool names the server may invoke via the bridge (plan §13.6, §14.5). */
+/** Tool names the server may invoke via the bridge. */
 export declare const REMOTE_KNOWN_TOOL_NAMES: Set<string>;

package/dist/src/remote/schema.js

@@ -1,8 +1,8 @@
-/** Remote review wire protocol — plan §15.1–15.2. */
+/** Remote review wire protocol. */
 export const REMOTE_SCHEMA_VERSION = 1;
 export const MIN_CLIENT_SCHEMA = 1;
 export const MIN_SERVER_SCHEMA = 1;
-/** README install line for 426 responses (plan §14.4). */
+/** README install line for 426 responses. */
 export const REMOTE_CLI_UPGRADE_COMMAND = "npm install -g co-maintainer@latest";
 export const REMOTE_MAX_BODY_BYTES = 52_428_800;
 export const REMOTE_SYNC_INTERVAL_SECONDS = 3;
@@ -18,7 +18,7 @@ export const REMOTE_SYNC_STATUSES = [
     "failed",
     "canceled",
 ];
-/** Tool names the server may invoke via the bridge (plan §13.6, §14.5). */
+/** Tool names the server may invoke via the bridge. */
 export const REMOTE_KNOWN_TOOL_NAMES = new Set([
     "codegraph-query",
     "codegraph-node",

package/dist/src/remote/server/body.d.ts

@@ -1,4 +1,4 @@
-/** Bounded request body read — plan §14.5 / G6 (bytes, streaming). */
+/** Bounded request body read (bytes, streaming). */
 export type BoundedBodyResult = {
     ok: true;
     text: string;

package/dist/src/remote/server/body.js

@@ -1,4 +1,4 @@
-/** Bounded request body read — plan §14.5 / G6 (bytes, streaming). */
+/** Bounded request body read (bytes, streaming). */
 export async function readBoundedUtf8(request, maxBytes) {
     const lengthHeader = request.headers.get("content-length");
     if (lengthHeader !== null) {

package/dist/src/remote/server/byok_keys.d.ts

@@ -0,0 +1,15 @@
+/** Remembers a key for one job. An empty key is not stored. */
+export declare function registerByokKey(jobId: string, key: string): void;
+/** The key for a job, or undefined when none was submitted or it was already
+ * dropped. Callers must treat undefined as "no key", never as "use the
+ * server key" without checking the policy first. */
+export declare function getByokKey(jobId: string): string | undefined;
+export declare function hasByokKey(jobId: string): boolean;
+/** Called on every terminal path: done, failed, canceled, superseded. */
+export declare function dropByokKey(jobId: string): void;
+/** Test-only hook so a scenario can simulate a server restart without a new
+ * process. Not used in production code. */
+export declare function clearByokKeysForTest(): void;
+/** Test-only count of held keys, so a test can prove a failed path left none
+ * behind without reading any key value. */
+export declare function byokKeyCountForTest(): number;

package/dist/src/remote/server/byok_keys.js

@@ -0,0 +1,40 @@
+/** In-memory BYOK key store for remote reviews.
+ *
+ * A client's own AI key lives only here, keyed by job id, for the life of the
+ * job. It is never written to a table, a log line, or an error message. The
+ * key is gone the moment the job finishes, fails, is canceled, or is
+ * superseded, and a server restart empties this map, which is exactly the
+ * documented "your key was not kept across a restart" behavior.
+ *
+ * Why a module-level Map rather than the DB: a persisted key would survive a
+ * restart and be readable by anything that reads the database file, which is
+ * the leak the byte-scan test exists to prevent. */
+const keys = new Map();
+/** Remembers a key for one job. An empty key is not stored. */
+export function registerByokKey(jobId, key) {
+    if (key)
+        keys.set(jobId, key);
+}
+/** The key for a job, or undefined when none was submitted or it was already
+ * dropped. Callers must treat undefined as "no key", never as "use the
+ * server key" without checking the policy first. */
+export function getByokKey(jobId) {
+    return keys.get(jobId);
+}
+export function hasByokKey(jobId) {
+    return keys.has(jobId);
+}
+/** Called on every terminal path: done, failed, canceled, superseded. */
+export function dropByokKey(jobId) {
+    keys.delete(jobId);
+}
+/** Test-only hook so a scenario can simulate a server restart without a new
+ * process. Not used in production code. */
+export function clearByokKeysForTest() {
+    keys.clear();
+}
+/** Test-only count of held keys, so a test can prove a failed path left none
+ * behind without reading any key value. */
+export function byokKeyCountForTest() {
+    return keys.size;
+}

package/dist/src/remote/server/guides.js

@@ -1,5 +1,5 @@
 /** `GET /api/remote/guides?repo=owner/repo` — read a repository's guides with a
- * remote token (CORE-44).
+ * remote token.
  *
  * This is what `view --remote` calls. It is a read-only addition: no existing
  * route changes, and it uses the same bearer model the review endpoints use
@@ -11,7 +11,7 @@ import { reposDir } from "../../config.js";
 import { loadGuides } from "../../review/guides.js";
 import { readDir, readTextFile, stat } from "../../util/runtime.js";
 import { validateRemotePath } from "../validate.js";
-/** The four generated guides, in the order a reader wants them (CORE-23). */
+/** The four generated guides, in the order a reader wants them. */
 const GUIDES = [
     { kind: "skill", file: "SKILL.md" },
     { kind: "codebase", file: "CODEBASE.md" },

package/dist/src/remote/server/routes.js

@@ -1,5 +1,5 @@
 import { VERSION } from "../../version.js";
-import { cloneDir, readConfig } from "../../config.js";
+import { cloneDir, readConfig, remoteByokPolicy } from "../../config.js";
 import { resolveDefaultBranchName } from "../../git/default_branch.js";
 import { runCommand } from "../../pr/checkout.js";
 import { loadGuides } from "../../review/guides.js";
@@ -77,6 +77,7 @@ async function handleHandshake(request, ip) {
     const config = readConfig();
     const timeoutSeconds = config.remoteSyncTimeoutSeconds ?? 10;
     const toolLimit = config.remoteToolOutputMaxChars ?? null;
+    const policy = remoteByokPolicy(config);
     return Response.json({
         schemaVersion: REMOTE_SCHEMA_VERSION,
         minClientSchema: MIN_CLIENT_SCHEMA,
@@ -95,6 +96,12 @@ async function handleHandshake(request, ip) {
             maxBodyBytes: REMOTE_MAX_BODY_BYTES,
             toolOutputMaxChars: toolLimit,
         },
+        // Additive advertisement: a 0.5.0 client ignores these, and an
+        // older server never sends them, so the client gates on `features`. No key,
+        // model, or other secret is ever echoed here.
+        features: ["byok"],
+        byok: { policy },
+        ai: { provider: config.ai ?? "openrouter" },
     });
 }
 async function handleSync(request, ip, jobId) {

package/dist/src/remote/validate.js

@@ -171,6 +171,20 @@ export function validateSubmitRequest(body) {
     if (body.fresh !== undefined && typeof body.fresh !== "boolean") {
         return bad("fresh", "must be a boolean");
     }
+    if (body.byok !== undefined) {
+        if (!isRecord(body.byok)) {
+            return bad("byok", "must be an object");
+        }
+        if (typeof body.byok.key !== "string" || !body.byok.key) {
+            return bad("byok.key", "must be a non-empty string");
+        }
+        if (body.byok.key.length > 500) {
+            return bad("byok.key", "too long");
+        }
+        if (/[\0\r\n]/.test(body.byok.key)) {
+            return bad("byok.key", "invalid characters");
+        }
+    }
     const revisionErr = validateRevisionPayload(body.revision);
     if (revisionErr)
         return revisionErr;
@@ -190,7 +204,7 @@ export function validateSubmitRequest(body) {
                 if (typeof tool.name !== "string" || !tool.name) {
                     return bad(`capabilities.tools[${i}].name`, "required");
                 }
-                // Unknown tools are ignored at runtime; no error here (plan §14.5).
+                // Unknown tools are ignored at runtime; no error here.
                 if (REMOTE_KNOWN_TOOL_NAMES.has(tool.name) &&
                     tool.version !== undefined &&
                     typeof tool.version !== "string") {

package/dist/src/review/blocking.d.ts

@@ -1,6 +1,6 @@
-/** How a review decides a blocking finding (CORE-41, plan decision 2 option C).
+/** How a review decides a blocking finding.
  *
- * F19: the same pull request was reviewed twice, the same P2 finding came back
+ * The same pull request was reviewed twice, the same P2 finding came back
  * `non-blocking` the first time and `blocking` the second, and the exit code
  * changed because the model's own label moved. `model` keeps that behavior
  * (the model decides) because it is what 0.4.13 shipped; `severity` ignores

package/dist/src/review/blocking.js

@@ -1,6 +1,6 @@
-/** How a review decides a blocking finding (CORE-41, plan decision 2 option C).
+/** How a review decides a blocking finding.
  *
- * F19: the same pull request was reviewed twice, the same P2 finding came back
+ * The same pull request was reviewed twice, the same P2 finding came back
  * `non-blocking` the first time and `blocking` the second, and the exit code
  * changed because the model's own label moved. `model` keeps that behavior
  * (the model decides) because it is what 0.4.13 shipped; `severity` ignores

package/dist/src/review/carry_over.d.ts

@@ -45,13 +45,13 @@ export declare function relocate(anchorText: string | null, oldFrom: number, pat
     from: number;
     to: number;
 } | null;
-/** CORE-42 / F03: a guide rebuilt after the previous review invalidates that
+/** A guide rebuilt after the previous review invalidates that
  * review's verdicts, its "unchanged" suppression and its open findings — they
  * were all judged against the old rules. Such a run starts fresh instead:
  * every file is scanned again and old findings are no longer carried over.
  *
  * `previousBuiltAt` is the guide's own build time as of that review. A
- * previous review that never recorded one (a snapshot written before CORE-42)
+ * previous review that never recorded one (a snapshot written by an older version)
  * counts as rebuilt too: re-scanning once is cheaper than letting a stale
  * verdict mask a new violation. With no current time there is nothing to
  * compare, so nothing is treated as rebuilt. */

package/dist/src/review/carry_over.js

@@ -70,13 +70,13 @@ export function relocate(anchorText, oldFrom, patch) {
 function guideChanged(previous, currentGuideBuiltAt) {
     return (previous.guideBuiltAt ?? "") !== (currentGuideBuiltAt ?? "");
 }
-/** CORE-42 / F03: a guide rebuilt after the previous review invalidates that
+/** A guide rebuilt after the previous review invalidates that
  * review's verdicts, its "unchanged" suppression and its open findings — they
  * were all judged against the old rules. Such a run starts fresh instead:
  * every file is scanned again and old findings are no longer carried over.
  *
  * `previousBuiltAt` is the guide's own build time as of that review. A
- * previous review that never recorded one (a snapshot written before CORE-42)
+ * previous review that never recorded one (a snapshot written by an older version)
  * counts as rebuilt too: re-scanning once is cheaper than letting a stale
  * verdict mask a new violation. With no current time there is nothing to
  * compare, so nothing is treated as rebuilt. */

package/dist/src/review/guides.js

@@ -55,7 +55,7 @@ export async function loadGuides(repo) {
         }
         // With no `repos` row, the files are the only evidence of when the guide
         // was built. Without this a local review always says `guide unknown` and
-        // can never notice that a rebuild made its carry-over stale (CORE-42).
+        // can never notice that a rebuild made its carry-over stale.
         guideBuiltAt ??= await guideFilesBuiltAt(repo);
         return {
             shortGuide,

package/dist/src/server/api/remote_tokens.js

@@ -3,6 +3,7 @@ import { errorResponse } from "../errors.js";
 import { createRemoteToken, deleteRemoteToken, listRemoteTokens, setRemoteTokenActive, } from "../../services/remote_tokens.js";
 import { cancelRemoteJobsForToken } from "../../services/remote_token_jobs.js";
 import { remoteTokenUsageSince } from "../../store/reviews.js";
+import { formatCostTotal } from "../pages/cost.js";
 import { getRemoteToken } from "../../store/remote_tokens.js";
 import { daysAgoIso } from "../../util/time.js";
 export async function handleRemoteTokensRoute(request, url) {
@@ -18,6 +19,7 @@ export async function handleRemoteTokensRoute(request, url) {
                 lastUsedAt: row.last_used_at,
                 reviews30d: usage.reviews,
                 cost30d: usage.cost,
+                cost30dLabel: formatCostTotal(usage),
             };
         });
         return Response.json(items);

package/dist/src/server/api/repos.js

@@ -3,6 +3,7 @@ import { AppClient, findInstallationForRepo } from "../../github/app.js";
 import { activateRepo, deactivateRepo, getRepo, listActiveRepos, updateRepoSettings, } from "../../store/repos.js";
 import { readConfig, writeRepoConfig } from "../../config.js";
 import { parseRemakeCron } from "../../services/remake_cron.js";
+import { parsePolicy, policyToStore, describePolicy, } from "../../services/review_policy.js";
 import { enqueueSetup } from "../../services/setup.js";
 import { enqueueManualReview } from "../../services/review.js";
 import { probePlan, recommendationPatch } from "../../services/probe.js";
@@ -14,6 +15,22 @@ export async function handleReposRoute(request, url, githubApp) {
     if (url.pathname === "/api/repos" && request.method === "GET") {
         return Response.json({ items: listActiveRepos() });
     }
+    // The plain sentences shown under the policy editor before it is saved, so
+    // the wording lives in one place and the page never rebuilds it.
+    if (url.pathname === "/api/repos/policy-preview" &&
+        request.method === "POST") {
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return errorResponse(400, "bad_request", "expected a JSON body");
+        }
+        const parsed = parsePolicy(body.policy);
+        if (!parsed.ok)
+            return errorResponse(422, "invalid_policy", parsed.problem);
+        return Response.json({ summary: describePolicy(parsed.value) });
+    }
     if (url.pathname === "/api/repos/preview" && request.method === "POST") {
         if (!githubApp) {
             return errorResponse(422, "no_github_app", "Configure the GitHub App in Settings to preview a repository.");
@@ -109,6 +126,15 @@ export async function handleReposRoute(request, url, githubApp) {
                 return errorResponse(422, "app_access_denied", `The GitHub App cannot access ${repo}.`);
             }
         }
+        // Checked before anything is written, so a bad policy leaves no half
+        // added repository behind.
+        let policyToKeep;
+        if ("reviewPolicy" in body) {
+            const stored = policyToStore(body.reviewPolicy, { allowLegacy: false });
+            if (!stored.ok)
+                return errorResponse(422, "invalid_policy", stored.problem);
+            policyToKeep = stored.value;
+        }
         // `patch` is the confirmed preview. It is optional so a caller that
         // never opened the preview keeps the old behavior; when present it is
         // written before `activateRepo` so the enqueued init reads it.
@@ -119,6 +145,9 @@ export async function handleReposRoute(request, url, githubApp) {
             await writeRepoConfig(repo, patch);
         }
         activateRepo(repo, installationId);
+        if (policyToKeep !== undefined) {
+            updateRepoSettings(repo, { review_policy_json: policyToKeep });
+        }
         try {
             const { id } = enqueueSetup(repo, "init");
             return Response.json({ jobId: id });
@@ -168,6 +197,13 @@ export async function handleReposRoute(request, url, githubApp) {
                 }
             }
             const patch = {};
+            if ("reviewPolicy" in body) {
+                const stored = policyToStore(body.reviewPolicy, { allowLegacy: true });
+                if (!stored.ok) {
+                    return errorResponse(422, "invalid_policy", stored.problem);
+                }
+                patch.review_policy_json = stored.value;
+            }
             if (typeof body.autoReview === "boolean") {
                 patch.auto_review = body.autoReview ? 1 : 0;
             }
@@ -177,6 +213,21 @@ export async function handleReposRoute(request, url, githubApp) {
             if (typeof body.skipBots === "boolean") {
                 patch.skip_bots = body.skipBots ? 1 : 0;
             }
+            // The three switches only mean something under the legacy policy. A
+            // repository on a real policy refuses them instead of silently ignoring
+            // the change, and one on the server default is pinned to the switches
+            // the moment someone uses them.
+            if (patch.auto_review !== undefined ||
+                patch.skip_drafts !== undefined ||
+                patch.skip_bots !== undefined) {
+                const stored = patch.review_policy_json !== undefined
+                    ? patch.review_policy_json
+                    : (getRepo(fullName)?.review_policy_json ?? null);
+                if (stored !== null && stored !== '"legacy"') {
+                    return errorResponse(409, "policy_in_use", "This repository uses a review policy, so the auto review, drafts and bots switches do not apply. Change the policy instead.");
+                }
+                patch.review_policy_json = '"legacy"';
+            }
             if (typeof body.useCodegraph === "boolean") {
                 patch.use_codegraph = body.useCodegraph ? 1 : 0;
             }

package/dist/src/server/api/settings.js

@@ -4,6 +4,7 @@ import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
 import { checkPassword, readSessionToken, revokeOtherSessions, } from "../auth.js";
 import { passwordProblem } from "../../util/password.js";
 import { readJsonObject } from "./json_body.js";
+import { policyToStore } from "../../services/review_policy.js";
 function validateWebhookUrl(value) {
     if (typeof value !== "string" || !value.trim()) {
         return "webhook URL is required";
@@ -64,6 +65,7 @@ export async function handleSettingsRoute(request, url, webhookUrl, passwords, i
             remoteSyncTimeoutSeconds: config.remoteSyncTimeoutSeconds ?? null,
             maxConcurrentRemoteReviewsPerToken: config.maxConcurrentRemoteReviewsPerToken ?? null,
             remoteToolOutputMaxChars: config.remoteToolOutputMaxChars ?? null,
+            reviewPolicy: config.reviewPolicy ?? null,
         });
     }
     if (url.pathname === "/api/settings" && request.method === "PUT") {
@@ -144,6 +146,14 @@ export async function handleSettingsRoute(request, url, webhookUrl, passwords, i
         const remoteToolOut = positiveIntOrNull("remoteToolOutputMaxChars", "remoteToolOutputMaxChars");
         if (remoteToolOut)
             return remoteToolOut;
+        if ("reviewPolicy" in body) {
+            const stored = policyToStore(body.reviewPolicy, { allowLegacy: false });
+            if (!stored.ok) {
+                return errorResponse(422, "invalid_policy", stored.problem);
+            }
+            patch.reviewPolicy =
+                stored.value === null ? undefined : JSON.parse(stored.value);
+        }
         if (body.defaults && typeof body.defaults === "object") {
             const defaults = body.defaults;
             const next = { ...current.defaults };

package/dist/src/server/errors.d.ts

@@ -1,4 +1,4 @@
-/** The one error shape every `/api/*` response uses — see PLAN.md Section 7. */
+/** The one error shape every `/api/*` response uses. */
 export type ApiError = {
     code: string;
     message: string;

package/dist/src/server/http.js

@@ -1,4 +1,4 @@
-/** A manual `node:http` ↔ `fetch` bridge (plan §2 HTTP).
+/** A manual `node:http` ↔ `fetch` bridge.
  *
  * The app is written against the Web `Request`/`Response` types, which Deno
  * served natively. Node has both types but no server that speaks them

package/dist/src/server/pages/activity.d.ts

@@ -1,5 +1,7 @@
 import type { activityFeed, runningJobs, skippedDeliveries } from "../../services/dashboard.ts";
 import type { JobLogRow, JobRow } from "../../store/rows.ts";
+/** True for the skips a policy left waiting on a maintainer's request. */
+export declare function isWaitingForRequest(reason: string | null): boolean;
 export declare function jobLabel(job: JobRow): string;
 export declare function renderActivity(username: string, running: ReturnType<typeof runningJobs>, feed: ReturnType<typeof activityFeed>, skipped: ReturnType<typeof skippedDeliveries>): Response;
 export declare function renderJob(username: string, job: JobRow, logs: JobLogRow[]): Response;

package/dist/src/server/pages/activity.js

@@ -1,5 +1,10 @@
-import { empty, html, layout, money, skSlot, text, when } from "./layout.js";
+import { empty, html, layout, skSlot, text, when } from "./layout.js";
+import { formatCost } from "./cost.js";
 import { getLogsSince } from "../../services/jobs.js";
+/** True for the skips a policy left waiting on a maintainer's request. */
+export function isWaitingForRequest(reason) {
+    return Boolean(reason?.endsWith("waiting for a maintainer request."));
+}
 function skipReason(reason) {
     switch (reason) {
         case "draft":
@@ -103,7 +108,7 @@ export function renderActivity(username, running, feed, skipped) {
           <td><a href="/repos/${text(review.repo)}/pulls/${review.pr_number}">${text(review.repo)} #${review.pr_number}</a></td>
           <td class="muted">${when(review.created_at)}</td>
           <td>${result}</td>
-          <td class="num">${money(Number(review.cost ?? 0))}</td></tr>`;
+          <td class="num">${formatCost(review)}</td></tr>`;
         }
         const job = item.job;
         return `<tr><td><a href="/activity/${text(job.id)}">${text(jobLabel(job))}</a></td>
@@ -128,9 +133,18 @@ export function renderActivity(username, running, feed, skipped) {
             : `<button class="btn sm" disabled>Next</button>`}</div>`;
     const skippedRows = skipped
         .slice(0, 20)
-        .map((row) => `<tr><td>${text(row.repo ?? "")}${row.pr_number ? ` #${row.pr_number}` : ""}</td>
+        .map((row) => {
+        const label = `${row.repo ?? ""}${row.pr_number ? ` #${row.pr_number}` : ""}`;
+        // A pull request waiting for a request is one click from a review, and
+        // the person on the dashboard is already allowed to ask.
+        const action = row.repo && row.pr_number && isWaitingForRequest(row.reason)
+            ? `<button class="btn sm" type="button" data-post="/api/repos/${text(row.repo)}/pulls/${row.pr_number}/review" aria-label="Review ${text(label)} now">Review now</button>`
+            : "";
+        return `<tr><td>${text(label)}</td>
         <td class="muted">${text(skipReason(row.reason))}</td>
-        <td class="muted" style="width:120px">${when(row.received_at)}</td></tr>`)
+        <td class="muted" style="width:120px">${when(row.received_at)}</td>
+        <td style="width:110px;text-align:right">${action}</td></tr>`;
+    })
         .join("");
     return html(layout({
         title: "Activity · co-maintainer",

package/dist/src/server/pages/add_repo.js

@@ -1,4 +1,6 @@
 import { html, layout, skSlot, text } from "./layout.js";
+import { readConfig } from "../../config.js";
+import { TEMPLATE_INFO } from "../../services/review_policy.js";
 export function renderAddRepo(username, picker) {
     const notice = picker.error
         ? `<div class="notice bad"><div class="txt">${text(picker.error)}</div></div>`
@@ -15,6 +17,27 @@ export function renderAddRepo(username, picker) {
         .join("")}</optgroup>`)
         .join("");
     const canAdd = picker.repos.some((repo) => !repo.alreadyActive);
+    // What a repository added now would follow if nobody chooses: the server
+    // default when there is one, otherwise the simple switches, which behave
+    // exactly like "everyone".
+    const serverDefault = readConfig().reviewPolicy;
+    const choices = [
+        ...TEMPLATE_INFO,
+        ...(typeof serverDefault === "object"
+            ? [
+                {
+                    name: "__server",
+                    label: "Server default (custom rules)",
+                    description: "The custom rules set for the whole server.",
+                },
+            ]
+            : []),
+    ];
+    const initial = typeof serverDefault === "string"
+        ? serverDefault
+        : typeof serverDefault === "object"
+            ? "__server"
+            : "everyone";
     const select = `<select id="repo"${canAdd ? "" : " disabled"}>
           <option value="">Choose a repository</option>
           ${options}
@@ -44,6 +67,7 @@ export function renderAddRepo(username, picker) {
 </div>
 <script>
 var plan = null;
+var POLICY = ${JSON.stringify({ choices, initial }).replace(/</g, "\\u003c")};
 function showPlan(data) {
   plan = data;
   var box = document.getElementById("plan");
@@ -84,6 +108,37 @@ function showPlan(data) {
     });
     box.appendChild(ul);
   }
+  var choose = document.createElement("fieldset");
+  choose.style.cssText = "border:0;padding:0;margin:14px 0 0";
+  var legend = document.createElement("legend");
+  legend.className = "muted";
+  legend.style.padding = "0";
+  legend.textContent = "Who gets a review";
+  choose.appendChild(legend);
+  POLICY.choices.forEach(function(item) {
+    var id = "policy-" + item.name;
+    var radio = document.createElement("input");
+    radio.type = "radio";
+    radio.name = "policy";
+    radio.id = id;
+    radio.value = item.name;
+    radio.checked = item.name === POLICY.initial;
+    var label = document.createElement("label");
+    label.setAttribute("for", id);
+    label.style.cssText = "display:flex;align-items:flex-start;gap:8px;margin:6px 0";
+    var body = document.createElement("span");
+    var title = document.createElement("b");
+    title.textContent = item.label;
+    var desc = document.createElement("span");
+    desc.className = "muted";
+    desc.textContent = " " + item.description;
+    body.appendChild(title);
+    body.appendChild(desc);
+    label.appendChild(radio);
+    label.appendChild(body);
+    choose.appendChild(label);
+  });
+  box.appendChild(choose);
   var row = document.createElement("div");
   row.style.display = "flex";
   row.style.gap = "8px";
@@ -107,7 +162,12 @@ function showPlan(data) {
   confirm.addEventListener("click", function() {
     var repo = document.getElementById("repo").value.trim();
     if (!repo || !plan) return;
-    postAndGo("/api/repos", { repo: repo, patch: plan.patch }, "/activity", confirm);
+    var picked = document.querySelector('input[name="policy"]:checked');
+    var body = { repo: repo, patch: plan.patch };
+    // The server default is followed, not copied, so it is only sent when
+    // this repository is meant to differ from it.
+    if (picked && picked.value !== POLICY.initial) body.reviewPolicy = picked.value;
+    postAndGo("/api/repos", body, "/activity", confirm);
   });
 }
 document.getElementById("preview").addEventListener("click", function() {