co-maintainer 0.5.1-beta.2 → 0.5.1-beta.3

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "co-maintainer",
-    "version": "0.5.1-beta.2",
+    "version": "0.5.1-beta.3",
     "description": "An imitator of yours, A PR review tool like co-maintainer.",
     "keywords": [
         "ai",

package/dist/src/ai/provider.d.ts

@@ -3,9 +3,7 @@ import type { AiProvider, AiRequest, AiResponse, Json, Options } from "../types.
  * added or removed in a single place instead of the half dozen copies
  * Hetzner's removal had to chase down. */
 export declare const AI_PROVIDERS: readonly ["none", "openrouter", "openai", "anthropic", "opencode-zen", "opencode-go"];
-/** The provider's own key variable. It is read only when that provider runs,
- * so a key meant for one provider is never sent to another. */
-export declare function providerKeyEnv(ai: string, env: (name: string) => string | undefined): string | undefined;
+export { providerKeyEnv } from "../config.ts";
 /** Hetzner was dropped in 0.5.1. Naming it beats a generic "must be one of". */
 export declare function rejectRetiredProvider(value: string | undefined): void;
 export declare function createAiProvider(options: Options, model: string): AiProvider | undefined;

package/dist/src/ai/provider.js

@@ -14,16 +14,7 @@ export const AI_PROVIDERS = [
     "opencode-zen",
     "opencode-go",
 ];
-/** The provider's own key variable. It is read only when that provider runs,
- * so a key meant for one provider is never sent to another. */
-export function providerKeyEnv(ai, env) {
-    if (ai === "openrouter")
-        return env("OPENROUTER_API_KEY");
-    if (ai === "opencode-zen" || ai === "opencode-go") {
-        return env("OPENCODE_API_KEY");
-    }
-    return undefined;
-}
+export { providerKeyEnv } from "../config.js";
 /** Hetzner was dropped in 0.5.1. Naming it beats a generic "must be one of". */
 export function rejectRetiredProvider(value) {
     if (value === "hetzner") {

package/dist/src/config.d.ts

@@ -97,6 +97,16 @@ export type ByokPolicy = "off" | "allow" | "require";
  * overrides the saved config, so a hosted server cannot be talked out of its
  * policy by a config edit. An unset or unreadable value falls back to the
  * config, then to `off`. */
+/** The provider's own key variable. It is read only when that provider runs,
+ * so a key meant for one provider is never sent to another. */
+export declare function providerKeyEnv(ai: string, env?: (name: string) => string | undefined): string | undefined;
+/** The AI key `serve` uses for its jobs and its setup checks, in the order the
+ * CLI resolves it: `CO_MAINTAINER_TOKEN`, then the provider's own variable,
+ * then the saved key. Without this a server started with the key in its
+ * environment reported AI as not configured and failed every job. */
+export declare function resolvedAiToken(config: Pick<UserConfig, "ai" | "token">, ai?: string | undefined): string | undefined;
+/** True when a provider is chosen and a key reaches it from anywhere. */
+export declare function aiConfigured(config: Pick<UserConfig, "ai" | "token">): boolean;
 export declare function remoteByokPolicy(config?: Pick<UserConfig, "remoteByokPolicy">): ByokPolicy;
 /** Platform/env injection keeps the OS branches testable: the
  * migration's `"windows"` vs `"win32"` trap is invisible otherwise. */

package/dist/src/config.js

@@ -3,6 +3,29 @@ import { chmod, currentPlatform, getEnv, isNotFound, mkdir, readTextFileSync, se
  * overrides the saved config, so a hosted server cannot be talked out of its
  * policy by a config edit. An unset or unreadable value falls back to the
  * config, then to `off`. */
+/** The provider's own key variable. It is read only when that provider runs,
+ * so a key meant for one provider is never sent to another. */
+export function providerKeyEnv(ai, env = getEnv) {
+    if (ai === "openrouter")
+        return env("OPENROUTER_API_KEY");
+    if (ai === "opencode-zen" || ai === "opencode-go") {
+        return env("OPENCODE_API_KEY");
+    }
+    return undefined;
+}
+/** The AI key `serve` uses for its jobs and its setup checks, in the order the
+ * CLI resolves it: `CO_MAINTAINER_TOKEN`, then the provider's own variable,
+ * then the saved key. Without this a server started with the key in its
+ * environment reported AI as not configured and failed every job. */
+export function resolvedAiToken(config, ai = config.ai) {
+    return (getEnv("CO_MAINTAINER_TOKEN") ??
+        (ai ? providerKeyEnv(ai) : undefined) ??
+        config.token);
+}
+/** True when a provider is chosen and a key reaches it from anywhere. */
+export function aiConfigured(config) {
+    return Boolean(config.ai && config.ai !== "none" && resolvedAiToken(config));
+}
 export function remoteByokPolicy(config = readConfig()) {
     // An env value that is not one of the three known policies is treated as
     // unreadable and falls back to the config, so a typo cannot silently turn a

package/dist/src/server/api/settings.js

@@ -1,5 +1,6 @@
 import { errorResponse } from "../errors.js";
 import { readConfig, resolveAppPrivateKey, writeUserConfig, } from "../../config.js";
+import { aiConfigured } from "../../config.js";
 import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
 import { checkPassword, readSessionToken, revokeOtherSessions, } from "../auth.js";
 import { passwordProblem } from "../../util/password.js";
@@ -231,7 +232,7 @@ export async function handleSettingsRoute(request, url, webhookUrl, passwords, i
             privateKeyPem: resolveAppPrivateKey(config) ?? "",
         });
         return Response.json({
-            ai: { ok: Boolean(config.ai && config.ai !== "none" && config.token) },
+            ai: { ok: aiConfigured(config) },
             github: github.ok
                 ? { ok: true, login: github.login }
                 : { ok: false, message: github.message },

package/dist/src/server/app.js

@@ -5,7 +5,7 @@ import { errorResponse } from "./errors.js";
 import { hasCsrfHeader, login, logout, readSessionToken, sessionCookieHeader, verifySession, } from "./auth.js";
 import { memoryPasswordStore } from "./auth.js";
 import { clientAddress, forwardedHttps } from "./proxy_headers.js";
-import { readConfig, resolveAppPrivateKey } from "../config.js";
+import { aiConfigured, readConfig, resolveAppPrivateKey } from "../config.js";
 import { listJobs } from "../store/jobs.js";
 import { handleJobsRoute } from "./api/jobs.js";
 import { handleReposRoute } from "./api/repos.js";
@@ -19,7 +19,7 @@ import { handleWebhookRequest } from "./webhook/index.js";
 import { handlePageRequest } from "./pages/router.js";
 function setupStatus() {
     const config = readConfig();
-    const ai = Boolean(config.ai && config.ai !== "none" && config.token);
+    const ai = aiConfigured(config);
     const github = Boolean(config.auth === "gh" || (config.auth === "pat" && config.githubPat));
     const app = Boolean(config.githubAppId && resolveAppPrivateKey(config));
     const missing = [

package/dist/src/server/pages/router.js

@@ -5,6 +5,7 @@ import { activityFeed, listReposForHome, prDetail, repoKnowledge, RepoNotFound,
 import { escapeHtml, html } from "./layout.js";
 import { formatCostTotal } from "./cost.js";
 import { readConfig, resolveAppPrivateKey, writeUserConfig, } from "../../config.js";
+import { aiConfigured } from "../../config.js";
 import { appNameProblem, beginManifestState, buildAppManifest, consumeManifestState, convertManifest, } from "../../github/app_manifest.js";
 import { renderHome, renderLogin } from "./home.js";
 import { renderSetup } from "./setup.js";
@@ -113,7 +114,7 @@ export async function handlePageRequest(request, deps, ip) {
         if (url.pathname === "/setup" && request.method === "GET") {
             const config = readConfig();
             return renderSetup(username, {
-                ai: Boolean(config.ai && config.ai !== "none" && config.token),
+                ai: aiConfigured(config),
                 github: Boolean(config.auth === "gh" || (config.auth === "pat" && config.githubPat)),
                 app: Boolean(config.githubAppId && resolveAppPrivateKey(config)),
             });

package/dist/src/server/pages/settings.js

@@ -1,11 +1,22 @@
 import { html, layout, skSlot, text } from "./layout.js";
-import { resolveAppPrivateKey } from "../../config.js";
+import { aiConfigured, resolveAppPrivateKey, resolvedAiToken, } from "../../config.js";
 import { VERSION } from "../../version.js";
 import { TEMPLATE_INFO } from "../../services/review_policy.js";
 import { defaultAppName, manifestBlockedReason, } from "../../github/app_manifest.js";
 const SOURCE_URL = "https://github.com/GroophyLifefor/co-maintainer";
+/** Which key the jobs will use. The environment wins over the saved key, the
+ * same order `resolvedAiToken` follows, so the hint must check it first. */
+function keyHint(config) {
+    const fromEnv = resolvedAiToken({ ai: config.ai });
+    if (fromEnv && config.token) {
+        return "Using the key from the server's environment, which overrides the saved key";
+    }
+    if (fromEnv)
+        return "Using the key from the server's environment";
+    return config.token ? "A key is saved" : "No key saved";
+}
 export function renderSettings(username, config, webhookUrl, baseUrl) {
-    const aiOk = Boolean(config.ai && config.ai !== "none" && config.token);
+    const aiOk = aiConfigured(config);
     const ghOk = Boolean(config.auth === "gh" || (config.auth === "pat" && config.githubPat));
     const appOk = Boolean(config.githubAppId && resolveAppPrivateKey(config));
     let host = "localhost";
@@ -53,7 +64,7 @@ export function renderSettings(username, config, webhookUrl, baseUrl) {
           </select></div>
         <div class="field"><label>API key</label>
           <input id="token" type="password" placeholder="Leave blank to keep the current key">
-          <div class="hint">${config.token ? "A key is saved" : "No key saved"}</div></div>
+          <div class="hint">${keyHint(config)}</div></div>
         <div class="two" style="max-width:none">
           <div class="field"><label>High model</label>
             <input id="high" value="${text(config.highModel ?? "")}">

package/dist/src/services/jobs.js

@@ -85,7 +85,9 @@ async function runJob(job) {
             ? cancelReason
                 ? { cancel_reason: cancelReason }
                 : {}
-            : { error: String(error) });
+            : // The message only: `String(error)` would show the class name, and
+                // a remote client prints this text to its user as is.
+                { error: message });
         if (status === "failed")
             log(job.id, "error", message);
         log(job.id, "status", status);
@@ -210,7 +212,9 @@ export async function recoverOrphans() {
                 setJobStatus(job.id, outcome === "canceled" ? "canceled" : "done", outcome === "canceled" ? { cancel_reason: "server_restarted" } : {});
             }
             catch (error) {
-                setJobStatus(job.id, "failed", { error: String(error) });
+                setJobStatus(job.id, "failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
             }
         }
         else {

package/dist/src/services/remote_review.js

@@ -8,7 +8,7 @@ import { buildCarryPromptSection, classifyCarryItems, guideRebuiltSince, increme
 import { remoteBridgeToolHandlers } from "../remote/tool_bridge.js";
 import { revisionFromSubmitJson } from "../remote/revision_from_submit.js";
 import { closeRemoteSession, openRemoteSession, setRemoteSyncResult, } from "../remote/server/sessions.js";
-import { readConfig, remoteByokPolicy } from "../config.js";
+import { readConfig, remoteByokPolicy, resolvedAiToken } from "../config.js";
 import { dropByokKey, getByokKey, hasByokKey, registerByokKey, } from "../remote/server/byok_keys.js";
 import { reviewBlockingFrom } from "../review/blocking.js";
 import { loadGuides } from "../review/guides.js";
@@ -66,7 +66,7 @@ function reviewOptionsForRepo(repo, useCodegraph, aiToken) {
         auth: config.auth ?? "gh",
         githubPat: config.githubPat,
         ai: config.ai ?? "openrouter",
-        aiToken: aiToken ?? config.token,
+        aiToken: aiToken ?? resolvedAiToken(config, config.ai ?? "openrouter"),
         lowModel: config.lowModel,
         highModel: config.highModel,
         synthesisVersion: 16,

package/dist/src/services/review.js

@@ -14,7 +14,7 @@ import { addResponseCost, costColumns, emptyTally, settle, } from "../util/cost.
 import { loadGuides } from "../review/guides.js";
 import { reviewBlockingFrom, isBlocking, DEFAULT_REVIEW_BLOCKING, } from "../review/blocking.js";
 import { matchRepeat } from "../pr/rounds.js";
-import { readConfig, resolveAppPrivateKey } from "../config.js";
+import { readConfig, resolveAppPrivateKey, resolvedAiToken, } from "../config.js";
 import { outsideCode, redact } from "../util/redact.js";
 import { getRepo, setInstallationId } from "../store/repos.js";
 import { getReviewByJobId, insertReview, latestPostedReview, setReviewScope, setReviewStatus, } from "../store/reviews.js";
@@ -143,7 +143,7 @@ export function reviewOptions(repo, prNumber) {
         // With no provider saved the App review stays on OpenRouter, the same
         // fallback the CLI review uses.
         ai: config.ai && config.ai !== "none" ? config.ai : "openrouter",
-        aiToken: config.token,
+        aiToken: resolvedAiToken(config, config.ai && config.ai !== "none" ? config.ai : "openrouter"),
         highModel: config.highModel,
         lowModel: config.lowModel,
         synthesisVersion: 16,

package/dist/src/services/setup.js

@@ -10,7 +10,7 @@ import { extractFacts } from "../knowledge/facts.js";
 import { buildReviewDocuments, reviewSignalCount } from "../knowledge/guide.js";
 import { assembleSkill, codebaseBody, factSectionHashes, } from "../knowledge/skill.js";
 import { validateSkill } from "../knowledge/validate.js";
-import { readConfig, reposDir, writeRepoConfig } from "../config.js";
+import { readConfig, reposDir, resolvedAiToken, writeRepoConfig, } from "../config.js";
 import { readState, writeState } from "../store/skill_state.js";
 import { cacheSet } from "../store/cache_db.js";
 import { log, timed, withLogSink } from "../util/log.js";
@@ -318,7 +318,8 @@ export function optionsFromConfig(repo, command) {
     const ai = repoConfig.ai ?? config.ai ?? "none";
     const lowModel = repoConfig.lowModel ?? config.lowModel;
     const highModel = repoConfig.highModel ?? config.highModel;
-    if (ai !== "none" && (!config.token || !lowModel || !highModel)) {
+    const aiToken = resolvedAiToken(config, ai);
+    if (ai !== "none" && (!aiToken || !lowModel || !highModel)) {
         throw new Error("AI is enabled but token/low-model/high-model are not fully configured. Run: " +
             "co-maintainer set --token=... --low-model=... --high-model=...");
     }
@@ -333,7 +334,7 @@ export function optionsFromConfig(repo, command) {
         auth,
         githubPat: config.githubPat,
         ai,
-        aiToken: config.token,
+        aiToken,
         lowModel,
         highModel,
         synthesisVersion: 16,

package/dist/src/services/setup_checklist.js

@@ -3,7 +3,7 @@
  * Each item is derived from state that already exists, so the card reflects
  * what serve can actually do rather than a parallel bookkeeping of it. The
  * webhook item reuses the existing reachability check. */
-import { readConfig, resolveAppPrivateKey } from "../config.js";
+import { aiConfigured, readConfig, resolveAppPrivateKey } from "../config.js";
 import { countReviews } from "../store/reviews.js";
 import { listRemoteTokens } from "../store/remote_tokens.js";
 import { listActiveRepos } from "../store/repos.js";
@@ -11,7 +11,7 @@ import { lastDelivery } from "../store/deliveries.js";
 import { webhookReachabilityProblem } from "../util/webhook_reachability.js";
 export function setupChecklist(webhookUrl) {
     const config = readConfig();
-    const aiDone = Boolean(config.ai && config.ai !== "none" && config.token);
+    const aiDone = aiConfigured(config);
     const appDone = Boolean(config.githubAppId && resolveAppPrivateKey(config));
     const repoCount = listActiveRepos().length;
     const reviewCount = countReviews();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "co-maintainer",
-  "version": "0.5.1-beta.2",
+  "version": "0.5.1-beta.3",
   "description": "An imitator of yours, A PR review tool like co-maintainer.",
   "keywords": [
     "ai",