limn-review 0.1.123

package/dist/api/routes/repos.js

@@ -0,0 +1,563 @@
+import { and, eq, inArray } from 'drizzle-orm';
+import { db, schema } from '../../db/client.js';
+import { getGraphqlClientFor, graphqlTolerant } from '../../github/client.js';
+import { getAccessToken } from '../../auth/account.js';
+import { OWNER_TYPE_QUERY, REPO_ID_QUERY, REPO_SEARCH_QUERY, VIEWER_REPOS_QUERY, } from '../../github/queries.js';
+import { upsertRepo } from '../../sync/upsert.js';
+import { enqueueSyncForRepo, getSyncStatus, isSyncQueued, isSyncRunning, listActiveSyncProgress, requestSyncCancel, manualSyncCooldownMs, noteManualSync, waitForSyncToStop, } from '../../sync/sync-manager.js';
+import { deleteRepo, getAddedRepoNodeIds, getRepo, listRepos, resolveWorkspaceScope, } from '../../db/queries.js';
+import { getBranchStatus, getBranchTrends } from '../../db/branch-queries.js';
+import { withPrChangeSignal } from '../../sync/pr-change-signal.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Local copy of the shared MAX_REPOS_PER_ACCOUNT value. `@pierre-review/shared` is
+// a types-only package (not shipped in the published tarball), so the backend must
+// only `import type` from it — runtime constants are duplicated here. Keep in sync.
+const MAX_REPOS_PER_ACCOUNT = 100;
+const createRepoSchema = {
+    body: {
+        type: 'object',
+        required: ['owner', 'name'],
+        additionalProperties: false,
+        properties: {
+            owner: { type: 'string', minLength: 1 },
+            name: { type: 'string', minLength: 1 },
+        },
+    },
+};
+const idParamSchema = {
+    params: {
+        type: 'object',
+        required: ['id'],
+        properties: { id: { type: 'integer' } },
+    },
+};
+const syncSchema = {
+    ...idParamSchema,
+    querystring: {
+        type: 'object',
+        additionalProperties: false,
+        properties: { full: { type: 'boolean', default: false } },
+    },
+};
+const searchSchema = {
+    querystring: {
+        type: 'object',
+        required: ['q'],
+        additionalProperties: false,
+        properties: {
+            q: { type: 'string', minLength: 1, maxLength: 256 },
+            cursor: { type: 'string', minLength: 1 },
+            limit: { type: 'integer', default: 10, minimum: 1, maximum: 25 },
+        },
+    },
+};
+// `repoIds=1,2,3` → [1,2,3]; absent/blank/garbage → null ("no explicit narrowing"). It is fed to
+// `resolveWorkspaceScope` as the `narrow` argument, never used as a scope in its own right.
+function parseIntList(raw) {
+    if (!raw)
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isFinite(n));
+    return ids.length > 0 ? ids : null;
+}
+export async function repoRoutes(app) {
+    // `lastPrChangeAt` rides the listing so the SPA's existing 30s `['repos']` poll learns about a
+    // PR change made OUTSIDE a walk (a webhook, a post-write settle, a backstop re-read) — see
+    // sync/pr-change-signal.ts. In-memory, account-keyed, optional on the wire.
+    app.get('/api/repos', async (req) => {
+        const accountId = accountIdOf(req);
+        return withPrChangeSignal(accountId, await listRepos(accountId));
+    });
+    // Default-branch status ("is trunk green?") for every repo in the active WORKSPACE: the head
+    // snapshot plus the recent trunk commits with their own CI state. A pure DB read off what the
+    // branch sync already persisted — never a live GitHub call, hence the plain `read` rate-limit
+    // tier. Informational only: nothing here feeds attention counts, My Turn, or any badge.
+    //
+    // `?workspace=<id>` is the scope; `?repoIds=` only narrows within it. It carried repo ids alone
+    // while `null` meant "every repo of the account", which under a workspace scope meant an EMPTY
+    // workspace (no ids on the wire) rendered the whole account's trunk strip, and two workspaces
+    // sending no ids shared one client cache slot.
+    //
+    // ⚠ THE EMPTY CASE IS HANDLED HERE, NOT IN THE GETTER. `getBranchStatus` reads `[]` as "every
+    // repo the account owns" — the same widening this route exists to close — so an empty workspace
+    // must short-circuit before the call. That getter lives in db/branch-queries.ts and is not this
+    // unit's to change; the guard is the route's until it is.
+    app.get('/api/branch-status', async (req) => {
+        const q = req.query;
+        const accountId = accountIdOf(req);
+        const scope = await resolveWorkspaceScope(accountId, q.workspace, parseIntList(q.repoIds));
+        if (scope.repoIds.length === 0)
+            return { repos: [] };
+        return getBranchStatus(accountId, scope.repoIds);
+    });
+    // The lazy per-day trend series behind an expanded default-branch row (failing trunk commits
+    // + PRs merged into the default branch, one shared axis). Fetched only on expand, so it takes
+    // ONE repo — never the workspace scope — and, unlike /api/branch-status, the id-addressed
+    // getter enforces ownership (→ 404). A pure DB read: default `read` tier.
+    app.get('/api/branch-trends', {
+        schema: {
+            querystring: {
+                type: 'object',
+                required: ['repoId'],
+                additionalProperties: false,
+                properties: { repoId: { type: 'integer' } },
+            },
+        },
+    }, async (req, reply) => {
+        const { repoId } = req.query;
+        const trends = await getBranchTrends(accountIdOf(req), repoId);
+        if (trends == null) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${repoId} not found` };
+        }
+        return trends;
+    });
+    // Live GitHub repository search for the Add-repo picker. Best-match ordering
+    // (GitHub default), repos already added to this account filtered out, owned/member repos
+    // floated to the top. Detail comes straight from GitHub — nothing persisted.
+    app.get('/api/repos/search', { schema: searchSchema }, async (req, reply) => {
+        const { q, cursor, limit } = req.query;
+        const term = q.trim();
+        if (!term) {
+            reply.status(400);
+            return { error: 'BadRequest', message: 'Search query must not be empty' };
+        }
+        const accountId = accountIdOf(req);
+        // Translate the user term into a literal GitHub search query. An `owner/...`
+        // prefix scopes results to that owner (org:/user: qualifier — resolved by type);
+        // the remainder (or the whole term) is matched against the repo NAME only
+        // (`in:name`), and `needle` drives the literal re-rank below.
+        const client = getGraphqlClientFor(await getAccessToken(accountId));
+        const slash = term.indexOf('/');
+        const owner = slash >= 0 ? term.slice(0, slash).trim() : '';
+        const rest = slash >= 0 ? term.slice(slash + 1).trim() : term;
+        let searchQuery;
+        let needle;
+        if (owner) {
+            // `owner/...` → scope to that owner. Note a stray leading slash ("/foo") leaves
+            // owner empty and falls through to the plain branch (no malformed `user:` query).
+            needle = rest;
+            let qualifier = `user:${owner}`;
+            try {
+                const ownerResp = await client(OWNER_TYPE_QUERY, {
+                    login: owner,
+                });
+                const kind = ownerResp.repositoryOwner?.__typename ?? null;
+                if (kind == null) {
+                    // Owner login doesn't exist → no possible matches.
+                    return { results: [], hasNextPage: false, cursor: null };
+                }
+                qualifier = kind === 'Organization' ? `org:${owner}` : `user:${owner}`;
+            }
+            catch (err) {
+                // Lookup failed (network / rate limit) — default to user: scoping and run the
+                // search anyway. Logged so a wrong-scope result is diagnosable.
+                req.log.warn({ err, owner }, 'repo search: owner-type lookup failed; defaulting to user: scope');
+            }
+            searchQuery = rest ? `${qualifier} ${rest} in:name` : qualifier;
+        }
+        else {
+            // Plain term (or a stray leading slash) → literal repo-name search.
+            needle = rest;
+            searchQuery = rest ? `${rest} in:name` : term;
+        }
+        let resp;
+        try {
+            // NB: the GraphQL variable is `searchQuery`, not `query` — @octokit/graphql
+            // reserves `query` for the document body and rejects it as a variable name.
+            resp = await client(REPO_SEARCH_QUERY, {
+                searchQuery,
+                first: limit,
+                cursor: cursor ?? null,
+            });
+        }
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : 'GitHub search failed',
+            };
+        }
+        const added = await getAddedRepoNodeIds(accountId);
+        const me = resp.viewer.login.toLowerCase();
+        const orgLogins = new Set(resp.viewer.organizations.nodes
+            .filter((o) => o != null)
+            .map((o) => o.login.toLowerCase()));
+        const results = resp.search.nodes
+            // GitHub returns a NULL node for any hit the token can't fully resolve (a scoped
+            // GitHub-App token in cloud hits this; the local `gh` PAT sees them all), and {} for
+            // a (theoretical) non-repo node. Drop both null-safely BEFORE reading `id`/`owner`,
+            // then drop the ones already added. (This null node is the cloud-only crash source.)
+            .filter((n) => n != null && typeof n.id === 'string')
+            .filter((n) => !added.has(n.id))
+            .map((n) => {
+            const ownerLogin = n.owner.login;
+            return {
+                githubNodeId: n.id,
+                owner: ownerLogin,
+                name: n.name,
+                fullName: n.nameWithOwner,
+                description: n.description,
+                ownerAvatarUrl: n.owner.avatarUrl,
+                stargazerCount: n.stargazerCount,
+                openPrCount: n.pullRequests.totalCount,
+                url: n.url,
+                isPrivate: n.isPrivate,
+                isOwnedOrMember: ownerLogin.toLowerCase() === me ||
+                    orgLogins.has(ownerLogin.toLowerCase()),
+            };
+        });
+        // Re-rank for literal matching: closest name match first (exact < prefix <
+        // substring < other), then your own/org repos, then stars. Array.prototype.sort
+        // is stable (Node ≥ 12), so GitHub's best-match order breaks remaining ties.
+        const lc = needle.toLowerCase();
+        const nameTier = (name) => {
+            if (!lc)
+                return 0;
+            const n = name.toLowerCase();
+            if (n === lc)
+                return 0;
+            if (n.startsWith(lc))
+                return 1;
+            if (n.includes(lc))
+                return 2;
+            return 3;
+        };
+        results.sort((a, b) => {
+            const t = nameTier(a.name) - nameTier(b.name);
+            if (t !== 0)
+                return t;
+            const own = Number(b.isOwnedOrMember) - Number(a.isOwnedOrMember);
+            if (own !== 0)
+                return own;
+            return b.stargazerCount - a.stargazerCount;
+        });
+        const body = {
+            results,
+            hasNextPage: resp.search.pageInfo.hasNextPage,
+            cursor: resp.search.pageInfo.endCursor,
+        };
+        return body;
+    });
+    // First-run onboarding: the viewer's recently-active repositories, detected from their
+    // GitHub activity (recent pushes + contributions). Same token idiom as /search; repos
+    // already added filtered out; mapped to the picker's RepoSearchResult shape and ordered
+    // most-recently-pushed first, capped at 30. Detail comes straight from GitHub — nothing
+    // persisted. Local's broad `gh` token surfaces private + org repos; a scoped cloud token
+    // surfaces only what it can read (both are handled by the same null-tolerant merge below).
+    app.get('/api/repos/suggested', async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const client = getGraphqlClientFor(await getAccessToken(accountId));
+        let resp;
+        try {
+            // Tolerate PARTIAL GraphQL errors (a scoped cloud token forbidden one sub-field answers
+            // 200 + partial data) — the null-drop merge below is built for exactly that. Only a
+            // response with NO usable data (auth failure, rate limit, network) 502s.
+            resp = await graphqlTolerant(client, VIEWER_REPOS_QUERY, {}, (errors) => req.log.warn({ errors }, 'partial viewer-repos response'));
+        }
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : 'GitHub request failed',
+            };
+        }
+        if (resp?.viewer == null)
+            return { results: [] };
+        const me = resp.viewer.login.toLowerCase();
+        const orgLogins = new Set(resp.viewer.organizations.nodes
+            .filter((o) => o != null)
+            .map((o) => o.login.toLowerCase()));
+        // Merge the two recency-ordered lists, deduping by repo node id and keeping the more
+        // recent pushedAt. Null node arrays (scoped token) and null nodes are dropped BEFORE any
+        // field read (ISO-8601 pushedAt strings compare lexically; a null pushedAt sorts last).
+        const byId = new Map();
+        const merged = [
+            ...(resp.viewer.repositories.nodes ?? []),
+            ...(resp.viewer.repositoriesContributedTo.nodes ?? []),
+        ];
+        for (const n of merged) {
+            if (n == null || typeof n.id !== 'string')
+                continue;
+            const existing = byId.get(n.id);
+            if (existing == null || (n.pushedAt ?? '') > (existing.pushedAt ?? '')) {
+                byId.set(n.id, n);
+            }
+        }
+        const added = await getAddedRepoNodeIds(accountId);
+        const results = [...byId.values()]
+            .filter((n) => !added.has(n.id))
+            // Most-recently-pushed first; a missing pushedAt sorts to the bottom.
+            .sort((a, b) => (b.pushedAt ?? '').localeCompare(a.pushedAt ?? ''))
+            .slice(0, 30)
+            .map((n) => {
+            const ownerLogin = n.owner.login;
+            return {
+                githubNodeId: n.id,
+                owner: ownerLogin,
+                name: n.name,
+                fullName: n.nameWithOwner,
+                description: n.description,
+                ownerAvatarUrl: n.owner.avatarUrl,
+                stargazerCount: n.stargazerCount,
+                openPrCount: n.pullRequests.totalCount,
+                url: n.url,
+                isPrivate: n.isPrivate,
+                isOwnedOrMember: ownerLogin.toLowerCase() === me ||
+                    orgLogins.has(ownerLogin.toLowerCase()),
+            };
+        });
+        const body = { results };
+        return body;
+    });
+    app.post('/api/repos', { schema: createRepoSchema }, async (req, reply) => {
+        const { owner, name } = req.body;
+        const accountId = accountIdOf(req);
+        let resp;
+        try {
+            const client = getGraphqlClientFor(await getAccessToken(accountId));
+            resp = await client(REPO_ID_QUERY, { owner, name });
+        }
+        catch (err) {
+            reply.status(502);
+            return {
+                error: 'GitHubError',
+                message: err instanceof Error ? err.message : 'GitHub request failed',
+            };
+        }
+        if (!resp.repository) {
+            reply.status(404);
+            return {
+                error: 'NotFound',
+                message: `Repository ${owner}/${name} not found or inaccessible. Check the name and your gh auth / SSO.`,
+            };
+        }
+        // Enforce the per-account repo cap. Re-adding a repo that is already there is an
+        // idempotent no-op (it doesn't grow the count), so only genuinely NEW repos
+        // are blocked once at the limit.
+        const added = await getAddedRepoNodeIds(accountId);
+        if (added.size >= MAX_REPOS_PER_ACCOUNT && !added.has(resp.repository.id)) {
+            reply.status(409);
+            return {
+                error: 'RepoLimitExceeded',
+                message: `You can add at most ${MAX_REPOS_PER_ACCOUNT} repositories. Remove one to add another.`,
+            };
+        }
+        const canonOwner = resp.repository.owner.login;
+        const canonName = resp.repository.name;
+        const repoId = await upsertRepo(canonOwner, canonName, resp.repository.id, null, accountId);
+        // No second visibility axis to set: `upsertRepo` gives the repo its workspace membership
+        // in the same transaction, and a repo in a workspace is fully live — Feed, Activity, My
+        // Turn and Bots all cover it. (The old `setRepoInboxWatch(accountId, repoId, true)` call
+        // that used to sit here, and the `watch` body field that fed it, are both gone.)
+        //
+        // My Turn's "New PRs" clock is `repos.createdAt`, stamped by that same upsert, so adding a
+        // repo with 400 open PRs still doesn't dump them into the inbox on day one.
+        // Kick off the initial backfill in the background — QUEUED behind any other
+        // API-triggered sync of this account, so adding several repos consecutively walks
+        // them one at a time instead of hammering one token with N concurrent 90-day
+        // backfills (each was also a 10-way commit-file REST fan-out). The 201 still
+        // returns immediately; the queued repo reports status 'running' with
+        // `paused: { reason: 'queued' }` until its turn comes.
+        void enqueueSyncForRepo(repoId, app.log).catch((err) => app.log.error(`enqueue initial sync for repo ${repoId} failed: ${err instanceof Error ? err.message : err}`));
+        reply.status(201);
+        return getRepo(repoId, accountId);
+    });
+    // NOTE: there is no `PATCH /api/repos/:id`. Its only body was `{ inboxWatch }`, and the
+    // "watched" axis is gone — a repo is either in a workspace (fully live) or removed. Moving
+    // a repo between workspaces is `PATCH /api/workspaces/:id` / `POST /api/workspaces/:id/repos`,
+    // not a mutation of the repo row.
+    app.delete('/api/repos/:id', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const accountId = accountIdOf(req);
+        // Ownership check first: a repo this account doesn't own is a 404 (and we
+        // must not consult the repoId-keyed sync managers for someone else's repo).
+        if (!(await getRepo(id, accountId))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${id} not found` };
+        }
+        // A repo still WAITING in the per-account queue would resurrect the deleted repo
+        // when its turn came (the walk's upsertRepo re-creates the row). Cancelling a queued
+        // repo is synchronous: it dequeues + clears the progress row, so the delete can go.
+        if (isSyncQueued(id))
+            requestSyncCancel(id);
+        // A sync in flight would re-create the repo (and its rows) right after we
+        // delete them, since the sync's upserts are still running. Refuse until it
+        // settles — the cron tick / initial backfill is short.
+        if (isSyncRunning(id)) {
+            reply.status(409);
+            return {
+                error: 'Conflict',
+                message: 'A sync is running for this repo — try removing it again in a moment.',
+            };
+        }
+        const ok = await deleteRepo(id, accountId);
+        if (!ok) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${id} not found` };
+        }
+        reply.status(204);
+        return null;
+    });
+    app.post('/api/repos/:id/sync', { schema: syncSchema }, async (req, reply) => {
+        const { id } = req.params;
+        if (!(await getRepo(id, accountIdOf(req)))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${id} not found` };
+        }
+        // ?full=true forces a full backfill (catches CI/thread-resolve changes
+        // that don't bump PR.updatedAt and so lag the incremental path).
+        const { full } = req.query;
+        const forceFull = full === true;
+        // Per-repo cooldown. `runSyncForRepo`'s own guard only refuses a sync already in
+        // flight for this repo — it did not stop a caller re-firing the moment one finished,
+        // so a loop could keep a forced 90-day backfill running permanently and drain the
+        // tenant's GitHub quota (breaking their real sync for the rest of the hour).
+        const waitMs = manualSyncCooldownMs(id, forceFull);
+        if (waitMs > 0) {
+            const retryAfter = Math.ceil(waitMs / 1000);
+            reply.status(429).header('Retry-After', String(retryAfter));
+            return {
+                error: 'TooManyRequests',
+                message: forceFull
+                    ? `A deep sync for this repo ran recently — try again in ${retryAfter}s.`
+                    : `This repo was synced moments ago — try again in ${retryAfter}s.`,
+                retryAfter,
+            };
+        }
+        // QUEUED behind the account's other API-triggered syncs (the per-account serial
+        // queue replaced the old process-wide concurrency 429): "deep sync everything"
+        // fires one POST per repo, and each repo now waits its turn with an honest
+        // 'queued' progress row instead of either running 100 concurrent GraphQL walks
+        // or bouncing off a 429. Returns as soon as the repo is queued.
+        const started = await enqueueSyncForRepo(id, app.log, { forceFull });
+        if (!started) {
+            reply.status(409);
+            return { error: 'Conflict', message: 'A sync is already running for this repo' };
+        }
+        noteManualSync(id);
+        reply.status(202);
+        return { status: 'started' };
+    });
+    app.get('/api/repos/:id/sync-status', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        if (!(await getRepo(id, accountIdOf(req)))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${id} not found` };
+        }
+        return getSyncStatus(id);
+    });
+    // A cold return's catch-up: an incremental walk whose cutoff is older than this is fetching
+    // a delta measured in DAYS, not the ~50 minutes a routine tick covers (cold activity bucket
+    // 15 min + the 30-min forced re-walk floor + the 20-min overlap). Three orders of magnitude
+    // between the two populations, so nothing here needs tuning.
+    const CATCHUP_MIN_AGE_MS = 24 * 60 * 60 * 1000;
+    // The account's HEAVY sync work, in TWO disjoint arrays:
+    //  • `backfills` — repos whose CURRENT walk is full-mode: a first-sync backfill, a forced
+    //    deep re-sync, or a repo QUEUED for one (its seeded progress row rides
+    //    `paused: { reason: 'queued' }` and counts only when the seeded mode is 'full').
+    //  • `catchups` — the ONE kind of incremental walk that is reported: one whose `since` is
+    //    more than 24h old, i.e. somebody came back to the app after days away and the board is
+    //    that far behind. Routine incremental ticks stay EXCLUDED: this feeds the SPA's global
+    //    bottom-right loading bar, which must not flicker on every cron tick.
+    // They are separate arrays rather than a flag because they are separate populations and the
+    // bar says a different sentence about each ("Backfilling" is a repo's first 90 days;
+    // "Catching up" is an established repo that is behind).
+    //
+    // Cost: an in-memory snapshot (`listActiveSyncProgress`) + ONE account-scoped `repos`
+    // SELECT. The join is not just for `fullName` — the progress maps are process-wide across
+    // tenants in cloud, so the accountId predicate IS the isolation: a repo that doesn't come
+    // back from the SELECT (another tenant's, or deleted mid-walk) is silently dropped. Pure
+    // DB read + memory, default `read` rate tier.
+    app.get('/api/sync-activity', async (req) => {
+        const accountId = accountIdOf(req);
+        const now = Date.now();
+        const generatedAt = new Date(now).toISOString();
+        // Returns the cutoff when this walk is a catch-up, else null — one predicate, used for
+        // both the filter and the row, so a row can never be classified one way and read another.
+        // An absent `sinceMs` is "not recorded", never "old": it must not invent a catch-up.
+        const catchupSinceMs = (p) => p.mode === 'incremental' && p.sinceMs != null && now - p.sinceMs > CATCHUP_MIN_AGE_MS
+            ? p.sinceMs
+            : null;
+        const heavy = listActiveSyncProgress().filter((e) => e.progress.mode === 'full' || catchupSinceMs(e.progress) != null);
+        if (heavy.length === 0)
+            return { backfills: [], catchups: [], generatedAt };
+        const { repos, syncState } = schema;
+        const rows = await db
+            .select({
+            id: repos.id,
+            owner: repos.owner,
+            name: repos.name,
+            lastSyncStatus: syncState.lastSyncStatus,
+        })
+            .from(repos)
+            .leftJoin(syncState, eq(syncState.repoId, repos.id))
+            .where(and(eq(repos.accountId, accountId), inArray(repos.id, heavy.map((e) => e.repoId))))
+            .execute();
+        const nameById = new Map(rows.map((r) => [r.id, `${r.owner}/${r.name}`]));
+        const erroredIds = new Set(rows.filter((r) => r.lastSyncStatus === 'error').map((r) => r.id));
+        const backfills = [];
+        const catchups = [];
+        for (const { repoId, progress } of heavy) {
+            const fullName = nameById.get(repoId);
+            if (fullName === undefined)
+                continue; // not this account's repo (or deleted mid-walk)
+            // A permanently failing first backfill (revoked token, SAML-walled org) is retried
+            // by the scheduler indefinitely, each attempt seeding a fresh full-mode row — which
+            // would flash the ambient loading bar on an idle board forever. Suppress the
+            // zero-progress retries of a repo already marked errored; a walk that is actually
+            // making progress (percent > 0) or an explicit user-queued re-sync still shows.
+            //
+            // ⚠ THIS COVERS CATCH-UPS TOO, AND FOR A SHARPER REASON: a repo whose walk fails every
+            // time never stamps lastIncrementalSyncAt, so its `since` gets older every attempt and
+            // it would read as a catch-up FOREVER — a permanent "18 days behind" on a repo nothing
+            // can fetch. The predicate is mode-blind on purpose; do not narrow it to full-mode.
+            if (erroredIds.has(repoId) &&
+                progress.percent === 0 &&
+                progress.paused?.reason !== 'queued') {
+                continue;
+            }
+            const row = {
+                repoId,
+                fullName,
+                percent: progress.percent,
+                prsProcessed: progress.prsProcessed,
+                ...(progress.paused ? { paused: progress.paused } : {}),
+            };
+            const sinceMs = catchupSinceMs(progress);
+            if (sinceMs != null)
+                catchups.push({ ...row, sinceMs });
+            else
+                backfills.push(row);
+        }
+        return { backfills, catchups, generatedAt };
+    });
+    // Cancel an in-flight sync. Signals the sync loop to stop, waits for it to
+    // settle, then — if this repo never completed a sync (an initial backfill the
+    // user is aborting) — deletes it and its partially-loaded data. An established
+    // repo whose re-sync was cancelled keeps everything. Drives the modal's Cancel.
+    app.post('/api/repos/:id/cancel', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const accountId = accountIdOf(req);
+        if (!(await getRepo(id, accountId))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Repo ${id} not found` };
+        }
+        requestSyncCancel(id);
+        await waitForSyncToStop(id, 30_000);
+        // Re-read AFTER it stops: if the sync actually finished during the wait, the
+        // repo is now "synced" and must NOT be deleted (avoids a cancel-vs-finish race).
+        const fresh = await getRepo(id, accountId);
+        const neverSynced = fresh != null &&
+            fresh.lastFullSyncAt == null &&
+            fresh.lastIncrementalSyncAt == null;
+        let deleted = false;
+        if (neverSynced && !isSyncRunning(id))
+            deleted = await deleteRepo(id, accountId);
+        reply.status(200);
+        return { repoId: id, deleted };
+    });
+}
+//# sourceMappingURL=repos.js.map

package/dist/api/routes/search.js

@@ -0,0 +1,41 @@
+import { resolveWorkspaceScope } from '../../db/queries.js';
+import { searchPrs } from '../../db/search.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Workspace-wide full-text search (CORE, no AI). GET /api/search?q=&workspace=&kinds=&limit=&offset=
+// searches the local `search_index` (PR titles + descriptions, review bodies, review-comments,
+// PR-comments, and authors) across the active workspace's repos. `workspace` is a plain integer;
+// absent / unparseable / another tenant's id all resolve to the account's DEFAULT workspace (never
+// a 404 — every id yields the same response shape, so it is not an existence oracle). It is
+// resolved to a repo set server-side (`resolveWorkspaceScope`) so a caller can't widen it, and an
+// empty workspace resolves to `[]` → no hits, rather than the whole account. `kinds`
+// (comma-separated) optionally narrows to one or more hit kinds. Account-scoped in the query layer
+// → no cross-tenant leak.
+const VALID_KINDS = new Set(['pr', 'review', 'review_comment', 'pr_comment']);
+const MAX_LIMIT = 50;
+const DEFAULT_LIMIT = 25;
+export async function searchRoutes(app) {
+    app.get('/api/search', async (req) => {
+        const q = req.query;
+        const accountId = accountIdOf(req);
+        const query = (q.q ?? '').trim();
+        if (query === '')
+            return { query: '', hits: [], people: [], total: 0 };
+        const scope = await resolveWorkspaceScope(accountId, q.workspace);
+        const kinds = (q.kinds ?? '')
+            .split(',')
+            .map((k) => k.trim())
+            .filter((k) => VALID_KINDS.has(k));
+        const limRaw = Number.parseInt(q.limit ?? '', 10);
+        const offRaw = Number.parseInt(q.offset ?? '', 10);
+        const limit = Number.isFinite(limRaw) && limRaw > 0 ? Math.min(limRaw, MAX_LIMIT) : DEFAULT_LIMIT;
+        const offset = Number.isFinite(offRaw) && offRaw > 0 ? offRaw : 0;
+        return searchPrs(accountId, {
+            query,
+            repoIds: scope.repoIds,
+            kinds: kinds.length > 0 ? kinds : undefined,
+            limit,
+            offset,
+        });
+    });
+}
+//# sourceMappingURL=search.js.map