limn-review 0.1.125 → 0.1.127

package/dist/api/plugins/rate-limit.js

@@ -468,6 +468,16 @@ function tierFor(method, path) {
         return [TIERS.githubWrite];
     if (path.startsWith('/api/ticket-reviews'))
         return [TIERS.read];
+    // CI REVIEW (review/ci-review/routes.ts), matched EXPLICITLY by exact path for the same reason:
+    //   POST /api/ci-reviews          starts an agent run (reads the head's checks + logs) → ai + ai_hourly
+    //   POST /api/ci-reviews/states   batched DB read of the SYNCED head + failing names   → read
+    //   GET  …/:id, …/:id/stream, /api/prs/:id/ci-review                                  → read
+    if (path === '/api/ci-reviews' && mutating)
+        return [TIERS.ai, TIERS.aiHourly];
+    if (path === '/api/ci-reviews/states')
+        return [TIERS.read];
+    if (path.startsWith('/api/ci-reviews'))
+        return [TIERS.read];
     if (/^\/api\/claude-reviews\/[^/]+\/chat$/.test(path)) {
         return mutating ? [TIERS.ai, TIERS.aiHourly] : [TIERS.read];
     }

package/dist/coding/ai-fix/auto-fix.js

@@ -6,6 +6,9 @@
 //   0. the PR's author IS the account's own GitHub user (pull_requests.author_id → users.github_login
 //      vs accounts.github_login, case-insensitive). Anyone else's PR: nothing happens and nothing is
 //      recorded — fixing someone else's branch is never automatic;
+//   ½. `off`             — auto AI Fix is switched off for the workspace holding the PR's repo
+//                          (`workspaces.auto_fix_enabled`, migration 0083 / pg 0070, Settings →
+//                          Auto review). ON by default; a repo with no membership row reads ON;
 //   1. `nothing_to_fix`  — the review's seed is empty (the same refusal as the button's NothingToFix);
 //   2. `head_moved`      — the PR's synced head is no longer the reviewed one (the next review decides);
 //   3. `fix_in_progress` — a fix for this PR (auto or manual) is queued or running;
@@ -33,6 +36,7 @@ import { AUTO_FIX_DAILY_CAP, CLAUDE_REVIEW_MODELS, DEFAULT_AI_FIX_MODEL, } from
 import { isFixRunning, loadReviewSeed, startReviewFix } from './manager.js';
 import { parseChangeReport, parseReviewItems } from './persist.js';
 import { getFixPrContext } from './pr-context.js';
+import { readWorkspaceAutoFixForPr } from '../../review/claude-review/auto-settings.js';
 // At most AUTO_FIX_DAILY_CAP (shared) AUTO fixes per PR in any rolling AUTO_FIX_WINDOW_MS.
 export { AUTO_FIX_DAILY_CAP };
 export const AUTO_FIX_WINDOW_MS = 24 * 60 * 60 * 1000;
@@ -119,6 +123,8 @@ export async function maybeStartAutoFix(ctx, input, deps = defaultDeps, nowMs =
     try {
         if (!(await prAuthorIsAccount(ctx, accountId, prId)))
             return { status: 'not_own' };
+        if (!(await readWorkspaceAutoFixForPr(ctx, accountId, prId)))
+            return skip('off');
         const loaded = await deps.loadReviewSeed(ctx, { accountId, prId, reviewId });
         if (!loaded)
             return skip('not_started');

package/dist/coding/ai-fix/manager.js

@@ -4,6 +4,7 @@ import { getClaudeReviewById } from '../../review/claude-review/persist.js';
 import { pickReviewNonce } from '../../review/claude-review/prompts.js';
 import { buildReviewSeed } from './review-seed.js';
 import { getOwnedTicketItemsForPr } from '../../review/ticket-review/persist.js';
+import { getFixableCiItemsForPr } from '../../review/ci-review/persist.js';
 import { buildFixSystemPrompt, buildFixUserPrompt } from './prompts.js';
 import { insertQueuedFix, markFixCancelled, markFixFailed, markFixRunning, reconcileOrphanedFixes, saveFixSuccess, } from './persist.js';
 // In-memory job manager for AI Fix's agentic fixer (CORE, free, local-only — it left the plugin
@@ -102,7 +103,13 @@ export async function loadReviewSeed(ctx, input) {
                 return [];
             })
             : [];
-        return { review, seed: buildReviewSeed(review, { nonce: pickReviewNonce, ticketItems }) };
+        // The CI review's fixable items at the PR's CURRENT head (manual and auto fixes alike). A failed
+        // read costs the CI items only.
+        const ciItems = await getFixableCiItemsForPr(ctx, input.accountId, input.prId).catch((err) => {
+            ctx.log.warn({ err }, 'ai-fix: loading CI review items failed');
+            return [];
+        });
+        return { review, seed: buildReviewSeed(review, { nonce: pickReviewNonce, ticketItems, ciItems }) };
     }
     catch (err) {
         ctx.log.warn({ err }, 'ai-fix: loading the review seed failed');

package/dist/coding/ai-fix/review-seed.js

@@ -15,7 +15,9 @@ import { isThreadToFix } from '../../shared/index.js';
 //               addressed — unless this run re-raised it as a finding (then F covers it).
 //   T<n>        another reviewer's thread the review judged still needs a fix (shared
 //               `isThreadToFix`: valid / partly valid AND not / partly addressed).
-//   C<n>        a CI failure the review judged fixable in this PR (`ciFailures`, when present).
+//   C<n>        a CI failure the CI REVIEW (review/ci-review/) explained and judged fixable in this PR —
+//               from its latest succeeded run AT THE PR'S CURRENT HEAD (`ciItems`, the caller's
+//               `getFixableCiItemsForPr`), never from the code review's own (legacy) `ciFailures`.
 //   S<t>-AC<n>  an acceptance criterion of ticket t judged not met or partly met, and
 //   S<t>-M<n>   something ticket t asked for that is missing — BOTH from the TICKET review
 //               (review/ticket-review/), never from the PR review, and ONLY the items whose owner is
@@ -72,21 +74,21 @@ function mkItem(ref, kind, title, over = {}) {
         ...over,
     };
 }
-// ---- CI failures (the review's `ciFailures`, from the Claude Review CI diagnosis) ----
-// Only a DIAGNOSED failure the review judged fixable in this PR (`fixableInPr === true`). Anything
-// else — infrastructure, flaky, unclear, not checked — is not the fixer's. Older rows carry none.
-export function readFixableCiFailures(review) {
-    const raw = review.ciFailures;
-    if (!Array.isArray(raw))
-        return [];
-    return raw.filter((f) => f != null && f.status === 'diagnosed' && f.fixableInPr === true);
+// ---- CI failures (the CI review's items) ----
+// Only a DIAGNOSED failure judged fixable in this PR (`fixableInPr === true`). Anything else —
+// infrastructure, flaky, unclear, not checked — is not the fixer's. The code review's own legacy
+// `ciFailures` are NEVER read: the CI review replaced them, and they describe an older head.
+export function fixableCiItems(items) {
+    return items.filter((f) => f != null && f.status === 'diagnosed' && f.fixableInPr === true);
 }
 /**
  * Collect every fixable item of a review, refs assigned. Pure — the review is the stored run.
  */
 export function collectReviewItems(review, 
 // The ticket review's items THIS PR owns. A MANUAL fix only; absent/[] ⇒ none (an auto fix).
-ticketItems = []) {
+ticketItems = [], 
+// The CI review's items at the PR's current head (both manual and auto fixes); absent/[] ⇒ none.
+ciItems = []) {
     const out = [];
     // F — the review's findings. A RE-RAISE (`priorFindingId` set) left out only because the same
     // comment is already on this commit (follow-up.ts `isAlreadyOnThisCommit`) is NOT a reader's
@@ -161,13 +163,15 @@ ticketItems = []) {
         });
     });
     // C — CI failures fixable in this PR.
-    readFixableCiFailures(review).forEach((f, i) => {
+    fixableCiItems(ciItems).forEach((f, i) => {
         const ref = `C${i + 1}`;
-        const first = f.relatedFiles?.[0] ?? null;
+        const first = f.path ? { path: f.path, line: f.line } : (f.relatedFiles?.[0] ?? null);
         const body = [
             `Check: ${f.checkName}${f.step ? ` (step: ${f.step})` : ''}`,
             f.cause ? `Cause: ${f.cause}` : '',
             f.explanation ? `Detail: ${f.explanation}` : '',
+            f.path ? `Where: ${where(f.path, f.line)}` : '',
+            f.suggestion ? `Suggested change: ${f.suggestion}` : '',
             f.relatedFiles?.length
                 ? `Related files: ${f.relatedFiles.map((r) => where(r.path, r.line)).join(', ')}`
                 : '',
@@ -226,7 +230,7 @@ function fencedTexts(items, summary) {
  */
 export function buildReviewSeed(review, opts) {
     const budget = opts.budgetChars ?? REVIEW_SEED_CHAR_BUDGET;
-    const all = collectReviewItems(review, opts.ticketItems ?? []);
+    const all = collectReviewItems(review, opts.ticketItems ?? [], opts.ciItems ?? []);
     if (all.length === 0)
         return { items: [], sentRefs: [], text: '' };
     const summary = clip(review.userBody?.trim() || review.summary?.trim() || '', SUMMARY_MAX);

package/dist/config.js

@@ -536,9 +536,20 @@ export const config = {
     // every member's worktree.
     ticketReviewBudgetUsd: floatFromEnv('TICKET_REVIEW_BUDGET_USD', 4),
     ticketReviewMaxTurns: intFromEnv('TICKET_REVIEW_MAX_TURNS', 40),
+    // The per-card spend cap of the ticket review's CARD PRE-PASS (Sonnet 5, diff-only, one tool —
+    // review/ticket-review/prepass.ts). Its spend is added to the ticket run's cost. Env only.
+    ticketCardBudgetUsd: floatFromEnv('TICKET_CARD_BUDGET_USD', 0.4),
     // AUTOMATIC ticket reviews (trigger 'auto' / 'cascade') per workspace per UTC day. Not shared with
     // the PR review's own auto cap. Manual runs never count. Default = shared TICKET_REVIEW_DAILY_CAP.
     ticketReviewDailyCap: intFromEnv('TICKET_REVIEW_DAILY_CAP', 20),
+    // ---- CI review (one run per (PR, head, failing-check set) — review/ci-review/) ----
+    // Its OWN spend cap and turn cap: a CI run reads log excerpts and the files they point at, nothing
+    // more. Env only — no route sets it.
+    ciReviewBudgetUsd: floatFromEnv('CI_REVIEW_BUDGET_USD', 2),
+    ciReviewMaxTurns: intFromEnv('CI_REVIEW_MAX_TURNS', 25),
+    // AUTOMATIC CI reviews per workspace per UTC day. Not shared with the PR or ticket review caps.
+    // Manual runs never count. Default = shared CI_REVIEW_DAILY_CAP.
+    ciReviewDailyCap: intFromEnv('CI_REVIEW_DAILY_CAP', 20),
     // ---- Diff-size cap ----
     // A very large inlined diff is the dominant cost on a big PR (it's the cached
     // prefix re-read every turn). The diff shown IN THE PROMPT is truncated at a

package/dist/db/ci-review-prune.js

@@ -0,0 +1,22 @@
+import { inArray } from 'drizzle-orm';
+import { schema } from './client.js';
+// THE CI-REVIEW HALF OF BOTH PR DELETE PATHS (deleteRepo in queries.ts, retention's
+// deletePrSubtree). A CI review belongs to exactly one PR, so deleting the PR deletes its runs and
+// their items. Children before parents, explicitly — the composite FKs cascade, but these paths run
+// parent-last by hand on both dialects. Runs inside the caller's transaction.
+export async function pruneCiReviewsForPrs(tx, prIds) {
+    if (prIds.length === 0)
+        return;
+    const runs = schema.ciReviews;
+    const rows = await tx
+        .select({ id: runs.id })
+        .from(runs)
+        .where(inArray(runs.prId, [...prIds]))
+        .execute();
+    const runIds = rows.map((r) => r.id);
+    if (runIds.length > 0) {
+        await tx.delete(schema.ciReviewItems).where(inArray(schema.ciReviewItems.ciReviewId, runIds)).execute();
+    }
+    await tx.delete(runs).where(inArray(runs.prId, [...prIds])).execute();
+}
+//# sourceMappingURL=ci-review-prune.js.map

package/dist/db/erase-account.js

@@ -128,6 +128,19 @@ export async function eraseAccountData(accountId) {
             .delete(schema.ticketReviews)
             .where(eq(schema.ticketReviews.accountId, accountId))
             .execute();
+        // Ticket review contribution cards (migration 0086 / pg 0073): model text describing the user's
+        // PRs. The repo loop has normally taken them with their PRs; explicit, like every agentic table.
+        await tx
+            .delete(schema.ticketReviewPrCards)
+            .where(eq(schema.ticketReviewPrCards.accountId, accountId))
+            .execute();
+        // CI reviews (migration 0082 / pg 0069), items first. The repo loop has normally taken them with
+        // their PRs; explicit, like every agentic table.
+        await tx
+            .delete(schema.ciReviewItems)
+            .where(eq(schema.ciReviewItems.accountId, accountId))
+            .execute();
+        await tx.delete(schema.ciReviews).where(eq(schema.ciReviews.accountId, accountId)).execute();
         // AI Fix runs (patches of the user's code + the prompts they were built from). Core since
         // migration 0074 / pg 0061 — the plugin's erasure hook used to own them.
         await tx.delete(schema.aiFixes).where(eq(schema.aiFixes.accountId, accountId)).execute();
@@ -211,6 +224,16 @@ export function accountScopedTables() {
             col: schema.ticketReviewItems.accountId,
             table: schema.ticketReviewItems,
         },
+        // Contribution cards (migration 0086 / pg 0073) — one per (PR, head); erased explicitly above.
+        {
+            name: 'ticketReviewPrCards',
+            col: schema.ticketReviewPrCards.accountId,
+            table: schema.ticketReviewPrCards,
+        },
+        // CI reviews (migration 0082 / pg 0069) — the runs and their per-check items. Both carry their
+        // own accountId; both are erased explicitly above.
+        { name: 'ciReviews', col: schema.ciReviews.accountId, table: schema.ciReviews },
+        { name: 'ciReviewItems', col: schema.ciReviewItems.accountId, table: schema.ciReviewItems },
         { name: 'aiUsage', col: aiUsage.accountId, table: aiUsage },
         // Adopted from the plugin (migration 0074 / pg 0061) with AI Fix's fixer. No FKs, so nothing
         // cascades: the explicit delete above is the whole guarantee. (`reviewLearnings`, review

package/dist/db/migrations/0082_ci_reviews.sql

@@ -0,0 +1,73 @@
+-- CI REVIEW (local-only feature, like the rest of Claude Review): a separate Claude run that explains
+-- why checks FAILED on a PR's head, split out of the PR review's own run. Two tables:
+--   ci_reviews       one row per run (history kept). Keyed by (pr, head, sorted failing check names):
+--                    `failing_key` is what the run read live, `trigger_key` the synced set that
+--                    started it.
+--   ci_review_items  one row per failing check: Claude's cause, or the server's not-checked reason.
+-- Run ids arrive in request paths, so the item table's tenancy is STRUCTURAL: a composite FK against
+-- ci_reviews(id, account_id), whose parent key `ci_reviews_id_account` is created here; the run's PR
+-- against pull_requests(id, account_id). Both delete paths (deleteRepo, retention's deletePrSubtree)
+-- and eraseAccountData delete these rows explicitly. `claude_reviews.ci_failures` becomes LEGACY
+-- (read-only); nothing here touches it. The Postgres twin is migrations-pg/0069_ci_reviews.sql.
+CREATE TABLE IF NOT EXISTS `ci_reviews` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`repo_id` integer NOT NULL,
+	`head_sha` text NOT NULL,
+	`failing_key` text,
+	`trigger_key` text,
+	`failing_checks` text,
+	`trigger` text DEFAULT 'manual' NOT NULL,
+	`status` text NOT NULL,
+	`model` text NOT NULL,
+	`cost_usd` real,
+	`input_tokens` integer,
+	`output_tokens` integer,
+	`num_turns` integer,
+	`error` text,
+	`refused` text,
+	`ci_state` text,
+	`summary` text,
+	`started_at` integer,
+	`completed_at` integer,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `cir_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `cir_account_pr_created_idx` ON `ci_reviews` (`account_id`,`pr_id`,`created_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `cir_account_ws_created_idx` ON `ci_reviews` (`account_id`,`workspace_id`,`created_at`);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `ci_reviews_id_account` ON `ci_reviews` (`id`,`account_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `ci_review_items` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`ci_review_id` integer NOT NULL,
+	`account_id` integer NOT NULL,
+	`ref` text,
+	`check_name` text NOT NULL,
+	`job_id` integer,
+	`step` text,
+	`url` text,
+	`sent` integer DEFAULT false NOT NULL,
+	`carried` integer DEFAULT false NOT NULL,
+	`status` text NOT NULL,
+	`not_checked_reason` text,
+	`cause` text,
+	`explanation` text,
+	`category` text,
+	`fixable_in_pr` integer,
+	`path` text,
+	`line` integer,
+	`suggestion` text,
+	`related_files` text,
+	`assessed_at_head` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `ciri_review_account_fk` FOREIGN KEY (`ci_review_id`,`account_id`) REFERENCES `ci_reviews`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `ciri_review_idx` ON `ci_review_items` (`ci_review_id`);

package/dist/db/migrations/0083_workspace_auto_fix.sql

@@ -0,0 +1,9 @@
+-- AUTO AI FIX, PER WORKSPACE — `workspaces.auto_fix_enabled`. After a succeeded AUTO Claude review
+-- of the reader's OWN pull request, Limn may prepare one review-seeded AI Fix (never pushed;
+-- coding/ai-fix/auto-fix.ts `maybeStartAutoFix`). This is that step's switch, edited in Settings
+-- beside auto review and written by `setWorkspaceAutoReview` (review/claude-review/auto-settings.ts).
+-- ⚠ DEFAULT TRUE (1) and NOT NULL: auto fix ran unconditionally before this column existed, so
+-- every existing workspace keeps today's behaviour until someone switches it off. It only matters
+-- while auto review is on, because it only runs after an auto review. The Postgres twin is
+-- migrations-pg/0070_workspace_auto_fix.sql.
+ALTER TABLE `workspaces` ADD `auto_fix_enabled` integer DEFAULT 1 NOT NULL;

package/dist/db/migrations/0084_auto_fix_off_by_default.sql

@@ -0,0 +1,7 @@
+-- AUTO AI FIX IS OFF BY DEFAULT. 0083 added `workspaces.auto_fix_enabled` DEFAULT 1 so nothing
+-- changed on upgrade; the product decision since is OFF until someone switches it on. Every
+-- existing workspace is switched off once here (the switch shipped one release earlier, so no one
+-- has had time to choose it). SQLite cannot change a column default in place, so the 0083 DDL
+-- default stays 1; both workspace inserts in db/queries.ts write `autoFixEnabled: false`
+-- explicitly. The Postgres twin is migrations-pg/0071_auto_fix_off_by_default.sql.
+UPDATE `workspaces` SET `auto_fix_enabled` = 0;

package/dist/db/migrations/0085_auto_review_daily_cap.sql

@@ -0,0 +1,6 @@
+-- AUTO REVIEW DAILY CAP, PER WORKSPACE. How many auto Claude reviews a workspace may start per UTC
+-- day. OVERRIDES ONLY: NULL = the product default (20, `AUTO_REVIEW_DAILY_CAP`), resolved through
+-- `resolveAutoReviewDailyCap` (review/claude-review/auto-settings.ts); the PUT route bounds it
+-- 1..500. Nullable with no default, so no workspace insert has to name it. The Postgres twin is
+-- migrations-pg/0072_auto_review_daily_cap.sql.
+ALTER TABLE `workspaces` ADD `auto_review_daily_cap` integer;

package/dist/db/migrations/0086_ticket_review_pr_cards.sql

@@ -0,0 +1,24 @@
+-- TICKET REVIEW CONTRIBUTION CARDS. One row per (account, PR, head commit): a model-written,
+-- verdict-free description of what that PR's head does (summary, interfaces, the story criteria it
+-- moves forward, loose ends) plus the PR's changed files at that head (server-written). A ticket
+-- review reads a member whose CURRENT head has a card as the card, not as its diff; the run writes a
+-- card for every member it read as a diff (source 'story_check') and a cheap per-PR pre-pass writes
+-- the overflow (source 'prepass', with its own cost). Re-writing the same head replaces the card.
+-- Tenancy: a composite FK against pull_requests(id, account_id). Both delete paths (deleteRepo,
+-- retention's deletePrSubtree, via db/ticket-review-prune.ts) and eraseAccountData delete these rows
+-- explicitly. The Postgres twin is migrations-pg/0073_ticket_review_pr_cards.sql.
+CREATE TABLE IF NOT EXISTS `ticket_review_pr_cards` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`head_sha` text NOT NULL,
+	`card` text NOT NULL,
+	`source` text NOT NULL,
+	`model` text NOT NULL,
+	`cost_usd` real,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `trpc_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `trpc_account_pr_head_ux` ON `ticket_review_pr_cards` (`account_id`,`pr_id`,`head_sha`);

package/dist/db/migrations/0087_auto_post.sql

@@ -0,0 +1,21 @@
+-- AUTO-POSTING OF CLAUDE REVIEW OUTPUT (review/claude-review/auto-post.ts, review/ticket-review/
+-- auto-post.ts). A per-workspace master switch, OFF for every workspace existing and new, plus the
+-- per-run records of what was posted and the per-item "posted automatically" flag.
+--   workspaces.auto_post_enabled      NULL/false = off. Nullable, no default: no insert names it.
+--   workspaces.auto_post_settings     JSON, OVERRIDES ONLY ({ scope?, kinds? }); NULL = defaults.
+--   claude_reviews.auto_post          JSON ClaudeAutoPostRecord; NULL = never looked at.
+--   claude_review_findings.posted_auto  true = posted by auto-posting.
+--   ticket_reviews.auto_post          JSON TicketAutoPostRecord; NULL = never looked at.
+--   ticket_review_items.posted_auto   true = posted by auto-posting (carried with the posting).
+-- The Postgres twin is migrations-pg/0074_auto_post.sql.
+ALTER TABLE `workspaces` ADD `auto_post_enabled` integer;
+--> statement-breakpoint
+ALTER TABLE `workspaces` ADD `auto_post_settings` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `claude_review_findings` ADD `posted_auto` integer;
+--> statement-breakpoint
+ALTER TABLE `ticket_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `ticket_review_items` ADD `posted_auto` integer;

package/dist/db/migrations/meta/_journal.json

@@ -575,6 +575,48 @@
       "when": 1790658000000,
       "tag": "0081_review_request_requester",
       "breakpoints": true
+    },
+    {
+      "idx": 82,
+      "version": "6",
+      "when": 1790661600000,
+      "tag": "0082_ci_reviews",
+      "breakpoints": true
+    },
+    {
+      "idx": 83,
+      "version": "6",
+      "when": 1790665200000,
+      "tag": "0083_workspace_auto_fix",
+      "breakpoints": true
+    },
+    {
+      "idx": 84,
+      "version": "6",
+      "when": 1790751600000,
+      "tag": "0084_auto_fix_off_by_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 85,
+      "version": "6",
+      "when": 1790838000000,
+      "tag": "0085_auto_review_daily_cap",
+      "breakpoints": true
+    },
+    {
+      "idx": 86,
+      "version": "6",
+      "when": 1790841600000,
+      "tag": "0086_ticket_review_pr_cards",
+      "breakpoints": true
+    },
+    {
+      "idx": 87,
+      "version": "6",
+      "when": 1790928000000,
+      "tag": "0087_auto_post",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0069_ci_reviews.sql

@@ -0,0 +1,65 @@
+-- Postgres twin of migrations/0082_ci_reviews.sql, where the contract lives. CI review is
+-- local-only, so the tables exist in Postgres for schema parity. `job_id` is BIGINT: GitHub Actions
+-- job ids have passed 2^31.
+CREATE TABLE IF NOT EXISTS "ci_reviews" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"workspace_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"repo_id" integer NOT NULL,
+	"head_sha" text NOT NULL,
+	"failing_key" text,
+	"trigger_key" text,
+	"failing_checks" jsonb,
+	"trigger" text DEFAULT 'manual' NOT NULL,
+	"status" text NOT NULL,
+	"model" text NOT NULL,
+	"cost_usd" double precision,
+	"input_tokens" integer,
+	"output_tokens" integer,
+	"num_turns" integer,
+	"error" text,
+	"refused" text,
+	"ci_state" jsonb,
+	"summary" text,
+	"started_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ci_reviews_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "cir_pr_account_fk" FOREIGN KEY ("pr_id","account_id") REFERENCES "pull_requests"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "cir_account_pr_created_idx" ON "ci_reviews" USING btree ("account_id","pr_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "cir_account_ws_created_idx" ON "ci_reviews" USING btree ("account_id","workspace_id","created_at");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "ci_reviews_id_account" ON "ci_reviews" USING btree ("id","account_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "ci_review_items" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"ci_review_id" integer NOT NULL,
+	"account_id" integer NOT NULL,
+	"ref" text,
+	"check_name" text NOT NULL,
+	"job_id" bigint,
+	"step" text,
+	"url" text,
+	"sent" boolean DEFAULT false NOT NULL,
+	"carried" boolean DEFAULT false NOT NULL,
+	"status" text NOT NULL,
+	"not_checked_reason" text,
+	"cause" text,
+	"explanation" text,
+	"category" text,
+	"fixable_in_pr" boolean,
+	"path" text,
+	"line" integer,
+	"suggestion" text,
+	"related_files" jsonb,
+	"assessed_at_head" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ci_review_items_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "ciri_review_account_fk" FOREIGN KEY ("ci_review_id","account_id") REFERENCES "ci_reviews"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "ciri_review_idx" ON "ci_review_items" USING btree ("ci_review_id");

package/dist/db/migrations-pg/0070_workspace_auto_fix.sql

@@ -0,0 +1,3 @@
+-- Postgres twin of migrations/0083_workspace_auto_fix.sql — the per-workspace auto AI Fix switch.
+-- DEFAULT true so every existing workspace keeps today's behaviour. See the sqlite original.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_fix_enabled" boolean DEFAULT true NOT NULL;

package/dist/db/migrations-pg/0071_auto_fix_off_by_default.sql

@@ -0,0 +1,5 @@
+-- Postgres twin of migrations/0084_auto_fix_off_by_default.sql: auto AI Fix is OFF by default,
+-- and every existing workspace is switched off once.
+ALTER TABLE "workspaces" ALTER COLUMN "auto_fix_enabled" SET DEFAULT false;
+--> statement-breakpoint
+UPDATE "workspaces" SET "auto_fix_enabled" = false;

package/dist/db/migrations-pg/0072_auto_review_daily_cap.sql

@@ -0,0 +1,3 @@
+-- Postgres twin of migrations/0085_auto_review_daily_cap.sql: the per-workspace auto review daily
+-- cap. NULL = the default 20.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_review_daily_cap" integer;

package/dist/db/migrations-pg/0073_ticket_review_pr_cards.sql

@@ -0,0 +1,17 @@
+-- Postgres twin of migrations/0086_ticket_review_pr_cards.sql: ticket review contribution cards,
+-- one row per (account, PR, head commit). The contract lives in schema.sqlite.ts.
+CREATE TABLE IF NOT EXISTS "ticket_review_pr_cards" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"head_sha" text NOT NULL,
+	"card" jsonb NOT NULL,
+	"source" text NOT NULL,
+	"model" text NOT NULL,
+	"cost_usd" double precision,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ticket_review_pr_cards_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "trpc_pr_account_fk" FOREIGN KEY ("pr_id","account_id") REFERENCES "pull_requests"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "trpc_account_pr_head_ux" ON "ticket_review_pr_cards" USING btree ("account_id","pr_id","head_sha");

package/dist/db/migrations-pg/0074_auto_post.sql

@@ -0,0 +1,14 @@
+-- Postgres twin of migrations/0087_auto_post.sql: auto-posting of Claude review output. A
+-- per-workspace switch (NULL/false = off) + overrides-only settings, the per-run records and the
+-- per-item "posted automatically" flags. The contract lives in schema.sqlite.ts.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_enabled" boolean;
+--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_settings" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_review_findings" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;
+--> statement-breakpoint
+ALTER TABLE "ticket_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "ticket_review_items" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;

package/dist/db/migrations-pg/meta/_journal.json

@@ -484,6 +484,48 @@
       "when": 1790658000000,
       "tag": "0068_review_request_requester",
       "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "7",
+      "when": 1790661600000,
+      "tag": "0069_ci_reviews",
+      "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "7",
+      "when": 1790665200000,
+      "tag": "0070_workspace_auto_fix",
+      "breakpoints": true
+    },
+    {
+      "idx": 71,
+      "version": "7",
+      "when": 1790751600000,
+      "tag": "0071_auto_fix_off_by_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 72,
+      "version": "7",
+      "when": 1790838000000,
+      "tag": "0072_auto_review_daily_cap",
+      "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1790841600000,
+      "tag": "0073_ticket_review_pr_cards",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1790928000000,
+      "tag": "0074_auto_post",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/my-turn-dismissals.js

@@ -30,6 +30,12 @@
 // clock scores higher and wins `compareScored`'s age tie-break). Ties beyond that break on the
 // item's own id, so two reads of unchanged data keep the same card.
 //
+// ⚠ A CLAUDE REVIEW IS EXEMPT: it never competes for the PR's one card and is never removed by
+// it. A finished run, and above all an auto RE-review on a PR that already holds another job (a
+// reply in your thread), is new work of its own; folding it under that job hid every re-review on
+// a busy PR. Each run is its own item (its own id and `finishedAt` clock), so a newer run shows
+// even after an older one's card was dismissed.
+//
 // ⚠ IT IS A BOARD RULE, NOT A NOTIFICATION RULE. `getWorkspaceInsights` asks for it; the
 // account-wide `GET /api/my-turn` does not, because the browser-notification watcher diffs item
 // ids — a deduplicated list would flip the winner whenever the top job cleared and announce the
@@ -285,14 +291,6 @@ export function onePerPr(mt, order) {
             ref: `${i.threadId}`,
         }),
     };
-    const claude = {
-        of: (i) => ({
-            prId: i.prId,
-            reason: 'claude_review',
-            clockMs: clockMsOf(i.finishedAt),
-            ref: `${i.reviewId}`,
-        }),
-    };
     for (const i of mt.awaitingReview)
         offer(S.awaitingReview.of(i));
     for (const i of mt.mentions)
@@ -319,8 +317,6 @@ export function onePerPr(mt, order) {
         offer(threadReplies.of(i));
     for (const i of mt.ownThreads)
         offer(ownThreads.of(i));
-    for (const i of mt.claudeReviewsToAction)
-        offer(claude.of(i));
     return {
         awaitingReview: mt.awaitingReview.filter((i) => winnerIs(S.awaitingReview.of(i))),
         mentions: mt.mentions.filter((i) => winnerIs(S.mentions.of(i))),
@@ -335,7 +331,8 @@ export function onePerPr(mt, order) {
         threadsAwaiting: mt.threadsAwaiting.filter((i) => winnerIs(threadsAwaiting.of(i))),
         threadReplies: mt.threadReplies.filter((i) => winnerIs(threadReplies.of(i))),
         ownThreads: mt.ownThreads.filter((i) => winnerIs(ownThreads.of(i))),
-        claudeReviewsToAction: mt.claudeReviewsToAction.filter((i) => winnerIs(claude.of(i))),
+        // Exempt (header, rule 2): every Claude review keeps its own card.
+        claudeReviewsToAction: mt.claudeReviewsToAction,
         // Repo-grained: a branch is not a pull request, and never shares a key with one.
         redTrunks: mt.redTrunks,
     };