limn-review 0.1.126 → 0.1.128

package/dist/api/plugins/rate-limit.js

@@ -117,6 +117,21 @@ function tierFor(method, path) {
     // `startsWith('/api/workspaces')` and emphatically not `startsWith('/api/workspace')`:
     // the `/api/workspace-metrics` family is a SIBLING vocabulary, and a loose prefix over two
     // sibling vocabularies is precisely how one silently swallows the other.
+    // ⚠ THREE WORKSPACE ROUTES SPEND THE CUSTOMER'S TRACKER QUOTA, so they are decided ABOVE the
+    // `read` line below, by exact shape (tracker/routes.ts):
+    //   PUT /api/workspaces/:id/tracker              saving a tracker or token KICKS the ticket
+    //                                                worker for the account (up to 40 reads);
+    //   GET /api/workspaces/:id/tracker/jira-fields  the Settings connection check — one call to
+    //                                                the customer's Jira with the saved token.
+    //   GET /api/workspaces/:id/tracker/linear-check the Linear connection check — one call to
+    //                                                Linear with the saved key.
+    // All three take the 60/min `search` bucket, the "one upstream call per request" tier. The plain
+    // `GET …/tracker` is DB-only and stays on `read` with the rest of the family.
+    if (method === 'PUT' && /^\/api\/workspaces\/\d+\/tracker$/.test(path))
+        return [TIERS.search, TIERS.read];
+    if (!mutating && /^\/api\/workspaces\/\d+\/tracker\/(jira-fields|linear-check)$/.test(path)) {
+        return [TIERS.search, TIERS.read];
+    }
     if (path === '/api/workspaces' || path.startsWith('/api/workspaces/'))
         return [TIERS.read];
     // ---- Per-account settings writes: `read`, RECORDED rather than inherited ----
@@ -407,35 +422,32 @@ function tierFor(method, path) {
         return [TIERS.read];
     if (mutating && path === '/api/pro/slack/test')
         return [TIERS.ai, TIERS.aiHourly];
-    // ---- Jira API reads (must sit ABOVE the /api/pro/ AI-tier catch-all) ----
-    // GET /api/pro/jira/fields and GET /api/pro/prs/:id/jira-ticket each make ONE outbound call to
-    // the customer's own Jira with the workspace's saved token — a THIRD-PARTY quota (Jira Cloud rate
-    // limits per user) and up to a 10s wait on this process. Following the token: it is theirs, not
-    // ours, so the catch-all's 600/min GET→read branch is wrong; they take the 60/min `search`
-    // bucket, the "one upstream call per request" tier. Anchored on exact paths (the ticket route by
-    // a both-ends regex), so a sibling `/api/pro/prs/:id/*` route is not swept in.
-    if (!mutating && path === '/api/pro/jira/fields')
+    // ---- The issue tracker's PR routes (CORE since apiVersion 23 — tracker/routes.ts) ----
+    // GET /api/prs/:id/tracker-ticket answers a STORED row, but a ticket the worker never reached is
+    // read ONCE from the customer's tracker with the workspace's saved token — a THIRD-PARTY quota
+    // (Jira Cloud rate limits per user) and up to a 10s wait. `POST …/refresh` re-reads it now and
+    // `PUT …/ac-field` saves the criteria field and re-reads it: one upstream call each. Following
+    // the token: theirs, not ours, so the 60/min `search` bucket. Anchored at BOTH ends, so a sibling
+    // `/api/prs/:id/*` route is not swept in — and the segment is `tracker-ticket`, never a prefix of
+    // `ticket-reviews` (the ticket review's own, `read`-tier family below).
+    if (!mutating && /^\/api\/prs\/\d+\/tracker-ticket$/.test(path))
         return [TIERS.search, TIERS.read];
-    if (!mutating && /^\/api\/pro\/prs\/[^/]+\/jira-ticket$/.test(path)) {
+    if (method === 'POST' && /^\/api\/prs\/\d+\/tracker-ticket\/refresh$/.test(path)) {
         return [TIERS.search, TIERS.read];
     }
-    // The story panel's two writes on a STORED ticket (plugin 0038): `POST …/jira-ticket/refresh` reads
-    // that ticket from Jira again now, and `PUT …/jira-ticket/ac-field` saves the criteria field for
-    // its issue type and re-reads it — one upstream call each, the customer's quota. Spelled by exact
-    // verb + path: without these lines the catch-all parks a mutating /api/pro/ route on `ai`.
-    if (method === 'POST' && /^\/api\/pro\/prs\/[^/]+\/jira-ticket\/refresh$/.test(path)) {
+    if (method === 'PUT' && /^\/api\/prs\/\d+\/tracker-ticket\/ac-field$/.test(path)) {
         return [TIERS.search, TIERS.read];
     }
-    if (method === 'PUT' && /^\/api\/pro\/prs\/[^/]+\/jira-ticket\/ac-field$/.test(path)) {
-        return [TIERS.search, TIERS.read];
-    }
-    // POST /api/pro/ticket-links — the Open PRs cards' ticket row, ONE request per board: DB-only
-    // detection plus the STORED ticket rows (plugin 0038); a detected ticket with no row kicks the
-    // background worker, which spends the customer's Jira quota — so `search`, not `read`. A POST
-    // only because it carries a list of PR ids; it writes nothing itself. Without this line the catch-all would tier it
-    // on the verb and park a read on the 20/min `ai` bucket.
-    if (path === '/api/pro/ticket-links')
+    // POST /api/ticket-links — the Open PRs cards' ticket row, ONE request per board: DB-only
+    // detection plus the STORED ticket rows; a detected ticket with no row kicks the background
+    // worker, which spends the customer's tracker quota — so `search`, not `read`. A POST only
+    // because it carries a list of PR ids. EXACT `===`.
+    if (path === '/api/ticket-links')
         return [TIERS.search, TIERS.read];
+    // GET /api/ticket-merged-prs — the stacks' "Merged (n)" panel: DB-only (stored rows joined to
+    // pull_requests), no tracker call. `read`, DECIDED rather than inherited.
+    if (!mutating && path === '/api/ticket-merged-prs')
+        return [TIERS.read];
     // ---- AI generation ----
     // ⚠ RE-DECIDED, not inherited: `POST /api/pro/prs/:id/annotations/run` now spends GITHUB quota
     // as well as model tokens — one PR_DETAIL_QUERY per uncached PR for the anchor hunks

package/dist/app.js

@@ -12,6 +12,7 @@ import { authRoutes } from './api/routes/auth.js';
 import { healthRoutes } from './api/routes/health.js';
 import { aiRuntimeRoutes } from './api/routes/ai-runtime.js';
 import { registerAgenticRoutes } from './review/agentic.js';
+import { registerTracker } from './tracker/index.js';
 import { repoRoutes } from './api/routes/repos.js';
 import { workspaceRoutes } from './api/routes/workspaces.js';
 import { userRoutes } from './api/routes/users.js';
@@ -271,6 +272,10 @@ export async function buildApp() {
     // memory and AI Fix's fixer. CORE and FREE, LOCAL ONLY: `registerAgenticRoutes` registers
     // NOTHING in cloud (an explicit `isCloud` check) or under LIMN_AI_DISABLED. review/agentic.ts.
     registerAgenticRoutes(app);
+    // THE ISSUE TRACKER (CORE, FREE, BOTH MODES — apiVersion 23; docs/TRACKERS.md): the workspace's
+    // tracker settings, the stored-ticket routes behind the PR pane's story panel, the Open PRs ticket
+    // row and stacks. Unconditional: no capability, no plugin.
+    registerTracker(app);
     return app;
 }
 //# sourceMappingURL=app.js.map

package/dist/config.js

@@ -536,6 +536,9 @@ export const config = {
     // every member's worktree.
     ticketReviewBudgetUsd: floatFromEnv('TICKET_REVIEW_BUDGET_USD', 4),
     ticketReviewMaxTurns: intFromEnv('TICKET_REVIEW_MAX_TURNS', 40),
+    // The per-card spend cap of the ticket review's CARD PRE-PASS (Sonnet 5, diff-only, one tool —
+    // review/ticket-review/prepass.ts). Its spend is added to the ticket run's cost. Env only.
+    ticketCardBudgetUsd: floatFromEnv('TICKET_CARD_BUDGET_USD', 0.4),
     // AUTOMATIC ticket reviews (trigger 'auto' / 'cascade') per workspace per UTC day. Not shared with
     // the PR review's own auto cap. Manual runs never count. Default = shared TICKET_REVIEW_DAILY_CAP.
     ticketReviewDailyCap: intFromEnv('TICKET_REVIEW_DAILY_CAP', 20),

package/dist/db/erase-account.js

@@ -128,6 +128,12 @@ export async function eraseAccountData(accountId) {
             .delete(schema.ticketReviews)
             .where(eq(schema.ticketReviews.accountId, accountId))
             .execute();
+        // Ticket review contribution cards (migration 0086 / pg 0073): model text describing the user's
+        // PRs. The repo loop has normally taken them with their PRs; explicit, like every agentic table.
+        await tx
+            .delete(schema.ticketReviewPrCards)
+            .where(eq(schema.ticketReviewPrCards.accountId, accountId))
+            .execute();
         // CI reviews (migration 0082 / pg 0069), items first. The repo loop has normally taken them with
         // their PRs; explicit, like every agentic table.
         await tx
@@ -138,6 +144,14 @@ export async function eraseAccountData(accountId) {
         // AI Fix runs (patches of the user's code + the prompts they were built from). Core since
         // migration 0074 / pg 0061 — the plugin's erasure hook used to own them.
         await tx.delete(schema.aiFixes).where(eq(schema.aiFixes.accountId, accountId)).execute();
+        // THE ISSUE TRACKER (core since migration 0088 / pg 0075 — the plugin's erasure hook used to own
+        // these): the stored tickets (story text from the customer's tracker), the acceptance-criteria
+        // field choices, and the workspace tracker rows — which hold the customer's internal tracker
+        // hostname AND the sealed API token. No FKs on the first two, so the explicit deletes are the
+        // whole guarantee; workspace_trackers cascades from workspaces too, and is explicit anyway.
+        await tx.delete(schema.trackerTickets).where(eq(schema.trackerTickets.accountId, accountId)).execute();
+        await tx.delete(schema.jiraAcFields).where(eq(schema.jiraAcFields.accountId, accountId)).execute();
+        await tx.delete(schema.workspaceTrackers).where(eq(schema.workspaceTrackers.accountId, accountId)).execute();
         // The AI spend ledger (token/credit counts — no prompt text).
         await tx.delete(aiUsage).where(eq(aiUsage.accountId, accountId)).execute();
         // Any aggregate rows contributed to the cross-org benchmark. Consent was the basis for
@@ -218,6 +232,12 @@ export function accountScopedTables() {
             col: schema.ticketReviewItems.accountId,
             table: schema.ticketReviewItems,
         },
+        // Contribution cards (migration 0086 / pg 0073) — one per (PR, head); erased explicitly above.
+        {
+            name: 'ticketReviewPrCards',
+            col: schema.ticketReviewPrCards.accountId,
+            table: schema.ticketReviewPrCards,
+        },
         // CI reviews (migration 0082 / pg 0069) — the runs and their per-check items. Both carry their
         // own accountId; both are erased explicitly above.
         { name: 'ciReviews', col: schema.ciReviews.accountId, table: schema.ciReviews },
@@ -227,6 +247,11 @@ export function accountScopedTables() {
         // cascades: the explicit delete above is the whole guarantee. (`reviewLearnings`, review
         // memory's table, sat here until migration 0075 / pg 0062 DROPPED it.)
         { name: 'aiFixes', col: schema.aiFixes.accountId, table: schema.aiFixes },
+        // The issue tracker (migration 0088 / pg 0075). All three carry their own accountId and are
+        // erased explicitly above; `workspaceTrackers` holds a credential.
+        { name: 'trackerTickets', col: schema.trackerTickets.accountId, table: schema.trackerTickets },
+        { name: 'jiraAcFields', col: schema.jiraAcFields.accountId, table: schema.jiraAcFields },
+        { name: 'workspaceTrackers', col: schema.workspaceTrackers.accountId, table: schema.workspaceTrackers },
         // `myTurnDismissals` sat here until migration 0060 / pg 0047 DROPPED the table. It is named
         // rather than silently absent because this list is a checklist, and a checklist that shortens
         // with no explanation reads as an omission — the exact failure this function guards against.

package/dist/db/export-account.js

@@ -72,6 +72,21 @@ export async function exportAccountData(accountId) {
     // The child tables reach their account through prId. An account with no PRs short-circuits
     // to empty arrays rather than issuing an `IN ()`.
     const childRows = async (fn) => (prIds.length === 0 ? [] : fn(prIds));
+    // The tracker rows — explicit columns, the token reduced to its presence below.
+    const trackerRows = await db
+        .select({
+        workspaceId: schema.workspaceTrackers.workspaceId,
+        provider: schema.workspaceTrackers.provider,
+        baseUrl: schema.workspaceTrackers.baseUrl,
+        projectKeys: schema.workspaceTrackers.projectKeys,
+        matchScope: schema.workspaceTrackers.matchScope,
+        email: schema.workspaceTrackers.authEmail,
+        hasToken: schema.workspaceTrackers.authToken,
+        updatedAt: schema.workspaceTrackers.updatedAt,
+    })
+        .from(schema.workspaceTrackers)
+        .where(eq(schema.workspaceTrackers.accountId, accountId))
+        .execute();
     const [reviewRows, threadRows, reviewCommentRows, prCommentRows, eventRows, workspaceRows, workspaceRepoRows, usageRows, workspaceReviewerRows, benchmarkRows, autoMergeRows,] = await Promise.all([
         childRows((ids) => db.select().from(reviews).where(inArray(reviews.prId, ids)).execute()),
         childRows((ids) => db.select().from(reviewThreads).where(inArray(reviewThreads.prId, ids)).execute()),
@@ -184,6 +199,8 @@ export async function exportAccountData(accountId) {
         workspaceReviewers: workspaceReviewerRows,
         benchmarkContributions: benchmarkRows,
         autoMergeRequests: autoMergeRows,
+        // ⚠ PRESENCE ONLY — never the stored token, in any form.
+        workspaceTrackers: trackerRows.map((t) => ({ ...t, hasToken: t.hasToken != null && t.hasToken !== '' })),
     };
 }
 //# sourceMappingURL=export-account.js.map

package/dist/db/migrations/0084_auto_fix_off_by_default.sql

@@ -0,0 +1,7 @@
+-- AUTO AI FIX IS OFF BY DEFAULT. 0083 added `workspaces.auto_fix_enabled` DEFAULT 1 so nothing
+-- changed on upgrade; the product decision since is OFF until someone switches it on. Every
+-- existing workspace is switched off once here (the switch shipped one release earlier, so no one
+-- has had time to choose it). SQLite cannot change a column default in place, so the 0083 DDL
+-- default stays 1; both workspace inserts in db/queries.ts write `autoFixEnabled: false`
+-- explicitly. The Postgres twin is migrations-pg/0071_auto_fix_off_by_default.sql.
+UPDATE `workspaces` SET `auto_fix_enabled` = 0;

package/dist/db/migrations/0085_auto_review_daily_cap.sql

@@ -0,0 +1,6 @@
+-- AUTO REVIEW DAILY CAP, PER WORKSPACE. How many auto Claude reviews a workspace may start per UTC
+-- day. OVERRIDES ONLY: NULL = the product default (20, `AUTO_REVIEW_DAILY_CAP`), resolved through
+-- `resolveAutoReviewDailyCap` (review/claude-review/auto-settings.ts); the PUT route bounds it
+-- 1..500. Nullable with no default, so no workspace insert has to name it. The Postgres twin is
+-- migrations-pg/0072_auto_review_daily_cap.sql.
+ALTER TABLE `workspaces` ADD `auto_review_daily_cap` integer;

package/dist/db/migrations/0086_ticket_review_pr_cards.sql

@@ -0,0 +1,24 @@
+-- TICKET REVIEW CONTRIBUTION CARDS. One row per (account, PR, head commit): a model-written,
+-- verdict-free description of what that PR's head does (summary, interfaces, the story criteria it
+-- moves forward, loose ends) plus the PR's changed files at that head (server-written). A ticket
+-- review reads a member whose CURRENT head has a card as the card, not as its diff; the run writes a
+-- card for every member it read as a diff (source 'story_check') and a cheap per-PR pre-pass writes
+-- the overflow (source 'prepass', with its own cost). Re-writing the same head replaces the card.
+-- Tenancy: a composite FK against pull_requests(id, account_id). Both delete paths (deleteRepo,
+-- retention's deletePrSubtree, via db/ticket-review-prune.ts) and eraseAccountData delete these rows
+-- explicitly. The Postgres twin is migrations-pg/0073_ticket_review_pr_cards.sql.
+CREATE TABLE IF NOT EXISTS `ticket_review_pr_cards` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`head_sha` text NOT NULL,
+	`card` text NOT NULL,
+	`source` text NOT NULL,
+	`model` text NOT NULL,
+	`cost_usd` real,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `trpc_pr_account_fk` FOREIGN KEY (`pr_id`,`account_id`) REFERENCES `pull_requests`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `trpc_account_pr_head_ux` ON `ticket_review_pr_cards` (`account_id`,`pr_id`,`head_sha`);

package/dist/db/migrations/0087_auto_post.sql

@@ -0,0 +1,21 @@
+-- AUTO-POSTING OF CLAUDE REVIEW OUTPUT (review/claude-review/auto-post.ts, review/ticket-review/
+-- auto-post.ts). A per-workspace master switch, OFF for every workspace existing and new, plus the
+-- per-run records of what was posted and the per-item "posted automatically" flag.
+--   workspaces.auto_post_enabled      NULL/false = off. Nullable, no default: no insert names it.
+--   workspaces.auto_post_settings     JSON, OVERRIDES ONLY ({ scope?, kinds? }); NULL = defaults.
+--   claude_reviews.auto_post          JSON ClaudeAutoPostRecord; NULL = never looked at.
+--   claude_review_findings.posted_auto  true = posted by auto-posting.
+--   ticket_reviews.auto_post          JSON TicketAutoPostRecord; NULL = never looked at.
+--   ticket_review_items.posted_auto   true = posted by auto-posting (carried with the posting).
+-- The Postgres twin is migrations-pg/0074_auto_post.sql.
+ALTER TABLE `workspaces` ADD `auto_post_enabled` integer;
+--> statement-breakpoint
+ALTER TABLE `workspaces` ADD `auto_post_settings` text;
+--> statement-breakpoint
+ALTER TABLE `claude_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `claude_review_findings` ADD `posted_auto` integer;
+--> statement-breakpoint
+ALTER TABLE `ticket_reviews` ADD `auto_post` text;
+--> statement-breakpoint
+ALTER TABLE `ticket_review_items` ADD `posted_auto` integer;

package/dist/db/migrations/0088_issue_tracker.sql

@@ -0,0 +1,109 @@
+-- THE ISSUE TRACKER MOVES TO CORE (apiVersion 23). Ticket links, the stored tickets, the story panel
+-- and the Open PRs ticket stacks are FREE and run in the public `npx limn-review` install, so their
+-- tables leave the private plugin. The Postgres twin is migrations-pg/0075_issue_tracker.sql;
+-- docs/TRACKERS.md has the contract and docs/MIGRATIONS.md the history.
+--
+--   workspace_trackers   NEW. ONE tracker per workspace: provider, base URL, project-key allowlist,
+--                        match scope, and the Jira email + SEALED token. The values move here from
+--                        the plugin's `pro_workspace_settings` (plugin 0031/0035).
+--   tracker_tickets      NEW. The provider-aware generalisation of the plugin's
+--                        `pro_pr_jira_tickets` (plugin 0038/0039) — the same columns plus
+--                        `provider` (DEFAULT 'jira': every row that existed was a Jira row).
+--   pro_jira_ac_fields   ADOPTED IN PLACE, exactly the ai_fixes precedent (0074): same name, same
+--                        columns, same index name. Where the plugin created it this is a no-op and
+--                        its rows stay; on a fresh or plugin-less install it is created here.
+--
+-- ⚠ NO DATA IS COPIED BY THIS FILE, AND THAT IS DELIBERATE. The source rows live in PLUGIN tables,
+-- which do not exist on a fresh install, on a plugin-less install, or (in the pg twin's case) may
+-- not exist at all — and SQLite has no conditional DDL/DML to test for a table. The values are
+-- MOVED by a guarded BOOT-TIME step instead (src/tracker/legacy-import.ts, run after the plugin
+-- binds): it tests each source table and column for existence, copies with ON CONFLICT DO NOTHING,
+-- and then CLEARS the source (deletes the ticket rows, NULLs the tracker columns) in the same
+-- transaction — so a second boot finds nothing to move, a token is never left in two places, and a
+-- value cleared in core is never resurrected from the old copy.
+--
+-- ⚠ WHY A NEW TICKETS TABLE RATHER THAN ADOPTING `pro_pr_jira_tickets` + ADD COLUMN `provider`.
+-- Adopting needs `ALTER TABLE … ADD COLUMN provider` on a table this file may or may not have just
+-- created, and `changed_at` (plugin 0039) may or may not already be on it — SQLite has no
+-- ADD COLUMN IF NOT EXISTS, so one of the two install shapes would fail the boot. A new table has
+-- one shape everywhere. Plugin 0038/0039 are stripped to no-ops in the same change, so a fresh
+-- install never grows the old table at all.
+--
+-- Tenancy: `workspace_trackers.workspace_id` arrives in a request PATH, so its FK is the named
+-- COMPOSITE one onto `workspaces (id, account_id)`. `tracker_tickets` and `pro_jira_ac_fields` are
+-- written only by the server (the worker, and a route that resolves the PR's own workspace): no FKs,
+-- like the tables they replace; every read predicates on account_id, both delete paths prune
+-- tracker_tickets, and all three are in `accountScopedTables()`.
+CREATE TABLE IF NOT EXISTS `workspace_trackers` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`provider` text,
+	`base_url` text,
+	`project_keys` text,
+	`match_scope` text,
+	`auth_email` text,
+	`auth_token` text,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`account_id`) REFERENCES `accounts`(`id`) ON UPDATE no action ON DELETE cascade,
+	CONSTRAINT `workspace_trackers_workspace_account_fk` FOREIGN KEY (`workspace_id`,`account_id`) REFERENCES `workspaces`(`id`,`account_id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `workspace_trackers_account_workspace` ON `workspace_trackers` (`account_id`,`workspace_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `tracker_tickets` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`pr_id` integer NOT NULL,
+	`provider` text DEFAULT 'jira' NOT NULL,
+	`issue_key` text NOT NULL,
+	`detected_from` text NOT NULL,
+	`detect_order` integer NOT NULL,
+	`api_root` text NOT NULL,
+	`url` text NOT NULL,
+	`state` text NOT NULL,
+	`error_code` text,
+	`title` text,
+	`description` text,
+	`acceptance_criteria` text,
+	`ac_field_id` text,
+	`ac_field_name` text,
+	`ac_field_source` text,
+	`issue_type_id` text,
+	`issue_type_name` text,
+	`status_name` text,
+	`status_category` text,
+	`assignee_name` text,
+	`assignee_account_id` text,
+	`assignee_avatar_url` text,
+	`candidates_json` text,
+	`omitted_candidates` integer DEFAULT 0 NOT NULL,
+	`fetched_at` integer,
+	`checked_at` integer NOT NULL,
+	`next_check_at` integer NOT NULL,
+	`changed_at` integer
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `tracker_tickets_account_pr_key` ON `tracker_tickets` (`account_id`,`pr_id`,`issue_key`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `tracker_tickets_account_ws_type` ON `tracker_tickets` (`account_id`,`workspace_id`,`issue_type_id`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `tracker_tickets_account_site_key` ON `tracker_tickets` (`account_id`,`provider`,`api_root`,`issue_key`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `tracker_tickets_account_changed` ON `tracker_tickets` (`account_id`,`changed_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `tracker_tickets_pr` ON `tracker_tickets` (`pr_id`);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS `pro_jira_ac_fields` (
+	`id` integer PRIMARY KEY AUTOINCREMENT,
+	`account_id` integer NOT NULL,
+	`workspace_id` integer NOT NULL,
+	`api_root` text NOT NULL,
+	`issue_type_id` text NOT NULL,
+	`field_id` text NOT NULL,
+	`field_name` text NOT NULL,
+	`updated_at` integer NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS `pro_jira_ac_fields_account_ws_site_type` ON `pro_jira_ac_fields` (`account_id`,`workspace_id`,`api_root`,`issue_type_id`);

package/dist/db/migrations/0089_github_issue_links.sql

@@ -0,0 +1,18 @@
+-- GITHUB ISSUES — the tracker's second reading adapter (docs/TRACKERS.md § GitHub Issues). The
+-- Postgres twin is migrations-pg/0076_github_issue_links.sql.
+--
+-- A GitHub Issues workspace links a pull request to the issues it CLOSES — GitHub's own
+-- `closingIssuesReferences` ("Fixes #12", "Closes owner/repo#12", a Development-panel link), never
+-- a bare "#12" mention. That list is a fact about the PR that the view paths (the PR pane's chips,
+-- the Open PRs ticket row) must read without calling GitHub, so it is stored on the PR:
+--
+--   closing_issues             JSON array of lower-cased `owner/repo#12` keys, in GitHub's order.
+--   closing_issues_checked_at  when it was last read.
+--
+-- ⚠ NULL IS "NEVER READ", NOT "CLOSES NOTHING" (`[]` is GitHub's positive statement). Both are
+-- written ONLY by the tracker worker's targeted `nodes(ids:)` step, and only for PRs in a workspace
+-- whose tracker is GitHub Issues — the repo walk's query is unchanged, so every other workspace pays
+-- nothing for this. Additive; no data to move.
+ALTER TABLE `pull_requests` ADD `closing_issues` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `closing_issues_checked_at` integer;

package/dist/db/migrations/0090_linear_links.sql

@@ -0,0 +1,22 @@
+-- LINEAR — the tracker's third reading adapter (docs/TRACKERS.md § Linear). The Postgres twin is
+-- migrations-pg/0077_linear_links.sql.
+--
+-- A Linear workspace links a pull request to the Linear issues Linear's GitHub integration ATTACHED
+-- it to (`attachmentsForURL` on the PR's GitHub URL — it sees the PR body, which lean storage never
+-- keeps), in addition to the keys detection finds in the title and branch. That list is a fact the
+-- view paths must read without calling Linear, so it is stored on the PR:
+--
+--   linear_links             JSON array of upper-cased `ENG-123` keys, in Linear's order.
+--   linear_links_root        the Linear workspace they were read against (`https://linear.app/<key>`);
+--                            a different current root means "never read" for this workspace.
+--   linear_links_checked_at  when they were last read.
+--
+-- ⚠ NULL IS "NEVER READ", NOT "ATTACHED TO NOTHING" (`[]` is Linear's positive statement) — and for
+-- Linear an unread PR still shows the tickets detection finds. Written ONLY by the tracker worker,
+-- only for PRs in a workspace whose tracker is Linear with a saved key; the repo walk is unchanged,
+-- so every other workspace pays nothing. Additive; no data to move.
+ALTER TABLE `pull_requests` ADD `linear_links` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `linear_links_root` text;
+--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `linear_links_checked_at` integer;

package/dist/db/migrations/meta/_journal.json

@@ -589,6 +589,55 @@
       "when": 1790665200000,
       "tag": "0083_workspace_auto_fix",
       "breakpoints": true
+    },
+    {
+      "idx": 84,
+      "version": "6",
+      "when": 1790751600000,
+      "tag": "0084_auto_fix_off_by_default",
+      "breakpoints": true
+    },
+    {
+      "idx": 85,
+      "version": "6",
+      "when": 1790838000000,
+      "tag": "0085_auto_review_daily_cap",
+      "breakpoints": true
+    },
+    {
+      "idx": 86,
+      "version": "6",
+      "when": 1790841600000,
+      "tag": "0086_ticket_review_pr_cards",
+      "breakpoints": true
+    },
+    {
+      "idx": 87,
+      "version": "6",
+      "when": 1790928000000,
+      "tag": "0087_auto_post",
+      "breakpoints": true
+    },
+    {
+      "idx": 88,
+      "version": "6",
+      "when": 1791014400000,
+      "tag": "0088_issue_tracker",
+      "breakpoints": true
+    },
+    {
+      "idx": 89,
+      "version": "6",
+      "when": 1791100800000,
+      "tag": "0089_github_issue_links",
+      "breakpoints": true
+    },
+    {
+      "idx": 90,
+      "version": "6",
+      "when": 1791187200000,
+      "tag": "0090_linear_links",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0071_auto_fix_off_by_default.sql

@@ -0,0 +1,5 @@
+-- Postgres twin of migrations/0084_auto_fix_off_by_default.sql: auto AI Fix is OFF by default,
+-- and every existing workspace is switched off once.
+ALTER TABLE "workspaces" ALTER COLUMN "auto_fix_enabled" SET DEFAULT false;
+--> statement-breakpoint
+UPDATE "workspaces" SET "auto_fix_enabled" = false;

package/dist/db/migrations-pg/0072_auto_review_daily_cap.sql

@@ -0,0 +1,3 @@
+-- Postgres twin of migrations/0085_auto_review_daily_cap.sql: the per-workspace auto review daily
+-- cap. NULL = the default 20.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_review_daily_cap" integer;

package/dist/db/migrations-pg/0073_ticket_review_pr_cards.sql

@@ -0,0 +1,17 @@
+-- Postgres twin of migrations/0086_ticket_review_pr_cards.sql: ticket review contribution cards,
+-- one row per (account, PR, head commit). The contract lives in schema.sqlite.ts.
+CREATE TABLE IF NOT EXISTS "ticket_review_pr_cards" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"head_sha" text NOT NULL,
+	"card" jsonb NOT NULL,
+	"source" text NOT NULL,
+	"model" text NOT NULL,
+	"cost_usd" double precision,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "ticket_review_pr_cards_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "accounts"("id") ON DELETE cascade,
+	CONSTRAINT "trpc_pr_account_fk" FOREIGN KEY ("pr_id","account_id") REFERENCES "pull_requests"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "trpc_account_pr_head_ux" ON "ticket_review_pr_cards" USING btree ("account_id","pr_id","head_sha");

package/dist/db/migrations-pg/0074_auto_post.sql

@@ -0,0 +1,14 @@
+-- Postgres twin of migrations/0087_auto_post.sql: auto-posting of Claude review output. A
+-- per-workspace switch (NULL/false = off) + overrides-only settings, the per-run records and the
+-- per-item "posted automatically" flags. The contract lives in schema.sqlite.ts.
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_enabled" boolean;
+--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN IF NOT EXISTS "auto_post_settings" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "claude_review_findings" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;
+--> statement-breakpoint
+ALTER TABLE "ticket_reviews" ADD COLUMN IF NOT EXISTS "auto_post" jsonb;
+--> statement-breakpoint
+ALTER TABLE "ticket_review_items" ADD COLUMN IF NOT EXISTS "posted_auto" boolean;

package/dist/db/migrations-pg/0075_issue_tracker.sql

@@ -0,0 +1,77 @@
+-- Postgres twin of migrations/0088_issue_tracker.sql: the issue tracker moves to CORE
+-- (apiVersion 23). `workspace_trackers` and `tracker_tickets` are new; `pro_jira_ac_fields` is
+-- ADOPTED IN PLACE (the plugin's pg 0038 shape, same index name). No data is copied here — the
+-- boot-time move (src/tracker/legacy-import.ts) does that, guarded on the plugin tables existing.
+-- Rationale in the sqlite twin and docs/TRACKERS.md.
+CREATE TABLE IF NOT EXISTS "workspace_trackers" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL REFERENCES "accounts"("id") ON DELETE cascade,
+	"workspace_id" integer NOT NULL,
+	"provider" text,
+	"base_url" text,
+	"project_keys" text,
+	"match_scope" text,
+	"auth_email" text,
+	"auth_token" text,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "workspace_trackers_workspace_account_fk" FOREIGN KEY ("workspace_id","account_id") REFERENCES "workspaces"("id","account_id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "workspace_trackers_account_workspace" ON "workspace_trackers" USING btree ("account_id","workspace_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "tracker_tickets" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"account_id" integer NOT NULL,
+	"workspace_id" integer NOT NULL,
+	"pr_id" integer NOT NULL,
+	"provider" text DEFAULT 'jira' NOT NULL,
+	"issue_key" text NOT NULL,
+	"detected_from" text NOT NULL,
+	"detect_order" integer NOT NULL,
+	"api_root" text NOT NULL,
+	"url" text NOT NULL,
+	"state" text NOT NULL,
+	"error_code" text,
+	"title" text,
+	"description" text,
+	"acceptance_criteria" text,
+	"ac_field_id" text,
+	"ac_field_name" text,
+	"ac_field_source" text,
+	"issue_type_id" text,
+	"issue_type_name" text,
+	"status_name" text,
+	"status_category" text,
+	"assignee_name" text,
+	"assignee_account_id" text,
+	"assignee_avatar_url" text,
+	"candidates_json" text,
+	"omitted_candidates" integer DEFAULT 0 NOT NULL,
+	"fetched_at" timestamp with time zone,
+	"checked_at" timestamp with time zone NOT NULL,
+	"next_check_at" timestamp with time zone NOT NULL,
+	"changed_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "tracker_tickets_account_pr_key" ON "tracker_tickets" USING btree ("account_id","pr_id","issue_key");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tracker_tickets_account_ws_type" ON "tracker_tickets" USING btree ("account_id","workspace_id","issue_type_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tracker_tickets_account_site_key" ON "tracker_tickets" USING btree ("account_id","provider","api_root","issue_key");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tracker_tickets_account_changed" ON "tracker_tickets" USING btree ("account_id","changed_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "tracker_tickets_pr" ON "tracker_tickets" USING btree ("pr_id");
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "pro_jira_ac_fields" (
+	"id" serial PRIMARY KEY,
+	"account_id" integer NOT NULL,
+	"workspace_id" integer NOT NULL,
+	"api_root" text NOT NULL,
+	"issue_type_id" text NOT NULL,
+	"field_id" text NOT NULL,
+	"field_name" text NOT NULL,
+	"updated_at" timestamptz NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "pro_jira_ac_fields_account_ws_site_type" ON "pro_jira_ac_fields" ("account_id","workspace_id","api_root","issue_type_id");

package/dist/db/migrations-pg/0076_github_issue_links.sql

@@ -0,0 +1,6 @@
+-- GITHUB ISSUES LINKS — the Postgres twin of migrations/0089_github_issue_links.sql (read that file
+-- for the rationale). The issues a PR closes, as GitHub states them, read only for GitHub Issues
+-- workspaces; NULL is "never read", never "closes nothing". Additive.
+ALTER TABLE "pull_requests" ADD COLUMN IF NOT EXISTS "closing_issues" jsonb;
+--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN IF NOT EXISTS "closing_issues_checked_at" timestamp with time zone;

package/dist/db/migrations-pg/0077_linear_links.sql

@@ -0,0 +1,8 @@
+-- LINEAR LINKS — the Postgres twin of migrations/0090_linear_links.sql (read that file for the
+-- rationale). The Linear issues a PR is attached to, read only for Linear workspaces with a saved
+-- key, and the Linear workspace they were read against; NULL is "never read". Additive.
+ALTER TABLE "pull_requests" ADD COLUMN IF NOT EXISTS "linear_links" jsonb;
+--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN IF NOT EXISTS "linear_links_root" text;
+--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN IF NOT EXISTS "linear_links_checked_at" timestamp with time zone;