limn-review 0.1.128 → 0.1.129

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,21 @@
+# Third-party notices
+
+Limn includes material from the projects below. Each is used under the licence shown.
+
+## Material Icon Theme
+
+The file-type icons in the Changes tab (`apps/frontend/src/components/FileTypeIcons.tsx`) are
+copied from Material Icon Theme by Material Extensions, npm `material-icon-theme@5.39.0`.
+
+Source: https://github.com/material-extensions/vscode-material-icon-theme
+
+```
+The MIT License (MIT)
+Copyright (c) 2025 Material Extensions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```

package/dist/ai/agent-isolation.js

@@ -0,0 +1,45 @@
+// AGENT ISOLATION — every Agent SDK run in this app sees ONLY the tools it registered itself.
+//
+// ⚠ MEASURED (2026-10-10): a run on the reader's ambient Claude Code login, with `tools: []`,
+// `settingSources: []` and `bypassPermissions`, still lists the ACCOUNT'S claude.ai CONNECTORS
+// (`mcp__claude_ai_Claude_Docs__create/update/delete/export`, …) a few seconds after start — they
+// connect after `system/init`, so the init message shows none. A trial agent wrote a report into the
+// user's Claude Docs unprompted. Claude Review reads PR text strangers write, so a prompt injection
+// could create, edit or delete documents in the reader's claude.ai account. `strictMcpConfig: true`
+// removes them (measured: 8 connector tools → 0); the PreToolUse hook below is the backstop that
+// refuses any `mcp__` tool whose server the run did not register, and its deny holds under
+// bypassPermissions (the path guard relies on the same property).
+//
+// EVERY `query({ options })` spreads `ISOLATED_MCP` and adds `ownToolsOnlyHook(<its server names>)`
+// to `PreToolUse` — pinned by agent-isolation.test.ts, which reads every call site.
+export const ISOLATED_MCP = { strictMcpConfig: true };
+/** The MCP server a tool name belongs to (`mcp__<server>__<tool>`), or null for a built-in tool. */
+export function mcpServerOf(toolName) {
+    if (!toolName.startsWith('mcp__'))
+        return null;
+    const rest = toolName.slice('mcp__'.length);
+    const cut = rest.indexOf('__');
+    return cut < 0 ? rest : rest.slice(0, cut);
+}
+/** True when `toolName` is an MCP tool from a server this run did not register. */
+export function isForeignMcpTool(toolName, ownServers) {
+    const server = mcpServerOf(toolName);
+    return server != null && !ownServers.includes(server);
+}
+/** One SDK PreToolUse matcher entry refusing every MCP tool outside `ownServers`. */
+export function ownToolsOnlyHook(ownServers) {
+    return {
+        hooks: [
+            async (input) => input.hook_event_name === 'PreToolUse' && isForeignMcpTool(input.tool_name ?? '', ownServers)
+                ? {
+                    hookSpecificOutput: {
+                        hookEventName: 'PreToolUse',
+                        permissionDecision: 'deny',
+                        permissionDecisionReason: `${input.tool_name} is not available in this run.`,
+                    },
+                }
+                : { continue: true },
+        ],
+    };
+}
+//# sourceMappingURL=agent-isolation.js.map

package/dist/ai/runtime.js

@@ -9,6 +9,9 @@
 //
 //   @anthropic-ai/claude-agent-sdk · @anthropic-ai/sdk · @modelcontextprotocol/sdk · zod
 //
+// (plus the reference-docs converters — mammoth · turndown · turndown-plugin-gfm — which ride the
+// same download because only an agentic feature uses them; see AI_RUNTIME_LATER_PACKAGES)
+//
 // at EXACT pinned versions into `<dataDir>/ai-runtime` (`~/.limn/ai-runtime`), by
 // `npm install --prefix`, after the reader presses "Set up AI" or runs `limn ai install`. The pins
 // ride the release manifest as a NON-dependency field (`limnAiRuntime`), generated by
@@ -43,7 +46,19 @@ export const AI_RUNTIME_PACKAGES = [
     '@anthropic-ai/sdk',
     '@modelcontextprotocol/sdk',
     'zod',
+    // THE REFERENCE-DOCS CONVERTERS (docs/REFERENCE-DOCS.md): Word → HTML, and HTML → markdown with
+    // GitHub tables. Small, pure JS, used only by the agentic docs library — so they ride the same
+    // on-demand download rather than every `npx limn-review`. PDF needs none: Claude reads it natively.
+    'mammoth',
+    'turndown',
+    'turndown-plugin-gfm',
 ];
+/**
+ * The packages added to the runtime AFTER it first shipped. A runtime directory installed before
+ * them still runs every agent, so a missing one reads as STALE ("Set up AI again"), never ABSENT —
+ * only the feature that needs it (the docs library's Word / web-page conversion) refuses until then.
+ */
+export const AI_RUNTIME_LATER_PACKAGES = ['mammoth', 'turndown', 'turndown-plugin-gfm'];
 /** The release manifest's field carrying the pins. Spelled once; build-release.mjs mirrors it. */
 export const AI_RUNTIME_MANIFEST_FIELD = 'limnAiRuntime';
 /** An exact semver version — no range, no tag. Anything else is refused before npm sees it. */
@@ -59,6 +74,9 @@ const ENTRY_SUBPATH = {
     '@anthropic-ai/sdk': '.',
     '@modelcontextprotocol/sdk': './server',
     zod: '.',
+    mammoth: '.',
+    turndown: '.',
+    'turndown-plugin-gfm': '.',
 };
 const specifierFor = (name) => ENTRY_SUBPATH[name] === '.' ? name : `${name}${ENTRY_SUBPATH[name].slice(1)}`;
 export const AI_RUNTIME_MISSING_MESSAGE = 'AI is not set up yet. Press "Set up AI" in Limn, or run: limn ai install';
@@ -88,7 +106,7 @@ function readJson(path) {
  * which ESM ignores, so a package found there would be one the real import cannot see. (Under
  * pnpm/vitest NODE_PATH points into the workspace store, which is how this was found.)
  */
-function findPackageDir(spec, fromDir) {
+export function findPackageDir(spec, fromDir) {
     let dir = resolve(fromDir);
     for (;;) {
         const candidate = join(dir, 'node_modules', spec);
@@ -164,12 +182,84 @@ export function esmEntryOf(pkgDir, subpath = '.') {
     const file = resolve(pkgDir, rel);
     return existsSync(file) ? file : null;
 }
-function installedVersion(pkgDir) {
+export function installedVersion(pkgDir) {
     if (!pkgDir)
         return null;
     const v = readJson(join(pkgDir, 'package.json'))?.version;
     return typeof v === 'string' ? v : null;
 }
+/**
+ * npm's own JS entry run with THIS node, so there is no shell and no PATH guessing on Windows
+ * (where `npm` is a .cmd that cannot be spawned without one).
+ */
+export function resolveNpm(env = process.env) {
+    const viaEnv = env.npm_execpath;
+    if (viaEnv && /npm-cli\.c?js$/.test(viaEnv) && existsSync(viaEnv)) {
+        return { command: process.execPath, args: [viaEnv] };
+    }
+    const nodeDir = dirname(process.execPath);
+    for (const candidate of [
+        join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+        join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    ]) {
+        if (existsSync(candidate))
+            return { command: process.execPath, args: [candidate] };
+    }
+    if (process.platform !== 'win32')
+        return { command: 'npm', args: [] };
+    return null;
+}
+/** Run one npm command to completion. Never throws; a spawn failure comes back as `error`. */
+export function spawnNpm(npm, args, opts) {
+    const tail = [];
+    return new Promise((done) => {
+        let child;
+        try {
+            child = spawn(npm.command, args, {
+                cwd: opts.cwd,
+                env: { ...opts.env, npm_config_loglevel: 'http' },
+                stdio: ['ignore', 'pipe', 'pipe'],
+                shell: false,
+                windowsHide: true,
+            });
+        }
+        catch (err) {
+            done({ code: null, error: err.message, timedOut: false, tail });
+            return;
+        }
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+        }, opts.timeoutMs);
+        const onData = (buf) => {
+            for (const raw of buf.toString('utf8').split(/\r?\n/)) {
+                const line = raw.trim();
+                if (!line)
+                    continue;
+                tail.push(line);
+                if (tail.length > 8)
+                    tail.shift();
+                opts.onLine?.(line);
+            }
+        };
+        child.stdout?.on('data', onData);
+        child.stderr?.on('data', onData);
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            done({
+                code: null,
+                error: err.code === 'ENOENT' ? 'npm was not found. Install Node.js with npm, then try again.' : err.message,
+                timedOut: false,
+                tail,
+            });
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            done({ code, error: null, timedOut, tail });
+        });
+    });
+}
 const HERE = dirname(fileURLToPath(import.meta.url));
 /**
  * Build a runtime over one data directory. The app uses the module-level default below; tests
@@ -223,8 +313,13 @@ export function createAiRuntime(opts = {}) {
         for (const name of AI_RUNTIME_PACKAGES) {
             const dir = findPackageDir(name, runtimeDir);
             const have = installedVersion(dir);
-            if (!dir || !have || !esmEntryOf(dir, ENTRY_SUBPATH[name]))
-                anyMissing = true;
+            if (!dir || !have || !esmEntryOf(dir, ENTRY_SUBPATH[name])) {
+                // An install from before a later package existed still runs the agents: stale, not absent.
+                if (AI_RUNTIME_LATER_PACKAGES.includes(name))
+                    anyMismatch = true;
+                else
+                    anyMissing = true;
+            }
             else if (want && want[name] !== have)
                 anyMismatch = true;
         }
@@ -328,25 +423,6 @@ export function createAiRuntime(opts = {}) {
             }
         }
     }
-    function resolveNpm() {
-        // Run npm's own JS entry with THIS node, so there is no shell and no PATH guessing on Windows
-        // (where `npm` is a .cmd that cannot be spawned without one).
-        const viaEnv = env.npm_execpath;
-        if (viaEnv && /npm-cli\.c?js$/.test(viaEnv) && existsSync(viaEnv)) {
-            return { command: process.execPath, args: [viaEnv] };
-        }
-        const nodeDir = dirname(process.execPath);
-        for (const candidate of [
-            join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-            join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-        ]) {
-            if (existsSync(candidate))
-                return { command: process.execPath, args: [candidate] };
-        }
-        if (process.platform !== 'win32')
-            return { command: 'npm', args: [] };
-        return null;
-    }
     function install(onProgress, installOpts = {}) {
         if (onProgress)
             listeners.add(onProgress);
@@ -372,7 +448,7 @@ export function createAiRuntime(opts = {}) {
         if (!want) {
             return failWith('This copy of Limn does not list which AI runtime versions to download. Update Limn and try again.');
         }
-        const npm = installOpts.npm ?? resolveNpm();
+        const npm = installOpts.npm ?? resolveNpm(env);
         if (!npm)
             return failWith('npm was not found. Install Node.js with npm, then try again.');
         lastFailure = null;
@@ -399,7 +475,7 @@ export function createAiRuntime(opts = {}) {
             '--no-audit',
             '--no-fund',
             '--no-update-notifier',
-            // None of the four needs an install script, so none gets to run one.
+            // None of the packages needs an install script, so none gets to run one.
             '--ignore-scripts',
             '--no-package-lock',
         ];
@@ -407,55 +483,13 @@ export function createAiRuntime(opts = {}) {
         if (env.LIMN_CLAUDE_PATH?.trim())
             args.push('--omit=optional');
         const timeoutMs = installOpts.timeoutMs ?? 10 * 60_000;
-        const tail = [];
-        const exit = await new Promise((done) => {
-            let child;
-            try {
-                child = spawn(npm.command, args, {
-                    cwd: staging,
-                    env: { ...env, npm_config_loglevel: 'http' },
-                    stdio: ['ignore', 'pipe', 'pipe'],
-                    shell: false,
-                    windowsHide: true,
-                });
-            }
-            catch (err) {
-                done({ code: null, error: err.message, timedOut: false });
-                return;
-            }
-            let timedOut = false;
-            const timer = setTimeout(() => {
-                timedOut = true;
-                child.kill('SIGTERM');
-            }, timeoutMs);
-            const onData = (buf) => {
-                for (const raw of buf.toString('utf8').split(/\r?\n/)) {
-                    const line = raw.trim();
-                    if (!line)
-                        continue;
-                    tail.push(line);
-                    if (tail.length > 8)
-                        tail.shift();
-                    emit({ phase: 'downloading', message: line.slice(0, 200) });
-                }
-            };
-            child.stdout?.on('data', onData);
-            child.stderr?.on('data', onData);
-            child.on('error', (err) => {
-                clearTimeout(timer);
-                done({
-                    code: null,
-                    error: err.code === 'ENOENT'
-                        ? 'npm was not found. Install Node.js with npm, then try again.'
-                        : err.message,
-                    timedOut: false,
-                });
-            });
-            child.on('close', (code) => {
-                clearTimeout(timer);
-                done({ code, error: null, timedOut });
-            });
+        const exit = await spawnNpm(npm, args, {
+            cwd: staging,
+            env,
+            timeoutMs,
+            onLine: (line) => emit({ phase: 'downloading', message: line.slice(0, 200) }),
         });
+        const tail = exit.tail;
         if (exit.error || exit.timedOut || exit.code !== 0) {
             rmSync(staging, { recursive: true, force: true });
             if (exit.error)
@@ -520,6 +554,13 @@ export const loadMcpSdk = () => runtime.load('@modelcontextprotocol/sdk');
 export const loadZodModule = () => runtime.load('zod');
 /** zod's `z` namespace, from the SAME install the Agent SDK uses. */
 export const loadZod = async () => (await loadZodModule()).z;
+const cjsDefault = (mod) => {
+    const m = mod;
+    return (m && typeof m === 'object' && m.default != null ? m.default : mod);
+};
+export const loadMammoth = async () => cjsDefault(await runtime.load('mammoth'));
+export const loadTurndown = async () => cjsDefault(await runtime.load('turndown'));
+export const loadTurndownGfm = async () => cjsDefault(await runtime.load('turndown-plugin-gfm'));
 /**
  * `LIMN_CLAUDE_PATH` → the Agent SDK's `pathToClaudeCodeExecutable`: run the user's own installed
  * `claude` instead of the SDK's bundled binary (and `limn ai install` then skips downloading it).

package/dist/api/plugins/rate-limit.js

@@ -19,8 +19,8 @@ function tier(name, perWindow, windowMs) {
     };
 }
 const TIERS = {
-    // Anthropic-spending generation. A digest refresh, a sprint report, an Insights
-    // chat turn, a themes rebuild, a PR summary, an agentic review or fix. The most
+    // Anthropic-spending generation. A sprint report, an Insights chat turn, a themes
+    // rebuild, an impact note, an agentic review or fix. The most
     // expensive thing in the app and the tightest bucket.
     ai: tier('ai', 20, MINUTE),
     // A second, longer window on the same routes: 20/min would still be 1200/hour.
@@ -96,6 +96,10 @@ function tierFor(method, path) {
     // family other routes may join, and none of them should inherit this decision.
     if (path === '/api/ai/runtime/install')
         return [TIERS.sync];
+    // "Set up" for local bot-comment scoring: the same shape (npm install + ~150 MB of model files
+    // over the user's own bandwidth, single-flight in ml/runtime.ts), the same bucket, spelled exactly.
+    if (path === '/api/ml/install')
+        return [TIERS.sync];
     // ---- Workspace CRUD: `read`, RECORDED rather than inherited ----
     //
     // The six surviving routes (list / create / rename+reassign / delete / move-one-repo-in /
@@ -132,6 +136,11 @@ function tierFor(method, path) {
     if (!mutating && /^\/api\/workspaces\/\d+\/tracker\/(jira-fields|linear-check)$/.test(path)) {
         return [TIERS.search, TIERS.read];
     }
+    // SONARCLOUD (sonar/routes.ts): "Test connection" calls SonarCloud with the saved token (one call
+    // for the organization + one per repo, ≤ 20) — a THIRD-PARTY quota, so `search`. GET/PUT
+    // `…/sonar` are DB-only and fall to `read` on the next line, decided rather than inherited.
+    if (method === 'POST' && /^\/api\/workspaces\/\d+\/sonar\/check$/.test(path))
+        return [TIERS.search, TIERS.read];
     if (path === '/api/workspaces' || path.startsWith('/api/workspaces/'))
         return [TIERS.read];
     // ---- Per-account settings writes: `read`, RECORDED rather than inherited ----
@@ -406,8 +415,7 @@ function tierFor(method, path) {
     //                               calling it 404s, which is the catch-all's problem, not a tier's.
     //   POST /api/pro/slack/test    "Send test" — and it is NOT a probe. It runs the SAME billed
     //                               path the cron does: `refreshSprintReport` (one Haiku call unless
-    //                               the payload hash is unchanged) plus the account-wide repo-digest
-    //                               refresh, then an outbound POST to a user-supplied host. It stays
+    //                               the payload hash is unchanged), then an outbound POST to a user-supplied host. It stays
     //                               on `ai` + `aiHourly` — where the catch-all would have put it
     //                               anyway, spelled here so the family's two tiers are DECIDED
     //                               together rather than one of them being inherited. ⚠ It takes ONE
@@ -430,6 +438,51 @@ function tierFor(method, path) {
     // the token: theirs, not ours, so the 60/min `search` bucket. Anchored at BOTH ends, so a sibling
     // `/api/prs/:id/*` route is not swept in — and the segment is `tracker-ticket`, never a prefix of
     // `ticket-reviews` (the ticket review's own, `read`-tier family below).
+    // ---- SonarCloud's PR routes (sonar/routes.ts), anchored at BOTH ends ----
+    //   GET  /api/prs/:id/sonar          the STORED snapshot, no SonarCloud call        → read
+    //   POST /api/prs/:id/sonar/refresh  reads SonarCloud now (issues, hotspots, gate, rules,
+    //                                    flagged lines — up to ~100 calls on THEIR quota;
+    //                                    + ONE GitHub REST read when SonarCloud analysed
+    //                                    another sha, to check it is the head's merge commit) → search
+    //   POST /api/prs/:id/sonar/post     ONE GitHub comment                            → github_write
+    if (!mutating && /^\/api\/prs\/\d+\/sonar$/.test(path))
+        return [TIERS.read];
+    if (method === 'POST' && /^\/api\/prs\/\d+\/sonar\/refresh$/.test(path))
+        return [TIERS.search, TIERS.read];
+    if (method === 'POST' && /^\/api\/prs\/\d+\/sonar\/post$/.test(path))
+        return [TIERS.githubWrite];
+    // ---- SEQUENCE DIAGRAMS (review/diagrams/routes.ts, LOCAL ONLY), anchored at BOTH ends ----
+    //   GET  /api/prs/:id/sequence-diagrams          stored rows, no model                → read
+    //   POST /api/prs/:id/sequence-diagrams/redraw   queues ONE Sonnet 5 agent run         → ai + ai_hourly
+    //   GET  /api/sequence-diagrams/story            stored rows, no model                → read
+    //   POST /api/sequence-diagrams/story/redraw     queues ONE Sonnet 5 agent run         → ai + ai_hourly
+    if (!mutating && /^\/api\/prs\/\d+\/sequence-diagrams$/.test(path))
+        return [TIERS.read];
+    if (method === 'POST' && /^\/api\/prs\/\d+\/sequence-diagrams\/redraw$/.test(path))
+        return [TIERS.ai, TIERS.aiHourly];
+    if (!mutating && path === '/api/sequence-diagrams/story')
+        return [TIERS.read];
+    if (method === 'POST' && path === '/api/sequence-diagrams/story/redraw')
+        return [TIERS.ai, TIERS.aiHourly];
+    // ---- REFERENCE DOCS (reference-docs/routes.ts, LOCAL ONLY), anchored at BOTH ends ----
+    //   POST   /api/docs/upload           stores a file (≤ 25 MB) + queues ONE Sonnet 5 build  → ai + ai_hourly
+    //   POST   /api/docs/url              queues ONE build (which fetches the page)            → ai + ai_hourly
+    //   POST   /api/docs/:id/rebuild      queues ONE build                                     → ai + ai_hourly
+    //   POST   /api/docs/chat             ONE Sonnet 5 agent answer                            → ai + ai_hourly
+    //   POST   /api/docs/story-alignment  ONE Haiku shortlist + ONE Sonnet 5 read of a story   → ai + ai_hourly
+    //   GET    /api/docs/story-alignment  the stored runs (DB + disk)                          → read
+    //   everything else (list, tree, section, stream, cancel, delete, chats, settings)         → read
+    // The upload's bytes ride the same `ai` bucket: twenty 25 MB files a minute is far past a person
+    // adding reference material, and a script hits the hourly window long before the disk notices.
+    if (method === 'POST' && (path === '/api/docs/upload' || path === '/api/docs/url' || path === '/api/docs/chat' || path === '/api/docs/story-alignment')) {
+        return [TIERS.ai, TIERS.aiHourly];
+    }
+    if (method === 'POST' && /^\/api\/docs\/\d+\/rebuild$/.test(path))
+        return [TIERS.ai, TIERS.aiHourly];
+    if (path === '/api/docs' || path.startsWith('/api/docs/'))
+        return [TIERS.read];
+    if (/^\/api\/workspaces\/\d+\/docs-settings$/.test(path))
+        return [TIERS.read];
     if (!mutating && /^\/api\/prs\/\d+\/tracker-ticket$/.test(path))
         return [TIERS.search, TIERS.read];
     if (method === 'POST' && /^\/api\/prs\/\d+\/tracker-ticket\/refresh$/.test(path)) {
@@ -438,6 +491,12 @@ function tierFor(method, path) {
     if (method === 'PUT' && /^\/api\/prs\/\d+\/tracker-ticket\/ac-field$/.test(path)) {
         return [TIERS.search, TIERS.read];
     }
+    // POST …/tracker-ticket/resolve — the Story check's paste box: up to TICKET_REFS_MAX tickets a
+    // person named, each read from the customer's tracker (or GitHub, for GitHub Issues) with the
+    // workspace's credential. Their quota, so `search`. Exact segment `resolve`.
+    if (method === 'POST' && /^\/api\/prs\/\d+\/tracker-ticket\/resolve$/.test(path)) {
+        return [TIERS.search, TIERS.read];
+    }
     // POST /api/ticket-links — the Open PRs cards' ticket row, ONE request per board: DB-only
     // detection plus the STORED ticket rows; a detected ticket with no row kicks the background
     // worker, which spends the customer's tracker quota — so `search`, not `read`. A POST only
@@ -448,13 +507,12 @@ function tierFor(method, path) {
     // pull_requests), no tracker call. `read`, DECIDED rather than inherited.
     if (!mutating && path === '/api/ticket-merged-prs')
         return [TIERS.read];
+    // GET /api/ticket-prs — the ticket tab: stored ticket rows joined to PRs, DB-only.
+    if (!mutating && path === '/api/ticket-prs')
+        return [TIERS.read];
     // ---- AI generation ----
-    // ⚠ RE-DECIDED, not inherited: `POST /api/pro/prs/:id/annotations/run` now spends GITHUB quota
-    // as well as model tokens — one PR_DETAIL_QUERY per uncached PR for the anchor hunks
-    // (sync/hydrate-detail.ts) on top of the two-sha compares. It stays on `ai` (20/min), which is
-    // TIGHTER than `prDetail`'s 60/min, so the GitHub exposure is already bounded more
-    // conservatively than a plain `GET /api/prs/:id`. Nothing to change — but the decision is
-    // recorded, because this file's failure mode is a tier nobody re-examined.
+    // `POST /api/pro/prs/:id/annotations/run` (the blast-radius impact note — the one kind left;
+    // the comment kinds that hydrated hunks and compared shas are REMOVED) stays on `ai` (20/min).
     // The PAIRED `GET /api/pro/prs/:id/annotations` must STAY on `read`: it is a pure DB read fired
     // on every PR open, and it must never grow a hydration leg (see the prDetail note above for
     // what that cost the first time).
@@ -480,6 +538,35 @@ function tierFor(method, path) {
         return [TIERS.githubWrite];
     if (path.startsWith('/api/ticket-reviews'))
         return [TIERS.read];
+    // STORY LABEL RUN (Reports → Stories; path kept from the retired Story health), EXACT paths:
+    //   POST /api/story-health/label          starts ONE label run (≤150 Haiku calls) → ai + ai_hourly
+    //   POST /api/story-health/label/cancel   stops spend, spends nothing             → read
+    //   GET  /api/story-health/label          the account's run (memory)              → read
+    if (path === '/api/story-health/label' && mutating)
+        return [TIERS.ai, TIERS.aiHourly];
+    if (path === '/api/story-health/label/cancel')
+        return [TIERS.read];
+    if (path === '/api/story-health/label')
+        return [TIERS.read];
+    // THIS SPRINT (Activity → This Sprint), matched EXPLICITLY by exact path, FOLLOWING THE TOKEN:
+    //   POST /api/sprint-stories/refresh               kicks a third-party tracker read  → search + read
+    //                                                  … and, with AI on (local), may start ≤ 3 ticket
+    //                                                  checks (agent runs)                 → search + ai + ai_hourly
+    //   POST /api/sprint-graph/ask                     ONE Haiku completion per turn       → ai + ai_hourly
+    //   GET  /api/sprint-graph, GET …/token, PUT …/statuses, GET /api/ticket-story       → read
+    // ("Check against code" — POST /api/sprint-stories/assess and its assessments/repos routes — is
+    // REMOVED; nothing answers those paths any more.)
+    if (mutating && path === '/api/sprint-stories/refresh') {
+        return config.aiEnabled ? [TIERS.search, TIERS.ai, TIERS.aiHourly] : [TIERS.search, TIERS.read];
+    }
+    if (mutating && path === '/api/sprint-graph/ask')
+        return [TIERS.ai, TIERS.aiHourly];
+    if (path === '/api/sprint-graph' ||
+        path === '/api/sprint-graph/token' ||
+        path === '/api/sprint-stories/statuses' ||
+        path === '/api/ticket-story') {
+        return [TIERS.read];
+    }
     // CI REVIEW (review/ci-review/routes.ts), matched EXPLICITLY by exact path for the same reason:
     //   POST /api/ci-reviews          starts an agent run (reads the head's checks + logs) → ai + ai_hourly
     //   POST /api/ci-reviews/states   batched DB read of the SYNCED head + failing names   → read
@@ -490,6 +577,21 @@ function tierFor(method, path) {
         return [TIERS.read];
     if (path.startsWith('/api/ci-reviews'))
         return [TIERS.read];
+    // "Post reply" on a follow-up reply status: ONE GitHub thread reply (+ a resolve), no model.
+    if (mutating && /^\/api\/claude-reviews\/\d+\/follow-up\/\d+\/reply$/.test(path))
+        return [TIERS.githubWrite];
+    // AI Fix PLAN MODE (coding/ai-fix/routes.ts, LOCAL ONLY). Spelled out so the family cannot drift
+    // with the /api/pro/ catch-all below, which would also have parked the DB-only discard on `ai`:
+    //   POST /api/pro/prs/:id/ai-fix/plan             starts a planning agent pass  → ai + ai_hourly
+    //   POST /api/pro/ai-fixes/:fixId/plan/message    one re-plan agent pass        → ai + ai_hourly
+    //   POST /api/pro/ai-fixes/:fixId/plan/approve    starts the build agent run    → ai + ai_hourly
+    //   POST /api/pro/ai-fixes/:fixId/plan/discard    one DB update, no model       → read
+    if (mutating && /^\/api\/pro\/prs\/\d+\/ai-fix\/plan$/.test(path))
+        return [TIERS.ai, TIERS.aiHourly];
+    if (mutating && /^\/api\/pro\/ai-fixes\/\d+\/plan\/(message|approve)$/.test(path))
+        return [TIERS.ai, TIERS.aiHourly];
+    if (/^\/api\/pro\/ai-fixes\/\d+\/plan\/discard$/.test(path))
+        return [TIERS.read];
     if (/^\/api\/claude-reviews\/[^/]+\/chat$/.test(path)) {
         return mutating ? [TIERS.ai, TIERS.aiHourly] : [TIERS.read];
     }
@@ -514,6 +616,8 @@ function tierFor(method, path) {
             // The Open PRs table's batched latest-run read: a POST only because a list of ids does not
             // fit a query string. One DB query, no model, no GitHub — so `read`, exact path only.
             path !== '/api/claude-review/states' &&
+            // The thread cards' batched Claude-judgement read: the same shape, DB-only.
+            path !== '/api/claude-review/thread-judgements' &&
             !isSettingsWrite;
         if (generates)
             return [TIERS.ai, TIERS.aiHourly];
@@ -626,6 +730,11 @@ function tierFor(method, path) {
     // neither a substitute.
     if (!mutating && path === '/api/flow-findings')
         return [TIERS.search, TIERS.read];
+    // GET /api/flow-trend — Chronology "Over time" (PAID `periodReports`, deterministic): the same
+    // ledger walk as /api/flow-findings over 26 weeks, plus four grouped first-seen scans. DB-only,
+    // and heavier than the panel, so the same `search` bucket.
+    if (!mutating && path === '/api/flow-trend')
+        return [TIERS.search, TIERS.read];
     // ---- Emoji reactions: BOTH routes reach GitHub, and NEITHER lives under /api/prs/<id>/ ----
     //
     // Spelled as two EXACT string matches, above the mutating block, for the reason this file has
@@ -738,6 +847,12 @@ function tierFor(method, path) {
     //   GET  …/conflicts/stream   an SSE subscribe onto an already-started job — a read.
     //   DELETE …/conflicts        a Map.delete. `read` — DECIDED, not inherited from the POST
     //                             line, which it would otherwise match.
+    // "Resolve with Claude" (coding/ai-resolve/, LOCAL ONLY): the POST starts an agent run — model
+    // money, and possibly a clone — so `ai` + `ai_hourly`. Its GET is a Map lookup polled while the
+    // run works and its DELETE a cancel: `read`. Exact paths, ABOVE the resolver's own lines.
+    if (/^\/api\/prs\/\d+\/conflicts\/ai-resolve$/.test(path)) {
+        return method === 'POST' ? [TIERS.ai, TIERS.aiHourly] : [TIERS.read];
+    }
     if (method === 'POST' && /^\/api\/prs\/\d+\/conflicts$/.test(path))
         return [TIERS.sync];
     if (method === 'DELETE' && /^\/api\/prs\/\d+\/conflicts$/.test(path))
@@ -777,9 +892,16 @@ function tierFor(method, path) {
         // it belongs in the same bucket as an explicit merge.
         //
         // Deliberately NOT here: `/dismiss` and `/mark-viewed` (pure local bookkeeping).
-        const hitsGithub = path.startsWith('/api/threads/') ||
+        //
+        // `/api/dependencies/merge-all` is Pending → Dependencies' "Merge or arm all": up to one
+        // merge (or a live probe + arm) per listed PR, sequentially, on the account's quota. Spelled
+        // EXACTLY; its dry run hits no GitHub but shares the bucket rather than a second rule.
+        // `withdraw-approval` (dismiss the viewer's own APPROVED review: a live reviews list + one REST
+        // dismissal) is spelled out — `approve` is ANCHORED after the id and does not prefix-match it.
+        const hitsGithub = path === '/api/dependencies/merge-all' ||
+            path.startsWith('/api/threads/') ||
             path.startsWith('/api/bot-threads/') ||
-            /^\/api\/prs\/\d+\/(review-comment|comments?|approve|request-changes|close|reopen|ci\/rerun|request-reviewers|merge-queue|merge|auto-merge|update-branch|resolve-bot-threads|reviews)/.test(path);
+            /^\/api\/prs\/\d+\/(review-comment|comments?|approve|withdraw-approval|request-changes|close|reopen|ci\/rerun|request-reviewers|merge-queue|merge|auto-merge|update-branch|resolve-bot-threads|reviews)/.test(path);
         if (hitsGithub)
             return [TIERS.githubWrite];
     }

package/dist/api/routes/activity.js

@@ -51,10 +51,10 @@ export async function activityRoutes(app) {
     // every repo in it, with no second visibility axis; `repoIds` + `userIds` narrow WITHIN that.
     // Pure DB read — no GitHub sync, no AI.
     //
-    // `workspaceId` is passed SEPARATELY from `repoIds` and is required: the bots-only path
-    // resolves an automated-reviewer set, and that answer is a workspace fact. The two deliberately
-    // disagree on the single-PR isolation path (`prId`), which reaches a PR whose repo may be
-    // filtered out of `repoIds` — the workspace still owns "is this login a bot" there.
+    // `workspaceId` is passed SEPARATELY from `repoIds` and is required: the `authors` split
+    // (people | bots) resolves the union bot set, and that answer is a workspace fact. The two
+    // deliberately disagree on the single-PR isolation path (`prId`), which reaches a PR whose repo
+    // may be filtered out of `repoIds` — the workspace still owns "is this login a bot" there.
     app.get('/api/activity/feed', async (req) => {
         const q = req.query;
         const accountId = accountIdOf(req);
@@ -62,11 +62,6 @@ export async function activityRoutes(app) {
         const limit = q.limit != null ? Number(q.limit) : null;
         const offset = q.offset != null ? Number(q.offset) : 0;
         const prId = q.prId != null ? Number(q.prId) : null;
-        // Bot-only feed window (days) — clamped to 1..90; only honored on the botsOnly path.
-        const botWindowDaysRaw = q.botWindowDays != null ? Number(q.botWindowDays) : null;
-        const botWindowDays = botWindowDaysRaw != null && Number.isFinite(botWindowDaysRaw)
-            ? Math.min(90, Math.max(1, Math.trunc(botWindowDaysRaw)))
-            : null;
         return getConsolidatedFeed(accountId, {
             workspaceId: scope.workspaceId,
             repoIds: scope.repoIds,
@@ -74,15 +69,9 @@ export async function activityRoutes(app) {
             prId: prId != null && Number.isFinite(prId) ? prId : null,
             limit: Number.isFinite(limit) && limit != null && limit > 0 ? limit : null,
             offset: Number.isFinite(offset) && offset > 0 ? offset : 0,
-            excludeBots: q.excludeBots === 'true',
-            allowBotIds: parseIntList(q.allowBotIds),
-            botsOnly: q.botsOnly === 'true',
-            botWindowDays,
+            // People or bots, never both. Anything but an explicit 'bots' is people — the default.
+            authors: q.authors === 'bots' ? 'bots' : 'humans',
             includeAllCommits: q.includeAllCommits === 'true',
-            // Opt-in CI-failure rows (PR heads + the default branch). OFF unless explicitly asked
-            // for, like includeAllCommits — a missing/garbage value means off, never on. Still a
-            // pure DB read over two indexed transition logs, so no new rate-limit tier is needed.
-            includeCiFailures: q.includeCiFailures === 'true',
         });
     });
     // Mark the Activity Feed as seen (bumps the account's server-side "seen" marker to