limn-review 0.1.128 → 0.1.130

package/LICENSE

@@ -1,110 +1,127 @@
-# Functional Source License, Version 1.1, MIT Future License
+# Limn License 1.0
 
-## Abbreviation
+Copyright 2026 Alex Wakeman
 
-FSL-1.1-MIT
+## 1. Acceptance
 
-## Notice
+In order to get any license under these terms, you must agree to them as both
+strict obligations and conditions to all your licenses.
 
-Copyright 2026 Alex Wakeman
+## 2. Copyright License
+
+The licensor grants you a copyright license for the software to do everything
+you might do with the software that would otherwise infringe the licensor's
+copyright in it for any permitted purpose. However, you may only distribute the
+software according to section 5 (Distribution License) and make changes or new
+works based on the software according to section 6 (Changes and New Works
+License).
+
+## 3. Permitted Purposes
 
-## Terms and Conditions
+Any purpose is a permitted purpose for:
 
-### Licensor ("We")
+(a) an individual using the software for themselves; and
 
-The party offering the Software under these Terms and Conditions.
+(b) an organization in which no more than three (3) individuals use the
+software, counting the organization together with all of its affiliates.
 
-### The Software
+Any other use, including use within an organization in which more than three
+(3) individuals use the software, is not a permitted purpose. That use needs a
+separate commercial license from the licensor, which you can ask for through
+the contact form at https://limn-review.com/contact.
 
-The "Software" is each version of the software that we make available under
-these Terms and Conditions, as indicated by our inclusion of these Terms and
-Conditions with the Software.
+## 4. No Competing Use
 
-### License Grant
+No purpose is a permitted purpose if it is a competing use. A competing use is
+making the software, or any product or service substantially similar to it or
+built from it, available to others as a commercial product or service, whether
+as installable software, a hosted service or any other form.
 
-Subject to your compliance with this License Grant and the Patents,
-Redistribution and Trademark clauses below, we hereby grant you the right to
-use, copy, modify, create derivative works, publicly perform, publicly display
-and redistribute the Software for any Permitted Purpose identified below.
+## 5. Distribution License
 
-### Permitted Purpose
+The licensor grants you an additional copyright license to distribute copies of
+the software. Your license to distribute covers distributing the software with
+changes and new works permitted by section 6 (Changes and New Works License).
 
-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
-means making the Software available to others in a commercial product or
-service that:
+## 6. Changes and New Works License
 
-1. substitutes for the Software;
+The licensor grants you an additional copyright license to make changes and new
+works based on the software for any permitted purpose.
 
-2. substitutes for any other product or service we offer using the Software
-   that exists as of the date we make the Software available; or
+## 7. Notices
 
-3. offers the same or substantially similar functionality as the Software.
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms, together with the copyright notice above.
+Anyone who gets a copy from you gets it under these terms only, and no other
+terms. If you modify the software, you must include in any modified copies of
+the software a prominent notice stating that you have modified the software.
 
-Permitted Purposes specifically include using the Software:
+## 8. Patent License
 
-1. for your internal use and access;
+The licensor grants you a patent license for the software that covers patent
+claims the licensor can license, or becomes able to license, that you would
+infringe by using the software for a permitted purpose.
 
-2. for non-commercial education;
+## 9. Fair Use
 
-3. for non-commercial research; and
+You may have "fair use" rights for the software under the law. These terms do
+not limit them.
 
-4. in connection with professional services that you provide to a licensee
-   using the Software in accordance with these Terms and Conditions.
+## 10. No Other Rights
 
-### Patents
+These terms do not allow you to sublicense or transfer any of your licenses to
+anyone else, or prevent the licensor from granting licenses to anyone else.
+These terms do not imply any other licenses. The licensor will not convert
+these terms, or any version of the software released under them, to the MIT
+License or to any other license by the passing of time.
 
-To the extent your use for a Permitted Purpose would necessarily infringe our
-patents, the license grant above includes a license under our patents. If you
-make a claim against any party that the Software infringes or contributes to
-the infringement of any patent, then your patent license to the Software ends
-immediately.
+## 11. Patent Defense
 
-### Redistribution
+If you make any written claim that the software infringes or contributes to
+infringement of any patent, your patent license for the software granted under
+these terms ends immediately. If your company makes such a claim, your patent
+license ends immediately for work on behalf of your company.
 
-The Terms and Conditions apply to all copies, modifications and derivatives of
-the Software.
+## 12. Violations
 
-If you redistribute any copies, modifications or derivatives of the Software,
-you must include a copy of or a link to these Terms and Conditions and not
-remove any copyright notices provided in or with the Software.
+The first time you are notified in writing that you have violated any of these
+terms, or done anything with the software not covered by your licenses, your
+licenses can nonetheless continue if you come into full compliance with these
+terms, and take practical steps to correct past violations, within 32 days of
+receiving notice. Otherwise, all your licenses end immediately.
 
-### Disclaimer
+## 13. No Liability
 
-THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
-PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+***As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.***
 
-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
-SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
-EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+## 14. Definitions
 
-### Trademarks
+The **licensor** is Alex Wakeman, the individual offering these terms, and the
+**software** is the software the licensor makes available under these terms,
+including any version of it.
 
-Except for displaying the License Details and identifying us as the origin of
-the Software, you have no right under these Terms and Conditions to use our
-trademarks, trade names, service marks or product names.
+**You** refers to the individual or entity agreeing to these terms.
 
-## Grant of Future License
+**Your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
 
-We hereby irrevocably grant you an additional license to use the Software under
-the MIT license that is effective on the second anniversary of the date we make
-the Software available. On or after that date, you may use the Software under
-the MIT license, in which case the following will apply:
+An **organization** includes any company, firm, partnership, government body,
+charity, team or other group of people working together, and **affiliates** of
+an organization are all organizations that have control over, are under the
+control of, or are under common control with it. **Control** means ownership of
+substantially all the assets of an entity, or the power to direct its
+management and policies by vote, contract, or otherwise. Control can be direct
+or indirect.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
+An individual **uses** the software within an organization if they run it, or
+work with it directly, in the course of their work for, or on behalf of, that
+organization.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+**Your licenses** are all the licenses granted to you for the software under
+these terms.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -9,6 +9,12 @@ There's no hosted backend, no database server, and no stored credentials. It
 authenticates by shelling out to your already-logged-in `gh` CLI, syncs activity
 into a local SQLite file, and serves the dashboard from a single local process.
 
+**100% free.** Every feature, no paid tier, no sign-up (see [License](#license)
+for the one limit, on large organisations).
+
+**Try it first:** the [live demo](https://limn-review.com/demo/) is the real
+app on sample data, in your browser. No install, no sign-in.
+
 > **Renamed.** This package used to be `pierre-review`. The command is now `limn`
 > (the `pierre-review` package now only forwards to this one, and says so). On first start, an existing
 > `~/.pierre-review` is moved to `~/.limn` — your database, settings and clones
@@ -32,9 +38,11 @@ limn
 ## Review and fix with Claude — free, on your own Claude
 
 Claude Review (a code review of any PR, follow-ups, a check against a user
-story you paste, and a chat about the review) and AI Fix are free. They run on
-your own Claude Code or Anthropic API key: sign in to Claude Code, or set
-`ANTHROPIC_API_KEY`. Limn stores no key and charges nothing for it.
+story you paste, and a chat about the review) and AI Fix are free. By default
+they use your local Claude Code login: if you are signed in to Claude Code,
+there is nothing to set up. An Anthropic API key is the alternative: set
+`ANTHROPIC_API_KEY`. Limn stores no key and charges nothing for it. Codex
+support is coming soon.
 
 - **First use downloads the AI runtime, once (about 110 MB).** Press
   **Set up AI** in the app, or run `limn ai install`. It goes to
@@ -45,6 +53,8 @@ your own Claude Code or Anthropic API key: sign in to Claude Code, or set
 - The reviewer reads code. It cannot edit files, run commands or reach the web.
 - The fixer edits files. It has no shell, and builds and tests nothing.
 - Nothing is posted or pushed until you press the button.
+- `LIMN_AI_USE_API_KEY=true` uses `ANTHROPIC_API_KEY` even when you are signed
+  in to Claude Code.
 - `LIMN_AI_DISABLED=true` turns every AI feature off.
 
 ## Prerequisites
@@ -125,9 +135,11 @@ locally instead — a larger database, but PR detail then works fully offline.
 
 ## License
 
-Source-available under the **Functional Source License (FSL-1.1-MIT)** — see
-[LICENSE](./LICENSE). You may use, self-host, and modify Limn freely; you may
-**not** offer it as a competing commercial or hosted product. Each release
-automatically converts to the **MIT License** two years after its publication.
+Source-available under the **Limn License 1.0** — see [LICENSE](./LICENSE).
+Limn is free for individuals, and for organisations where no more than 3 people
+use it (affiliates count together). More users than that need a licence — ask
+through the [contact form](https://limn-review.com/contact?topic=licence). You may
+**not** offer Limn, or a product built from it, as a competing commercial
+product or service.
 The AI runtime Limn downloads on first use is Anthropic's, under Anthropic's own
 terms; it is not part of this package.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,21 @@
+# Third-party notices
+
+Limn includes material from the projects below. Each is used under the licence shown.
+
+## Material Icon Theme
+
+The file-type icons in the Changes tab (`apps/frontend/src/components/FileTypeIcons.tsx`) are
+copied from Material Icon Theme by Material Extensions, npm `material-icon-theme@5.39.0`.
+
+Source: https://github.com/material-extensions/vscode-material-icon-theme
+
+```
+The MIT License (MIT)
+Copyright (c) 2025 Material Extensions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```

package/dist/ai/agent-isolation.js

@@ -0,0 +1,45 @@
+// AGENT ISOLATION — every Agent SDK run in this app sees ONLY the tools it registered itself.
+//
+// ⚠ MEASURED (2026-10-10): a run on the reader's ambient Claude Code login, with `tools: []`,
+// `settingSources: []` and `bypassPermissions`, still lists the ACCOUNT'S claude.ai CONNECTORS
+// (`mcp__claude_ai_Claude_Docs__create/update/delete/export`, …) a few seconds after start — they
+// connect after `system/init`, so the init message shows none. A trial agent wrote a report into the
+// user's Claude Docs unprompted. Claude Review reads PR text strangers write, so a prompt injection
+// could create, edit or delete documents in the reader's claude.ai account. `strictMcpConfig: true`
+// removes them (measured: 8 connector tools → 0); the PreToolUse hook below is the backstop that
+// refuses any `mcp__` tool whose server the run did not register, and its deny holds under
+// bypassPermissions (the path guard relies on the same property).
+//
+// EVERY `query({ options })` spreads `ISOLATED_MCP` and adds `ownToolsOnlyHook(<its server names>)`
+// to `PreToolUse` — pinned by agent-isolation.test.ts, which reads every call site.
+export const ISOLATED_MCP = { strictMcpConfig: true };
+/** The MCP server a tool name belongs to (`mcp__<server>__<tool>`), or null for a built-in tool. */
+export function mcpServerOf(toolName) {
+    if (!toolName.startsWith('mcp__'))
+        return null;
+    const rest = toolName.slice('mcp__'.length);
+    const cut = rest.indexOf('__');
+    return cut < 0 ? rest : rest.slice(0, cut);
+}
+/** True when `toolName` is an MCP tool from a server this run did not register. */
+export function isForeignMcpTool(toolName, ownServers) {
+    const server = mcpServerOf(toolName);
+    return server != null && !ownServers.includes(server);
+}
+/** One SDK PreToolUse matcher entry refusing every MCP tool outside `ownServers`. */
+export function ownToolsOnlyHook(ownServers) {
+    return {
+        hooks: [
+            async (input) => input.hook_event_name === 'PreToolUse' && isForeignMcpTool(input.tool_name ?? '', ownServers)
+                ? {
+                    hookSpecificOutput: {
+                        hookEventName: 'PreToolUse',
+                        permissionDecision: 'deny',
+                        permissionDecisionReason: `${input.tool_name} is not available in this run.`,
+                    },
+                }
+                : { continue: true },
+        ],
+    };
+}
+//# sourceMappingURL=agent-isolation.js.map

package/dist/ai/credentials.js

@@ -0,0 +1,113 @@
+// THE ONE CREDENTIAL LADDER for every model call Limn makes — the agentic runs (Claude Review, AI
+// Fix, the ticket / CI reviews, diagrams, sprint paths, the docs build and chat, resolve with
+// Claude, every chat) AND the one-shot completions (review/llm.ts `cheapComplete`, which the
+// sprint briefs/themes, story labels, docs ranking, sprint Ask Claude and every platform feature —
+// reports, synthesis, work-plan wording, pointers, bot themes, the impact note, the advisor's
+// refine, the Slack report — all go through).
+//
+//   1. THE LOCAL CLAUDE CODE LOGIN (default) — a `claude` session on disk or
+//      CLAUDE_CODE_OAUTH_TOKEN, used through the Agent SDK. Any ANTHROPIC_API_KEY in the
+//      environment is HIDDEN from that run, or the SDK would prefer it and silently meter it.
+//   2. ANTHROPIC_API_KEY from the environment — the alternative when there is no login. Agent runs
+//      hand it to the Agent SDK; one-shot completions call the Anthropic API directly with it
+//      (the SDK loaded through ai/runtime.ts `loadAnthropicSdk`, never imported here).
+//
+// LIMN_AI_USE_API_KEY=true flips the order when a key is set: the key first, the login ignored.
+// LIMN_AI_DISABLED=true (config.aiEnabled) turns every model call off; that switch is checked by
+// the callers, not here, because this module answers only "which credential", never "may we".
+//
+// Nothing is stored. Detection of the login reads the disk (a credentials file, or `oauthAccount`
+// recorded in the Claude config — see hasClaudeLogin); a wrong
+// guess surfaces as the SDK's own auth error on the first real call.
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** The opt-in that makes ANTHROPIC_API_KEY win over a Claude Code login. */
+export const USE_API_KEY_ENV = 'LIMN_AI_USE_API_KEY';
+function envApiKey(env) {
+    const k = env.ANTHROPIC_API_KEY?.trim();
+    return k ? k : undefined;
+}
+/** Does the reader prefer the API key over the login (`LIMN_AI_USE_API_KEY=true`)? */
+export function prefersApiKey(env = process.env) {
+    return env[USE_API_KEY_ENV]?.trim().toLowerCase() === 'true';
+}
+/**
+ * Does this Claude Code config file record a signed-in account? The CLI writes a non-empty
+ * `oauthAccount` object on sign-in and removes it on logout — on macOS, where the token itself is
+ * in the Keychain, it is the only on-disk signal. A missing, unreadable or unparseable file is no.
+ */
+function configRecordsLogin(path) {
+    try {
+        if (!existsSync(path))
+            return false;
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return false;
+        const account = parsed.oauthAccount;
+        return !!account && typeof account === 'object' && Object.keys(account).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is a Claude Code login available (an OAuth token, or a logged-in session on disk)? Deliberately
+ * ignores API keys: it answers "can this run on the reader's own Claude, not a meter?".
+ *
+ * ⚠ A BARE `~/.claude` DIRECTORY OR `~/.claude.json` IS NOT A LOGIN. Merely running Claude Code —
+ * including the Agent SDK on the API-key route — creates both, so counting them moved a key-only
+ * reader onto the login route after their first run and stripped their key from every later one.
+ * Only a credentials file, CLAUDE_CODE_OAUTH_TOKEN, or a config recording `oauthAccount` counts.
+ * CLAUDE_CONFIG_DIR (which the SDK subprocess inherits) is checked before the defaults.
+ */
+export function hasClaudeLogin(env = process.env, home = homedir()) {
+    if (env.CLAUDE_CODE_OAUTH_TOKEN?.trim())
+        return true;
+    const cfg = env.CLAUDE_CONFIG_DIR?.trim();
+    const credentialFiles = [
+        ...(cfg ? [join(cfg, '.credentials.json')] : []),
+        join(home, '.claude', '.credentials.json'),
+        join(home, '.config', 'claude', '.credentials.json'),
+    ];
+    if (credentialFiles.some((path) => existsSync(path)))
+        return true;
+    const configFiles = [...(cfg ? [join(cfg, '.claude.json')] : []), join(home, '.claude.json')];
+    return configFiles.some(configRecordsLogin);
+}
+/** Which credential the next model call uses. Read at call time, so an env change takes effect. */
+export function resolveAiCredential(env = process.env, loginAvailable = hasClaudeLogin) {
+    const apiKey = envApiKey(env);
+    if (apiKey && prefersApiKey(env))
+        return { route: 'api_key', method: 'api_key', apiKey };
+    if (env.CLAUDE_CODE_OAUTH_TOKEN)
+        return { route: 'login', method: 'oauth_token' };
+    if (loginAvailable(env))
+        return { route: 'login', method: 'ambient' };
+    if (apiKey)
+        return { route: 'api_key', method: 'api_key', apiKey };
+    return { route: 'none' };
+}
+/**
+ * The environment an Agent SDK subprocess runs with, per the ladder. Passed as the query's `env`
+ * option, so it never touches process.env and two concurrent runs cannot race.
+ *
+ *   • login → the inherited environment WITHOUT ANTHROPIC_API_KEY (the login pays, not a meter).
+ *   • API key → the inherited environment WITHOUT CLAUDE_CODE_OAUTH_TOKEN, so the key is used.
+ *   • none → the inherited environment unchanged; the SDK reports the authoritative auth error.
+ */
+export function agentSdkEnv(env = process.env, credential = resolveAiCredential(env)) {
+    const out = { ...env };
+    if (credential.route === 'login')
+        delete out.ANTHROPIC_API_KEY;
+    else if (credential.route === 'api_key') {
+        delete out.CLAUDE_CODE_OAUTH_TOKEN;
+        out.ANTHROPIC_API_KEY = credential.apiKey;
+    }
+    return out;
+}
+/** Spread into every Agent SDK `query({ options })`, beside `claudeExecutableOptions()`. */
+export function agentAuthOptions() {
+    return { env: agentSdkEnv() };
+}
+//# sourceMappingURL=credentials.js.map