limn-review 0.1.129 → 0.1.130

package/LICENSE

@@ -1,110 +1,127 @@
-# Functional Source License, Version 1.1, MIT Future License
+# Limn License 1.0
 
-## Abbreviation
+Copyright 2026 Alex Wakeman
 
-FSL-1.1-MIT
+## 1. Acceptance
 
-## Notice
+In order to get any license under these terms, you must agree to them as both
+strict obligations and conditions to all your licenses.
 
-Copyright 2026 Alex Wakeman
+## 2. Copyright License
+
+The licensor grants you a copyright license for the software to do everything
+you might do with the software that would otherwise infringe the licensor's
+copyright in it for any permitted purpose. However, you may only distribute the
+software according to section 5 (Distribution License) and make changes or new
+works based on the software according to section 6 (Changes and New Works
+License).
+
+## 3. Permitted Purposes
 
-## Terms and Conditions
+Any purpose is a permitted purpose for:
 
-### Licensor ("We")
+(a) an individual using the software for themselves; and
 
-The party offering the Software under these Terms and Conditions.
+(b) an organization in which no more than three (3) individuals use the
+software, counting the organization together with all of its affiliates.
 
-### The Software
+Any other use, including use within an organization in which more than three
+(3) individuals use the software, is not a permitted purpose. That use needs a
+separate commercial license from the licensor, which you can ask for through
+the contact form at https://limn-review.com/contact.
 
-The "Software" is each version of the software that we make available under
-these Terms and Conditions, as indicated by our inclusion of these Terms and
-Conditions with the Software.
+## 4. No Competing Use
 
-### License Grant
+No purpose is a permitted purpose if it is a competing use. A competing use is
+making the software, or any product or service substantially similar to it or
+built from it, available to others as a commercial product or service, whether
+as installable software, a hosted service or any other form.
 
-Subject to your compliance with this License Grant and the Patents,
-Redistribution and Trademark clauses below, we hereby grant you the right to
-use, copy, modify, create derivative works, publicly perform, publicly display
-and redistribute the Software for any Permitted Purpose identified below.
+## 5. Distribution License
 
-### Permitted Purpose
+The licensor grants you an additional copyright license to distribute copies of
+the software. Your license to distribute covers distributing the software with
+changes and new works permitted by section 6 (Changes and New Works License).
 
-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
-means making the Software available to others in a commercial product or
-service that:
+## 6. Changes and New Works License
 
-1. substitutes for the Software;
+The licensor grants you an additional copyright license to make changes and new
+works based on the software for any permitted purpose.
 
-2. substitutes for any other product or service we offer using the Software
-   that exists as of the date we make the Software available; or
+## 7. Notices
 
-3. offers the same or substantially similar functionality as the Software.
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms, together with the copyright notice above.
+Anyone who gets a copy from you gets it under these terms only, and no other
+terms. If you modify the software, you must include in any modified copies of
+the software a prominent notice stating that you have modified the software.
 
-Permitted Purposes specifically include using the Software:
+## 8. Patent License
 
-1. for your internal use and access;
+The licensor grants you a patent license for the software that covers patent
+claims the licensor can license, or becomes able to license, that you would
+infringe by using the software for a permitted purpose.
 
-2. for non-commercial education;
+## 9. Fair Use
 
-3. for non-commercial research; and
+You may have "fair use" rights for the software under the law. These terms do
+not limit them.
 
-4. in connection with professional services that you provide to a licensee
-   using the Software in accordance with these Terms and Conditions.
+## 10. No Other Rights
 
-### Patents
+These terms do not allow you to sublicense or transfer any of your licenses to
+anyone else, or prevent the licensor from granting licenses to anyone else.
+These terms do not imply any other licenses. The licensor will not convert
+these terms, or any version of the software released under them, to the MIT
+License or to any other license by the passing of time.
 
-To the extent your use for a Permitted Purpose would necessarily infringe our
-patents, the license grant above includes a license under our patents. If you
-make a claim against any party that the Software infringes or contributes to
-the infringement of any patent, then your patent license to the Software ends
-immediately.
+## 11. Patent Defense
 
-### Redistribution
+If you make any written claim that the software infringes or contributes to
+infringement of any patent, your patent license for the software granted under
+these terms ends immediately. If your company makes such a claim, your patent
+license ends immediately for work on behalf of your company.
 
-The Terms and Conditions apply to all copies, modifications and derivatives of
-the Software.
+## 12. Violations
 
-If you redistribute any copies, modifications or derivatives of the Software,
-you must include a copy of or a link to these Terms and Conditions and not
-remove any copyright notices provided in or with the Software.
+The first time you are notified in writing that you have violated any of these
+terms, or done anything with the software not covered by your licenses, your
+licenses can nonetheless continue if you come into full compliance with these
+terms, and take practical steps to correct past violations, within 32 days of
+receiving notice. Otherwise, all your licenses end immediately.
 
-### Disclaimer
+## 13. No Liability
 
-THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
-PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+***As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.***
 
-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
-SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
-EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+## 14. Definitions
 
-### Trademarks
+The **licensor** is Alex Wakeman, the individual offering these terms, and the
+**software** is the software the licensor makes available under these terms,
+including any version of it.
 
-Except for displaying the License Details and identifying us as the origin of
-the Software, you have no right under these Terms and Conditions to use our
-trademarks, trade names, service marks or product names.
+**You** refers to the individual or entity agreeing to these terms.
 
-## Grant of Future License
+**Your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
 
-We hereby irrevocably grant you an additional license to use the Software under
-the MIT license that is effective on the second anniversary of the date we make
-the Software available. On or after that date, you may use the Software under
-the MIT license, in which case the following will apply:
+An **organization** includes any company, firm, partnership, government body,
+charity, team or other group of people working together, and **affiliates** of
+an organization are all organizations that have control over, are under the
+control of, or are under common control with it. **Control** means ownership of
+substantially all the assets of an entity, or the power to direct its
+management and policies by vote, contract, or otherwise. Control can be direct
+or indirect.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of
-this software and associated documentation files (the "Software"), to deal in
-the Software without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Software, and to permit persons to whom the Software is furnished to do
-so, subject to the following conditions:
+An individual **uses** the software within an organization if they run it, or
+work with it directly, in the course of their work for, or on behalf of, that
+organization.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+**Your licenses** are all the licenses granted to you for the software under
+these terms.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -9,6 +9,12 @@ There's no hosted backend, no database server, and no stored credentials. It
 authenticates by shelling out to your already-logged-in `gh` CLI, syncs activity
 into a local SQLite file, and serves the dashboard from a single local process.
 
+**100% free.** Every feature, no paid tier, no sign-up (see [License](#license)
+for the one limit, on large organisations).
+
+**Try it first:** the [live demo](https://limn-review.com/demo/) is the real
+app on sample data, in your browser. No install, no sign-in.
+
 > **Renamed.** This package used to be `pierre-review`. The command is now `limn`
 > (the `pierre-review` package now only forwards to this one, and says so). On first start, an existing
 > `~/.pierre-review` is moved to `~/.limn` — your database, settings and clones
@@ -32,9 +38,11 @@ limn
 ## Review and fix with Claude — free, on your own Claude
 
 Claude Review (a code review of any PR, follow-ups, a check against a user
-story you paste, and a chat about the review) and AI Fix are free. They run on
-your own Claude Code or Anthropic API key: sign in to Claude Code, or set
-`ANTHROPIC_API_KEY`. Limn stores no key and charges nothing for it.
+story you paste, and a chat about the review) and AI Fix are free. By default
+they use your local Claude Code login: if you are signed in to Claude Code,
+there is nothing to set up. An Anthropic API key is the alternative: set
+`ANTHROPIC_API_KEY`. Limn stores no key and charges nothing for it. Codex
+support is coming soon.
 
 - **First use downloads the AI runtime, once (about 110 MB).** Press
   **Set up AI** in the app, or run `limn ai install`. It goes to
@@ -45,6 +53,8 @@ your own Claude Code or Anthropic API key: sign in to Claude Code, or set
 - The reviewer reads code. It cannot edit files, run commands or reach the web.
 - The fixer edits files. It has no shell, and builds and tests nothing.
 - Nothing is posted or pushed until you press the button.
+- `LIMN_AI_USE_API_KEY=true` uses `ANTHROPIC_API_KEY` even when you are signed
+  in to Claude Code.
 - `LIMN_AI_DISABLED=true` turns every AI feature off.
 
 ## Prerequisites
@@ -125,9 +135,11 @@ locally instead — a larger database, but PR detail then works fully offline.
 
 ## License
 
-Source-available under the **Functional Source License (FSL-1.1-MIT)** — see
-[LICENSE](./LICENSE). You may use, self-host, and modify Limn freely; you may
-**not** offer it as a competing commercial or hosted product. Each release
-automatically converts to the **MIT License** two years after its publication.
+Source-available under the **Limn License 1.0** — see [LICENSE](./LICENSE).
+Limn is free for individuals, and for organisations where no more than 3 people
+use it (affiliates count together). More users than that need a licence — ask
+through the [contact form](https://limn-review.com/contact?topic=licence). You may
+**not** offer Limn, or a product built from it, as a competing commercial
+product or service.
 The AI runtime Limn downloads on first use is Anthropic's, under Anthropic's own
 terms; it is not part of this package.

package/dist/ai/credentials.js

@@ -0,0 +1,113 @@
+// THE ONE CREDENTIAL LADDER for every model call Limn makes — the agentic runs (Claude Review, AI
+// Fix, the ticket / CI reviews, diagrams, sprint paths, the docs build and chat, resolve with
+// Claude, every chat) AND the one-shot completions (review/llm.ts `cheapComplete`, which the
+// sprint briefs/themes, story labels, docs ranking, sprint Ask Claude and every platform feature —
+// reports, synthesis, work-plan wording, pointers, bot themes, the impact note, the advisor's
+// refine, the Slack report — all go through).
+//
+//   1. THE LOCAL CLAUDE CODE LOGIN (default) — a `claude` session on disk or
+//      CLAUDE_CODE_OAUTH_TOKEN, used through the Agent SDK. Any ANTHROPIC_API_KEY in the
+//      environment is HIDDEN from that run, or the SDK would prefer it and silently meter it.
+//   2. ANTHROPIC_API_KEY from the environment — the alternative when there is no login. Agent runs
+//      hand it to the Agent SDK; one-shot completions call the Anthropic API directly with it
+//      (the SDK loaded through ai/runtime.ts `loadAnthropicSdk`, never imported here).
+//
+// LIMN_AI_USE_API_KEY=true flips the order when a key is set: the key first, the login ignored.
+// LIMN_AI_DISABLED=true (config.aiEnabled) turns every model call off; that switch is checked by
+// the callers, not here, because this module answers only "which credential", never "may we".
+//
+// Nothing is stored. Detection of the login reads the disk (a credentials file, or `oauthAccount`
+// recorded in the Claude config — see hasClaudeLogin); a wrong
+// guess surfaces as the SDK's own auth error on the first real call.
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** The opt-in that makes ANTHROPIC_API_KEY win over a Claude Code login. */
+export const USE_API_KEY_ENV = 'LIMN_AI_USE_API_KEY';
+function envApiKey(env) {
+    const k = env.ANTHROPIC_API_KEY?.trim();
+    return k ? k : undefined;
+}
+/** Does the reader prefer the API key over the login (`LIMN_AI_USE_API_KEY=true`)? */
+export function prefersApiKey(env = process.env) {
+    return env[USE_API_KEY_ENV]?.trim().toLowerCase() === 'true';
+}
+/**
+ * Does this Claude Code config file record a signed-in account? The CLI writes a non-empty
+ * `oauthAccount` object on sign-in and removes it on logout — on macOS, where the token itself is
+ * in the Keychain, it is the only on-disk signal. A missing, unreadable or unparseable file is no.
+ */
+function configRecordsLogin(path) {
+    try {
+        if (!existsSync(path))
+            return false;
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!parsed || typeof parsed !== 'object')
+            return false;
+        const account = parsed.oauthAccount;
+        return !!account && typeof account === 'object' && Object.keys(account).length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is a Claude Code login available (an OAuth token, or a logged-in session on disk)? Deliberately
+ * ignores API keys: it answers "can this run on the reader's own Claude, not a meter?".
+ *
+ * ⚠ A BARE `~/.claude` DIRECTORY OR `~/.claude.json` IS NOT A LOGIN. Merely running Claude Code —
+ * including the Agent SDK on the API-key route — creates both, so counting them moved a key-only
+ * reader onto the login route after their first run and stripped their key from every later one.
+ * Only a credentials file, CLAUDE_CODE_OAUTH_TOKEN, or a config recording `oauthAccount` counts.
+ * CLAUDE_CONFIG_DIR (which the SDK subprocess inherits) is checked before the defaults.
+ */
+export function hasClaudeLogin(env = process.env, home = homedir()) {
+    if (env.CLAUDE_CODE_OAUTH_TOKEN?.trim())
+        return true;
+    const cfg = env.CLAUDE_CONFIG_DIR?.trim();
+    const credentialFiles = [
+        ...(cfg ? [join(cfg, '.credentials.json')] : []),
+        join(home, '.claude', '.credentials.json'),
+        join(home, '.config', 'claude', '.credentials.json'),
+    ];
+    if (credentialFiles.some((path) => existsSync(path)))
+        return true;
+    const configFiles = [...(cfg ? [join(cfg, '.claude.json')] : []), join(home, '.claude.json')];
+    return configFiles.some(configRecordsLogin);
+}
+/** Which credential the next model call uses. Read at call time, so an env change takes effect. */
+export function resolveAiCredential(env = process.env, loginAvailable = hasClaudeLogin) {
+    const apiKey = envApiKey(env);
+    if (apiKey && prefersApiKey(env))
+        return { route: 'api_key', method: 'api_key', apiKey };
+    if (env.CLAUDE_CODE_OAUTH_TOKEN)
+        return { route: 'login', method: 'oauth_token' };
+    if (loginAvailable(env))
+        return { route: 'login', method: 'ambient' };
+    if (apiKey)
+        return { route: 'api_key', method: 'api_key', apiKey };
+    return { route: 'none' };
+}
+/**
+ * The environment an Agent SDK subprocess runs with, per the ladder. Passed as the query's `env`
+ * option, so it never touches process.env and two concurrent runs cannot race.
+ *
+ *   • login → the inherited environment WITHOUT ANTHROPIC_API_KEY (the login pays, not a meter).
+ *   • API key → the inherited environment WITHOUT CLAUDE_CODE_OAUTH_TOKEN, so the key is used.
+ *   • none → the inherited environment unchanged; the SDK reports the authoritative auth error.
+ */
+export function agentSdkEnv(env = process.env, credential = resolveAiCredential(env)) {
+    const out = { ...env };
+    if (credential.route === 'login')
+        delete out.ANTHROPIC_API_KEY;
+    else if (credential.route === 'api_key') {
+        delete out.CLAUDE_CODE_OAUTH_TOKEN;
+        out.ANTHROPIC_API_KEY = credential.apiKey;
+    }
+    return out;
+}
+/** Spread into every Agent SDK `query({ options })`, beside `claudeExecutableOptions()`. */
+export function agentAuthOptions() {
+    return { env: agentSdkEnv() };
+}
+//# sourceMappingURL=credentials.js.map

package/dist/api/plugins/auth.js

@@ -1,169 +1,25 @@
-import { createHash } from 'node:crypto';
-import { config } from '../../config.js';
-import { getAccountById, getLocalAccountCached, stampAccountActive, LOCAL_ACCOUNT_ID, } from '../../auth/account.js';
-// Attaches `request.account` to every request. Registered once on the root app
-// (so it covers all routes, including static/health which simply ignore it).
-//
-// Local mode: always the synthesized local account (id 1).
-// Cloud mode: resolved from the sealed session cookie (set up in registerCloudAuth,
-//   Phase 1). Unauthenticated requests get `null`; the requireAuth preHandler
-//   then 401s the data routes.
+import { getLocalAccountCached, LOCAL_ACCOUNT_ID } from '../../auth/account.js';
+// Attaches `request.account` to every request. Registered once on the root app (so it covers all
+// routes, including static/health which simply ignore it). Limn runs on the reader's own machine
+// with their `gh` login, so every request is the synthesized local account (id 1).
 export function registerAccountContext(app) {
     app.decorateRequest('account', null);
     app.addHook('onRequest', async (req) => {
-        if (config.isCloud) {
-            const accountId = readSessionAccountId(req);
-            req.account = accountId != null ? await getAccountById(accountId) : null;
-            // A request from a signed-in account on a real data route means that tenant
-            // has a loaded frontend — stamp activity (throttled) so the scheduler keeps
-            // syncing their repos. Skips static/landing assets and the health/auth probes.
-            if (req.account && req.url.startsWith('/api/')) {
-                stampAccountActive(req.account.id);
-            }
-        }
-        else {
-            req.account =
-                getLocalAccountCached() ?? {
-                    id: LOCAL_ACCOUNT_ID,
-                    githubUserId: '',
-                    githubLogin: '',
-                    displayName: null,
-                    avatarUrl: null,
-                    isLocal: true,
-                    plan: 'free',
-                    stripeCustomerId: null,
-                    aiCreditAllowance: null,
-                    benchmarkOptIn: false,
-                    largePrCodeLocThreshold: null,
-                    blastRadiusConfig: null,
-                };
-        }
+        req.account =
+            getLocalAccountCached() ?? {
+                id: LOCAL_ACCOUNT_ID,
+                githubUserId: '',
+                githubLogin: '',
+                displayName: null,
+                avatarUrl: null,
+                isLocal: true,
+                largePrCodeLocThreshold: null,
+                blastRadiusConfig: null,
+            };
     });
 }
-// Reads {accountId} from the sealed session cookie. @fastify/secure-session is
-// only registered in cloud mode (Phase 1); guarded so this is safe pre-registration.
-function readSessionAccountId(req) {
-    const session = req
-        .session;
-    if (!session)
-        return null;
-    const raw = session.get('accountId');
-    return typeof raw === 'number' ? raw : null;
-}
-// Cloud only: register the cookie + sealed-session plugins. MUST run before
-// registerAccountContext so the session cookie is parsed by the time the
-// account-context onRequest hook reads it. The session key is derived from
-// SESSION_SECRET (sha256 → 32 bytes, the size secure-session needs).
-export async function registerSession(app) {
-    const cookie = await import('@fastify/cookie');
-    const secureSession = await import('@fastify/secure-session');
-    await app.register(cookie.default, { secret: config.sessionSecret });
-    const key = createHash('sha256').update(config.sessionSecret).digest();
-    await app.register(secureSession.default, {
-        key,
-        cookieName: 'pierre_session',
-        cookie: {
-            path: '/',
-            httpOnly: true,
-            sameSite: 'lax',
-            secure: config.appBaseUrl.startsWith('https://'),
-            maxAge: 30 * 24 * 60 * 60, // 30 days
-        },
-    });
-}
-// Cloud only: 401 any unauthenticated /api data route. Skips /api/health,
-// /api/auth/* (sign-in itself), /api/billing/webhook (Stripe posts
-// unauthenticated — verified by signature instead), /api/contact* (the public
-// contact form, whose visitors have no account by definition) and all non-/api requests
-// (the SPA + landing are served openly; the frontend gate handles the signed-out
-// UI). MUST be registered AFTER registerAccountContext so req.account is already
-// resolved. Also the cloud-only ENTITLEMENT gate: an authenticated free-plan
-// account gets 402 on the Pro plugin's /api/pro/* routes (local accounts are
-// always entitled — isLocal never reaches the cloud gate anyway).
-export function registerAuthGate(app) {
-    app.addHook('onRequest', async (req, reply) => {
-        const path = req.url.split('?')[0] ?? req.url;
-        if (!path.startsWith('/api/'))
-            return;
-        if (path === '/api/health')
-            return;
-        if (path.startsWith('/api/auth/'))
-            return;
-        if (path === '/api/billing/webhook')
-            return;
-        // GitHub App webhook: GitHub posts unauthenticated — authenticity is the
-        // X-Hub-Signature-256 HMAC, verified in the route (see api/routes/webhooks.ts).
-        if (path === '/api/webhooks/github')
-            return;
-        // The pricing page's "Get Pro" is a plain browser navigation from the public
-        // landing; the route itself bounces anonymous visitors to sign-in instead of
-        // dead-ending them on a JSON 401.
-        if (path === '/api/billing/checkout')
-            return;
-        // The public contact form. It exists FOR people who are not signed in — someone
-        // asking for a Pro trial does not have an account yet, and someone reporting that
-        // sign-in is broken cannot sign in to say so. Spam control is the honeypot, the
-        // signed fill-time ticket and the IP-keyed `contact` rate-limit tier, all in
-        // api/routes/contact.ts; authentication was never the control here.
-        if (path === '/api/contact' || path === '/api/contact/ticket')
-            return;
-        if (!req.account) {
-            await reply.code(401).send({
-                error: 'Unauthorized',
-                message: 'Sign in with GitHub to continue.',
-            });
-            return;
-        }
-        if (isProPath(path) && !req.account.isLocal && req.account.plan === 'free') {
-            await reply.code(402).send({ error: 'pro required' });
-        }
-    });
-}
-// Which paths the free-plan 402 gate covers.
-//
-// `/api/pro/*` is the convention, but it is NOT the whole surface: Claude Review has always kept
-// its pre-plugin URLs — `/api/prs/:id/claude-review*`, `/api/claude-reviews/*`,
-// `/api/claude-findings/*`, `/api/claude-review/*` — and AI Fix's fixer kept its
-// `/api/pro/prs/:id/ai-fix*` / `/api/pro/ai-fixes/*` paths when both moved to core.
-//
-// ⚠ THIS IS NOW THE SECOND GUARD, NOT THE FIRST. Claude Review, review memory and AI Fix are core,
-// free and LOCAL ONLY: `registerAgenticRoutes` (review/agentic.ts) registers none of them in cloud
-// — an explicit `isCloud` check — so in cloud they 404 before this matters. The entries stay so a
-// future change that registers one in cloud does not hand it to every free account by default.
-// Enumerated explicitly so adding a route outside /api/pro/ is a visible decision.
-function isProPath(path) {
-    if (path.startsWith('/api/pro/'))
-        return true;
-    if (path.startsWith('/api/claude-reviews'))
-        return true;
-    if (path.startsWith('/api/claude-findings/'))
-        return true;
-    if (path.startsWith('/api/claude-review/'))
-        return true;
-    // /api/prs/<id>/claude-review, …/status, …/stream, …/cancel
-    if (/^\/api\/prs\/\d+\/claude-review/.test(path))
-        return true;
-    return false;
-}
-// preHandler that rejects unauthenticated requests in cloud mode. A no-op in
-// local mode (the account is always present). Kept for any route that wants an
-// explicit per-route guard in addition to the global gate above.
-export async function requireAuth(req, reply) {
-    if (!config.isCloud)
-        return;
-    if (!req.account) {
-        await reply
-            .code(401)
-            .send({ error: 'Unauthorized', message: 'Sign in with GitHub to continue.' });
-    }
-}
-// The request's account id, for scoping queries. Always present in local mode;
-// in cloud mode requireAuth has already guaranteed it on data routes.
+// The request's account id, for scoping queries.
 export function accountIdOf(req) {
-    if (req.account)
-        return req.account.id;
-    if (!config.isCloud)
-        return LOCAL_ACCOUNT_ID;
-    throw new Error('no account on request (requireAuth missing?)');
+    return req.account?.id ?? LOCAL_ACCOUNT_ID;
 }
 //# sourceMappingURL=auth.js.map