pierre-review 0.1.14 → 0.1.16

package/dist/api/routes/me.js

@@ -1,7 +1,7 @@
 import { config } from '../../config.js';
 import { accountToLocalUser } from '../../auth/account.js';
 import { accountIdOf } from '../plugins/auth.js';
-import { dismissMyTurn, getMyTurn } from '../../db/queries.js';
+import { dismissMyTurn, getCompletedDismissals, getMyTurn, undismissMyTurn, } from '../../db/queries.js';
 const dismissSchema = {
     body: {
         type: 'object',
@@ -34,5 +34,13 @@ export async function meRoutes(app) {
         await dismissMyTurn(accountIdOf(req), kind, refId);
         return { status: 'ok' };
     });
+    // The "Done" tab: entries dismissed in the past 90 days (review_request + thread).
+    app.get('/api/my-turn/done', async (req) => getCompletedDismissals(accountIdOf(req), 90));
+    // Un-dismiss: move a completed entry back to the inbox.
+    app.post('/api/my-turn/undismiss', { schema: dismissSchema }, async (req) => {
+        const { kind, refId } = req.body;
+        await undismissMyTurn(accountIdOf(req), kind, refId);
+        return { status: 'ok' };
+    });
 }
 //# sourceMappingURL=me.js.map

package/dist/api/routes/repos.js

@@ -5,6 +5,10 @@ import { upsertRepo } from '../../sync/upsert.js';
 import { getSyncStatus, isSyncRunning, requestSyncCancel, runSyncForRepo, waitForSyncToStop, } from '../../sync/sync-manager.js';
 import { deleteRepo, getRepo, getWatchedRepoNodeIds, listRepos, } from '../../db/queries.js';
 import { accountIdOf } from '../plugins/auth.js';
+// Local copy of the shared MAX_REPOS_PER_ACCOUNT value. `@pierre-review/shared` is
+// a types-only package (not shipped in the published tarball), so the backend must
+// only `import type` from it — runtime constants are duplicated here. Keep in sync.
+const MAX_REPOS_PER_ACCOUNT = 15;
 const createRepoSchema = {
     body: {
         type: 'object',
@@ -131,6 +135,18 @@ export async function repoRoutes(app) {
                 message: `Repository ${owner}/${name} not found or inaccessible. Check the name and your gh auth / SSO.`,
             };
         }
+        // Enforce the per-account repo cap. Re-adding an already-watched repo is an
+        // idempotent no-op (it doesn't grow the count), so only genuinely NEW repos
+        // are blocked once at the limit.
+        const watched = await getWatchedRepoNodeIds(accountId);
+        if (watched.size >= MAX_REPOS_PER_ACCOUNT &&
+            !watched.has(resp.repository.id)) {
+            reply.status(409);
+            return {
+                error: 'RepoLimitExceeded',
+                message: `You can watch at most ${MAX_REPOS_PER_ACCOUNT} repositories. Remove one to add another.`,
+            };
+        }
         const canonOwner = resp.repository.owner.login;
         const canonName = resp.repository.name;
         const repoId = await upsertRepo(canonOwner, canonName, resp.repository.id, null, accountId);

package/dist/app.js

@@ -30,6 +30,39 @@ export async function buildApp() {
                 : { target: 'pino-pretty', options: { translateTime: 'HH:MM:ss' } },
         },
     });
+    // Cloud only: canonicalise the host and pin HTTPS. Local mode runs on
+    // http://127.0.0.1, where HSTS would wrongly pin localhost to HTTPS and a www
+    // redirect is meaningless — so both are cloud-gated. Registered first so it runs
+    // before everything else (the redirect short-circuits before CORS/routing).
+    if (config.isCloud) {
+        let canonicalHost = '';
+        try {
+            // hostname (not host) so a configured port never enters the comparison.
+            canonicalHost = new URL(config.appBaseUrl).hostname.toLowerCase();
+        }
+        catch {
+            canonicalHost = '';
+        }
+        app.addHook('onRequest', async (req, reply) => {
+            // HSTS: keep browsers on HTTPS for this domain. Honored only over HTTPS
+            // (Railway terminates TLS); ignored on plain HTTP. `includeSubDomains` also
+            // covers www. No `preload` — it's hard to undo. HSTS_MAX_AGE=0 disables it.
+            if (config.hstsMaxAge > 0) {
+                reply.header('Strict-Transport-Security', `max-age=${config.hstsMaxAge}; includeSubDomains`);
+            }
+            // Canonical host: 301 www.<apex> → <apex> so the OAuth round-trip and the
+            // session cookie stay on a single origin (and crawlers see one canonical
+            // URL). The HSTS header set above still rides on the redirect response.
+            if (canonicalHost) {
+                // Strip any :port from the Host header before comparing hostnames.
+                const host = (req.headers.host ?? '').toLowerCase().split(':')[0] ?? '';
+                if (host !== canonicalHost &&
+                    host.replace(/^www\./, '') === canonicalHost) {
+                    return reply.redirect(`${config.appBaseUrl}${req.url}`, 301);
+                }
+            }
+        });
+    }
     // CORS: in cloud mode lock to the app's own origin and allow credentials so the
     // session cookie rides along; local mode reflects any origin (dev convenience).
     await app.register(cors, {

package/dist/config.js

@@ -96,6 +96,11 @@ export const config = {
     sessionSecret: process.env.SESSION_SECRET ?? '',
     // 32-byte (64-hex) key for AES-256-GCM encryption of stored access tokens.
     encryptionKey: process.env.ENCRYPTION_KEY ?? '',
+    // HSTS max-age (seconds) for the cloud public origin. Sent only in cloud mode
+    // and honored only over HTTPS (Railway terminates TLS). Default 1 year. Set
+    // HSTS_MAX_AGE=0 as a kill switch. `preload` is intentionally NOT sent — it is
+    // hard to undo; opt in manually once the domain is proven.
+    hstsMaxAge: intFromEnv('HSTS_MAX_AGE', 31536000),
     // ---- Claude Review (agentic PR review; opt-in, LOCAL-ONLY) ----
     // OFF by default: the feature spends real money / Agent-SDK credits per run.
     // Enable with ENABLE_CLAUDE_REVIEW=true. FORCE-DISABLED in cloud mode (it

package/dist/db/migrations/0011_pr_diff_size.sql

@@ -0,0 +1,10 @@
+-- PR diff-size metadata (additive). Adds the GraphQL additions/deletions/
+-- changedFiles totals and the per-file breakdown (files JSON) to pull_requests,
+-- powering the PR-detail LOC summary label and the new "Changes" tab. This is
+-- small metadata (not bulky user text), so it's stored in BOTH modes regardless
+-- of lean storage. Existing rows get the 0 defaults / NULL files until the next
+-- sync backfills real values.
+ALTER TABLE `pull_requests` ADD `additions` integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `deletions` integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `changed_files` integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE `pull_requests` ADD `files` text;

package/dist/db/migrations/0012_findings_included_default.sql

@@ -0,0 +1,7 @@
+-- Claude Review findings are now INCLUDED by default (the UI is opt-OUT via an
+-- "Ignore" button, replacing the old opt-IN "include" checkbox). New findings are
+-- inserted with included=1 (see review/persist.ts); this backfills existing rows so
+-- already-generated reviews show their findings as included rather than ignored.
+-- SQLite-only: Claude Review is force-disabled in cloud, so the Postgres
+-- claude_review_findings table is never populated.
+UPDATE `claude_review_findings` SET `included` = 1 WHERE `included` = 0;

package/dist/db/migrations/meta/_journal.json

@@ -78,6 +78,20 @@
       "when": 1780800000001,
       "tag": "0010_lean_bodies_nullable",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1780800000002,
+      "tag": "0011_pr_diff_size",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1780800000003,
+      "tag": "0012_findings_included_default",
+      "breakpoints": true
     }
   ]
 }

package/dist/db/migrations-pg/0002_glorious_ikaris.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "pull_requests" ADD COLUMN "additions" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN "deletions" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN "changed_files" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "pull_requests" ADD COLUMN "files" jsonb;