pierre-review 0.1.22 → 0.1.23

package/dist/api/routes/claude-review.js

@@ -154,8 +154,8 @@ export async function claudeReviewRoutes(app) {
             return {
                 error: 'Conflict',
                 message: result.reason === 'already_running'
-                    ? 'A review is already running for this PR.'
-                    : 'Another review is in progress; try again shortly.',
+                    ? 'A review is already running or queued for this PR.'
+                    : 'The review queue is full; try again once some finish.',
             };
         }
         reply.status(202);

package/dist/api/routes/insights.js

@@ -0,0 +1,23 @@
+import { getInsights } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+function parseIntList(raw) {
+    if (!raw)
+        return null;
+    const ids = raw
+        .split(',')
+        .map((s) => Number.parseInt(s.trim(), 10))
+        .filter((n) => Number.isFinite(n));
+    return ids.length > 0 ? ids : null;
+}
+export async function insightsRoutes(app) {
+    // Per-repo sprint/team stats for the Insights panel. Scoped to the account;
+    // `repoIds` narrows to the active watched-repo selection.
+    app.get('/api/insights', async (req) => {
+        const q = req.query;
+        return getInsights({
+            accountId: accountIdOf(req),
+            repoIds: parseIntList(q.repoIds),
+        });
+    });
+}
+//# sourceMappingURL=insights.js.map

package/dist/api/routes/me.js

@@ -23,6 +23,7 @@ export async function meRoutes(app) {
                 awaitingReview: myTurn.awaitingReview.length,
                 yourPrsActivity: myTurn.yourPrs.length,
                 threadsAwaiting: myTurn.threadsAwaiting.length,
+                claudeReviewsToAction: myTurn.claudeReviewsToAction.length,
             },
             claudeReviewEnabled: config.claudeReviewEnabled,
             deploymentMode: config.deploymentMode,

package/dist/api/routes/prs.js

@@ -1,4 +1,4 @@
-import { getPrDetail, markPrViewed } from '../../db/queries.js';
+import { getPrDetail, markAllViewed, markPrViewed } from '../../db/queries.js';
 import { hydratePrDetail } from '../../sync/hydrate-detail.js';
 import { accountIdOf } from '../plugins/auth.js';
 const idParamSchema = {
@@ -16,7 +16,22 @@ const markViewedSchema = {
         properties: { sha: { type: 'string' } },
     },
 };
+const markAllViewedSchema = {
+    body: {
+        type: 'object',
+        additionalProperties: false,
+        properties: { repoIds: { type: 'array', items: { type: 'integer' } } },
+    },
+};
 export async function prRoutes(app) {
+    // Bulk "mark all seen": stamp every open PR (optionally scoped to repoIds) viewed
+    // at its head, clearing all new-since badges at once. Static path — no :id — so it
+    // doesn't collide with /api/prs/:id.
+    app.post('/api/prs/mark-all-viewed', { schema: markAllViewedSchema }, async (req) => {
+        const { repoIds } = (req.body ?? {});
+        const count = await markAllViewed(accountIdOf(req), repoIds && repoIds.length > 0 ? repoIds : null);
+        return { status: 'ok', count };
+    });
     app.get('/api/prs/:id', { schema: idParamSchema }, async (req, reply) => {
         const { id } = req.params;
         const accountId = accountIdOf(req);

package/dist/app.js

@@ -16,6 +16,7 @@ import { threadRoutes } from './api/routes/threads.js';
 import { meRoutes } from './api/routes/me.js';
 import { openPrsRoutes } from './api/routes/open-prs.js';
 import { mergersRoutes } from './api/routes/mergers.js';
+import { insightsRoutes } from './api/routes/insights.js';
 import { claudeReviewRoutes } from './api/routes/claude-review.js';
 export async function buildApp() {
     const app = Fastify({
@@ -126,6 +127,7 @@ export async function buildApp() {
     await app.register(meRoutes);
     await app.register(openPrsRoutes);
     await app.register(mergersRoutes);
+    await app.register(insightsRoutes);
     // Claude Review is local-only + opt-in. Only register its routes when enabled,
     // so the clone-manager / gh-CLI dependency is unreachable in cloud mode.
     if (config.claudeReviewEnabled)

package/dist/config.js

@@ -126,8 +126,15 @@ export const config = {
     // Turn cap for a diff-only run. These are TOOL-LESS (only submit_review), so they
     // should finish in ~2 turns; a tight cap is a cheap runaway guard.
     reviewDiffOnlyMaxTurns: intFromEnv('REVIEW_DIFF_ONLY_MAX_TURNS', 6),
-    // At most one review per PR; this caps concurrent reviews across all PRs.
-    reviewConcurrency: intFromEnv('REVIEW_CONCURRENCY', 1),
+    // At most one review per PR; this caps concurrent reviews across all PRs. Default
+    // 4 so the user can bulk-review (extras queue, see review-manager). Raising this
+    // also DISABLES the pasted-key override (which mutates process.env and is only
+    // safe at concurrency 1 — see local-settings.applyUserAnthropicKey); ambient auth
+    // is used instead. Set REVIEW_CONCURRENCY=1 to restore the pasted-key path.
+    reviewConcurrency: intFromEnv('REVIEW_CONCURRENCY', 4),
+    // Hard ceiling on QUEUED (not-yet-started) reviews, a runaway guard for bulk
+    // triggering; further starts return 'busy' until the queue drains.
+    reviewMaxQueued: intFromEnv('REVIEW_MAX_QUEUED', 50),
     // ---- Claude Review routing (diff-only vs worktree) — THE THRESHOLDS ----
     // The deterministic pre-check (review/routing.ts) decides, BEFORE the agent runs,
     // whether a PR can be reviewed from its diff alone (fast, tool-less, no worktree)

package/dist/db/queries.js

@@ -383,6 +383,154 @@ export async function getOpenPrs(filters) {
         return a.openedAt.localeCompare(b.openedAt); // oldest first
     });
 }
+const INSIGHTS_MERGED_WINDOW_DAYS = 7;
+const INSIGHTS_REVIEW_WINDOW_DAYS = 30;
+function median(xs) {
+    if (xs.length === 0)
+        return null;
+    const s = [...xs].sort((a, b) => a - b);
+    const mid = Math.floor(s.length / 2);
+    return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+}
+/**
+ * Per-repo snapshot for the Insights panel. Counts (open/draft/stalled) are current
+ * state; merged is a 7-day window; time-to-first-review is a median over PRs opened
+ * in the last 30 days that got a review. Per-repo only — no team aggregation yet.
+ * Scoped to the account; `repoIds` narrows to the watched-repo selection.
+ */
+export async function getInsights(filters) {
+    const { accountId, repoIds } = filters;
+    const now = Date.now();
+    const mergedCutoff = new Date(now - INSIGHTS_MERGED_WINDOW_DAYS * 86_400_000);
+    const reviewCutoff = new Date(now - INSIGHTS_REVIEW_WINDOW_DAYS * 86_400_000);
+    const base = {
+        mergedWindowDays: INSIGHTS_MERGED_WINDOW_DAYS,
+        reviewWindowDays: INSIGHTS_REVIEW_WINDOW_DAYS,
+        stallThresholdDays: config.stallThresholdDays,
+        generatedAt: new Date().toISOString(),
+    };
+    const reposAll = await listRepos(accountId);
+    const repos = repoIds ? reposAll.filter((r) => repoIds.includes(r.id)) : reposAll;
+    if (repos.length === 0)
+        return { ...base, repos: [] };
+    const repoIdSet = new Set(repos.map((r) => r.id));
+    // Open PRs for these repos (one query → open/draft/stalled/oldest-unreviewed).
+    const openConds = [eq(pullRequests.accountId, accountId), eq(pullRequests.state, 'open')];
+    if (repoIds)
+        openConds.push(inArray(pullRequests.repoId, repoIds));
+    const openRows = await db.select().from(pullRequests).where(and(...openConds)).execute();
+    const counts = await buildThreadCounts(openRows.map((p) => p.id));
+    // Merged in the window (count per repo).
+    const mergedConds = [
+        eq(pullRequests.accountId, accountId),
+        eq(pullRequests.state, 'merged'),
+        gte(pullRequests.mergedAt, mergedCutoff),
+    ];
+    if (repoIds)
+        mergedConds.push(inArray(pullRequests.repoId, repoIds));
+    const mergedRows = await db
+        .select({ repoId: pullRequests.repoId })
+        .from(pullRequests)
+        .where(and(...mergedConds))
+        .execute();
+    const mergedByRepo = new Map();
+    for (const r of mergedRows)
+        mergedByRepo.set(r.repoId, (mergedByRepo.get(r.repoId) ?? 0) + 1);
+    // Time-to-first-review samples: PRs opened in the review window with a first review.
+    const ttfrConds = [
+        eq(pullRequests.accountId, accountId),
+        gte(pullRequests.openedAt, reviewCutoff),
+        isNotNull(pullRequests.firstReviewAt),
+    ];
+    if (repoIds)
+        ttfrConds.push(inArray(pullRequests.repoId, repoIds));
+    const ttfrRows = await db
+        .select({
+        repoId: pullRequests.repoId,
+        openedAt: pullRequests.openedAt,
+        firstReviewAt: pullRequests.firstReviewAt,
+    })
+        .from(pullRequests)
+        .where(and(...ttfrConds))
+        .execute();
+    const ttfrByRepo = new Map();
+    for (const r of ttfrRows) {
+        if (!r.firstReviewAt)
+            continue;
+        const hrs = (r.firstReviewAt.getTime() - r.openedAt.getTime()) / 3_600_000;
+        if (hrs < 0)
+            continue;
+        const arr = ttfrByRepo.get(r.repoId) ?? [];
+        arr.push(hrs);
+        ttfrByRepo.set(r.repoId, arr);
+    }
+    // Pending review-requests per reviewer, for OPEN PRs only (the review-load signal).
+    const rrRows = await db
+        .select({ repoId: pullRequests.repoId, userId: schema.reviewRequests.userId })
+        .from(schema.reviewRequests)
+        .innerJoin(pullRequests, eq(pullRequests.id, schema.reviewRequests.prId))
+        .where(and(eq(pullRequests.accountId, accountId), eq(pullRequests.state, 'open'), isNotNull(schema.reviewRequests.userId)))
+        .execute();
+    const reviewLoadByRepo = new Map();
+    for (const r of rrRows) {
+        if (r.userId == null || !repoIdSet.has(r.repoId))
+            continue;
+        const m = reviewLoadByRepo.get(r.repoId) ?? new Map();
+        m.set(r.userId, (m.get(r.userId) ?? 0) + 1);
+        reviewLoadByRepo.set(r.repoId, m);
+    }
+    const OPEN_LIST_CAP = 100; // bound the payload for a pathologically busy repo
+    const repoInsights = repos.map((repo) => {
+        const repoOpen = openRows.filter((p) => p.repoId === repo.id);
+        const [owner, name] = repo.fullName.split('/');
+        const stalledOf = (p) => isStalled({ state: p.state, lastCommitAt: p.lastCommitAt }, counts.get(p.id) ?? emptyCounts());
+        const unreviewed = repoOpen
+            .filter((p) => !p.isDraft && p.firstReviewAt == null)
+            .sort((a, b) => a.openedAt.getTime() - b.openedAt.getTime());
+        const oldest = unreviewed[0];
+        // The full open-PR list (oldest first), independent of timeline filters; the
+        // client toggles stale visibility off the per-row flag.
+        const openPrList = [...repoOpen]
+            .sort((a, b) => a.openedAt.getTime() - b.openedAt.getTime())
+            .slice(0, OPEN_LIST_CAP)
+            .map((p) => ({
+            prId: p.id,
+            number: p.number,
+            title: p.title,
+            authorId: p.authorId,
+            isDraft: p.isDraft,
+            isStalled: stalledOf(p),
+            openedAt: p.openedAt.toISOString(),
+            githubUrl: `https://github.com/${owner}/${name}/pull/${p.number}`,
+        }));
+        const med = median(ttfrByRepo.get(repo.id) ?? []);
+        const reviewLoad = [...(reviewLoadByRepo.get(repo.id) ?? new Map()).entries()]
+            .map(([userId, pending]) => ({ userId, pending }))
+            .sort((a, b) => b.pending - a.pending)
+            .slice(0, 5);
+        return {
+            repoId: repo.id,
+            repoFullName: repo.fullName,
+            openPrs: repoOpen.filter((p) => !p.isDraft).length,
+            draftPrs: repoOpen.filter((p) => p.isDraft).length,
+            mergedLast7d: mergedByRepo.get(repo.id) ?? 0,
+            stalledPrs: repoOpen.filter(stalledOf).length,
+            medianHoursToFirstReview: med == null ? null : Math.round(med * 10) / 10,
+            oldestUnreviewed: oldest
+                ? {
+                    prId: oldest.id,
+                    number: oldest.number,
+                    title: oldest.title,
+                    openedAt: oldest.openedAt.toISOString(),
+                    githubUrl: `https://github.com/${owner}/${name}/pull/${oldest.number}`,
+                }
+                : null,
+            reviewLoad,
+            openPrList,
+        };
+    });
+    return { ...base, repos: repoInsights };
+}
 // ---- merge-rights inference ----
 // Distinct users who have merged a PR INTO THE DEFAULT BRANCH per repo (across
 // ALL synced history, not the timeline window). We treat "has merged into the
@@ -438,6 +586,37 @@ export async function markPrViewed(prId, accountId, sha) {
         .execute();
     return true;
 }
+// Mark every currently-open PR (optionally repo-scoped) viewed at its head — the
+// bulk "mark all seen" that clears all new-since badges at once. Account-scoped;
+// returns how many PRs were stamped. Closed/merged PRs carry no new-since badge,
+// so open is the set that matters. One transaction, one upsert per PR (portable
+// across dialects; the open-PR set is bounded in practice).
+export async function markAllViewed(accountId, repoIds) {
+    const conds = [eq(pullRequests.accountId, accountId), eq(pullRequests.state, 'open')];
+    if (repoIds)
+        conds.push(inArray(pullRequests.repoId, repoIds));
+    const rows = await db
+        .select({ id: pullRequests.id, headSha: pullRequests.headSha })
+        .from(pullRequests)
+        .where(and(...conds))
+        .execute();
+    if (rows.length === 0)
+        return 0;
+    const now = new Date();
+    await runTransaction(async (tx) => {
+        for (const r of rows) {
+            await tx
+                .insert(prViews)
+                .values({ prId: r.id, lastViewedSha: r.headSha ?? null, lastViewedAt: now })
+                .onConflictDoUpdate({
+                target: prViews.prId,
+                set: { lastViewedSha: r.headSha ?? null, lastViewedAt: now },
+            })
+                .execute();
+        }
+    });
+    return rows.length;
+}
 // ---- my turn ----
 // Does this (kind, refId) actually belong to the account? Guards the dismiss
 // insert so a buggy/hostile client can't seed orphan dismissal rows for ids it
@@ -608,6 +787,7 @@ export async function getMyTurn(accountId) {
         awaitingReview: [],
         yourPrs: [],
         threadsAwaiting: [],
+        claudeReviewsToAction: [],
         users: [],
     };
     if (localUserId == null)
@@ -690,6 +870,10 @@ export async function getMyTurn(accountId) {
         if (ta.lastReplyAuthorId != null)
             referencedUsers.add(ta.lastReplyAuthorId);
     }
+    // Completed-but-unactioned Claude reviews (local-only feature; empty otherwise).
+    const claudeReviewsToAction = config.claudeReviewEnabled
+        ? await getUnactionedClaudeReviews(accountId)
+        : [];
     const users = referencedUsers.size > 0
         ? (await db
             .select()
@@ -697,7 +881,7 @@ export async function getMyTurn(accountId) {
             .where(inArray(schema.users.id, [...referencedUsers]))
             .execute()).map(mapUser)
         : [];
-    return { awaitingReview, yourPrs, threadsAwaiting, users };
+    return { awaitingReview, yourPrs, threadsAwaiting, claudeReviewsToAction, users };
 }
 async function countOtherReviewers(prId, localUserId) {
     const rows = await db
@@ -1267,6 +1451,53 @@ export async function listAllClaudeReviews(accountId) {
     }
     return items;
 }
+// Completed Claude reviews on OPEN PRs that haven't been actioned: each PR's
+// MOST-RECENT succeeded run, kept only when it was never posted (postedAt null).
+// Account-scoped. Feeds the My Turn "Claude reviews to action" section so finished
+// reviews don't fall through the cracks.
+export async function getUnactionedClaudeReviews(accountId) {
+    const rows = await db
+        .select({
+        reviewId: claudeReviews.id,
+        prId: claudeReviews.prId,
+        owner: repos.owner,
+        name: repos.name,
+        prNumber: pullRequests.number,
+        prTitle: pullRequests.title,
+        verdict: claudeReviews.verdict,
+        finishedAt: claudeReviews.finishedAt,
+        postedAt: claudeReviews.postedAt,
+        reviewHead: claudeReviews.headSha,
+        prHead: pullRequests.headSha,
+    })
+        .from(claudeReviews)
+        .innerJoin(pullRequests, eq(pullRequests.id, claudeReviews.prId))
+        .innerJoin(repos, eq(repos.id, pullRequests.repoId))
+        .where(and(eq(repos.accountId, accountId), eq(claudeReviews.status, 'succeeded'), eq(pullRequests.state, 'open')))
+        .orderBy(desc(claudeReviews.finishedAt), desc(claudeReviews.createdAt))
+        .execute();
+    const seen = new Set(); // most-recent succeeded run per PR only
+    const out = [];
+    for (const r of rows) {
+        if (seen.has(r.prId))
+            continue;
+        seen.add(r.prId);
+        if (r.postedAt != null)
+            continue; // that latest run was already posted → actioned
+        out.push({
+            reviewId: r.reviewId,
+            prId: r.prId,
+            repoFullName: `${r.owner}/${r.name}`,
+            prNumber: r.prNumber,
+            prTitle: r.prTitle,
+            verdict: r.verdict,
+            finishedAt: iso(r.finishedAt),
+            headStale: r.reviewHead !== r.prHead,
+            githubUrl: `https://github.com/${r.owner}/${r.name}/pull/${r.prNumber}`,
+        });
+    }
+    return out;
+}
 export async function getFindingPostContext(findingId, accountId) {
     const rows = await db
         .select({

package/dist/review/agent.js

@@ -5,7 +5,7 @@ import { createSdkMcpServer, query, tool, } from '@anthropic-ai/claude-agent-sdk
 import { config } from '../config.js';
 import { submitReviewShape } from './schema.js';
 import { applyUserAnthropicKey } from './local-settings.js';
-import { addWorktree, cleanupCloneCache, ensureClone, fetchPrHead, removeWorktree, } from './clone-manager.js';
+import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from './clone-manager.js';
 import { buildUserPrompt, isNoiseFile, systemPromptForMode, } from './prompt.js';
 import { buildAnchorIndex, extractHunk, fetchPrDiff, isFindingAnchored, splitDiffByFile, stripNoiseFromDiff, } from './post-review.js';
 import { decideReviewMode } from './routing.js';
@@ -90,9 +90,9 @@ export async function runReview(args) {
         let maxTurns;
         if (mode === 'worktree') {
             onProgress({ phase: 'cloning', reviewMode: mode });
-            repoCloneDir = await ensureClone(args.owner, args.name);
-            await fetchPrHead(repoCloneDir, args.prNumber, args.headSha);
-            worktreePath = await addWorktree(repoCloneDir, args.headSha);
+            // Clone/fetch/worktree-add run under a per-repo lock (clone-manager) so several
+            // concurrent reviews of the same repo can't race on git locks.
+            ({ repoCloneDir, worktreePath } = await prepWorktree(args.owner, args.name, args.prNumber, args.headSha));
             cwd = worktreePath;
             allowedTools = WORKTREE_TOOLS;
             maxTurns = config.reviewMaxTurns;
@@ -248,7 +248,7 @@ export async function runReview(args) {
     finally {
         restoreEnv?.();
         if (repoCloneDir && worktreePath) {
-            await removeWorktree(repoCloneDir, worktreePath).catch(() => { });
+            await removeWorktreeLocked(args.owner, args.name, repoCloneDir, worktreePath).catch(() => { });
         }
         // Diff-only runs use a throwaway cwd — remove it (best-effort).
         if (tempCwd) {

package/dist/review/clone-manager.js

@@ -17,6 +17,28 @@ async function git(args, cwd) {
         maxBuffer: 64 * 1024 * 1024,
     });
 }
+// Serialise git PREP/CLEANUP (clone / fetch / worktree add+remove) PER REPO so
+// concurrent reviews of PRs in the same repo don't race on git's index / worktree
+// locks (`index.lock` exists, worktree-registry contention) once reviewConcurrency
+// > 1. A simple promise-chain mutex keyed by `owner/name`; only this short prep
+// phase serialises — the agent runs themselves (each in its own worktree) overlap.
+const repoLocks = new Map();
+async function withRepoLock(key, fn) {
+    const prev = repoLocks.get(key) ?? Promise.resolve();
+    let release;
+    const next = new Promise((r) => {
+        release = r;
+    });
+    // The map tail resolves when WE release, so the next caller queues behind us.
+    repoLocks.set(key, prev.then(() => next));
+    await prev.catch(() => { }); // our turn once the previous holder releases (ignore its error)
+    try {
+        return await fn();
+    }
+    finally {
+        release();
+    }
+}
 /** Absolute path to a repo's long-lived partial clone under config.cloneDir. */
 function repoCloneDir(owner, name) {
     return join(config.cloneDir, `${owner}__${name}`);
@@ -129,6 +151,24 @@ export async function removeWorktree(repoCloneDir, worktreePath) {
         /* best-effort */
     }
 }
+/**
+ * Prepare a worktree for a review under the per-repo lock: ensure the clone, fetch
+ * the PR head, add the worktree. Serialised per repo so several concurrent reviews
+ * of the same repo can't collide on git locks; returns both the clone dir (for
+ * later cleanup) and the worktree path the agent runs in.
+ */
+export async function prepWorktree(owner, name, prNumber, sha) {
+    return withRepoLock(`${owner}/${name}`, async () => {
+        const dir = await ensureClone(owner, name);
+        await fetchPrHead(dir, prNumber, sha);
+        const worktreePath = await addWorktree(dir, sha);
+        return { repoCloneDir: dir, worktreePath };
+    });
+}
+/** Tear down a per-run worktree under the per-repo lock (matches prepWorktree). */
+export async function removeWorktreeLocked(owner, name, repoCloneDir, worktreePath) {
+    await withRepoLock(`${owner}/${name}`, () => removeWorktree(repoCloneDir, worktreePath));
+}
 /** Recursively sum file sizes and track the most-recent mtime under `dir`. */
 function walkSize(dir) {
     let bytes = 0;

package/dist/review/review-manager.js

@@ -2,49 +2,73 @@ import { config } from '../config.js';
 import { LOCAL_ACCOUNT_ID } from '../auth/account.js';
 import { getLatestClaudeReview, getReviewPrContext } from '../db/queries.js';
 import { runReview } from './agent.js';
-import { insertQueuedReview, reconcileOrphanedReviews } from './persist.js';
-// In-memory state (analogous to sync/sync-manager.ts). At most one review per PR;
-// a global gate (config.reviewConcurrency) bounds concurrent reviews overall.
-const running = new Set(); // prIds with a review in flight
+import { insertQueuedReview, markReviewCancelled, reconcileOrphanedReviews, } from './persist.js';
+// In-memory state (analogous to sync/sync-manager.ts). At most one review per PR.
+// `config.reviewConcurrency` bounds concurrent RUNNING reviews; extras wait in a
+// FIFO `pending` queue and launch as slots free (so the user can bulk-trigger).
+const running = new Set(); // prIds with a review actively running
+const pending = []; // FIFO of queued reviews waiting for a slot
+const claimed = new Set(); // prIds either running OR pending — the sync guard
 const reviewIdByPr = new Map();
 const progressByReview = new Map();
 const controllers = new Map();
 export async function startReview(prId, model, requestedMode, log) {
     if (!config.claudeReviewEnabled)
         return { ok: false, reason: 'disabled' };
-    if (running.has(prId))
+    // `claimed` covers BOTH running and queued, so a re-trigger of an in-flight or
+    // already-queued PR is rejected without a TOCTOU double-start.
+    if (claimed.has(prId))
         return { ok: false, reason: 'already_running' };
-    if (running.size >= config.reviewConcurrency) {
+    // Runaway guard for bulk triggering: cap the queue depth.
+    if (pending.length >= config.reviewMaxQueued)
         return { ok: false, reason: 'busy' };
-    }
-    // Reserve the slot SYNCHRONOUSLY before any await, so a second concurrent
-    // startReview for the same prId sees `running.has(prId)` immediately (no
-    // TOCTOU double-start). Roll it back on any early-bail / insert failure below.
-    running.add(prId);
+    // Reserve SYNCHRONOUSLY before any await; roll back on early-bail / insert failure.
+    claimed.add(prId);
     let reviewId;
     let ctx;
     try {
         ctx = await getReviewPrContext(prId, LOCAL_ACCOUNT_ID);
         if (!ctx) {
-            running.delete(prId);
+            claimed.delete(prId);
             return { ok: false, reason: 'not_found' };
         }
         if (!ctx.headSha) {
-            running.delete(prId);
+            claimed.delete(prId);
             return { ok: false, reason: 'no_head' };
         }
         reviewId = await insertQueuedReview(prId, ctx.headSha, model, LOCAL_ACCOUNT_ID);
     }
     catch (err) {
-        running.delete(prId);
+        claimed.delete(prId);
         throw err;
     }
-    const headSha = ctx.headSha;
+    const item = {
+        reviewId,
+        prId,
+        model,
+        requestedMode,
+        headSha: ctx.headSha,
+        ctx,
+        log,
+    };
+    reviewIdByPr.set(prId, reviewId);
+    if (running.size < config.reviewConcurrency) {
+        launch(item);
+        return { ok: true, reviewId, queued: false };
+    }
+    // No slot — leave it queued (the row's persisted status is already 'queued'); it
+    // launches from pump() when a running review finishes.
+    pending.push(item);
+    return { ok: true, reviewId, queued: true };
+}
+function launch(item) {
+    const { reviewId, prId, ctx } = item;
+    running.add(prId);
     reviewIdByPr.set(prId, reviewId);
     const controller = new AbortController();
     controllers.set(reviewId, controller);
-    // The diff is fetched (and the mode decided) before any clone now, so the first
-    // real phase is always 'fetching_diff' — not 'cloning' (which a diff-only run skips).
+    // The diff is fetched (and the mode decided) before any clone, so the first real
+    // phase is always 'fetching_diff' — not 'cloning' (which a diff-only run skips).
     progressByReview.set(reviewId, { phase: 'fetching_diff' });
     void runReview({
         reviewId,
@@ -56,32 +80,50 @@ export async function startReview(prId, model, requestedMode, log) {
         title: ctx.title,
         body: ctx.body,
         baseRefName: ctx.baseRefName,
-        headSha,
-        model,
-        requestedMode,
+        headSha: item.headSha,
+        model: item.model,
+        requestedMode: item.requestedMode,
         abortController: controller,
         onProgress: (p) => progressByReview.set(reviewId, p),
     })
         .catch((err) => {
-        log.error(`claude review pr ${prId} failed: ${err instanceof Error ? err.message : err}`);
+        item.log.error(`claude review pr ${prId} failed: ${err instanceof Error ? err.message : err}`);
     })
         .finally(() => {
         running.delete(prId);
         reviewIdByPr.delete(prId);
         controllers.delete(reviewId);
         progressByReview.delete(reviewId);
+        claimed.delete(prId);
+        pump(); // a slot freed — start the next queued review
     });
-    return { ok: true, reviewId };
+}
+// Start as many queued reviews as there are free slots (FIFO).
+function pump() {
+    while (running.size < config.reviewConcurrency && pending.length > 0) {
+        launch(pending.shift());
+    }
 }
 export function isReviewRunning(prId) {
     return running.has(prId);
 }
 export function requestReviewCancel(prId) {
+    // Running → abort the SDK run (runReview's finally cleans up + pumps the queue).
     const reviewId = reviewIdByPr.get(prId);
-    if (reviewId == null)
-        return false;
-    controllers.get(reviewId)?.abort();
-    return true;
+    if (running.has(prId) && reviewId != null) {
+        controllers.get(reviewId)?.abort();
+        return true;
+    }
+    // Queued (not yet started) → drop it from the queue and mark the row cancelled.
+    const idx = pending.findIndex((p) => p.prId === prId);
+    if (idx >= 0) {
+        const item = pending.splice(idx, 1)[0];
+        claimed.delete(prId);
+        reviewIdByPr.delete(prId);
+        void markReviewCancelled(item.reviewId).catch(() => { });
+        return true;
+    }
+    return false;
 }
 // Live status when a review is in flight; otherwise the latest persisted run's
 // status (or 'idle' if the PR was never reviewed).
@@ -94,13 +136,16 @@ export async function getReviewStatus(prId) {
             progress: progressByReview.get(reviewId) ?? null,
         };
     }
+    const queued = pending.find((p) => p.prId === prId);
+    if (queued)
+        return { status: 'queued', reviewId: queued.reviewId, progress: null };
     const latest = await getLatestClaudeReview(prId, LOCAL_ACCOUNT_ID);
     if (!latest)
         return { status: 'idle', reviewId: null, progress: null };
     return { status: latest.status, reviewId: latest.id, progress: null };
 }
-// All reviews currently in flight (for the global progress banner), joined with
-// their PR coordinates.
+// All reviews currently in flight OR queued (for the global progress banner),
+// joined with their PR coordinates.
 export async function listActiveReviews() {
     const out = [];
     for (const prId of running) {
@@ -120,6 +165,18 @@ export async function listActiveReviews() {
             phase: progressByReview.get(reviewId)?.phase ?? null,
         });
     }
+    // Queued items use their stored ctx (no extra fetch); the banner shows them too.
+    for (const item of pending) {
+        out.push({
+            reviewId: item.reviewId,
+            prId: item.prId,
+            repoFullName: item.ctx.repoFullName,
+            prNumber: item.ctx.number,
+            prTitle: item.ctx.title,
+            status: 'queued',
+            phase: null,
+        });
+    }
     return out;
 }
 // Heal runs left 'running'/'queued' by a crash (our status is persisted).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",