pierre-review 0.1.40 → 0.1.41

package/dist/api/routes/activity.js

@@ -32,6 +32,7 @@ export async function activityRoutes(app) {
             limit: Number.isFinite(limit) && limit != null && limit > 0 ? limit : null,
             offset: Number.isFinite(offset) && offset > 0 ? offset : 0,
             excludeBots: q.excludeBots === 'true',
+            allowBotIds: parseIntList(q.allowBotIds),
         });
     });
     // Repo-scoped Claude-review history for the Activity single-repo console. Ownership +

package/dist/api/routes/prs.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { getAccessToken, getAccountUserId } from '../../auth/account.js';
 import { ghRestGetText } from '../../github/client.js';
-import { getPrDetail, getPrFilesContext, getPrWriteContext, markAllViewed, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
+import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, markAllViewed, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
 import { buildFileAnchors, fallbackAnchor, isFindingAnchored, } from '../../github/diff-anchor.js';
 import { addIssueComment, fetchHeadShaFor, fetchPrFilesWithPatch, postInlineComment, submitPrReview, } from '../../github/mutations.js';
 import { hydratePrDetail } from '../../sync/hydrate-detail.js';
@@ -115,6 +115,18 @@ export async function prRoutes(app) {
         // caches the result in IndexedDB keyed by updatedAt so unchanged PRs don't refetch.
         return hydratePrDetail(pr, accountId);
     });
+    // Candidates for an @mention autocomplete, ranked by proximity to this PR
+    // (participants first, then repo people), self + bots excluded. Account-scoped:
+    // 404 when the PR isn't the caller's.
+    app.get('/api/prs/:id/mention-candidates', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const candidates = await getMentionCandidates(id, accountIdOf(req));
+        if (!candidates) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        return candidates;
+    });
     // Record that the local user has seen this PR up to `sha` (defaults to the
     // current head). Clears "new since last viewed" badges.
     app.post('/api/prs/:id/mark-viewed', { schema: markViewedSchema }, async (req, reply) => {

package/dist/api/routes/timeline.js

@@ -86,6 +86,7 @@ export async function timelineRoutes(app) {
             statuses: parseStatuses(q.statuses),
             reviewStates: parseReviewStates(q.reviewStates),
             excludeBots: q.excludeBots === 'true',
+            allowBotIds: parseIntList(q.allowBotIds),
             excludeStale: q.excludeStale === 'true',
         };
         return getTimeline(filters);

package/dist/db/queries.js

@@ -225,7 +225,7 @@ function mapTimelinePr(p, counts, tr) {
     };
 }
 export async function getTimeline(filters) {
-    const { accountId, from, to, repoIds, userIds, types, statuses, reviewStates, excludeBots, excludeStale, } = filters;
+    const { accountId, from, to, repoIds, userIds, types, statuses, reviewStates, excludeBots, allowBotIds, excludeStale, } = filters;
     // ---- PRs that overlap the window ----
     const prConds = [
         eq(pullRequests.accountId, accountId),
@@ -244,8 +244,11 @@ export async function getTimeline(filters) {
             .from(events)
             .where(and(eq(events.prId, pullRequests.id), inArray(events.actorId, userIds))))));
     }
-    // Resolve the bot set once (used by both the PR and events branches below).
-    const bots = excludeBots ? await botUserIds() : [];
+    // Resolve the bot set once (used by both the PR and events branches below). The
+    // per-repo allow-list subtracts the "important" bots so their activity stays visible
+    // even under excludeBots — every downstream predicate keys off this trimmed set.
+    const allowBots = new Set(allowBotIds ?? []);
+    const bots = excludeBots ? (await botUserIds()).filter((id) => !allowBots.has(id)) : [];
     if (excludeBots && bots.length > 0) {
         prConds.push(or(sql `${pullRequests.authorId} is null`, sql `${pullRequests.authorId} not in (${sql.join(bots, sql `, `)})`));
     }
@@ -1318,6 +1321,7 @@ async function getCommitThreadItems(accountId, opts) {
             id: `feed:commitrun:${run.prId}:${run.latestEventId}`,
             // Flagged by the caller (getConsolidatedFeed) once participation is resolved.
             isMyTurn: false,
+            myTurnReasons: [],
             kind: 'commit_pushed',
             occurredAt: run.latestOccurredAt.toISOString(),
             repoId: run.repoId,
@@ -1329,6 +1333,7 @@ async function getCommitThreadItems(accountId, opts) {
             actorId: run.actorId,
             content: null,
             threadId: null,
+            commentId: null,
             path: null,
             line: null,
             reasonTag: null,
@@ -1338,27 +1343,27 @@ async function getCommitThreadItems(accountId, opts) {
                 : null,
             mergedById: null,
             reviewers: null,
+            ciStatus: null,
+            changedFilesCount: null,
             affectedThreads: affected,
             commitCount: run.commitCount,
             changeSummary: `pushed ${run.commitCount} ${commitWord} · addressed ${affected.length} ${threadWord}`,
+            claudeReviewId: null,
+            claudeVerdict: null,
         });
     }
     return out;
 }
-// Participation ("is this PR mine?") for the consolidated feed's isMyTurn flag. Given a
-// candidate set of PR ids (all account-owned — they come from the account-scoped feed),
-// returns the subset the viewer participates in: PRs they authored, are a requested
-// reviewer on, or previously reviewed / commented on (issue comment OR inline review
-// comment). Isolation rides on prId ∈ the account-owned candidate set, so the un-scoped
-// child tables (reviews/reviewRequests/prComments/reviewComments) need no accountId
-// predicate here. `authored`/`requested` are broken out so the caller can colour the badge.
-// Empty when the viewer is unknown (offline / not yet synced) → isMyTurn defaults false.
 async function getParticipatingPrIds(accountId, localUserId, prIds) {
     const authored = new Set();
     const requested = new Set();
+    const reviewed = new Set();
+    const commented = new Set();
+    const merged = new Set();
     const all = new Set();
+    const empty = { all, authored, requested, reviewed, commented, merged };
     if (localUserId == null || prIds.length === 0)
-        return { all, authored, requested };
+        return empty;
     for (const row of await db
         .select({ id: pullRequests.id })
         .from(pullRequests)
@@ -1367,6 +1372,16 @@ async function getParticipatingPrIds(accountId, localUserId, prIds) {
         authored.add(row.id);
         all.add(row.id);
     }
+    // PRs the viewer merged (even if they never reviewed) count as participation too — a
+    // merge is a strong "I own the outcome of this" signal, so later activity is FYI.
+    for (const row of await db
+        .select({ id: pullRequests.id })
+        .from(pullRequests)
+        .where(and(eq(pullRequests.accountId, accountId), eq(pullRequests.mergedById, localUserId), inArray(pullRequests.id, prIds)))
+        .execute()) {
+        merged.add(row.id);
+        all.add(row.id);
+    }
     for (const row of await db
         .select({ prId: reviewRequests.prId })
         .from(reviewRequests)
@@ -1379,35 +1394,144 @@ async function getParticipatingPrIds(accountId, localUserId, prIds) {
         .select({ prId: reviews.prId })
         .from(reviews)
         .where(and(eq(reviews.authorId, localUserId), inArray(reviews.prId, prIds)))
-        .execute())
+        .execute()) {
+        reviewed.add(row.prId);
         all.add(row.prId);
+    }
     for (const row of await db
         .select({ prId: prComments.prId })
         .from(prComments)
         .where(and(eq(prComments.authorId, localUserId), inArray(prComments.prId, prIds)))
-        .execute())
+        .execute()) {
+        commented.add(row.prId);
         all.add(row.prId);
+    }
     for (const row of await db
         .select({ prId: reviewComments.prId })
         .from(reviewComments)
         .where(and(eq(reviewComments.authorId, localUserId), inArray(reviewComments.prId, prIds)))
-        .execute())
+        .execute()) {
+        commented.add(row.prId);
         all.add(row.prId);
-    return { all, authored, requested };
+    }
+    return { all, authored, requested, reviewed, commented, merged };
+}
+// Map a viewer's participation in a PR to the ordered reason pills for its FYI card.
+// Most-relevant first; the UI shows the primary. Empty when the viewer doesn't
+// participate (non-my-turn row).
+function myTurnReasonsFor(participation, prId) {
+    if (prId == null)
+        return [];
+    const reasons = [];
+    if (participation.requested.has(prId))
+        reasons.push('requested');
+    if (participation.authored.has(prId))
+        reasons.push('authored');
+    if (participation.merged.has(prId))
+        reasons.push('merged');
+    if (participation.reviewed.has(prId))
+        reasons.push('reviewed');
+    if (participation.commented.has(prId))
+        reasons.push('commented');
+    return reasons;
+}
+// Claude Review runs surfaced in the consolidated feed as their own item kind. One item
+// per PR = that PR's most-recent SUCCEEDED run finished within the feed window, repo-scoped.
+// Gated on the feature flag (force-off in cloud) so no items appear where Claude Review
+// doesn't exist. Never member-/bot-filtered (a run has no member author).
+async function getClaudeReviewFeedItems(accountId, repoIds, since) {
+    if (!config.claudeReviewEnabled)
+        return [];
+    const conds = [
+        eq(repos.accountId, accountId),
+        eq(claudeReviews.status, 'succeeded'),
+        gte(sql `coalesce(${claudeReviews.finishedAt}, ${claudeReviews.createdAt})`, tsBound(since)),
+    ];
+    if (repoIds)
+        conds.push(inArray(pullRequests.repoId, repoIds));
+    const rows = await db
+        .select({
+        reviewId: claudeReviews.id,
+        prId: claudeReviews.prId,
+        repoId: pullRequests.repoId,
+        owner: repos.owner,
+        name: repos.name,
+        prNumber: pullRequests.number,
+        prTitle: pullRequests.title,
+        prState: pullRequests.state,
+        summary: claudeReviews.summary,
+        verdict: claudeReviews.verdict,
+        userVerdict: claudeReviews.userVerdict,
+        finishedAt: claudeReviews.finishedAt,
+        createdAt: claudeReviews.createdAt,
+    })
+        .from(claudeReviews)
+        .innerJoin(pullRequests, eq(pullRequests.id, claudeReviews.prId))
+        .innerJoin(repos, eq(repos.id, pullRequests.repoId))
+        .where(and(...conds))
+        .orderBy(desc(claudeReviews.finishedAt), desc(claudeReviews.createdAt))
+        .execute();
+    // Keep the most-recent succeeded run per PR (rows are newest-first).
+    const seen = new Set();
+    const out = [];
+    for (const r of rows) {
+        if (seen.has(r.prId))
+            continue;
+        seen.add(r.prId);
+        out.push({
+            id: `feed:claude:${r.reviewId}`,
+            isMyTurn: false,
+            myTurnReasons: [],
+            kind: 'claude_review',
+            occurredAt: (r.finishedAt ?? r.createdAt).toISOString(),
+            repoId: r.repoId,
+            repoFullName: `${r.owner}/${r.name}`,
+            prId: r.prId,
+            prNumber: r.prNumber,
+            prTitle: r.prTitle,
+            prState: r.prState,
+            actorId: null,
+            content: r.summary,
+            threadId: null,
+            commentId: null,
+            path: null,
+            line: null,
+            reasonTag: null,
+            reviewState: null,
+            githubUrl: r.prNumber != null ? `https://github.com/${r.owner}/${r.name}/pull/${r.prNumber}` : null,
+            mergedById: null,
+            reviewers: null,
+            ciStatus: null,
+            changedFilesCount: null,
+            affectedThreads: null,
+            commitCount: null,
+            changeSummary: null,
+            claudeReviewId: r.reviewId,
+            // Prefer the user's decision when they've set one, else Claude's read-only verdict.
+            claudeVerdict: r.userVerdict ?? r.verdict,
+        });
+    }
+    return out;
 }
 export async function getConsolidatedFeed(accountId, opts = {}) {
-    const { repoIds = null, userIds = null, limit = null, offset = 0, excludeBots = false } = opts;
+    const { repoIds = null, userIds = null, limit = null, offset = 0, excludeBots = false, allowBotIds = null, } = opts;
     // Bot set (only loaded when the filter is on) — drops bot-authored activity, mirroring
-    // the timeline's excludeBots. getFeed doesn't filter bots, so we do it here; the commit
+    // the timeline's excludeBots. The per-repo allow-list subtracts the "important" bots so
+    // their activity stays visible. getFeed doesn't filter bots, so we do it here; the commit
     // helper filters in its own SQL.
-    const botIds = excludeBots ? new Set(await botUserIds()) : new Set();
+    const allowBots = new Set(allowBotIds ?? []);
+    const botIds = excludeBots
+        ? new Set((await botUserIds()).filter((id) => !allowBots.has(id)))
+        : new Set();
     const notBot = (id) => !excludeBots || id == null || !botIds.has(id);
     const feedSince = new Date(Date.now() - 14 * 24 * 60 * 60 * 1000);
-    const [feed, commitItems, localUserId] = await Promise.all([
+    const [feed, commitItems, claudeItems, localUserId] = await Promise.all([
         getFeed(accountId, { daysBefore: 14, repoIds, userIds }),
         // Commit-push activity that ADDRESSED a review thread (the only commit rows we surface
         // — plain pushes are noise). Each carries the affected threads inline.
         getCommitThreadItems(accountId, { repoIds, userIds, botIds, since: feedSince }),
+        // Claude Review runs surfaced as their own feed item kind (local-only; empty in cloud).
+        getClaudeReviewFeedItems(accountId, repoIds, feedSince),
         getAccountUserId(accountId),
     ]);
     // Participation ("is this PR mine?") drives the isMyTurn flag: which of the PRs the feed
@@ -1453,6 +1577,7 @@ export async function getConsolidatedFeed(accountId, opts = {}) {
         push({
             id: `feed:${f.id}`,
             isMyTurn: mine,
+            myTurnReasons: mine ? myTurnReasonsFor(participation, f.prId) : [],
             kind: f.type,
             occurredAt: f.occurredAt,
             repoId: f.repoId,
@@ -1465,6 +1590,7 @@ export async function getConsolidatedFeed(accountId, opts = {}) {
             // Full markdown body (fallback to the short preview on pre-persistence lean rows).
             content: f.content ?? f.excerpt,
             threadId: f.type === 'review_comment' ? f.refId : null,
+            commentId: f.type === 'pr_comment' ? f.refId : null,
             path: null,
             line: null,
             reasonTag: mine ? myTurnReason(f.prId) : null,
@@ -1472,27 +1598,38 @@ export async function getConsolidatedFeed(accountId, opts = {}) {
             githubUrl: f.prNumber != null ? `https://github.com/${f.repoFullName}/pull/${f.prNumber}` : null,
             mergedById: null,
             reviewers: null,
+            ciStatus: null,
+            changedFilesCount: null,
             affectedThreads: null,
             commitCount: null,
             changeSummary: null,
+            claudeReviewId: null,
+            claudeVerdict: null,
         });
     }
     // Commit-push items (already repo/member/bot-scoped + thread-enriched in the SQL helper).
     // Flag them the same way, then append.
     for (const it of commitItems) {
         it.isMyTurn = isMine(it.prId, it.actorId);
-        if (it.isMyTurn)
+        if (it.isMyTurn) {
             it.reasonTag = myTurnReason(it.prId);
+            it.myTurnReasons = myTurnReasonsFor(participation, it.prId);
+        }
         push(it);
     }
-    // Pure chronological — newest first. Keep every My Turn item; cap the plain activity rows
-    // so a busy multi-repo account doesn't render thousands of them.
-    const myTurnRows = items.filter((i) => i.isMyTurn);
+    // Claude Review items — a distinct kind (never bot/member-scoped). Kept out of the FYI
+    // flow but always retained (see the caps below) so the "Claude Reviews" pill finds them.
+    for (const it of claudeItems)
+        push(it);
+    // Pure chronological — newest first. Keep every My Turn item AND every Claude-review item
+    // (both are always relevant); cap the plain activity rows so a busy multi-repo account
+    // doesn't render thousands of them.
+    const alwaysRows = items.filter((i) => i.isMyTurn || i.kind === 'claude_review');
     const feedRows = items
-        .filter((i) => !i.isMyTurn)
+        .filter((i) => !i.isMyTurn && i.kind !== 'claude_review')
         .sort((a, b) => b.occurredAt.localeCompare(a.occurredAt))
         .slice(0, FEED_EVENT_CAP);
-    const ordered = [...myTurnRows, ...feedRows].sort((a, b) => b.occurredAt.localeCompare(a.occurredAt));
+    const ordered = [...alwaysRows, ...feedRows].sort((a, b) => b.occurredAt.localeCompare(a.occurredAt));
     // Paginate: `total` is the full stream length; `page` is the requested window. Only
     // the page is enriched + has its users backfilled, so hidden items cost nothing.
     const total = ordered.length;
@@ -1504,16 +1641,27 @@ export async function getConsolidatedFeed(accountId, opts = {}) {
         if (it.prId != null)
             prIdsForCtx.add(it.prId);
     const mergedByPr = new Map();
+    const ciByPr = new Map();
+    const filesByPr = new Map();
     const reviewersByPr = new Map();
     if (prIdsForCtx.size > 0) {
         const prIdList = [...prIdsForCtx];
-        // mergedById — account-scoped via pullRequests.accountId.
+        // mergedById + CI rollup + changed-file count — account-scoped via
+        // pullRequests.accountId. CI/files surface on pr_opened cards (item 2).
         for (const row of await db
-            .select({ id: pullRequests.id, mergedById: pullRequests.mergedById })
+            .select({
+            id: pullRequests.id,
+            mergedById: pullRequests.mergedById,
+            ciStatus: pullRequests.ciStatus,
+            changedFiles: pullRequests.changedFiles,
+        })
             .from(pullRequests)
             .where(and(eq(pullRequests.accountId, accountId), inArray(pullRequests.id, prIdList)))
-            .execute())
+            .execute()) {
             mergedByPr.set(row.id, row.mergedById);
+            ciByPr.set(row.id, (row.ciStatus ?? 'unknown'));
+            filesByPr.set(row.id, row.changedFiles);
+        }
         // reviewers — `reviews` has NO accountId, so isolation MUST come from the join to
         // pullRequests (eq accountId). Ascending order → the last write per (prId, userId)
         // is that reviewer's standing state; non-'pending' only.
@@ -1545,6 +1693,8 @@ export async function getConsolidatedFeed(accountId, opts = {}) {
             continue;
         it.mergedById = mergedByPr.get(it.prId) ?? null;
         it.reviewers = reviewersByPr.get(it.prId) ?? null;
+        it.ciStatus = ciByPr.get(it.prId) ?? null;
+        it.changedFilesCount = filesByPr.get(it.prId) ?? null;
     }
     // Backfill any referenced users on the page not already loaded by getMyTurn / getFeed —
     // including merger + reviewer ids so the SPA resolves their login/avatar.
@@ -2550,6 +2700,110 @@ export async function getPrDetail(id, accountId) {
         newSinceLastViewed,
     };
 }
+// Candidates for an "@mention" autocomplete on a PR, ranked by PROXIMITY to the PR
+// (closest first) and account-scoped. Excludes the viewer (they can't @ themselves)
+// and bots. Ownership is verified via the account-scoped PR/repo join → null (→ 404)
+// when the PR isn't the caller's. Ranks: author(0) > requested reviewer(1) >
+// reviewer(2) > comment/thread author(3) > commit author(4) > repo maintainer(5) >
+// other repo PR author(6). Repo-people (5/6) are a bounded proxy for "active in this
+// repo" (authors + those who've merged here) — cheap and never cross-tenant because a
+// repo row belongs to exactly one account.
+export async function getMentionCandidates(prId, accountId) {
+    const prRows = await db
+        .select({ repoId: pullRequests.repoId, authorId: pullRequests.authorId })
+        .from(pullRequests)
+        .innerJoin(repos, eq(repos.id, pullRequests.repoId))
+        .where(and(eq(pullRequests.id, prId), eq(repos.accountId, accountId)))
+        .limit(1)
+        .execute();
+    const pr = prRows[0];
+    if (!pr)
+        return null;
+    const repoId = pr.repoId;
+    // Best (lowest) rank wins if a user shows up in more than one bucket.
+    const rank = new Map();
+    const bump = (id, r) => {
+        if (id == null)
+            return;
+        const cur = rank.get(id);
+        if (cur == null || r < cur)
+            rank.set(id, r);
+    };
+    bump(pr.authorId, 0);
+    const [reqRows, revRows, rcRows, thRows, pcRows, cmRows] = await Promise.all([
+        db
+            .select({ userId: schema.reviewRequests.userId })
+            .from(schema.reviewRequests)
+            .where(eq(schema.reviewRequests.prId, prId))
+            .execute(),
+        db.select({ authorId: reviews.authorId }).from(reviews).where(eq(reviews.prId, prId)).execute(),
+        db
+            .select({ authorId: reviewComments.authorId })
+            .from(reviewComments)
+            .where(eq(reviewComments.prId, prId))
+            .execute(),
+        db
+            .select({ id: reviewThreads.originalCommenterId })
+            .from(reviewThreads)
+            .where(eq(reviewThreads.prId, prId))
+            .execute(),
+        db
+            .select({ authorId: prComments.authorId })
+            .from(prComments)
+            .where(eq(prComments.prId, prId))
+            .execute(),
+        db
+            .select({ authorId: commits.authorId, committerId: commits.committerId })
+            .from(commits)
+            .where(eq(commits.prId, prId))
+            .execute(),
+    ]);
+    for (const r of reqRows)
+        bump(r.userId, 1);
+    for (const r of revRows)
+        bump(r.authorId, 2);
+    for (const r of rcRows)
+        bump(r.authorId, 3);
+    for (const r of thRows)
+        bump(r.id, 3);
+    for (const r of pcRows)
+        bump(r.authorId, 3);
+    for (const r of cmRows) {
+        bump(r.authorId, 4);
+        bump(r.committerId, 4);
+    }
+    // Repo people: whoever has MERGED here (maintainers, rank 5) + anyone who has
+    // OPENED a PR here (rank 6). Bounded to this repo's PR rows.
+    const [mergerRows, repoAuthorRows] = await Promise.all([
+        db
+            .selectDistinct({ userId: pullRequests.mergedById })
+            .from(pullRequests)
+            .where(and(eq(pullRequests.repoId, repoId), eq(pullRequests.state, 'merged')))
+            .execute(),
+        db
+            .selectDistinct({ authorId: pullRequests.authorId })
+            .from(pullRequests)
+            .where(eq(pullRequests.repoId, repoId))
+            .execute(),
+    ]);
+    for (const r of mergerRows)
+        bump(r.userId, 5);
+    for (const r of repoAuthorRows)
+        bump(r.authorId, 6);
+    // The viewer can't @ themselves.
+    const viewerUserId = await getAccountUserId(accountId);
+    if (viewerUserId != null)
+        rank.delete(viewerUserId);
+    const ids = [...rank.keys()];
+    if (ids.length === 0)
+        return [];
+    const rows = await db.select().from(users).where(inArray(users.id, ids)).execute();
+    return rows
+        .filter((u) => !u.isBot)
+        .map((u) => ({ user: mapUser(u), rank: rank.get(u.id) ?? 99 }))
+        .sort((a, b) => a.rank - b.rank || a.user.githubLogin.localeCompare(b.user.githubLogin))
+        .map((x) => x.user);
+}
 export async function getThreadDetail(id, accountId) {
     const rows = await db
         .select()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.40",
+  "version": "0.1.41",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",