pierre-review 0.1.59 → 0.1.61

package/dist/api/routes/activity.js

@@ -11,17 +11,17 @@ function parseIntList(raw) {
 }
 export async function activityRoutes(app) {
     // The Activity aggregate: per repo, current-state stats + thread totals +
-    // attention/unread flags + open PRs. Scoped to the account; `repoIds` + `userIds`
-    // narrow to the active FilterBar repo + member selection (across ALL the account's
-    // repos — watched-only was dropped). Pure DB read — no GitHub sync, no AI.
+    // attention/unread flags + open PRs. Scoped to the account's WATCHED repos (inboxWatch);
+    // `repoIds` + `userIds` narrow to the active FilterBar repo + member selection WITHIN
+    // watched. Pure DB read — no GitHub sync, no AI.
     app.get('/api/activity', async (req) => {
         const q = req.query;
         return getActivity(accountIdOf(req), parseIntList(q.repoIds), parseIntList(q.userIds));
     });
     // The consolidated Feed (the Activity "Feed" entry): one flat, chronological stream
-    // merging My Turn actionables + the activity feed, deduped. Scoped by the FilterBar
-    // repo + member selection across ALL the account's repos (watched-only dropped).
-    // Pure DB read — no GitHub sync, no AI.
+    // merging My Turn actionables + the activity feed, deduped. Scoped to the account's
+    // WATCHED repos (inboxWatch); the FilterBar repo + member selection narrow WITHIN
+    // watched. Pure DB read — no GitHub sync, no AI.
     app.get('/api/activity/feed', async (req) => {
         const q = req.query;
         const limit = q.limit != null ? Number(q.limit) : null;

package/dist/api/routes/prs.js

@@ -1,9 +1,10 @@
 import { createHash } from 'node:crypto';
+import { config } from '../../config.js';
 import { getAccessToken, getAccountUserId } from '../../auth/account.js';
 import { fetchActionsJobLog } from '../../github/actions-logs.js';
-import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, getReviewerLogins, markAllViewed, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
+import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, getReviewerLogins, markAllViewed, markPrMergedLocally, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
 import { buildFileAnchors, fallbackAnchor, isFindingAnchored, } from '../../github/diff-anchor.js';
-import { addIssueComment, fetchHeadShaFor, fetchPrFilesWithPatch, postInlineComment, requestReviewers, rerunWorkflowRun, submitPrReview, } from '../../github/mutations.js';
+import { addIssueComment, fetchHeadShaFor, fetchMergeability, fetchPrFilesWithPatch, fetchPrHeadInfo, fetchRepoMergeConfig, mergePullRequest, postInlineComment, requestReviewers, rerunWorkflowRun, submitPrReview, updatePullRequestBranch, } from '../../github/mutations.js';
 import { hydratePrDetail } from '../../sync/hydrate-detail.js';
 import { accountIdOf } from '../plugins/auth.js';
 // GitHub anchors a file in the PR "Files changed" diff by the SHA-256 of its
@@ -92,6 +93,23 @@ const approveSchema = {
         properties: { body: { type: 'string' } },
     },
 };
+const mergeSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['method'],
+        additionalProperties: false,
+        properties: { method: { type: 'string', enum: ['merge', 'squash', 'rebase'] } },
+    },
+};
+const updateBranchSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        additionalProperties: false,
+        properties: { strategy: { type: 'string', enum: ['rebase', 'merge'] } },
+    },
+};
 const reviewCommentSchema = {
     ...idParamSchema,
     body: {
@@ -259,6 +277,187 @@ export async function prRoutes(app) {
             };
         }
     });
+    // ---- Merge (CORE / free tier) ----
+    // The merge control's options — the repo's enabled merge methods + GitHub's live mergeability.
+    // Fetched lazily (only when the control opens) so the hot PR-detail path isn't slowed by a
+    // live GitHub call. Ownership-scoped via getPrWriteContext (→ 404).
+    app.get('/api/prs/:id/merge-options', async (req, reply) => {
+        const { id } = req.params;
+        const accountId = accountIdOf(req);
+        const ctx = await getPrWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        try {
+            const token = await getAccessToken(accountId);
+            const [cfg, m] = await Promise.all([
+                fetchRepoMergeConfig(token, ctx.owner, ctx.name),
+                fetchMergeability(token, ctx.owner, ctx.name, ctx.number),
+            ]);
+            const allowedMethods = ['merge', 'squash', 'rebase'].filter((meth) => meth === 'merge'
+                ? cfg.allowMergeCommit
+                : meth === 'squash'
+                    ? cfg.allowSquashMerge
+                    : cfg.allowRebaseMerge);
+            const conflicts = m.mergeable === false || m.mergeableState === 'dirty';
+            const behind = m.mergeableState === 'behind' || m.behindBy > 0;
+            const result = {
+                allowedMethods: [...allowedMethods],
+                defaultMethod: allowedMethods[0] ?? 'merge',
+                mergeable: m.mergeable,
+                mergeStateStatus: m.mergeableState,
+                conflicts,
+                behind,
+                blocked: m.mergeableState === 'blocked',
+                behindBy: m.behindBy,
+                baseRef: m.baseRef,
+                canUpdateBranch: behind && !conflicts,
+                canRebaseUpdate: !config.isCloud,
+            };
+            return result;
+        }
+        catch (err) {
+            reply.status(502);
+            return { error: 'GitHubError', message: err instanceof Error ? err.message : String(err) };
+        }
+    });
+    // Merge the PR (native GitHub merge; merge/squash/rebase). Re-checks write+ permission
+    // (author allowed — GitHub lets an author merge their own PR) and pre-checks conflicts, then
+    // pins the merge to the current head SHA (409 if it moved). Optimistically stamps merged.
+    app.post('/api/prs/:id/merge', { schema: mergeSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const { method } = req.body;
+        const accountId = accountIdOf(req);
+        const ctx = await getPrWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        if (!['WRITE', 'MAINTAIN', 'ADMIN'].includes(ctx.viewerPermission ?? '')) {
+            reply.status(403);
+            return { error: 'NotPermitted', message: 'You need write access to merge this PR.' };
+        }
+        try {
+            const token = await getAccessToken(accountId);
+            // Live conflict pre-check — never attempt a merge on a conflicting PR (no free-tier
+            // resolution). GitHub would 405 anyway; a 409 here is clearer.
+            const m = await fetchMergeability(token, ctx.owner, ctx.name, ctx.number);
+            if (m.mergeable === false || m.mergeableState === 'dirty') {
+                reply.status(409);
+                return {
+                    error: 'Conflicts',
+                    conflicts: true,
+                    message: 'This PR conflicts with the base branch — resolve the conflicts on GitHub.',
+                };
+            }
+            const info = await fetchPrHeadInfo(token, ctx.owner, ctx.name, ctx.number);
+            const out = await mergePullRequest(token, ctx.owner, ctx.name, ctx.number, {
+                method,
+                expectedHeadSha: info.headSha,
+            });
+            if (!out.ok) {
+                const status = out.reason === 'method_disallowed' ? 422 : 409;
+                reply.status(status);
+                return {
+                    error: out.reason === 'head_moved'
+                        ? 'HeadMoved'
+                        : out.reason === 'method_disallowed'
+                            ? 'MethodNotAllowed'
+                            : 'NotMergeable',
+                    message: out.message,
+                };
+            }
+            const viewerUserId = await getAccountUserId(accountId);
+            await markPrMergedLocally(id, accountId, viewerUserId);
+            const result = { merged: true, sha: out.sha, state: 'merged' };
+            return result;
+        }
+        catch (err) {
+            reply.status(502);
+            return { error: 'GitHubError', message: err instanceof Error ? err.message : String(err) };
+        }
+    });
+    // Update the PR's branch from the base/trunk before merging. Local: clone-based rebase
+    // (default) or merge, aborting on ANY conflict (no free-tier resolution → 409). Cloud: GitHub's
+    // native update-branch (merge-only, clone-free). Gated on write+ permission.
+    app.post('/api/prs/:id/update-branch', { schema: updateBranchSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const { strategy } = (req.body ?? {});
+        const accountId = accountIdOf(req);
+        const ctx = await getPrWriteContext(id, accountId);
+        if (!ctx) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        if (!['WRITE', 'MAINTAIN', 'ADMIN'].includes(ctx.viewerPermission ?? '')) {
+            reply.status(403);
+            return { error: 'NotPermitted', message: 'You need write access to update this branch.' };
+        }
+        try {
+            const token = await getAccessToken(accountId);
+            // Never attempt an update on a conflicting PR — conflict resolution is a Pro feature.
+            const m = await fetchMergeability(token, ctx.owner, ctx.name, ctx.number);
+            if (m.mergeable === false || m.mergeableState === 'dirty') {
+                reply.status(409);
+                return {
+                    error: 'Conflicts',
+                    conflicts: true,
+                    message: 'This PR conflicts with the base branch. Resolving conflicts isn’t available on the free tier — resolve them on GitHub.',
+                };
+            }
+            const info = await fetchPrHeadInfo(token, ctx.owner, ctx.name, ctx.number);
+            if (config.isCloud) {
+                // Cloud: native update-branch (merge trunk in). No clone/git on the host.
+                const out = await updatePullRequestBranch(token, ctx.owner, ctx.name, ctx.number, info.headSha);
+                if (!out.ok) {
+                    reply.status(409);
+                    return out.reason === 'head_moved'
+                        ? { error: 'HeadMoved', headMoved: true, message: out.message }
+                        : { error: 'Conflicts', conflicts: true, message: out.message };
+                }
+                const result = { ok: true, headSha: null, strategy: 'merge' };
+                return result;
+            }
+            // Local: clone-based rebase (default) or merge from trunk, autoResolve:false. Dynamic
+            // import so the clone/git machinery is only loaded on this path (never in cloud).
+            const strat = strategy === 'merge' ? 'merge' : 'rebase';
+            const { updatePrBranchFromTrunk } = await import('../../coding/merge.js');
+            const out = await updatePrBranchFromTrunk({
+                accountId,
+                owner: ctx.owner,
+                name: ctx.name,
+                prNumber: ctx.number,
+                headRef: info.headRef,
+                headSha: info.headSha,
+                trunk: info.baseRef,
+                strategy: strat,
+            });
+            const result = { ok: true, headSha: out.headSha, strategy: out.strategy };
+            return result;
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === 'CONFLICTS_UNRESOLVED') {
+                reply.status(409);
+                return {
+                    error: 'Conflicts',
+                    conflicts: true,
+                    message: 'This PR conflicts with the base branch. Resolving conflicts isn’t available on the free tier — resolve them on GitHub.',
+                };
+            }
+            if (code === 'HEAD_MOVED') {
+                reply.status(409);
+                return { error: 'HeadMoved', headMoved: true, message: err.message };
+            }
+            if (code === 'PUSH_DENIED') {
+                reply.status(403);
+                return { error: 'NotPermitted', message: err.message };
+            }
+            reply.status(502);
+            return { error: 'GitHubError', message: err instanceof Error ? err.message : String(err) };
+        }
+    });
     // Add ONE inline review comment, posted immediately. Validates the requested
     // (path, line, side) lands on an addable diff line; if not, re-anchors to the
     // file's first changed line; if the file has no changes at all, returns a

package/dist/api/routes/timeline.js

@@ -81,6 +81,7 @@ export async function timelineRoutes(app) {
             from: parseDate(q.from, new Date(now.getTime() - 14 * DAY_MS)),
             to: parseDate(q.to, now),
             repoIds: parseIntList(q.repoIds),
+            prIds: parseIntList(q.prIds),
             userIds: parseIntList(q.userIds),
             types: parseTypes(q.types),
             statuses: parseStatuses(q.statuses),

package/dist/coding/merge.js

@@ -480,6 +480,66 @@ export async function mergeResolveAndPush(args) {
         await teardown(owner, name, repoCloneDir, worktreePath);
     }
 }
+// ---- CORE (free tier): update a PR's OWN branch from its base/trunk ----
+// Rebase (default) or merge the trunk into the PR's head branch and push. This is the local,
+// clone-based path for the free-tier "Update branch from trunk" — reusing runRebase/runMerge
+// with autoResolve:false, so on ANY conflict the op is aborted and CONFLICTS_UNRESOLVED is
+// thrown (never the SDK resolver — conflict resolution is a Pro feature). No stored patch is
+// involved (unlike the AI-Fix paths above): we check the PR head out as-is and reconcile it.
+export async function updatePrBranchFromTrunk(args) {
+    const { accountId, owner, name, prNumber, headRef, headSha, trunk, strategy } = args;
+    const token = await getAccessToken(accountId);
+    const ident = await identFor(accountId);
+    // The head must not have moved out from under us, and a fork head must be pushable.
+    const info = await fetchPrHeadInfo(token, owner, name, prNumber);
+    if (info.headSha !== headSha) {
+        throw codedError('HEAD_MOVED', `the PR head advanced (now ${info.headSha.slice(0, 7)}, expected ${headSha.slice(0, 7)})`);
+    }
+    if (info.isFork && !info.maintainerCanModify) {
+        throw codedError('PUSH_DENIED', 'the PR head is a fork this account cannot push to — update it on GitHub instead');
+    }
+    // The PR head branch lives in the HEAD repo, which for a fork PR is NOT the base (watched)
+    // repo — push there, or a merge would create a stray branch on the base and a rebase's lease
+    // would target the wrong ref. The clone/fetch still uses the base repo below (pull/N/head
+    // resolves there); only the PUSH target is the head repo. full_name is always `owner/name`.
+    const slash = info.headRepoFullName.indexOf('/');
+    const headOwner = slash > 0 ? info.headRepoFullName.slice(0, slash) : owner;
+    const headName = slash > 0 ? info.headRepoFullName.slice(slash + 1) : name;
+    // autoResolve:false → runRebase/runMerge abort on the first conflict and throw
+    // CONFLICTS_UNRESOLVED; the model/resolver fields are never touched (no SDK import).
+    const opts = {
+        autoResolve: false,
+        model: '',
+        abortController: new AbortController(),
+        onProgress: () => { },
+    };
+    let repoCloneDir = null;
+    let worktreePath = null;
+    try {
+        // Check out the PR head branch (prepWorktree checks out at the given sha).
+        ({ repoCloneDir, worktreePath } = await prepWorktree(owner, name, prNumber, headSha, token));
+        const trunkSha = await fetchTrunk(worktreePath, owner, name, token, trunk);
+        if (strategy === 'rebase') {
+            await runRebase(worktreePath, trunkSha, ident, opts); // throws CONFLICTS_UNRESOLVED on conflict
+            const newSha = (await git(['rev-parse', 'HEAD'], worktreePath)).stdout.trim();
+            // Rewriting history requires a force push; the lease pins to the sha we cloned so a
+            // concurrent push aborts it (never blows away someone else's work).
+            await pushForceWithLease(worktreePath, headOwner, headName, token, 'HEAD', headRef, headSha);
+            return { headSha: newSha, strategy };
+        }
+        await runMerge(worktreePath, trunkSha, trunk, headRef, ident, opts); // throws on conflict
+        const newSha = (await git(['rev-parse', 'HEAD'], worktreePath)).stdout.trim();
+        // A merge only adds a commit (the old head is its ancestor) → a plain push. Already
+        // up-to-date (runMerge no-op) leaves HEAD unchanged → nothing to push.
+        if (newSha !== headSha) {
+            await pushRef(worktreePath, headOwner, headName, token, 'HEAD', headRef);
+        }
+        return { headSha: newSha, strategy };
+    }
+    finally {
+        await teardown(owner, name, repoCloneDir, worktreePath);
+    }
+}
 export async function pushResolved(args) {
     const { accountId, owner, name, prNumber, trunk, mbox, target, onProgress } = args;
     const token = await getAccessToken(accountId);