pierre-review 0.1.64 → 0.1.65

package/dist/api/routes/auth.js

@@ -2,12 +2,42 @@ import { randomBytes } from 'node:crypto';
 import { config } from '../../config.js';
 import { encryptToken } from '../../auth/crypto.js';
 import { upsertCloudAccount } from '../../auth/account.js';
+// Per-provider credential + the scope to request (empty for the GitHub App).
+function providerCredentials(provider) {
+    return provider === 'app'
+        ? {
+            clientId: config.githubAppClientId,
+            clientSecret: config.githubAppClientSecret,
+            scope: '',
+            enabled: config.appProviderEnabled,
+        }
+        : {
+            clientId: config.githubOAuthClientId,
+            clientSecret: config.githubOAuthClientSecret,
+            scope: config.oauthScope,
+            enabled: config.oauthProviderEnabled,
+        };
+}
 export async function authRoutes(app) {
     const redirectUri = `${config.appBaseUrl}/api/auth/callback`;
     const secureCookie = config.appBaseUrl.startsWith('https://');
-    // 302 → GitHub authorize, with a CSRF state in a short-lived signed cookie.
-    app.get('/api/auth/login', async (_req, reply) => {
-        const state = randomBytes(16).toString('hex');
+    // The default provider for the bare /api/auth/login link (landing/billing CTAs): prefer the
+    // frictionless OAuth App; fall back to the GitHub App if that's the only one configured.
+    const defaultProvider = config.oauthProviderEnabled ? 'oauth' : 'app';
+    // Which sign-in methods this deployment offers — read by the (signed-out) SignInGate to render
+    // the right button(s). Unauthenticated: it sits under the /api/auth/* auth-gate exemption.
+    app.get('/api/auth/providers', async () => ({
+        oauth: config.oauthProviderEnabled,
+        app: config.appProviderEnabled,
+        // Slug drives the private-repo install link on the gate; only meaningful with the App.
+        appSlug: config.appProviderEnabled ? config.githubAppSlug : '',
+    }));
+    const startLogin = (provider, reply) => {
+        const cred = providerCredentials(provider);
+        if (!cred.enabled)
+            return reply.redirect('/app?auth=unavailable');
+        // Fold the provider into the state so the callback knows which credential to exchange with.
+        const state = `${provider}.${randomBytes(16).toString('hex')}`;
         reply.setCookie('pierre_oauth_state', state, {
             path: '/',
             httpOnly: true,
@@ -17,20 +47,28 @@ export async function authRoutes(app) {
             maxAge: 600,
         });
         const params = new URLSearchParams({
-            client_id: config.githubAppClientId,
+            client_id: cred.clientId,
             redirect_uri: redirectUri,
             state,
         });
+        if (cred.scope)
+            params.set('scope', cred.scope);
         return reply.redirect(`https://github.com/login/oauth/authorize?${params.toString()}`);
+    };
+    // Explicit provider choice (the SignInGate's two buttons).
+    app.get('/api/auth/login/:provider', async (req, reply) => {
+        const provider = req.params.provider === 'app' ? 'app' : 'oauth';
+        return startLogin(provider, reply);
     });
-    // Verify state → exchange code for a token → fetch the user → upsert account →
-    // set session → 302 to the app.
+    // Back-compat bare login (landing/billing CTAs) → the default provider.
+    app.get('/api/auth/login', async (_req, reply) => startLogin(defaultProvider, reply));
+    // Verify state → exchange code for a token (against the state's provider) → fetch the user →
+    // upsert account → set session → 302 to the app.
     app.get('/api/auth/callback', async (req, reply) => {
-        // Already signed in? The callback URL carries a one-time ?code= that GitHub
-        // expires in ~10 min and invalidates on first use. A back-button, a restored
-        // tab, or a Chrome profile switch can re-request this exact URL; re-running the
-        // exchange would then fail on the already-consumed code ("code incorrect or
-        // expired"). Short-circuit a valid session straight to the app instead.
+        // Already signed in? The callback URL carries a one-time ?code= that GitHub expires in
+        // ~10 min and invalidates on first use. A back-button, a restored tab, or a Chrome profile
+        // switch can re-request this exact URL; re-running the exchange would then fail on the
+        // already-consumed code. Short-circuit a valid session straight to the app instead.
         if (req.session.get('accountId') != null) {
             return reply.redirect('/app');
         }
@@ -41,10 +79,13 @@ export async function authRoutes(app) {
             : { valid: false, value: null };
         reply.clearCookie('pierre_oauth_state', { path: '/' });
         if (!code || !state || !unsigned.valid || unsigned.value !== state) {
-            // Stale/replayed callback (state cookie expired or CSRF mismatch). Bounce
-            // back so the user starts a fresh sign-in — never render raw JSON to a human.
+            // Stale/replayed callback (state cookie expired or CSRF mismatch). Bounce back so the
+            // user starts a fresh sign-in — never render raw JSON to a human.
             return reply.redirect('/app?auth=expired');
         }
+        // The provider chosen at /login is encoded in the state; pick the matching credential.
+        const provider = state.startsWith('app.') ? 'app' : 'oauth';
+        const cred = providerCredentials(provider);
         // Exchange the code for a user access token.
         let token;
         try {
@@ -52,21 +93,21 @@ export async function authRoutes(app) {
                 method: 'POST',
                 headers: { accept: 'application/json', 'content-type': 'application/json' },
                 body: JSON.stringify({
-                    client_id: config.githubAppClientId,
-                    client_secret: config.githubAppClientSecret,
+                    client_id: cred.clientId,
+                    client_secret: cred.clientSecret,
                     code,
                     redirect_uri: redirectUri,
                 }),
             });
             const json = (await res.json());
             if (!json.access_token) {
-                req.log.warn({ err: json.error_description ?? json.error }, 'oauth token exchange returned no token');
+                req.log.warn({ err: json.error_description ?? json.error, provider }, 'oauth token exchange returned no token');
                 return reply.redirect('/app?auth=failed');
             }
             token = json.access_token;
         }
         catch (err) {
-            req.log.error({ err }, 'oauth token exchange request failed');
+            req.log.error({ err, provider }, 'oauth token exchange request failed');
             return reply.redirect('/app?auth=error');
         }
         // Identify the user.

package/dist/cli.js

@@ -82,8 +82,10 @@ Prerequisite (local mode):
   \`gh auth login\`. The dashboard reads your activity using your gh token.
 
 Prerequisite (--cloud):
-  Postgres + a GitHub App. See docs/LOCAL-CLOUD-TESTING.md. Provide
-  DATABASE_URL, APP_BASE_URL, GITHUB_APP_*, SESSION_SECRET, ENCRYPTION_KEY.
+  Postgres + a GitHub sign-in method (an OAuth App and/or a GitHub App). See
+  docs/GITHUB-AUTH-SETUP.md. Provide DATABASE_URL, APP_BASE_URL, SESSION_SECRET,
+  ENCRYPTION_KEY, and at least one of GITHUB_OAUTH_CLIENT_ID+SECRET or
+  GITHUB_APP_CLIENT_ID+SECRET.
 `);
 }
 // Cross-platform browser open — no extra dependency.

package/dist/config.js

@@ -43,7 +43,7 @@ function effortFromEnv(key, fallback) {
 // ---- Deployment mode (the master switch) ----
 // `local` (default): SQLite via better-sqlite3, `gh auth token` auth, one
 // implicit account, no landing page — the unchanged zero-config experience.
-// `cloud`: Postgres, GitHub App OAuth, many accounts, public landing page.
+// `cloud`: Postgres, GitHub sign-in (OAuth App and/or GitHub App), many accounts, landing page.
 // Everything dialect/tenancy-specific branches off `deploymentMode`.
 const deploymentMode = process.env.DEPLOYMENT_MODE === 'cloud' ? 'cloud' : 'local';
 const isCloud = deploymentMode === 'cloud';
@@ -111,14 +111,34 @@ export const config = {
     retentionCron: process.env.RETENTION_CRON ?? '0 3 * * *',
     // Disable the periodic scheduler (used by scripts/tests).
     disableScheduler: process.env.DISABLE_SCHEDULER === 'true',
-    // ---- Cloud (Railway) — GitHub App OAuth + sessions + token encryption ----
+    // ---- Cloud (Railway) — GitHub sign-in + sessions + token encryption ----
     // Public base URL of the deployment (no trailing slash); used to build the
     // OAuth redirect_uri and absolute links. Locally http://localhost:<port>.
     appBaseUrl: process.env.APP_BASE_URL?.replace(/\/$/, '') ??
         `http://localhost:${intFromEnv('PORT', 4000)}`,
+    // Cloud supports TWO sign-in providers side by side; a deployment configures either or both
+    // and the SignInGate offers whatever's set. They are SEPARATE GitHub registrations (distinct
+    // client id/secret) but share the same authorize/token endpoints — the flow only differs in
+    // which credential it uses and whether it requests `oauthScope` (see api/routes/auth.ts).
+    //
+    //  • OAuth App  — user-scoped token, NO installation. `public_repo` reads public repos incl.
+    //    CI checks/statuses (what an unscoped token can't) + enables the interactive PR actions.
+    //  • GitHub App — user-to-server token; for PRIVATE repos the App must be INSTALLED where they
+    //    live (public repos work without install, but reading CI Checks/Actions needs install).
+    githubOAuthClientId: process.env.GITHUB_OAUTH_CLIENT_ID ?? '',
+    githubOAuthClientSecret: process.env.GITHUB_OAUTH_CLIENT_SECRET ?? '',
+    // Scopes requested by the OAuth App at authorize time. Default = public repos only (widen to
+    // `repo read:org` for private-repo access via OAuth).
+    oauthScope: process.env.GITHUB_OAUTH_SCOPE ?? 'public_repo read:org',
     githubAppClientId: process.env.GITHUB_APP_CLIENT_ID ?? '',
     githubAppClientSecret: process.env.GITHUB_APP_CLIENT_SECRET ?? '',
+    // The GitHub App's URL slug — builds the private-repo install link
+    // (github.com/apps/<slug>/installations/new), shown on the sign-in gate.
     githubAppSlug: process.env.GITHUB_APP_SLUG ?? '',
+    // Derived: is each provider fully configured? (Both are optional; assertCloudConfig requires
+    // at least one.) The auth routes + SignInGate gate on these.
+    oauthProviderEnabled: !!(process.env.GITHUB_OAUTH_CLIENT_ID && process.env.GITHUB_OAUTH_CLIENT_SECRET),
+    appProviderEnabled: !!(process.env.GITHUB_APP_CLIENT_ID && process.env.GITHUB_APP_CLIENT_SECRET),
     // Seals the session cookie ({accountId}). Rotate to invalidate all sessions.
     sessionSecret: process.env.SESSION_SECRET ?? '',
     // 32-byte (64-hex) key for AES-256-GCM encryption of stored access tokens.
@@ -227,12 +247,17 @@ export function assertCloudConfig() {
     const required = [
         ['DATABASE_URL', config.databaseUrl],
         ['APP_BASE_URL', process.env.APP_BASE_URL ?? ''],
-        ['GITHUB_APP_CLIENT_ID', config.githubAppClientId],
-        ['GITHUB_APP_CLIENT_SECRET', config.githubAppClientSecret],
-        ['GITHUB_APP_SLUG', config.githubAppSlug],
         ['SESSION_SECRET', config.sessionSecret],
         ['ENCRYPTION_KEY', config.encryptionKey],
     ];
+    // At least ONE sign-in provider must be fully configured; a deployment may enable either or
+    // both. A GitHub App with no OAuth App (or vice-versa) is fine.
+    if (!config.oauthProviderEnabled && !config.appProviderEnabled) {
+        throw new Error('Cloud mode needs at least one GitHub sign-in method configured: set ' +
+            'GITHUB_OAUTH_CLIENT_ID + GITHUB_OAUTH_CLIENT_SECRET (OAuth App, public repos) and/or ' +
+            'GITHUB_APP_CLIENT_ID + GITHUB_APP_CLIENT_SECRET (GitHub App, adds private org repos via ' +
+            'install). See docs/GITHUB-AUTH-SETUP.md.');
+    }
     const missing = required.filter(([, v]) => !v).map(([k]) => k);
     if (missing.length > 0) {
         throw new Error(`Cloud mode (DEPLOYMENT_MODE=cloud) requires these env vars: ${missing.join(', ')}. See .env.cloud.example and docs/DEPLOY-RAILWAY.md.`);

package/dist/github/client.js

@@ -1,5 +1,56 @@
-import { graphql } from '@octokit/graphql';
+import { graphql, GraphqlResponseError } from '@octokit/graphql';
 import { getGithubToken } from './auth.js';
+// A parenthetical hint appended to a partial-GraphQL log, ONLY when the forbidden field is
+// actually a CI-checks field — so a NOT_FOUND (deleted/inaccessible PR) isn't mislabelled as a
+// checks-access problem. Empty otherwise (the raw errors still get logged). Cloud sign-in is an
+// OAuth App (needs the `public_repo` scope for checks) and/or a GitHub App (needs installing on
+// the repo's org with "Checks" read); either way public-repo checks read once that's in place.
+export function graphqlChecksHint(errors) {
+    const mentionsChecks = Array.isArray(errors) &&
+        errors.some((e) => {
+            const path = e.path;
+            const inPath = Array.isArray(path) && path.some((p) => /statuscheckrollup|check/i.test(String(p)));
+            const inMsg = /check\b|statuscheckrollup/i.test(e.message ?? '');
+            return inPath || inMsg;
+        });
+    return mentionsChecks
+        ? " — the sign-in token can't read CI checks here (GitHub App: install on this org with Checks read; OAuth App: re-authorize; or it's a private repo)"
+        : '';
+}
+// Compact one-line summary of a GraphQL `errors` array for logging.
+export function summarizeGraphqlErrors(errors) {
+    if (!Array.isArray(errors))
+        return String(errors);
+    return errors
+        .slice(0, 5)
+        .map((e) => {
+        const type = e.type ?? 'ERROR';
+        const path = e.path?.join('.') ?? '?';
+        const message = e.message ?? '';
+        return `${type}@${path}: ${message}`;
+    })
+        .join(' | ');
+}
+// Run a GraphQL query, TOLERATING GitHub's *partial* errors. GitHub answers HTTP 200 with a
+// non-empty `errors` array AND partial `data` when the token may read most of a query but is
+// FORBIDDEN one sub-field — e.g. CI check runs (`statusCheckRollup.contexts`) on a private repo
+// the token can't reach, or on a token minted before it was granted the scope to read them. By
+// default `@octokit/graphql` THROWS on any such response, throwing away the usable partial data
+// — so one un-permitted field would wipe the PR body/comments/reviewers. This returns the
+// partial data instead (the forbidden fields arrive as null) and reports the errors via
+// `onPartial`. A response with NO usable data (auth failure, rate limit, network) still throws.
+export async function graphqlTolerant(client, query, variables, onPartial) {
+    try {
+        return await client(query, variables);
+    }
+    catch (err) {
+        if (err instanceof GraphqlResponseError && err.data != null) {
+            onPartial?.(err.errors);
+            return err.data;
+        }
+        throw err;
+    }
+}
 // Per-account GitHub clients. There is deliberately NO module-level token /
 // client cache: in a multi-tenant (cloud) process a cached token would leak one
 // account's credentials into another account's request. The token is ALWAYS
@@ -46,10 +97,12 @@ export async function ghRestGetText(token, path) {
     const text = await res.text().catch(() => '');
     return { status: res.status, ok: res.ok, text };
 }
-// REST GET returning a resource in GitHub's raw `diff` media type (Accept:
-// application/vnd.github.diff) — the per-account, cloud-ready way to fetch a PR's
-// unified diff (vs the local-only `gh pr diff`). Throws on a non-2xx status.
-export async function ghRestGetDiff(token, path) {
+// REST GET in GitHub's raw `diff` media type (Accept: application/vnd.github.diff),
+// NOT throwing on a non-2xx — returns the status + body so the caller can branch. GitHub
+// caps this media type at 20,000 lines and 406s past it (a huge PR), which the caller
+// handles by falling back to the per-file endpoint. Mirrors ghRestGetText's non-throwing
+// contract.
+export async function ghRestGetDiffStatus(token, path) {
     const res = await fetch(`https://api.github.com${path}`, {
         method: 'GET',
         headers: {
@@ -58,11 +111,17 @@ export async function ghRestGetDiff(token, path) {
             'x-github-api-version': '2022-11-28',
         },
     });
+    const text = await res.text().catch(() => '');
+    return { status: res.status, ok: res.ok, text };
+}
+// Throwing variant of the above — the per-account, cloud-ready way to fetch a PR's
+// unified diff (vs the local-only `gh pr diff`). Throws on a non-2xx status.
+export async function ghRestGetDiff(token, path) {
+    const res = await ghRestGetDiffStatus(token, path);
     if (!res.ok) {
-        const text = await res.text().catch(() => '');
-        throw new Error(`GitHub REST GET(diff) ${path} -> ${res.status}: ${text.slice(0, 300)}`);
+        throw new Error(`GitHub REST GET(diff) ${path} -> ${res.status}: ${res.text.slice(0, 300)}`);
     }
-    return res.text();
+    return res.text;
 }
 // REST PUT returning the parsed STATUS + body WITHOUT throwing on a non-2xx, so the caller can
 // map GitHub's meaningful merge / update-branch statuses to structured results (405 not

package/dist/github/mutations.js

@@ -6,7 +6,7 @@
 //
 // GraphQL note: @octokit/graphql RESERVES the variable name `query`. The
 // operation-variable here is named `input` / etc., never `query`.
-import { getGraphqlClientFor, ghRestGetDiff, ghRestGetFor, ghRestPostFor, ghRestPostNoContent, ghRestPutStatus, } from './client.js';
+import { getGraphqlClientFor, ghRestGetDiffStatus, ghRestGetFor, ghRestPostFor, ghRestPostNoContent, ghRestPutStatus, } from './client.js';
 const ADD_REPLY_MUTATION = /* GraphQL */ `
   mutation AddThreadReply($input: AddPullRequestReviewThreadReplyInput!) {
     addPullRequestReviewThreadReply(input: $input) {
@@ -278,9 +278,49 @@ export async function updatePullRequestBranch(token, owner, name, number, expect
     return { ok: false, reason, message };
 }
 // The PR's unified diff via the REST API (Accept: application/vnd.github.diff) —
-// cloud-ready, per-account. Bounded implicitly by GitHub's own diff-size limit.
+// cloud-ready, per-account. GitHub caps this media type at 20,000 lines and returns 406
+// past it (a large PR — e.g. bulk data/generated files). In that case we fall back to the
+// per-file endpoint, which has no total-lines cap, and synthesise a unified diff from each
+// file's `patch`. Without this fallback the diff came back empty and the AI summary / CI
+// analysis / fixer would (correctly, but uselessly) report "the diff is empty".
 export async function fetchPrUnifiedDiff(token, owner, name, number) {
-    return ghRestGetDiff(token, `/repos/${owner}/${name}/pulls/${number}`);
+    const path = `/repos/${owner}/${name}/pulls/${number}`;
+    const res = await ghRestGetDiffStatus(token, path);
+    if (res.ok)
+        return res.text;
+    if (res.status === 406) {
+        return reconstructUnifiedDiffFromFiles(token, owner, name, number);
+    }
+    throw new Error(`GitHub REST GET(diff) ${path} -> ${res.status}: ${res.text.slice(0, 300)}`);
+}
+// Synthesise a unified diff from GitHub's per-file `patch`es — the fallback when the
+// whole-PR .diff 406s (too large). The /files endpoint has no total-lines cap (up to 3000
+// files); a file's `patch` is omitted when it's binary or a single file's own diff is too
+// large, so we name those with their churn/status. The synthetic `diff --git a/… b/…`
+// headers keep the result splittable by capDiff's per-file budgeter (so a summary still
+// stays within the prompt's char budget, grounded in the files that DO have patches).
+export function filesToUnifiedDiff(files) {
+    const parts = [];
+    for (const f of files) {
+        const aPath = f.previous_filename ?? f.filename;
+        parts.push(`diff --git a/${aPath} b/${f.filename}`);
+        if (f.patch) {
+            parts.push(`--- a/${aPath}`, `+++ b/${f.filename}`, f.patch);
+        }
+        else {
+            // GitHub omits `patch` for binary files, a single file whose own diff is too large,
+            // and some no-content changes (pure rename / mode-only). Lead with the authoritative
+            // status + churn (the real signal) and hedge the reason so a rename isn't mislabelled.
+            parts.push(`(diff not shown — status=${f.status}, +${f.additions}/-${f.deletions}; likely binary or too large)`);
+        }
+    }
+    return parts.join('\n');
+}
+async function reconstructUnifiedDiffFromFiles(token, owner, name, number) {
+    // 300 files is plenty for a grounded summary and bounds the paging to ~3 requests; the
+    // downstream capDiff trims further to the prompt's char budget.
+    const { files } = await fetchPrFilesWithPatch(token, owner, name, number, 300);
+    return filesToUnifiedDiff(files);
 }
 // Open a pull request (per-account). `head` is the branch to merge FROM (in the base
 // repo — the fixer only ever creates branches in the base repo, so no `owner:branch`

package/dist/pro/contract.js

@@ -5,6 +5,7 @@ export const EMPTY_CAPABILITIES = {
     activityDigest: false,
     reviewMemory: false,
     aiAnalysis: false,
+    prSummary: false,
     aiFix: false,
     teamInsights: false,
     claudeReview: false,

package/dist/sync/hydrate-detail.js

@@ -17,7 +17,7 @@ import { eq } from 'drizzle-orm';
 import { db, schema } from '../db/client.js';
 import { config } from '../config.js';
 import { getAccessToken } from '../auth/account.js';
-import { getGraphqlClientFor } from '../github/client.js';
+import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, summarizeGraphqlErrors, } from '../github/client.js';
 import { PR_DETAIL_QUERY } from '../github/queries.js';
 import { checkRunsFrom } from './upsert.js';
 const { reviews, reviewComments, prComments, reviewThreads, pullRequests, repos } = schema;
@@ -39,9 +39,14 @@ async function fetchGhPrText(owner, name, number, accountId) {
     try {
         const token = await getAccessToken(accountId);
         const client = getGraphqlClientFor(token);
-        resp = await client(PR_DETAIL_QUERY, { owner, name, number });
+        // Tolerate partial errors: if the token is FORBIDDEN one sub-field (e.g. `statusCheckRollup`
+        // check runs on a private repo it can't reach), that used to throw away the ENTIRE hydration
+        // (PR body, comments, diff hunks, commit messages) even though all of those came back fine.
+        // Now we keep them; only the forbidden field (CI checks) stays empty (and we log why).
+        resp = await graphqlTolerant(client, PR_DETAIL_QUERY, { owner, name, number }, (errors) => console.warn(`[hydrate] partial GraphQL for ${owner}/${name}#${number} — continuing with available fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`));
     }
-    catch {
+    catch (err) {
+        console.error(`[hydrate] PR detail fetch failed for ${owner}/${name}#${number}; returning stored metadata. ${err instanceof Error ? err.message : String(err)}`);
         return null;
     }
     const pr = resp.repository?.pullRequest;

package/dist/sync/sync-repo.js

@@ -1,7 +1,7 @@
 import { performance } from 'node:perf_hooks';
 import { eq } from 'drizzle-orm';
 import { db, schema } from '../db/client.js';
-import { getGraphqlClientFor } from '../github/client.js';
+import { getGraphqlClientFor, graphqlChecksHint, graphqlTolerant, summarizeGraphqlErrors, } from '../github/client.js';
 import { REPO_ACTIVITY_QUERY } from '../github/queries.js';
 import { ensureCommitFiles } from './commit-files.js';
 import { createUserResolver, persistPr, upsertRepo } from './upsert.js';
@@ -62,15 +62,19 @@ export async function syncRepo(opts) {
             }
             pageStartCursor = cursor;
             const tPage = performance.now();
-            const resp = await client(REPO_ACTIVITY_QUERY, {
-                owner,
-                name,
-                cursor,
-            });
+            // Tolerate partial errors so a forbidden sub-field (e.g. `statusCheckRollup` check runs on
+            // a private repo the token can't reach, or a token minted before its scope covered checks)
+            // doesn't abort the whole sync — the PRs, reviews, comments and review REQUESTS still
+            // persist; only CI check detail is dropped (the `ciStatus` rollup, when readable, is kept).
+            const resp = await graphqlTolerant(client, REPO_ACTIVITY_QUERY, { owner, name, cursor }, (errors) => log.warn(`sync ${owner}/${name}: partial GraphQL — continuing without forbidden fields${graphqlChecksHint(errors)}. ${summarizeGraphqlErrors(errors)}`));
             graphqlMs += performance.now() - tPage;
             pages += 1;
-            totalCost += resp.rateLimit.cost;
-            lastRemaining = resp.rateLimit.remaining;
+            // `rateLimit` is a top-level sibling of `repository`, so it survives a partial
+            // (forbidden-subfield) response — but guard it so a genuinely rateLimit-less partial
+            // (e.g. a NOT_FOUND payload salvaged by graphqlTolerant) can't NPE before the
+            // `!resp.repository` 404 below gets to fire.
+            totalCost += resp.rateLimit?.cost ?? 0;
+            lastRemaining = resp.rateLimit?.remaining ?? lastRemaining;
             if (!resp.repository) {
                 const err = new Error(`Repository ${owner}/${name} not found or inaccessible`);
                 err.statusCode = 404;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pierre-review",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "Dashboard for tracking your team's GitHub PR activity across repos — local (SQLite + gh) or self-hosted multi-tenant cloud (Postgres + GitHub App).",
   "type": "module",
   "author": "Alex Wakeman",