pierre-review 0.1.77 → 0.1.79

package/dist/api/plugins/auth.js

@@ -87,6 +87,10 @@ export function registerAuthGate(app) {
             return;
         if (path === '/api/billing/webhook')
             return;
+        // GitHub App webhook: GitHub posts unauthenticated — authenticity is the
+        // X-Hub-Signature-256 HMAC, verified in the route (see api/routes/webhooks.ts).
+        if (path === '/api/webhooks/github')
+            return;
         // The pricing page's "Get Pro" is a plain browser navigation from the public
         // landing; the route itself bounces anonymous visitors to sign-in instead of
         // dead-ending them on a JSON 401.

package/dist/api/routes/activity.js

@@ -26,9 +26,11 @@ export async function activityRoutes(app) {
         const q = req.query;
         const limit = q.limit != null ? Number(q.limit) : null;
         const offset = q.offset != null ? Number(q.offset) : 0;
+        const prId = q.prId != null ? Number(q.prId) : null;
         return getConsolidatedFeed(accountIdOf(req), {
             repoIds: parseIntList(q.repoIds),
             userIds: parseIntList(q.userIds),
+            prId: prId != null && Number.isFinite(prId) ? prId : null,
             limit: Number.isFinite(limit) && limit != null && limit > 0 ? limit : null,
             offset: Number.isFinite(offset) && offset > 0 ? offset : 0,
             excludeBots: q.excludeBots === 'true',

package/dist/api/routes/bot-triage.js

@@ -1,4 +1,4 @@
-import { addBotMuteRule, deleteBotMuteRule, getBotAnalytics, getBotVendorPrs, getBotDedupClusters, listBotMuteRules, listDetectedReviewers, setReviewerOverride, } from '../../db/queries.js';
+import { addBotMuteRule, deleteBotMuteRule, getBotAnalytics, getBotVendorPrs, getBotDedupClusters, listBotMuteRules, listDetectedReviewers, resolveScopeRepoIds, setReviewerOverride, } from '../../db/queries.js';
 import { accountIdOf } from '../plugins/auth.js';
 // PATCH /api/bot-reviewers/:userId — the two-way manual override. `kind`/`label` are left as
 // open strings (nullable) rather than an enum: AutomatedReviewerKind is defined in the
@@ -32,6 +32,8 @@ const analyticsSchema = {
                 enum: ['rolling_7', 'rolling_14', 'rolling_30', 'sprint'],
                 default: 'rolling_14',
             },
+            // Team scope: 'all' | 'none' | '<teamId>' (see resolveScopeRepoIds). Absent = all.
+            scope: { type: 'string' },
         },
     },
 };
@@ -53,6 +55,7 @@ const vendorPrsSchema = {
                 enum: ['rolling_7', 'rolling_14', 'rolling_30', 'sprint'],
                 default: 'rolling_14',
             },
+            scope: { type: 'string' },
         },
     },
 };
@@ -113,16 +116,20 @@ export async function botTriageRoutes(app) {
     // untouched + verdict + trend + deterministic tuning suggestions. Cost fields are null here
     // (the client overlays per-vendor cost from Pro settings).
     app.get('/api/bot-analytics', { schema: analyticsSchema }, async (req) => {
-        const { window } = req.query;
-        const resp = await getBotAnalytics(accountIdOf(req), window);
+        const { window, scope } = req.query;
+        const accountId = accountIdOf(req);
+        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
+        const resp = await getBotAnalytics(accountId, window, repoIds);
         return resp;
     });
     // The per-vendor PR drill-down behind one Bot-ROI row: the PRs that automated reviewer kind
     // touched in the window (threads/comments/acted-on/untouched/bot-only), newest-activity first.
     app.get('/api/bot-analytics/:kind/prs', { schema: vendorPrsSchema }, async (req) => {
         const { kind } = req.params;
-        const { window } = req.query;
-        const resp = await getBotVendorPrs(accountIdOf(req), kind, window);
+        const { window, scope } = req.query;
+        const accountId = accountIdOf(req);
+        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
+        const resp = await getBotVendorPrs(accountId, kind, window, repoIds);
         return resp;
     });
     // Cross-bot dedup clusters for one PR (≥2 automated reviewers on the same path/line window).

package/dist/api/routes/prs.js

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { config } from '../../config.js';
 import { getAccessToken, getAccountUserId } from '../../auth/account.js';
 import { fetchActionsJobLog } from '../../github/actions-logs.js';
-import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, getReviewerLogins, getResolvableBotThreads, getUsersByLogins, markAllViewed, markPrMergedLocally, markPrViewed, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
+import { getMentionCandidates, getPrDetail, getPrFilesContext, getPrWriteContext, getReviewerLogins, getResolvableBotThreads, getSuggestedReviewersBasis, getUsersByLogins, markAllViewed, markPrMergedLocally, markPrViewed, stampReviewRequests, upsertLocalPrComment, upsertLocalReview, } from '../../db/queries.js';
 import { getCodeownersMatch } from '../../github/codeowners.js';
 import { suggestTeamsFromHistory } from '../../github/team-reviewers.js';
 import { buildFileAnchors, fallbackAnchor, isFindingAnchored, } from '../../github/diff-anchor.js';
@@ -155,29 +155,25 @@ const requestReviewersSchema = {
         },
     },
 };
-// Layer network-derived reviewer suggestions on top of the history-USER ones getPrDetail
-// already computed. Runs ONLY when the PR still warrants suggestions (same trigger getPrDetail
-// used). Two best-effort sources, fetched in parallel and both cached per-repo:
+// Build the CORE "Suggested reviewers" set for a PR — served as its OWN live query so it's
+// never frozen inside the cached PR detail (it must empty the instant a reviewer is
+// requested). Combines the history-USER basis (from synced data) with two best-effort,
+// per-repo-cached network sources fetched in parallel:
 //   • CODEOWNERS — declared ownership for the touched paths (users + teams).
 //   • Team history — which team(s) are usually REQUESTED to review this repo (the behavioural
 //     fallback when CODEOWNERS declares no team; repo-level, so it runs even when the PR
 //     touches no owned path). See github/team-reviewers.ts.
-// Any failure (no CODEOWNERS, org wall, a repo that doesn't use team requests) simply leaves
-// the history-user suggestions untouched. Precedence: declared CODEOWNERS owners, then the
-// inferred team(s), then history users, up to a small cap. Mutates + returns the detail.
-async function enrichSuggestions(detail, accountId) {
-    const wants = detail.state === 'open' &&
-        !detail.isDraft &&
-        detail.requestedReviewers.length === 0 &&
-        detail.reviews.length === 0;
-    if (!wants)
-        return detail;
-    const [owner, name] = detail.repoFullName.split('/');
-    if (!owner || !name)
-        return detail;
+// Returns empty when the PR doesn't warrant suggestions. Any network failure (no CODEOWNERS,
+// org wall, a repo that doesn't use team requests) degrades to just the history-user set.
+// Precedence: declared CODEOWNERS owners, then the inferred team(s), then history users, cap 5.
+async function buildSuggestedReviewers(basis, accountId) {
+    if (!basis.wants)
+        return { suggestedReviewers: [], users: [] };
+    const { owner, name, authorLogin, paths, suggestions, users } = basis;
+    const extraUsers = [];
+    let merged = suggestions;
     try {
         const token = await getAccessToken(accountId);
-        const paths = detail.files.map((f) => f.path);
         const emptyMatch = { logins: [], teams: [] };
         const [match, historyTeams] = await Promise.all([
             paths.length > 0
@@ -185,13 +181,6 @@ async function enrichSuggestions(detail, accountId) {
                 : Promise.resolve(emptyMatch),
             suggestTeamsFromHistory(token, owner, name, accountId),
         ]);
-        if (match.logins.length === 0 &&
-            match.teams.length === 0 &&
-            historyTeams.length === 0)
-            return detail;
-        const authorLogin = detail.authorId != null
-            ? detail.users.find((u) => u.id === detail.authorId)?.githubLogin ?? null
-            : null;
         // Resolve @user owners to synced users (avatar/link); unsynced owners show login-only.
         // Exclude the PR author (GitHub rejects self-review requests).
         const uniqueLogins = [...new Set(match.logins)].filter((l) => l !== authorLogin);
@@ -226,17 +215,11 @@ async function enrichSuggestions(detail, accountId) {
         }));
         // Merge = precedence: CODEOWNERS users, CODEOWNERS teams (declared), inferred teams, then
         // the history-user suggestions. Dedup users by login and teams by slug (so a team that's
-        // both a CODEOWNER and historically requested shows once, as the CODEOWNER), capped so the
-        // row stays digestible.
+        // both a CODEOWNER and historically requested shows once, as the CODEOWNER).
         const seenLogins = new Set();
         const seenTeams = new Set();
-        const merged = [];
-        for (const s of [
-            ...codeownerUsers,
-            ...codeownerTeams,
-            ...historyTeamSuggestions,
-            ...detail.suggestedReviewers,
-        ]) {
+        merged = [];
+        for (const s of [...codeownerUsers, ...codeownerTeams, ...historyTeamSuggestions, ...suggestions]) {
             if (s.kind === 'team') {
                 if (s.teamSlug && !seenTeams.has(s.teamSlug)) {
                     seenTeams.add(s.teamSlug);
@@ -248,17 +231,16 @@ async function enrichSuggestions(detail, accountId) {
                 merged.push(s);
             }
         }
-        detail.suggestedReviewers = merged.slice(0, 5);
-        // Surface any newly-resolved codeowner users so the client can render avatars/links.
-        const known = new Set(detail.users.map((u) => u.id));
+        // The newly-resolved codeowner users the basis didn't already carry.
+        const known = new Set(users.map((u) => u.id));
         for (const u of resolved)
             if (!known.has(u.id))
-                detail.users.push(u);
+                extraUsers.push(u);
     }
     catch {
-        /* best-effort: keep the history suggestions */
+        /* best-effort: fall back to the history-user suggestions */
     }
-    return detail;
+    return { suggestedReviewers: merged.slice(0, 5), users: [...users, ...extraUsers] };
 }
 export async function prRoutes(app) {
     // Bulk "mark all seen": stamp every open PR (optionally scoped to repoIds) viewed
@@ -279,11 +261,25 @@ export async function prRoutes(app) {
         }
         // Cloud lean mode: fill in bulky text from GitHub (no-op in local). The client
         // caches the result in IndexedDB keyed by updatedAt so unchanged PRs don't refetch.
-        const detail = await hydratePrDetail(pr, accountId);
-        // Layer CODEOWNERS ownership + inferred review team(s) onto the history-based suggestions
-        // (best-effort; never blocks the response). getPrDetail already gated the history part on
-        // the same trigger.
-        return enrichSuggestions(detail, accountId);
+        // (Suggested reviewers are NOT here — they're a separate live query, see below — so the
+        // cached detail never freezes a stale suggestion.)
+        return hydratePrDetail(pr, accountId);
+    });
+    // Suggested reviewers — its OWN live query (not embedded in the cached PR detail) so it
+    // always reflects current state: it empties the instant a reviewer is requested (the assign
+    // route stamps review_requests locally), rather than staying frozen until the PR's updatedAt
+    // next bumps. Best-effort network enrichment (CODEOWNERS + inferred team) on top of the
+    // synced history basis. 404s when the PR isn't the caller's.
+    app.get('/api/prs/:id/suggested-reviewers', { schema: idParamSchema }, async (req, reply) => {
+        const { id } = req.params;
+        const accountId = accountIdOf(req);
+        const basis = await getSuggestedReviewersBasis(id, accountId);
+        if (!basis) {
+            reply.status(404);
+            return { error: 'NotFound', message: `PR ${id} not found` };
+        }
+        const result = await buildSuggestedReviewers(basis, accountId);
+        return result;
     });
     // Candidates for an @mention autocomplete, ranked by proximity to this PR
     // (participants first, then repo people), self + bots excluded. Account-scoped:
@@ -790,7 +786,8 @@ export async function prRoutes(app) {
         // resolve to logins (also drops bots + unknown ids). Union with any direct logins
         // (suggested reviewers we haven't synced as users), deduped.
         const wanted = userIds.filter((uid) => uid !== ctx.authorId);
-        const resolvedLogins = (await getReviewerLogins(wanted)).map((r) => r.login);
+        const resolved = await getReviewerLogins(wanted); // [{ userId, login }]
+        const resolvedLogins = resolved.map((r) => r.login);
         const logins = [...new Set([...resolvedLogins, ...directLogins])];
         const teams = [...new Set(teamSlugs)];
         if (logins.length === 0 && teams.length === 0) {
@@ -803,6 +800,12 @@ export async function prRoutes(app) {
         try {
             const token = await getAccessToken(accountId);
             await requestReviewers(token, ctx.owner, ctx.name, ctx.number, logins, teams);
+            // Optimistically stamp the request locally (mirrors approve/comment/merge) so the
+            // "Requested" row + the suggestion gate reflect it immediately; the next sync
+            // re-derives review_requests idempotently. Team handle = `owner/slug` (matches how a
+            // CODEOWNERS team + the suggestion render). Only the synced-user ids are stamped;
+            // unsynced direct logins land on the next sync.
+            await stampReviewRequests(ctx.prId, resolved.map((r) => r.userId), teams.map((slug) => `${ctx.owner}/${slug}`));
             const result = {
                 status: 'ok',
                 requestedLogins: logins,

package/dist/api/routes/repos.js

@@ -8,7 +8,7 @@ import { accountIdOf } from '../plugins/auth.js';
 // Local copy of the shared MAX_REPOS_PER_ACCOUNT value. `@pierre-review/shared` is
 // a types-only package (not shipped in the published tarball), so the backend must
 // only `import type` from it — runtime constants are duplicated here. Keep in sync.
-const MAX_REPOS_PER_ACCOUNT = 15;
+const MAX_REPOS_PER_ACCOUNT = 100;
 const createRepoSchema = {
     body: {
         type: 'object',
@@ -189,7 +189,7 @@ export async function repoRoutes(app) {
         return body;
     });
     app.post('/api/repos', { schema: createRepoSchema }, async (req, reply) => {
-        const { owner, name, watch } = req.body;
+        const { owner, name } = req.body;
         const accountId = accountIdOf(req);
         let resp;
         try {
@@ -225,10 +225,11 @@ export async function repoRoutes(app) {
         const canonOwner = resp.repository.owner.login;
         const canonName = resp.repository.name;
         const repoId = await upsertRepo(canonOwner, canonName, resp.repository.id, null, accountId);
-        // Auto-watch "yours" repos for the inbox. Idempotent on re-add and preserves an
-        // existing watch-start (setRepoInboxWatch only stamps the start when unset).
-        if (watch === true)
-            await setRepoInboxWatch(accountId, repoId, true);
+        // Auto-watch every newly-added repo for the inbox (so its activity flows into the feed +
+        // team scopes by default). Idempotent on re-add and preserves an existing watch-start
+        // (setRepoInboxWatch only stamps the start when unset). The `watch` body field is now
+        // vestigial — every add watches — but the schema still accepts it for back-compat.
+        await setRepoInboxWatch(accountId, repoId, true);
         // Kick off the initial backfill in the background.
         runSyncForRepo(repoId, app.log, { background: true });
         reply.status(201);

package/dist/api/routes/teams.js

@@ -0,0 +1,150 @@
+import { assignReposToTeam, createTeam, deleteTeam, getTeamRepoIds, listTeams, removeRepoFromTeam, renameTeam, } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Teams (CORE): group an account's repos into named teams. Every handler is accountId-scoped;
+// id-addressed routes verify ownership (→ 404). Assigning a repo to a team auto-Watches it.
+const nameBodySchema = {
+    body: {
+        type: 'object',
+        required: ['name'],
+        additionalProperties: false,
+        properties: { name: { type: 'string', minLength: 1, maxLength: 120 } },
+    },
+};
+const idParamSchema = {
+    params: {
+        type: 'object',
+        required: ['id'],
+        properties: { id: { type: 'integer' } },
+    },
+};
+const patchSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            name: { type: 'string', minLength: 1, maxLength: 120 },
+            repoIds: { type: 'array', items: { type: 'integer' } },
+        },
+    },
+};
+const addRepoSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['repoId'],
+        additionalProperties: false,
+        properties: { repoId: { type: 'integer' } },
+    },
+};
+const removeRepoSchema = {
+    params: {
+        type: 'object',
+        required: ['id', 'repoId'],
+        properties: { id: { type: 'integer' }, repoId: { type: 'integer' } },
+    },
+};
+export async function teamRoutes(app) {
+    // Account-scoped ownership lookup (→ null for a foreign/unknown team).
+    const findTeam = async (accountId, id) => (await listTeams(accountId)).find((t) => t.id === id) ?? null;
+    app.get('/api/teams', async (req) => ({
+        teams: await listTeams(accountIdOf(req)),
+    }));
+    app.post('/api/teams', { schema: nameBodySchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const name = req.body.name.trim();
+        if (!name) {
+            reply.status(400);
+            return { error: 'BadRequest', message: 'Team name must not be empty' };
+        }
+        const existing = await listTeams(accountId);
+        if (existing.some((t) => t.name === name)) {
+            reply.status(400);
+            return { error: 'BadRequest', message: `A team named "${name}" already exists` };
+        }
+        try {
+            const team = await createTeam(accountId, name);
+            reply.status(201);
+            return { team };
+        }
+        catch {
+            // Unique-constraint fallback (a concurrent create raced us to the same name).
+            reply.status(400);
+            return { error: 'BadRequest', message: `A team named "${name}" already exists` };
+        }
+    });
+    // Rename and/or REPLACE membership (set the team's repos to exactly `repoIds`). Ownership → 404.
+    app.patch('/api/teams/:id', { schema: patchSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const { name, repoIds } = req.body;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        if (name !== undefined) {
+            const trimmed = name.trim();
+            if (!trimmed) {
+                reply.status(400);
+                return { error: 'BadRequest', message: 'Team name must not be empty' };
+            }
+            // Reject a rename that collides with another team's name.
+            const others = (await listTeams(accountId)).filter((t) => t.id !== id);
+            if (others.some((t) => t.name === trimmed)) {
+                reply.status(400);
+                return { error: 'BadRequest', message: `A team named "${trimmed}" already exists` };
+            }
+            await renameTeam(id, accountId, trimmed);
+        }
+        if (repoIds !== undefined) {
+            // Diff current membership → target: assign the new ones (auto-watch), remove the missing.
+            const current = await getTeamRepoIds(id, accountId);
+            const target = new Set(repoIds);
+            const toAdd = repoIds.filter((r) => !current.includes(r));
+            const toRemove = current.filter((r) => !target.has(r));
+            if (toAdd.length > 0)
+                await assignReposToTeam(id, accountId, toAdd);
+            for (const repoId of toRemove)
+                await removeRepoFromTeam(id, repoId, accountId);
+        }
+        const team = await findTeam(accountId, id);
+        return { team };
+    });
+    app.delete('/api/teams/:id', { schema: idParamSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const ok = await deleteTeam(id, accountId);
+        if (!ok) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        reply.status(204);
+        return null;
+    });
+    // Assign ONE repo to a team (auto-watch). Ownership → 404.
+    app.post('/api/teams/:id/repos', { schema: addRepoSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const { repoId } = req.body;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        await assignReposToTeam(id, accountId, [repoId]);
+        const team = await findTeam(accountId, id);
+        return { team };
+    });
+    // Unassign ONE repo from a team. Ownership → 404; idempotent (unassigning a non-member 204s).
+    app.delete('/api/teams/:id/repos/:repoId', { schema: removeRepoSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id, repoId } = req.params;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        await removeRepoFromTeam(id, repoId, accountId);
+        reply.status(204);
+        return null;
+    });
+}
+//# sourceMappingURL=teams.js.map

package/dist/api/routes/webhooks.js

@@ -0,0 +1,181 @@
+// GitHub App webhook receiver — real-time sync Phase 1 (see docs/REALTIME-SYNC.md).
+//
+// A GitHub App has ONE webhook URL that receives events for every installation, so this
+// single route serves every tenant. On a PR-affecting event it resolves which watched
+// repos the change touches and fires a debounced, targeted single-PR sync (Phase 0's
+// enqueuePrSync) — near-real-time freshness at ~1 GraphQL point per change, no window
+// re-walk. It is ADDITIVE: the periodic poll (SYNC.md) stays as the backstop for dropped
+// deliveries and for accounts signed in via the OAuth App (no App install → no webhooks).
+//
+// Structure mirrors the Stripe webhook (api/routes/billing.ts): authenticity is the
+// signature, not a session (so the route is exempted from the cloud auth gate); the raw
+// body is read via an ENCAPSULATED content-type parser so the rest of the API keeps
+// normal JSON parsing. Registered in both modes; inert until GITHUB_APP_WEBHOOK_SECRET is
+// set (replies 501 unconfigured).
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { config } from '../../config.js';
+import { db, schema } from '../../db/client.js';
+import { enqueuePrSync } from '../../sync/sync-one-pr.js';
+const { repos } = schema;
+/**
+ * Verify a GitHub webhook signature (the `X-Hub-Signature-256` header) without a
+ * dependency. Format: `sha256=<hex>`, where the hex is HMAC-SHA256(secret) over the raw
+ * request bytes. Compared timing-safely. Pure so it's unit-testable without Fastify.
+ */
+export function verifyGithubSignature(rawBody, header, secret) {
+    const prefix = 'sha256=';
+    if (!header.startsWith(prefix))
+        return false;
+    const provided = header.slice(prefix.length);
+    const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
+    const providedBuf = Buffer.from(provided, 'utf-8');
+    const expectedBuf = Buffer.from(expected, 'utf-8');
+    return (providedBuf.length === expectedBuf.length &&
+        timingSafeEqual(providedBuf, expectedBuf));
+}
+function asRecord(v) {
+    return v !== null && typeof v === 'object' ? v : null;
+}
+// A positive integer `number` field off an object (a PR reference), else null.
+function prNumberOf(v) {
+    const n = asRecord(v)?.['number'];
+    return typeof n === 'number' && Number.isInteger(n) && n > 0 ? n : null;
+}
+/**
+ * Map a GitHub webhook (event type + payload) to the repo + PR numbers it should refresh.
+ * Pure — no DB, no Fastify — so the per-event extraction is unit-testable. Every handled
+ * event carries `repository.owner.login` + `repository.name`; the PR number(s) live in a
+ * per-event slot. Returns null when there's nothing to sync.
+ */
+export function extractPrTargets(eventType, payload) {
+    const p = asRecord(payload);
+    if (!p)
+        return null;
+    const repo = asRecord(p['repository']);
+    const owner = asRecord(repo?.['owner'])?.['login'];
+    const name = repo?.['name'];
+    if (typeof owner !== 'string' || typeof name !== 'string')
+        return null;
+    const numbers = new Set();
+    const addNum = (v) => {
+        const n = prNumberOf(v);
+        if (n != null)
+            numbers.add(n);
+    };
+    const addArray = (v) => {
+        if (Array.isArray(v))
+            for (const e of v)
+                addNum(e);
+    };
+    switch (eventType) {
+        // All the PR-scoped events carry the PR directly.
+        case 'pull_request':
+        case 'pull_request_review':
+        case 'pull_request_review_comment':
+        case 'pull_request_review_thread':
+            addNum(p['pull_request']);
+            break;
+        // issue_comment also fires on plain issues; only PRs carry `issue.pull_request`.
+        case 'issue_comment': {
+            const issue = asRecord(p['issue']);
+            if (issue && issue['pull_request'] != null)
+                addNum(issue);
+            break;
+        }
+        // CI events carry the associated PRs (same-repo only) — this is how a check
+        // finishing (which never bumps a PR's updatedAt) drives a refresh.
+        case 'check_run':
+            addArray(asRecord(p['check_run'])?.['pull_requests']);
+            break;
+        case 'check_suite':
+            addArray(asRecord(p['check_suite'])?.['pull_requests']);
+            break;
+        // ping / push / installation / anything else → no targeted PR (a push to a PR's head
+        // arrives separately as pull_request `synchronize`, which the case above handles).
+        default:
+            return null;
+    }
+    if (numbers.size === 0)
+        return null;
+    return { owner, name, prNumbers: [...numbers] };
+}
+export async function webhookRoutes(app) {
+    // A STABLE logger for the detached (debounced) syncs — the request-scoped req.log is
+    // gone by the time enqueuePrSync's timer fires. Mirrors scheduler.ts's adapter.
+    const log = {
+        info: (m, ...a) => app.log.info(a.length ? { a } : {}, m),
+        warn: (m, ...a) => app.log.warn(a.length ? { a } : {}, m),
+        error: (m, ...a) => app.log.error(a.length ? { a } : {}, m),
+    };
+    // The signature signs the exact bytes, so this route needs the RAW body. Fastify's
+    // content-type parsers are ENCAPSULATED, so registering the buffer parser in this
+    // nested scope affects ONLY /api/webhooks/github — the rest of the API keeps normal
+    // JSON parsing (proven by webhooks.test.ts's sibling-route case).
+    await app.register(async (scope) => {
+        scope.addContentTypeParser('application/json', { parseAs: 'buffer' }, (_req, body, done) => {
+            done(null, body);
+        });
+        // GitHub posts unauthenticated (exempted from the auth gate); authenticity is the
+        // signature. Never 500 on a data mismatch — GitHub retries non-2xx.
+        scope.post('/api/webhooks/github', async (req, reply) => {
+            if (!config.githubAppWebhookSecret) {
+                return reply.code(501).send({ error: 'github webhooks not configured' });
+            }
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw)) {
+                return reply.code(400).send({ error: 'expected a JSON body' });
+            }
+            const sig = req.headers['x-hub-signature-256'];
+            if (typeof sig !== 'string' ||
+                !verifyGithubSignature(raw, sig, config.githubAppWebhookSecret)) {
+                return reply.code(401).send({ error: 'invalid signature' });
+            }
+            const eventType = req.headers['x-github-event'];
+            if (typeof eventType !== 'string') {
+                return reply.code(400).send({ error: 'missing X-GitHub-Event' });
+            }
+            // GitHub pings a newly-configured webhook once — ack it.
+            if (eventType === 'ping')
+                return { received: true, queued: 0 };
+            let payload;
+            try {
+                payload = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                return reply.code(400).send({ error: 'invalid JSON' });
+            }
+            const target = extractPrTargets(eventType, payload);
+            if (!target)
+                return { received: true, queued: 0 };
+            // Route by (owner, name) across ALL accounts watching this repo. `repos` is keyed
+            // (accountId, owner, name), so one webhook fans out to every tenant's copy — each
+            // synced with ITS OWN token inside syncOnePr (isolation is structural). No
+            // installation→account table is needed.
+            const rows = await db
+                .select({ id: repos.id })
+                .from(repos)
+                .where(and(eq(repos.owner, target.owner), eq(repos.name, target.name)))
+                .execute();
+            let queued = 0;
+            for (const row of rows) {
+                for (const prNumber of target.prNumbers) {
+                    // Debounced + coalesced + reservation-guarded: a burst for one PR collapses to
+                    // a single targeted sync (Phase 0). Fire-and-forget; syncOnePr swallows errors.
+                    enqueuePrSync(row.id, prNumber, log);
+                    queued += 1;
+                }
+            }
+            if (queued > 0) {
+                req.log.info({
+                    repo: `${target.owner}/${target.name}`,
+                    event: eventType,
+                    prs: target.prNumbers,
+                    watchers: rows.length,
+                }, 'github webhook → queued targeted sync');
+            }
+            return { received: true, queued };
+        });
+    });
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/app.js

@@ -9,6 +9,7 @@ import { registerAccountContext, registerAuthGate, registerSession, } from './ap
 import { authRoutes } from './api/routes/auth.js';
 import { healthRoutes } from './api/routes/health.js';
 import { repoRoutes } from './api/routes/repos.js';
+import { teamRoutes } from './api/routes/teams.js';
 import { userRoutes } from './api/routes/users.js';
 import { timelineRoutes } from './api/routes/timeline.js';
 import { prRoutes } from './api/routes/prs.js';
@@ -21,6 +22,7 @@ import { insightsRoutes } from './api/routes/insights.js';
 import { activityRoutes } from './api/routes/activity.js';
 import { billingRoutes } from './api/routes/billing.js';
 import { botTriageRoutes } from './api/routes/bot-triage.js';
+import { webhookRoutes } from './api/routes/webhooks.js';
 export async function buildApp() {
     const app = Fastify({
         // In production (the installed CLI) the per-request "incoming request" /
@@ -123,6 +125,8 @@ export async function buildApp() {
         await app.register(authRoutes);
     await app.register(healthRoutes);
     await app.register(repoRoutes);
+    // Teams (CORE, always registered): group repos into named teams; account-scoped, no AI.
+    await app.register(teamRoutes);
     await app.register(userRoutes);
     await app.register(timelineRoutes);
     await app.register(prRoutes);
@@ -139,6 +143,10 @@ export async function buildApp() {
     // Stripe billing seam (checkout redirect + webhook). Registered in both modes;
     // inert until the STRIPE_* env vars are set (webhook 501s unconfigured).
     await app.register(billingRoutes);
+    // GitHub App webhook receiver (real-time sync Phase 1). Registered in both modes;
+    // inert until GITHUB_APP_WEBHOOK_SECRET is set (501s unconfigured). Additive on top of
+    // the periodic poll — see docs/REALTIME-SYNC.md.
+    await app.register(webhookRoutes);
     // Claude Review moved into the @pierre/pro plugin (its routes register there, gated on the
     // `claudeReview` capability). The SDK-run / diff-prep / GitHub-post infra + the tables stay
     // in core behind the ctx.review seam; nothing to register here.