pierre-review 0.1.78 → 0.1.79

package/dist/api/plugins/auth.js

@@ -87,6 +87,10 @@ export function registerAuthGate(app) {
             return;
         if (path === '/api/billing/webhook')
             return;
+        // GitHub App webhook: GitHub posts unauthenticated — authenticity is the
+        // X-Hub-Signature-256 HMAC, verified in the route (see api/routes/webhooks.ts).
+        if (path === '/api/webhooks/github')
+            return;
         // The pricing page's "Get Pro" is a plain browser navigation from the public
         // landing; the route itself bounces anonymous visitors to sign-in instead of
         // dead-ending them on a JSON 401.

package/dist/api/routes/activity.js

@@ -26,9 +26,11 @@ export async function activityRoutes(app) {
         const q = req.query;
         const limit = q.limit != null ? Number(q.limit) : null;
         const offset = q.offset != null ? Number(q.offset) : 0;
+        const prId = q.prId != null ? Number(q.prId) : null;
         return getConsolidatedFeed(accountIdOf(req), {
             repoIds: parseIntList(q.repoIds),
             userIds: parseIntList(q.userIds),
+            prId: prId != null && Number.isFinite(prId) ? prId : null,
             limit: Number.isFinite(limit) && limit != null && limit > 0 ? limit : null,
             offset: Number.isFinite(offset) && offset > 0 ? offset : 0,
             excludeBots: q.excludeBots === 'true',

package/dist/api/routes/bot-triage.js

@@ -1,4 +1,4 @@
-import { addBotMuteRule, deleteBotMuteRule, getBotAnalytics, getBotVendorPrs, getBotDedupClusters, listBotMuteRules, listDetectedReviewers, setReviewerOverride, } from '../../db/queries.js';
+import { addBotMuteRule, deleteBotMuteRule, getBotAnalytics, getBotVendorPrs, getBotDedupClusters, listBotMuteRules, listDetectedReviewers, resolveScopeRepoIds, setReviewerOverride, } from '../../db/queries.js';
 import { accountIdOf } from '../plugins/auth.js';
 // PATCH /api/bot-reviewers/:userId — the two-way manual override. `kind`/`label` are left as
 // open strings (nullable) rather than an enum: AutomatedReviewerKind is defined in the
@@ -32,6 +32,8 @@ const analyticsSchema = {
                 enum: ['rolling_7', 'rolling_14', 'rolling_30', 'sprint'],
                 default: 'rolling_14',
             },
+            // Team scope: 'all' | 'none' | '<teamId>' (see resolveScopeRepoIds). Absent = all.
+            scope: { type: 'string' },
         },
     },
 };
@@ -53,6 +55,7 @@ const vendorPrsSchema = {
                 enum: ['rolling_7', 'rolling_14', 'rolling_30', 'sprint'],
                 default: 'rolling_14',
             },
+            scope: { type: 'string' },
         },
     },
 };
@@ -113,16 +116,20 @@ export async function botTriageRoutes(app) {
     // untouched + verdict + trend + deterministic tuning suggestions. Cost fields are null here
     // (the client overlays per-vendor cost from Pro settings).
     app.get('/api/bot-analytics', { schema: analyticsSchema }, async (req) => {
-        const { window } = req.query;
-        const resp = await getBotAnalytics(accountIdOf(req), window);
+        const { window, scope } = req.query;
+        const accountId = accountIdOf(req);
+        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
+        const resp = await getBotAnalytics(accountId, window, repoIds);
         return resp;
     });
     // The per-vendor PR drill-down behind one Bot-ROI row: the PRs that automated reviewer kind
     // touched in the window (threads/comments/acted-on/untouched/bot-only), newest-activity first.
     app.get('/api/bot-analytics/:kind/prs', { schema: vendorPrsSchema }, async (req) => {
         const { kind } = req.params;
-        const { window } = req.query;
-        const resp = await getBotVendorPrs(accountIdOf(req), kind, window);
+        const { window, scope } = req.query;
+        const accountId = accountIdOf(req);
+        const repoIds = scope ? await resolveScopeRepoIds(accountId, scope) : null;
+        const resp = await getBotVendorPrs(accountId, kind, window, repoIds);
         return resp;
     });
     // Cross-bot dedup clusters for one PR (≥2 automated reviewers on the same path/line window).

package/dist/api/routes/repos.js

@@ -8,7 +8,7 @@ import { accountIdOf } from '../plugins/auth.js';
 // Local copy of the shared MAX_REPOS_PER_ACCOUNT value. `@pierre-review/shared` is
 // a types-only package (not shipped in the published tarball), so the backend must
 // only `import type` from it — runtime constants are duplicated here. Keep in sync.
-const MAX_REPOS_PER_ACCOUNT = 15;
+const MAX_REPOS_PER_ACCOUNT = 100;
 const createRepoSchema = {
     body: {
         type: 'object',
@@ -189,7 +189,7 @@ export async function repoRoutes(app) {
         return body;
     });
     app.post('/api/repos', { schema: createRepoSchema }, async (req, reply) => {
-        const { owner, name, watch } = req.body;
+        const { owner, name } = req.body;
         const accountId = accountIdOf(req);
         let resp;
         try {
@@ -225,10 +225,11 @@ export async function repoRoutes(app) {
         const canonOwner = resp.repository.owner.login;
         const canonName = resp.repository.name;
         const repoId = await upsertRepo(canonOwner, canonName, resp.repository.id, null, accountId);
-        // Auto-watch "yours" repos for the inbox. Idempotent on re-add and preserves an
-        // existing watch-start (setRepoInboxWatch only stamps the start when unset).
-        if (watch === true)
-            await setRepoInboxWatch(accountId, repoId, true);
+        // Auto-watch every newly-added repo for the inbox (so its activity flows into the feed +
+        // team scopes by default). Idempotent on re-add and preserves an existing watch-start
+        // (setRepoInboxWatch only stamps the start when unset). The `watch` body field is now
+        // vestigial — every add watches — but the schema still accepts it for back-compat.
+        await setRepoInboxWatch(accountId, repoId, true);
         // Kick off the initial backfill in the background.
         runSyncForRepo(repoId, app.log, { background: true });
         reply.status(201);

package/dist/api/routes/teams.js

@@ -0,0 +1,150 @@
+import { assignReposToTeam, createTeam, deleteTeam, getTeamRepoIds, listTeams, removeRepoFromTeam, renameTeam, } from '../../db/queries.js';
+import { accountIdOf } from '../plugins/auth.js';
+// Teams (CORE): group an account's repos into named teams. Every handler is accountId-scoped;
+// id-addressed routes verify ownership (→ 404). Assigning a repo to a team auto-Watches it.
+const nameBodySchema = {
+    body: {
+        type: 'object',
+        required: ['name'],
+        additionalProperties: false,
+        properties: { name: { type: 'string', minLength: 1, maxLength: 120 } },
+    },
+};
+const idParamSchema = {
+    params: {
+        type: 'object',
+        required: ['id'],
+        properties: { id: { type: 'integer' } },
+    },
+};
+const patchSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            name: { type: 'string', minLength: 1, maxLength: 120 },
+            repoIds: { type: 'array', items: { type: 'integer' } },
+        },
+    },
+};
+const addRepoSchema = {
+    ...idParamSchema,
+    body: {
+        type: 'object',
+        required: ['repoId'],
+        additionalProperties: false,
+        properties: { repoId: { type: 'integer' } },
+    },
+};
+const removeRepoSchema = {
+    params: {
+        type: 'object',
+        required: ['id', 'repoId'],
+        properties: { id: { type: 'integer' }, repoId: { type: 'integer' } },
+    },
+};
+export async function teamRoutes(app) {
+    // Account-scoped ownership lookup (→ null for a foreign/unknown team).
+    const findTeam = async (accountId, id) => (await listTeams(accountId)).find((t) => t.id === id) ?? null;
+    app.get('/api/teams', async (req) => ({
+        teams: await listTeams(accountIdOf(req)),
+    }));
+    app.post('/api/teams', { schema: nameBodySchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const name = req.body.name.trim();
+        if (!name) {
+            reply.status(400);
+            return { error: 'BadRequest', message: 'Team name must not be empty' };
+        }
+        const existing = await listTeams(accountId);
+        if (existing.some((t) => t.name === name)) {
+            reply.status(400);
+            return { error: 'BadRequest', message: `A team named "${name}" already exists` };
+        }
+        try {
+            const team = await createTeam(accountId, name);
+            reply.status(201);
+            return { team };
+        }
+        catch {
+            // Unique-constraint fallback (a concurrent create raced us to the same name).
+            reply.status(400);
+            return { error: 'BadRequest', message: `A team named "${name}" already exists` };
+        }
+    });
+    // Rename and/or REPLACE membership (set the team's repos to exactly `repoIds`). Ownership → 404.
+    app.patch('/api/teams/:id', { schema: patchSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const { name, repoIds } = req.body;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        if (name !== undefined) {
+            const trimmed = name.trim();
+            if (!trimmed) {
+                reply.status(400);
+                return { error: 'BadRequest', message: 'Team name must not be empty' };
+            }
+            // Reject a rename that collides with another team's name.
+            const others = (await listTeams(accountId)).filter((t) => t.id !== id);
+            if (others.some((t) => t.name === trimmed)) {
+                reply.status(400);
+                return { error: 'BadRequest', message: `A team named "${trimmed}" already exists` };
+            }
+            await renameTeam(id, accountId, trimmed);
+        }
+        if (repoIds !== undefined) {
+            // Diff current membership → target: assign the new ones (auto-watch), remove the missing.
+            const current = await getTeamRepoIds(id, accountId);
+            const target = new Set(repoIds);
+            const toAdd = repoIds.filter((r) => !current.includes(r));
+            const toRemove = current.filter((r) => !target.has(r));
+            if (toAdd.length > 0)
+                await assignReposToTeam(id, accountId, toAdd);
+            for (const repoId of toRemove)
+                await removeRepoFromTeam(id, repoId, accountId);
+        }
+        const team = await findTeam(accountId, id);
+        return { team };
+    });
+    app.delete('/api/teams/:id', { schema: idParamSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const ok = await deleteTeam(id, accountId);
+        if (!ok) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        reply.status(204);
+        return null;
+    });
+    // Assign ONE repo to a team (auto-watch). Ownership → 404.
+    app.post('/api/teams/:id/repos', { schema: addRepoSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id } = req.params;
+        const { repoId } = req.body;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        await assignReposToTeam(id, accountId, [repoId]);
+        const team = await findTeam(accountId, id);
+        return { team };
+    });
+    // Unassign ONE repo from a team. Ownership → 404; idempotent (unassigning a non-member 204s).
+    app.delete('/api/teams/:id/repos/:repoId', { schema: removeRepoSchema }, async (req, reply) => {
+        const accountId = accountIdOf(req);
+        const { id, repoId } = req.params;
+        if (!(await findTeam(accountId, id))) {
+            reply.status(404);
+            return { error: 'NotFound', message: `Team ${id} not found` };
+        }
+        await removeRepoFromTeam(id, repoId, accountId);
+        reply.status(204);
+        return null;
+    });
+}
+//# sourceMappingURL=teams.js.map

package/dist/api/routes/webhooks.js

@@ -0,0 +1,181 @@
+// GitHub App webhook receiver — real-time sync Phase 1 (see docs/REALTIME-SYNC.md).
+//
+// A GitHub App has ONE webhook URL that receives events for every installation, so this
+// single route serves every tenant. On a PR-affecting event it resolves which watched
+// repos the change touches and fires a debounced, targeted single-PR sync (Phase 0's
+// enqueuePrSync) — near-real-time freshness at ~1 GraphQL point per change, no window
+// re-walk. It is ADDITIVE: the periodic poll (SYNC.md) stays as the backstop for dropped
+// deliveries and for accounts signed in via the OAuth App (no App install → no webhooks).
+//
+// Structure mirrors the Stripe webhook (api/routes/billing.ts): authenticity is the
+// signature, not a session (so the route is exempted from the cloud auth gate); the raw
+// body is read via an ENCAPSULATED content-type parser so the rest of the API keeps
+// normal JSON parsing. Registered in both modes; inert until GITHUB_APP_WEBHOOK_SECRET is
+// set (replies 501 unconfigured).
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { and, eq } from 'drizzle-orm';
+import { config } from '../../config.js';
+import { db, schema } from '../../db/client.js';
+import { enqueuePrSync } from '../../sync/sync-one-pr.js';
+const { repos } = schema;
+/**
+ * Verify a GitHub webhook signature (the `X-Hub-Signature-256` header) without a
+ * dependency. Format: `sha256=<hex>`, where the hex is HMAC-SHA256(secret) over the raw
+ * request bytes. Compared timing-safely. Pure so it's unit-testable without Fastify.
+ */
+export function verifyGithubSignature(rawBody, header, secret) {
+    const prefix = 'sha256=';
+    if (!header.startsWith(prefix))
+        return false;
+    const provided = header.slice(prefix.length);
+    const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
+    const providedBuf = Buffer.from(provided, 'utf-8');
+    const expectedBuf = Buffer.from(expected, 'utf-8');
+    return (providedBuf.length === expectedBuf.length &&
+        timingSafeEqual(providedBuf, expectedBuf));
+}
+function asRecord(v) {
+    return v !== null && typeof v === 'object' ? v : null;
+}
+// A positive integer `number` field off an object (a PR reference), else null.
+function prNumberOf(v) {
+    const n = asRecord(v)?.['number'];
+    return typeof n === 'number' && Number.isInteger(n) && n > 0 ? n : null;
+}
+/**
+ * Map a GitHub webhook (event type + payload) to the repo + PR numbers it should refresh.
+ * Pure — no DB, no Fastify — so the per-event extraction is unit-testable. Every handled
+ * event carries `repository.owner.login` + `repository.name`; the PR number(s) live in a
+ * per-event slot. Returns null when there's nothing to sync.
+ */
+export function extractPrTargets(eventType, payload) {
+    const p = asRecord(payload);
+    if (!p)
+        return null;
+    const repo = asRecord(p['repository']);
+    const owner = asRecord(repo?.['owner'])?.['login'];
+    const name = repo?.['name'];
+    if (typeof owner !== 'string' || typeof name !== 'string')
+        return null;
+    const numbers = new Set();
+    const addNum = (v) => {
+        const n = prNumberOf(v);
+        if (n != null)
+            numbers.add(n);
+    };
+    const addArray = (v) => {
+        if (Array.isArray(v))
+            for (const e of v)
+                addNum(e);
+    };
+    switch (eventType) {
+        // All the PR-scoped events carry the PR directly.
+        case 'pull_request':
+        case 'pull_request_review':
+        case 'pull_request_review_comment':
+        case 'pull_request_review_thread':
+            addNum(p['pull_request']);
+            break;
+        // issue_comment also fires on plain issues; only PRs carry `issue.pull_request`.
+        case 'issue_comment': {
+            const issue = asRecord(p['issue']);
+            if (issue && issue['pull_request'] != null)
+                addNum(issue);
+            break;
+        }
+        // CI events carry the associated PRs (same-repo only) — this is how a check
+        // finishing (which never bumps a PR's updatedAt) drives a refresh.
+        case 'check_run':
+            addArray(asRecord(p['check_run'])?.['pull_requests']);
+            break;
+        case 'check_suite':
+            addArray(asRecord(p['check_suite'])?.['pull_requests']);
+            break;
+        // ping / push / installation / anything else → no targeted PR (a push to a PR's head
+        // arrives separately as pull_request `synchronize`, which the case above handles).
+        default:
+            return null;
+    }
+    if (numbers.size === 0)
+        return null;
+    return { owner, name, prNumbers: [...numbers] };
+}
+export async function webhookRoutes(app) {
+    // A STABLE logger for the detached (debounced) syncs — the request-scoped req.log is
+    // gone by the time enqueuePrSync's timer fires. Mirrors scheduler.ts's adapter.
+    const log = {
+        info: (m, ...a) => app.log.info(a.length ? { a } : {}, m),
+        warn: (m, ...a) => app.log.warn(a.length ? { a } : {}, m),
+        error: (m, ...a) => app.log.error(a.length ? { a } : {}, m),
+    };
+    // The signature signs the exact bytes, so this route needs the RAW body. Fastify's
+    // content-type parsers are ENCAPSULATED, so registering the buffer parser in this
+    // nested scope affects ONLY /api/webhooks/github — the rest of the API keeps normal
+    // JSON parsing (proven by webhooks.test.ts's sibling-route case).
+    await app.register(async (scope) => {
+        scope.addContentTypeParser('application/json', { parseAs: 'buffer' }, (_req, body, done) => {
+            done(null, body);
+        });
+        // GitHub posts unauthenticated (exempted from the auth gate); authenticity is the
+        // signature. Never 500 on a data mismatch — GitHub retries non-2xx.
+        scope.post('/api/webhooks/github', async (req, reply) => {
+            if (!config.githubAppWebhookSecret) {
+                return reply.code(501).send({ error: 'github webhooks not configured' });
+            }
+            const raw = req.body;
+            if (!Buffer.isBuffer(raw)) {
+                return reply.code(400).send({ error: 'expected a JSON body' });
+            }
+            const sig = req.headers['x-hub-signature-256'];
+            if (typeof sig !== 'string' ||
+                !verifyGithubSignature(raw, sig, config.githubAppWebhookSecret)) {
+                return reply.code(401).send({ error: 'invalid signature' });
+            }
+            const eventType = req.headers['x-github-event'];
+            if (typeof eventType !== 'string') {
+                return reply.code(400).send({ error: 'missing X-GitHub-Event' });
+            }
+            // GitHub pings a newly-configured webhook once — ack it.
+            if (eventType === 'ping')
+                return { received: true, queued: 0 };
+            let payload;
+            try {
+                payload = JSON.parse(raw.toString('utf-8'));
+            }
+            catch {
+                return reply.code(400).send({ error: 'invalid JSON' });
+            }
+            const target = extractPrTargets(eventType, payload);
+            if (!target)
+                return { received: true, queued: 0 };
+            // Route by (owner, name) across ALL accounts watching this repo. `repos` is keyed
+            // (accountId, owner, name), so one webhook fans out to every tenant's copy — each
+            // synced with ITS OWN token inside syncOnePr (isolation is structural). No
+            // installation→account table is needed.
+            const rows = await db
+                .select({ id: repos.id })
+                .from(repos)
+                .where(and(eq(repos.owner, target.owner), eq(repos.name, target.name)))
+                .execute();
+            let queued = 0;
+            for (const row of rows) {
+                for (const prNumber of target.prNumbers) {
+                    // Debounced + coalesced + reservation-guarded: a burst for one PR collapses to
+                    // a single targeted sync (Phase 0). Fire-and-forget; syncOnePr swallows errors.
+                    enqueuePrSync(row.id, prNumber, log);
+                    queued += 1;
+                }
+            }
+            if (queued > 0) {
+                req.log.info({
+                    repo: `${target.owner}/${target.name}`,
+                    event: eventType,
+                    prs: target.prNumbers,
+                    watchers: rows.length,
+                }, 'github webhook → queued targeted sync');
+            }
+            return { received: true, queued };
+        });
+    });
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/app.js

@@ -9,6 +9,7 @@ import { registerAccountContext, registerAuthGate, registerSession, } from './ap
 import { authRoutes } from './api/routes/auth.js';
 import { healthRoutes } from './api/routes/health.js';
 import { repoRoutes } from './api/routes/repos.js';
+import { teamRoutes } from './api/routes/teams.js';
 import { userRoutes } from './api/routes/users.js';
 import { timelineRoutes } from './api/routes/timeline.js';
 import { prRoutes } from './api/routes/prs.js';
@@ -21,6 +22,7 @@ import { insightsRoutes } from './api/routes/insights.js';
 import { activityRoutes } from './api/routes/activity.js';
 import { billingRoutes } from './api/routes/billing.js';
 import { botTriageRoutes } from './api/routes/bot-triage.js';
+import { webhookRoutes } from './api/routes/webhooks.js';
 export async function buildApp() {
     const app = Fastify({
         // In production (the installed CLI) the per-request "incoming request" /
@@ -123,6 +125,8 @@ export async function buildApp() {
         await app.register(authRoutes);
     await app.register(healthRoutes);
     await app.register(repoRoutes);
+    // Teams (CORE, always registered): group repos into named teams; account-scoped, no AI.
+    await app.register(teamRoutes);
     await app.register(userRoutes);
     await app.register(timelineRoutes);
     await app.register(prRoutes);
@@ -139,6 +143,10 @@ export async function buildApp() {
     // Stripe billing seam (checkout redirect + webhook). Registered in both modes;
     // inert until the STRIPE_* env vars are set (webhook 501s unconfigured).
     await app.register(billingRoutes);
+    // GitHub App webhook receiver (real-time sync Phase 1). Registered in both modes;
+    // inert until GITHUB_APP_WEBHOOK_SECRET is set (501s unconfigured). Additive on top of
+    // the periodic poll — see docs/REALTIME-SYNC.md.
+    await app.register(webhookRoutes);
     // Claude Review moved into the @pierre/pro plugin (its routes register there, gated on the
     // `claudeReview` capability). The SDK-run / diff-prep / GitHub-post infra + the tables stay
     // in core behind the ctx.review seam; nothing to register here.

package/dist/coding/agent.js

@@ -1,6 +1,7 @@
 import { createSdkMcpServer, query, tool, } from '@anthropic-ai/claude-agent-sdk';
 import { config } from '../config.js';
 import { getAccessToken } from '../auth/account.js';
+import { applyClaudeReviewAuth } from '../review/auth.js';
 import { cleanupCloneCache, prepWorktree, removeWorktreeLocked, } from '../review/clone-manager.js';
 import { estimateCostUsd } from '../review/pricing.js';
 import { recordUsage, sumModelUsage, sumUsageMap, } from '../review/usage.js';
@@ -63,9 +64,11 @@ function emptyUsage() {
  * `settingSources:[]`, budget/turn caps, whitelisted tools) and streams activity, but
  * knows nothing about worktree prep, diff capture, or git — the callers own those.
  *
- * Auth: runs on the AMBIENT Claude env WITHOUT mutating process.env (unlike Claude
- * Review's applyClaudeReviewAuth) — the AI-Fix jobs are concurrency 1, and mutating
- * env would race a concurrent review manager. Whatever credential is ambient is used.
+ * Auth: prefers the ambient Claude session, else falls back to the user's local BYO
+ * Anthropic key — the SAME advanced-AI credential policy as Claude Review
+ * (applyClaudeReviewAuth), restored in `finally`. AI-Fix jobs are concurrency 1; the env
+ * mutation only bites when there's no ambient auth (a BYO-key-only setup), where it and a
+ * concurrent review would set the identical key.
  */
 export async function runAgentInWorktree(opts) {
     const model = opts.model;
@@ -78,81 +81,88 @@ export async function runAgentInWorktree(opts) {
     const effort = EFFORT_CAPABLE_MODELS.has(model)
         ? config.reviewEffort
         : undefined;
-    const q = query({
-        prompt: opts.prompt,
-        options: {
-            model,
-            ...(effort ? { effort } : {}),
-            ...(opts.systemPrompt ? { systemPrompt: opts.systemPrompt } : {}),
-            cwd: opts.worktreePath,
-            permissionMode: 'bypassPermissions',
-            allowedTools: opts.allowedTools,
-            disallowedTools: opts.disallowedTools,
-            maxTurns,
-            maxBudgetUsd: opts.maxBudgetUsd,
-            settingSources: [],
-            mcpServers: opts.mcpServers,
-            abortController: opts.abortController,
-        },
-    });
-    const activity = [];
-    const pushActivity = (line) => {
-        const trimmed = line.trim();
-        if (!trimmed)
-            return;
-        activity.push(trimmed);
-        if (activity.length > ACTIVITY_LOG_CAP)
-            activity.shift();
-    };
-    for await (const message of q) {
-        if (message.type === 'assistant') {
-            try {
-                recordUsage(usageByUuid, message);
-            }
-            catch {
-                /* usage shape varies — never let it break the run */
-            }
-            try {
-                for (const line of describeAssistantBlocks(message))
-                    pushActivity(line);
+    // Advanced-AI credential: ambient session preferred, else the local BYO key. Restored below.
+    const restoreEnv = applyClaudeReviewAuth(true);
+    try {
+        const q = query({
+            prompt: opts.prompt,
+            options: {
+                model,
+                ...(effort ? { effort } : {}),
+                ...(opts.systemPrompt ? { systemPrompt: opts.systemPrompt } : {}),
+                cwd: opts.worktreePath,
+                permissionMode: 'bypassPermissions',
+                allowedTools: opts.allowedTools,
+                disallowedTools: opts.disallowedTools,
+                maxTurns,
+                maxBudgetUsd: opts.maxBudgetUsd,
+                settingSources: [],
+                mcpServers: opts.mcpServers,
+                abortController: opts.abortController,
+            },
+        });
+        const activity = [];
+        const pushActivity = (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            activity.push(trimmed);
+            if (activity.length > ACTIVITY_LOG_CAP)
+                activity.shift();
+        };
+        for await (const message of q) {
+            if (message.type === 'assistant') {
+                try {
+                    recordUsage(usageByUuid, message);
+                }
+                catch {
+                    /* usage shape varies — never let it break the run */
+                }
+                try {
+                    for (const line of describeAssistantBlocks(message))
+                        pushActivity(line);
+                }
+                catch {
+                    /* never let progress derivation break the run */
+                }
+                const live = sumUsageMap(usageByUuid);
+                opts.onActivity?.([...activity], {
+                    ...live,
+                    estCostUsd: estimateCostUsd(model, live),
+                });
             }
-            catch {
-                /* never let progress derivation break the run */
+            else if (message.type === 'result') {
+                result = message;
             }
-            const live = sumUsageMap(usageByUuid);
-            opts.onActivity?.([...activity], {
-                ...live,
-                estCostUsd: estimateCostUsd(model, live),
-            });
         }
-        else if (message.type === 'result') {
-            result = message;
+        if (opts.abortController.signal.aborted) {
+            return {
+                result,
+                usage: emptyUsage(),
+                costUsd: null,
+                numTurns: null,
+                aborted: true,
+            };
         }
-    }
-    if (opts.abortController.signal.aborted) {
+        const usage = sumModelUsage(result) ?? sumUsageMap(usageByUuid);
+        const hasUsage = usage.inputTokens + usage.outputTokens + usage.cacheReadTokens > 0;
+        const costUsd = result?.total_cost_usd ?? (hasUsage ? estimateCostUsd(model, usage) : null);
         return {
             result,
-            usage: emptyUsage(),
-            costUsd: null,
-            numTurns: null,
-            aborted: true,
+            usage: {
+                inputTokens: usage.inputTokens,
+                outputTokens: usage.outputTokens,
+                cacheReadTokens: usage.cacheReadTokens,
+                cacheCreationTokens: usage.cacheCreationTokens,
+            },
+            costUsd,
+            numTurns: result?.num_turns ?? null,
+            aborted: false,
         };
     }
-    const usage = sumModelUsage(result) ?? sumUsageMap(usageByUuid);
-    const hasUsage = usage.inputTokens + usage.outputTokens + usage.cacheReadTokens > 0;
-    const costUsd = result?.total_cost_usd ?? (hasUsage ? estimateCostUsd(model, usage) : null);
-    return {
-        result,
-        usage: {
-            inputTokens: usage.inputTokens,
-            outputTokens: usage.outputTokens,
-            cacheReadTokens: usage.cacheReadTokens,
-            cacheCreationTokens: usage.cacheCreationTokens,
-        },
-        costUsd,
-        numTurns: result?.num_turns ?? null,
-        aborted: false,
-    };
+    finally {
+        restoreEnv();
+    }
 }
 /**
  * Run the write-capable coding agent against a PR's head in an ephemeral worktree and