npm - reviewstage - Versions diffs - 1.0.0-rc.24 - Mend

reviewstage 1.0.0-rc.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (74) hide show

package/LICENSE +21 -0
package/README.md +60 -0
package/bin/reviewstage.js +49 -0
package/flock.py +87 -0
package/main.js +281 -0
package/package.json +44 -0
package/pages/phone.html +79 -0
package/pages/preparing.html +66 -0
package/preload.cjs +15 -0
package/server/bin/bootstrap.sh +318 -0
package/server/bin/demo-fixture.py +188 -0
package/server/bin/doctor.sh +310 -0
package/server/bin/entrypoint.sh +191 -0
package/server/bin/lib-common.sh +308 -0
package/server/bin/lib-limits.sh +18 -0
package/server/bin/lib-settings.sh +37 -0
package/server/bin/notify.sh +335 -0
package/server/bin/poller-loop.sh +68 -0
package/server/bin/pr-watch.sh +356 -0
package/server/bin/profile-repo.sh +141 -0
package/server/bin/rs_agree.py +163 -0
package/server/bin/rs_assets.py +10 -0
package/server/bin/rs_device_flow.py +225 -0
package/server/bin/rs_devices.py +220 -0
package/server/bin/rs_diff.py +260 -0
package/server/bin/rs_learn.py +754 -0
package/server/bin/rs_md.py +107 -0
package/server/bin/rs_paths.py +285 -0
package/server/bin/rs_personal.py +276 -0
package/server/bin/rs_profile.py +1091 -0
package/server/bin/rs_push.py +417 -0
package/server/bin/rs_queue.py +791 -0
package/server/bin/rs_review_body.py +133 -0
package/server/bin/rs_rollup.py +382 -0
package/server/bin/rs_settings.py +265 -0
package/server/bin/rs_stack.py +76 -0
package/server/bin/rs_state.py +184 -0
package/server/bin/rs_webhook.py +250 -0
package/server/bin/run-qa.sh +295 -0
package/server/bin/run-review.sh +402 -0
package/server/bin/server.py +6271 -0
package/server/bin/static/app-c45f0338184b.css +2 -0
package/server/bin/static/app-c45f0338184b.js +237 -0
package/server/bin/static/assets.json +5 -0
package/server/bin/static/geist-cyrillic-ext-wght-normal-RO72NYA2.woff2 +0 -0
package/server/bin/static/geist-cyrillic-wght-normal-CK2XY27K.woff2 +0 -0
package/server/bin/static/geist-latin-ext-wght-normal-XEQ56JUF.woff2 +0 -0
package/server/bin/static/geist-latin-wght-normal-T72VVCUW.woff2 +0 -0
package/server/bin/static/geist-mono-cyrillic-ext-wght-normal-QXKVIKFD.woff2 +0 -0
package/server/bin/static/geist-mono-cyrillic-wght-normal-GOIAQAGU.woff2 +0 -0
package/server/bin/static/geist-mono-latin-ext-wght-normal-HU3ZAWN6.woff2 +0 -0
package/server/bin/static/geist-mono-latin-wght-normal-CJNQKXUG.woff2 +0 -0
package/server/bin/static/geist-mono-symbols2-wght-normal-WZJJVLQO.woff2 +0 -0
package/server/bin/static/geist-mono-vietnamese-wght-normal-KW5NM6YV.woff2 +0 -0
package/server/bin/static/geist-vietnamese-wght-normal-Y2R7JZKV.woff2 +0 -0
package/server/bin/static/icons/apple-touch-icon.png +0 -0
package/server/bin/static/icons/icon-192.png +0 -0
package/server/bin/static/icons/icon-512.png +0 -0
package/server/bin/static/icons/maskable-192.png +0 -0
package/server/bin/static/icons/maskable-512.png +0 -0
package/server/bin/static/manifest.webmanifest +20 -0
package/server/bin/static/offline.html +28 -0
package/server/bin/static/sw.js +126 -0
package/server/skills/examples/deep-depth-domain-example.md +68 -0
package/server/skills/examples/team-default-domain-example.md +68 -0
package/server/skills/global-review.md +58 -0
package/server/skills/pr-qa-guide/SKILL.md +187 -0
package/server/skills/pr-qa-guide/template.html +489 -0
package/server/skills/pr-review/SKILL.md +129 -0
package/server/skills/repo-profile/SKILL.md +67 -0
package/server.js +140 -0
package/tools.js +147 -0
package/tools.json +30 -0
package/tunnel.js +157 -0

package/pages/preparing.html ADDED Viewed

@@ -0,0 +1,66 @@
+<!doctype html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8">
+<title>ReviewStage</title>
+<style>
+  :root { --paper:#0B0C10; --panel:#12141A; --ink:#ECEEF3; --graphite:#9AA0B4; --hairline:#22262F; --blue:#7A83FF; --red:#F0718A; --green:#3DD98F; --light: rgba(255,225,176,.17); }
+  html, body { height: 100%; margin: 0; background: var(--paper); color: var(--ink); font: 14px/1.5 "Geist Variable", system-ui, -apple-system, "Segoe UI", sans-serif; -webkit-app-region: drag; }
+  body { display: grid; place-items: center; }
+  .card { position: relative; width: min(440px, calc(100vw - 32px)); padding: 32px 28px 24px; border-radius: 12px; background: var(--panel); box-shadow: 0 24px 64px -24px rgba(0,0,0,.8); -webkit-app-region: no-drag; }
+  .card::before { content: ""; position: absolute; left: 50%; top: -46%; width: 120%; height: 112%; transform: translateX(-50%); border-radius: 50%; background: radial-gradient(60% 55% at 50% 0%, var(--light), transparent 70%); pointer-events: none; animation: breathe 8s ease-in-out infinite alternate; }
+  @keyframes breathe { from { opacity: .7 } to { opacity: 1 } }
+  @media (prefers-reduced-motion: reduce) { .card::before { animation: none } }
+  h1 { margin: 12px 0 2px; font-size: 24px; font-weight: 600; letter-spacing: -0.02em; text-align: center; }
+  .sub { margin: 0 0 20px; color: var(--graphite); text-align: center; }
+  .mark { display: block; width: 40px; height: 40px; margin: 0 auto; }
+  .step { display: flex; align-items: center; gap: 10px; padding: 8px 0; color: var(--graphite); }
+  .step[data-state="doing"] { color: var(--ink) }
+  .step[data-state="done"] .dot { background: var(--green) }
+  .step[data-state="doing"] .dot { background: var(--blue); animation: pulse 1.2s ease-in-out infinite }
+  .step[data-state="failed"] .dot { background: var(--red) }
+  .dot { width: 8px; height: 8px; border-radius: 999px; background: var(--hairline); flex: none }
+  @keyframes pulse { 50% { opacity: .35 } }
+  .bar { height: 3px; margin-top: 6px; background: var(--hairline); border-radius: 999px; overflow: hidden }
+  .bar i { display: block; height: 100%; width: 0; background: var(--blue); transition: width .2s }
+  .err { margin-top: 14px; padding: 10px 12px; border-radius: 8px; background: rgba(240,113,138,.12); color: var(--ink); font-size: 13px; white-space: pre-wrap; display: none }
+  .err code { font: 12px/1.5 "Geist Mono Variable", ui-monospace, Menlo, monospace }
+  .acts { display: none; margin-top: 14px; gap: 8px; justify-content: flex-end }
+  button { font: inherit; font-weight: 500; border: 0; border-radius: 8px; padding: 8px 14px; cursor: pointer; background: var(--blue); color: var(--paper) }
+  button.ghost { background: transparent; color: var(--graphite) }
+  .fine { margin-top: 18px; text-align: center; color: var(--graphite); font-size: 12px }
+</style>
+</head>
+<body>
+  <div class="card">
+    <svg class="mark" viewBox="0 0 48 48" aria-hidden="true"><path d="M8 10h12v28H8z" fill="#ECEEF3"/><path d="M22 14h6v24h-6z" fill="#3947FF"/><path d="M30 10h10v28H30z" fill="#ECEEF3" opacity=".85"/></svg>
+    <h1>ReviewStage</h1>
+    <p class="sub">Getting ready on this machine.</p>
+    <div id="steps">
+      <div class="step" data-id="tools"><i class="dot"></i><span>Review tools</span></div>
+      <div class="bar" id="bar" hidden><i id="fill"></i></div>
+      <div class="step" data-id="claude"><i class="dot"></i><span>Claude Code</span></div>
+      <div class="step" data-id="server"><i class="dot"></i><span>Starting the server</span></div>
+    </div>
+    <div class="err" id="err"></div>
+    <div class="acts" id="acts">
+      <button class="ghost" id="quit">Quit</button>
+      <button id="retry">Try again</button>
+    </div>
+    <p class="fine">Nothing posts to GitHub until you click.</p>
+  </div>
+  <script>
+    const $ = (s) => document.querySelector(s);
+    const set = (id, state, label) => { const el = $(`.step[data-id="${id}"]`); el.dataset.state = state; if (label) el.querySelector("span").textContent = label; };
+    window.reviewstage?.onProgress((p) => {
+      if (p.step) set(p.step, p.state, p.label);
+      if (typeof p.fraction === "number") { $("#bar").hidden = false; $("#fill").style.width = Math.round(p.fraction * 100) + "%"; }
+      if (p.fraction === 1) $("#bar").hidden = true;
+      if (p.error) { $("#err").style.display = "block"; $("#err").innerHTML = p.error; $("#acts").style.display = "flex"; }
+      if (p.clearError) { $("#err").style.display = "none"; $("#acts").style.display = "none"; }
+    });
+    $("#retry").onclick = () => window.reviewstage?.retry();
+    $("#quit").onclick = () => window.reviewstage?.quit();
+  </script>
+</body>
+</html>

package/preload.cjs ADDED Viewed

@@ -0,0 +1,15 @@
+// The only bridge between the pages this app owns (preparing, phone) and the main process.
+// The dashboard itself is a plain web page from the local server and gets no preload.
+const { contextBridge, ipcRenderer } = require("electron");
+contextBridge.exposeInMainWorld("reviewstage", {
+  onProgress: (fn) => ipcRenderer.on("progress", (_e, p) => fn(p)),
+  retry: () => ipcRenderer.send("retry"),
+  quit: () => ipcRenderer.send("quit"),
+  phone: {
+    enable: () => ipcRenderer.invoke("phone:enable"),
+    disable: () => ipcRenderer.invoke("phone:disable"),
+    status: () => ipcRenderer.invoke("phone:status"),
+    onData: (fn) => ipcRenderer.on("phone", (_e, p) => fn(p)),
+  },
+});

package/server/bin/bootstrap.sh ADDED Viewed

@@ -0,0 +1,318 @@
+#!/usr/bin/env bash
+# bootstrap.sh — install ReviewStage on a Linux server you control. Idempotent; safe to re-run.
+#
+#   git clone <this repo> ~/reviewstage
+#   ~/reviewstage/bin/bootstrap.sh
+#
+# On first run it writes ~/.reviewstage/.env, prompting for the per-install values (the repo
+# to review, your GitHub login, the public URL of the dashboard), and tells you to paste your
+# secrets. Then you re-run it and it finishes. See docs/SETUP.md.
+#
+# Everything lives under ~/.reviewstage, in $HOME — deliberately outside any directory a
+# deploy tool or sync job of yours might rsync over or delete. The only files written outside
+# $HOME are the systemd unit and, when you opt in with SETUP_APACHE=1, an Apache vhost that is
+# config-tested before it is enabled.
+set -euo pipefail
+SRC="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$HOME/.reviewstage"
+BIN="$ROOT/bin"
+# The account that owns the install. It must be the same account Claude Code is signed in as,
+# because `claude` reads its credentials from $HOME. Defaults to whoever is running this; set
+# RS_USER to guard against running it from the wrong shell by accident.
+RS_USER="${RS_USER:-$(id -un)}"
+[ "$(id -un)" = "$RS_USER" ] \
+  || { echo "Run as $RS_USER (sudo su - $RS_USER), not $(id -un)."; exit 1; }
+echo "==> directories"
+mkdir -p "$BIN" "$ROOT/wt" "$ROOT/state" "$ROOT/repos"
+chmod 700 "$ROOT"
+touch "$ROOT/seen" "$ROOT/used-nonces"
+# Teammates' encrypted tokens + Slack IDs, written by the dashboard on sign-in.
+[ -f "$ROOT/users.json" ] || echo '{}' > "$ROOT/users.json"
+chmod 600 "$ROOT/users.json"
+echo "==> .env"
+# Ensure every documented key EXISTS rather than only writing the file when it is absent.
+# A hand-made .env (secrets pasted in before the first bootstrap) previously ended up with no
+# DRY_RUN line at all, so the code fell back to its "1" default and the dashboard stayed in
+# dry run with no visible reason — sed found nothing to flip. Existing values are never
+# overwritten, so flipping DRY_RUN to 0 survives a re-run.
+touch "$ROOT/.env"; chmod 600 "$ROOT/.env"
+ensure_key() { grep -q "^$1=" "$ROOT/.env" || printf '%s=%s\n' "$1" "$2" >> "$ROOT/.env"; }
+# The per-install values. Prompt when we have a terminal; otherwise write them empty and let
+# the checks below (and require_env later) fail loudly, which beats guessing.
+ask() {
+  local key="$1" prompt="$2" default="${3:-}" val=""
+  grep -q "^$key=.\+" "$ROOT/.env" && return 0
+  if [ -t 0 ]; then read -rp "   $prompt${default:+ [$default]}: " val; fi
+  printf '%s=%s\n' "$key" "${val:-$default}" >> "$ROOT/.env"
+}
+ensure_key GITHUB_PAT ""
+ensure_key SLACK_WEBHOOK ""
+# Optional: a Slack bot token + channel enable threaded replies (review-ready threads under the
+# review-request card). Without them, Slack falls back to the webhook (a fresh message each time).
+ensure_key SLACK_BOT_TOKEN ""
+ensure_key SLACK_CHANNEL ""
+# The repositories to review. No default — every install names its own. REPO (single) is still
+# honoured as an alias, so an existing .env is not re-prompted.
+grep -q '^REPO=.\+' "$ROOT/.env" || ask REPOS "GitHub repositories to review (owner/name, comma-separated)"
+grep -Eq '^REPOS?=.+' "$ROOT/.env" \
+  || { echo "   !! REPOS is empty in $ROOT/.env — set it to owner/name[,owner/name…], then re-run"; exit 1; }
+# Optional: accept any repo under this org where a signed-in user gets a review request.
+ensure_key REPO_ALLOW_ORG ""
+ensure_key RS_SIGNATURE_GRACE_DAYS 7
+# Your GitHub login. The PAT must belong to this account — everything the dashboard posts is
+# attributed to it, which is the whole point of the design.
+ask REVIEWER "Your GitHub login"
+# Where browsers reach the dashboard: the hostname your reverse proxy forwards to the server.
+# Older installs may have RS_ENV + RS_DOMAIN instead; lib-common.sh still derives the
+# URL from that pair, so only prompt when neither form is present.
+if ! grep -q '^RS_ENV=.\+' "$ROOT/.env" || ! grep -q '^RS_DOMAIN=.\+' "$ROOT/.env"; then
+  ask PUBLIC_URL "Public URL of this dashboard (e.g. https://reviews.example.com)"
+  grep -q '^PUBLIC_URL=.\+' "$ROOT/.env" \
+    || { echo "   !! PUBLIC_URL is empty in $ROOT/.env — set it, then re-run"; exit 1; }
+fi
+# GitHub login. Empty = token sign-in only. See docs/SETUP.md "GitHub login".
+ensure_key GH_CLIENT_ID ""
+ensure_key GH_CLIENT_SECRET ""
+ensure_key GH_OAUTH_SCOPES ""
+# Device flow: "Sign in with GitHub" with no app registration (shared public client ID).
+ensure_key GH_DEVICE_FLOW 1
+ensure_key GH_DEVICE_CLIENT_ID ""
+ensure_key DRY_RUN 1
+ensure_key SKIP_BOT_PRS 0
+ensure_key RS_MAX_PR_AGE_DAYS 45
+ensure_key RISK_PATHS ""
+ensure_key RS_SECRET "$(openssl rand -hex 32)"
+grep -q '^GITHUB_PAT=.\+' "$ROOT/.env" \
+  || echo "   !! GITHUB_PAT is empty in $ROOT/.env — add it, then re-run"
+chmod 600 "$ROOT/.env"
+# Everything below reads the values just written. PUBLIC_URL may be derived from the legacy
+# pair, so let lib-common.sh do that rather than repeating the logic here.
+# shellcheck disable=SC1091
+. "$SRC/lib-common.sh"
+PORT="${RS_PORT:-8899}"
+PUBLIC_HOST="${PUBLIC_URL#*://}"; PUBLIC_HOST="${PUBLIC_HOST%%[/:]*}"
+echo "==> gh"
+if ! command -v gh >/dev/null; then
+  case "$(uname -m)" in aarch64|arm64) arch=arm64;; *) arch=amd64;; esac
+  v=$(curl -fsSL https://api.github.com/repos/cli/cli/releases/latest | jq -r .tag_name)
+  curl -fsSL "https://github.com/cli/cli/releases/download/$v/gh_${v#v}_linux_${arch}.tar.gz" \
+    | tar -xz -C /tmp
+  sudo install -m 0755 "/tmp/gh_${v#v}_linux_${arch}/bin/gh" /usr/local/bin/gh
+  echo "   installed gh $v ($arch)"
+fi
+echo "==> claude"
+if ! command -v claude >/dev/null; then
+  curl -fsSL https://claude.ai/install.sh | bash \
+    || sudo npm install -g @anthropic-ai/claude-code
+  echo "   installed claude — sign in AS $RS_USER before the first review"
+fi
+echo "==> scripts"
+# Bootstrap copies itself into $BIN, so it can also be re-run FROM $BIN. Installing a file
+# onto itself makes `install` fail, and with `set -e` that aborted the run before the systemd
+# and proxy steps ever executed — silently skipping the parts you were re-running it for.
+if [ "$SRC" != "$BIN" ]; then
+  install -m 0755 "$SRC"/{pr-watch.sh,run-review.sh,run-qa.sh,bootstrap.sh} "$BIN/"
+  install -m 0755 "$SRC/server.py" "$BIN/"
+  install -m 0644 "$SRC"/rs_diff.py "$BIN/"   # imported by the server, must sit beside it
+  install -m 0644 "$SRC"/rs_md.py "$BIN/"
+  install -m 0644 "$SRC"/rs_assets.py "$BIN/"   # inlined brand logo + favicon
+  install -m 0644 "$SRC"/rs_learn.py "$BIN/"    # learnings loop (imported + run by shell)
+  install -m 0644 "$SRC"/rs_agree.py "$BIN/"    # convergence scoring, imported by the server
+  install -m 0644 "$SRC"/rs_rollup.py "$BIN/"   # insights rollup, imported by the server
+  install -m 0644 "$SRC/lib-common.sh" "$BIN/"
+else
+  echo "   (running from $BIN — nothing to copy)"
+fi
+echo "==> node + pnpm"
+# The dashboard UI is a React + TypeScript app bundled by esbuild. The server builds it from
+# source at install time (no build artifacts are committed). esbuild is low-memory, so a small
+# VM handles it fine. pnpm is installed via npm since the repo pins no packageManager field.
+if ! command -v node >/dev/null 2>&1    || [ "$(node -v 2>/dev/null | sed 's/^v//;s/\..*//')" -lt 18 ]; then
+  curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
+  sudo apt-get install -y nodejs
+  echo "   installed node $(node -v)"
+fi
+if ! command -v pnpm >/dev/null 2>&1; then
+  sudo npm install -g pnpm
+  echo "   installed pnpm $(pnpm -v)"
+fi
+echo "==> dashboard-ui build"
+# The build writes the fingerprinted bundle (app-<hash>.js/.css plus assets.json naming them)
+# to ../bin/static, i.e. $SRC/static. The server reads its bundle from $BIN/static, so copy the
+# freshly built files across after the build — and clear the old fingerprinted pair first, or
+# every upgrade leaves another dead copy of the bundle behind.
+UI="$SRC/../dashboard-ui"
+if [ -d "$UI" ]; then
+  ( cd "$UI" && pnpm install --frozen-lockfile && pnpm build )
+  # Replace the directory rather than copying into it: the bundle is fingerprinted, so an
+  # in-place copy leaves every previous release's app-<hash>.* behind for ever. This also
+  # unbreaks the copy itself — it used `install "$SRC/static/"*`, which under `set -e` aborted
+  # bootstrap the moment the PWA build started emitting a static/icons/ subdirectory.
+  rm -rf "$BIN/static"
+  mkdir -p "$BIN/static"
+  cp -R "$SRC/static/." "$BIN/static/"
+  chmod -R a+rX "$BIN/static"
+  echo "   built SPA bundle -> $BIN/static ($(ls -1 "$BIN/static" | tr '\n' ' '))"
+else
+  echo "   !! dashboard-ui not found at $UI — the SPA will not load (set RS_SPA=0 to fall"
+  echo "      back to the legacy HTML UI); build it and re-run bootstrap"
+fi
+echo "==> base clones (one per repo, under $ROOT/repos)"
+if [ -z "${GITHUB_PAT:-}" ]; then
+  # The documented flow is: bootstrap (writes .env) -> you paste the secrets -> re-run.
+  # Aborting here on the first run would strand that flow before systemd/proxy/cron ever
+  # got configured, so skip the clone and let the re-run pick it up.
+  echo "   skipped — GITHUB_PAT is empty; re-run bootstrap once it is set"
+elif [ -d "$ROOT/repo/.git" ] && [ ! -f "$ROOT/MIGRATED" ]; then
+  echo "   legacy clone at $ROOT/repo — the server moves it into $ROOT/repos on its next start"
+else
+  for repo in $(printf '%s %s' "${REPOS:-}" "${REPO:-}" | tr ',' ' ' | tr -s '[:space:]' '\n' | awk 'NF && !s[tolower($0)]++'); do
+    base="$ROOT/repos/${repo/\//__}"
+    [ -d "$base/.git" ] || GH_TOKEN="$GITHUB_PAT" gh repo clone "$repo" "$base" -- --filter=blob:none
+    [ -d "$base/.git" ] && git -C "$base" config credential.helper \
+      '!f() { echo username=x-access-token; echo "password=$GH_TOKEN"; }; f'
+  done
+fi
+echo "==> pr-review skill"
+mkdir -p "$HOME/.claude/skills"
+# The skill ships in this repo. The agent runs with the PR worktree as its cwd, so a
+# project-level copy would not be found — it has to be installed at the user level.
+cp -r "$SRC/../skills/pr-review" "$HOME/.claude/skills/" 2>/dev/null \
+  || echo "   !! skills/pr-review not found next to $SRC — reviews will run without it"
+cp -r "$SRC/../skills/pr-qa-guide" "$HOME/.claude/skills/" 2>/dev/null \
+  || echo "   !! skills/pr-qa-guide not found next to $SRC — QA guides will run without it"
+# Editable team-default review skill. Seed $ROOT/skills/_global.md on first install so it shows
+# real content and is editable from the dashboard; never overwrite once it exists (it's edited live).
+mkdir -p "$ROOT/skills"
+if [ ! -f "$ROOT/skills/_global.md" ] && [ -f "$SRC/../skills/global-review.md" ]; then
+  install -m 0644 "$SRC/../skills/global-review.md" "$ROOT/skills/_global.md"
+  echo "   seeded team-default skill (_global.md)"
+fi
+echo "==> systemd unit"
+sudo tee /etc/systemd/system/reviewstage.service >/dev/null <<EOF
+[Unit]
+Description=ReviewStage dashboard
+After=network.target
+[Service]
+User=$RS_USER
+Environment=RS_PORT=$PORT
+# run-review.sh is spawned from this service and shells out to \`claude\`, which the native
+# installer puts in ~/.local/bin — not on systemd's default PATH. Without this the agent
+# step fails as "command not found" and surfaces only as an empty review.json.
+Environment=PATH=$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin
+ExecStart=/usr/bin/python3 $BIN/server.py
+# Only kill the server itself on stop. The default (control-group) reaps every process in
+# the cgroup — including the detached run-review.sh a click spawned — so redeploying while a
+# review was running silently killed it and left the PR stuck reading "reviewing".
+KillMode=process
+Restart=always
+RestartSec=5
+[Install]
+WantedBy=multi-user.target
+EOF
+sudo systemctl daemon-reload
+sudo systemctl enable reviewstage.service
+# restart, not `enable --now`: the server reads .env once at startup, so an already-running
+# instance would keep serving stale secrets and a stale DRY_RUN after you edit them.
+sudo systemctl restart reviewstage.service
+echo "==> reverse proxy"
+# The server binds 127.0.0.1:$PORT only. Something you run must terminate TLS on $PUBLIC_HOST
+# and forward to it — any reverse proxy will do. This step is OPTIONAL and only runs when you
+# opt in with SETUP_APACHE=1: it writes a name-based Apache vhost for $PUBLIC_HOST that proxies
+# to the server, config-tests it, and disables it again if anything is off, so an existing
+# Apache on the box is never left broken. Without SETUP_APACHE it prints what to configure.
+if [ "${SETUP_APACHE:-0}" = 1 ]; then
+  [ -n "$PUBLIC_HOST" ] || { echo "   !! PUBLIC_URL has no hostname — fix .env, then re-run"; exit 1; }
+  # Extra hostnames that should also reach this instance (comma-separated in .env), e.g. an
+  # old name kept alive so already-sent links keep resolving.
+  aliases=$(printf '%s' "${RS_HOST_ALIASES:-}" | tr ',' ' ' | xargs || true)
+  alias_line=""
+  for a in $aliases; do [ "$a" = "$PUBLIC_HOST" ] || alias_line+="    ServerAlias $a"$'\n'; done
+  sudo a2enmod proxy proxy_http >/dev/null
+  sudo tee /etc/apache2/sites-available/reviewstage.conf >/dev/null <<EOF
+<VirtualHost *:80>
+    ServerName $PUBLIC_HOST
+${alias_line}    ProxyPreserveHost On
+    # The app is served at the site root.
+    ProxyPass        / http://127.0.0.1:$PORT/
+    ProxyPassReverse / http://127.0.0.1:$PORT/
+    ErrorLog \${APACHE_LOG_DIR}/reviewstage-error.log
+    CustomLog \${APACHE_LOG_DIR}/reviewstage-access.log combined
+</VirtualHost>
+EOF
+  sudo a2ensite reviewstage >/dev/null
+  if ! sudo apache2ctl configtest 2>&1 | grep -q "Syntax OK"; then
+    sudo a2dissite reviewstage >/dev/null
+    echo "   !! apache configtest FAILED — vhost disabled, nothing else touched"; exit 1
+  fi
+  # Verify functionally, by asking the endpoint through the vhost. A graceful reload is enough
+  # to pick up new LoadModule lines in practice; the restart stays only as a genuine fallback.
+  reviewstage_reachable() {
+    [ "$(curl -s -m 5 -H "Host: $PUBLIC_HOST" http://127.0.0.1/health 2>/dev/null)" = "ok" ]
+  }
+  sudo systemctl reload apache2
+  sleep 1
+  if ! reviewstage_reachable; then
+    echo "   endpoint not reachable after reload — restarting apache"
+    sudo systemctl restart apache2
+    sleep 2
+  fi
+  if reviewstage_reachable; then
+    echo "   apache ok (answers on $PUBLIC_HOST)"
+  else
+    sudo a2dissite reviewstage >/dev/null && sudo systemctl reload apache2
+    echo "   !! endpoint unreachable — vhost disabled, nothing else touched"; exit 1
+  fi
+else
+  echo "   skipped (set SETUP_APACHE=1 to write an Apache vhost). Point your reverse proxy at"
+  echo "   http://127.0.0.1:$PORT for $PUBLIC_HOST with TLS in front. nginx example:"
+  echo "     location / { proxy_pass http://127.0.0.1:$PORT; proxy_set_header Host \$host; }"
+fi
+echo "==> cron"
+# Strip BOTH of our lines before re-adding, or each bootstrap run leaves another PATH=
+# line behind. The PATH line cannot carry a trailing marker comment — cron would read the
+# comment as part of the value — so it is matched literally instead.
+cron_path="PATH=/usr/local/bin:/usr/bin:/bin:$HOME/.local/bin"
+tmp=$(mktemp)
+crontab -l 2>/dev/null | grep -vF "$cron_path" | grep -v 'pr-watch.sh' > "$tmp" || true
+{
+  echo "$cron_path"
+  echo "*/3 * * * * flock -n /tmp/pr-watch.lock $BIN/pr-watch.sh >> $ROOT/watch.log 2>&1"
+} >> "$tmp"
+crontab "$tmp"; rm -f "$tmp"
+echo
+echo "Done. Checks:"
+echo "  curl -s localhost:$PORT/health                # -> ok"
+echo "  curl -s $PUBLIC_URL/health                     # -> ok (through your reverse proxy)"
+echo "  $BIN/pr-watch.sh                              # -> Slack card per open request"
+echo
+echo "Sign in (you and every teammate):  $PUBLIC_URL/login"
+echo "  Each person signs in with GitHub (or pastes their own PAT) + Slack member ID once."
+echo "  Each reviewer runs their own review; posting and approving happen as each signed-in user."
+echo
+# Report the ACTUAL value, never a hardcoded assumption — a stale "nothing is written"
+# reassurance is worse than none once someone has flipped it.
+if grep -q '^DRY_RUN=0' "$ROOT/.env"; then
+  echo "DRY_RUN=0 — the dashboard POSTS AND APPROVES ON GITHUB for real, as $(grep '^REVIEWER=' "$ROOT/.env" | cut -d= -f2)."
+else
+  echo "DRY_RUN=1 — reviews run and Slack reports them, but GitHub is never written."
+fi

package/server/bin/demo-fixture.py ADDED Viewed

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""demo-fixture.py ROOT [PORT] — build the offline demo data set and print a sign-in link.
+A Python port of dashboard-ui/e2e/fixture.ts (the Playwright fixture): a .env with a dummy
+service token and TWO demo repositories, one demo user, a queue spanning both repos with
+finished reviews on disk, and a fake `gh` that fails every call so the server renders from the
+on-disk state and nothing ever reaches GitHub. Playwright signs in by injecting a cookie; here
+the server's own /handoff/accept route mints the session instead, from a link signed with the
+fixture's RS_SECRET.
+"""
+import hmac
+import json
+import os
+import secrets
+import stat
+import sys
+import time
+from hashlib import sha256
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).resolve().parent))   # rs_profile lives beside us
+USER = "demo-reviewer"
+REPO = "reviewstage/demo-repo"          # the web app
+REPO2 = "reviewstage/demo-api"          # a second repo, so the UI shows the repo dimension
+PR, PR2 = 101, 102                      # in REPO
+PR3 = 7                                 # in REPO2
+def slug(repo):
+    return repo.replace("/", "__", 1)
+def write(path: Path, body: str):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(body)
+def row(repo, num, title, adds, dels, files, head, created, updated):
+    return {"repo": repo, "number": num, "title": title,
+            "url": f"https://github.com/{repo}/pull/{num}", "additions": adds,
+            "deletions": dels, "changedFiles": files, "requested": [USER],
+            "author": "teammate", "isBot": False, "isDraft": False, "head": head,
+            "createdAt": created, "updatedAt": updated}
+def main():
+    root = Path(sys.argv[1] if len(sys.argv) > 1 else os.environ.get("ROOT", "~/.reviewstage"))
+    root = root.expanduser()
+    port = sys.argv[2] if len(sys.argv) > 2 else "8899"
+    root.mkdir(parents=True, exist_ok=True)
+    # Keep an existing secret so a restart does not invalidate the link printed last time.
+    env_f = root / ".env"
+    secret = ""
+    if env_f.exists():
+        for line in env_f.read_text().splitlines():
+            if line.startswith("RS_SECRET="):
+                secret = line.split("=", 1)[1].strip()
+    secret = secret or secrets.token_hex(32)
+    write(env_f, "\n".join([
+        f"RS_SECRET={secret}",
+        f"REVIEWER={USER}",
+        f"REPOS={REPO},{REPO2}",
+        "DRY_RUN=1",
+        f"PUBLIC_URL=http://localhost:{port}",
+        "GITHUB_PAT=ghp_demo_dummy_never_used",
+        "GH_DEVICE_FLOW=0",  # the demo never reaches GitHub
+    ]) + "\n")
+    env_f.chmod(0o600)
+    write(root / "users.json", json.dumps({
+        USER: {"name": "Demo Reviewer", "slack_id": "", "added": 1, "updated": 1}}))
+    (root / "users.json").chmod(0o600)
+    for name in ("seen", "used-nonces"):
+        (root / name).touch()
+    (root / "state").mkdir(exist_ok=True)
+    # A fresh fixture is already in the per-repo layout — nothing to migrate.
+    (root / "MIGRATED").write_text(json.dumps({"at": int(time.time()), "note": "demo"}) + "\n")
+    write(root / "queue.json", json.dumps([
+        row(REPO, PR, "Add lead-time badge to product cards", 42, 8, 5, "deadbeefcafe",
+            "2026-05-01T10:00:00Z", "2026-05-02T10:00:00Z"),
+        row(REPO, PR2, "Cache vendor lead times", 12, 3, 2, "feedfacecafe",
+            "2026-05-03T10:00:00Z", "2026-05-04T10:00:00Z"),
+        row(REPO2, PR3, "Rate-limit the lead-time endpoint", 30, 4, 3, "0badf00dcafe",
+            "2026-05-05T10:00:00Z", "2026-05-06T10:00:00Z"),
+    ]))
+    st = root / "state"
+    write(st / slug(REPO) / str(PR2) / "status", "done")
+    write(st / slug(REPO) / str(PR2) / "review.json", json.dumps({
+        "event": "COMMENT", "summary": "Caches vendor lead times. Looks fine.",
+        "keyPoints": ["A small, well-scoped cache.", "No blockers."],
+        "explainer": "- Adds a per-vendor cache for lead times.",
+        "analysis": "- Checked cache invalidation on vendor update.", "comments": []}))
+    write(st / slug(REPO) / str(PR) / "status", "done")
+    write(st / slug(REPO) / str(PR) / "review.json", json.dumps({
+        "event": "COMMENT",
+        "summary": "Adds a lead-time badge to product cards. Logic is sound; two small things.",
+        "keyPoints": [
+            "The badge logic is sound — no blockers.",
+            "Guard a null vendor before reading its lead time.",
+            "One nit: prefer const over let in the badge component."],
+        "explainer": "- Shows a lead-time badge on each product card.\n"
+                     "- Reads the lead time from the product's vendor.",
+        "analysis": "- Verified the badge renders for products with and without a vendor.\n"
+                    "- Skipped: styling and i18n.",
+        "comments": [
+            {"path": "app/models/Product.php", "line": 42, "severity": "should-fix",
+             "title": "A product with no vendor can crash the lead-time badge",
+             "impact": "A shopper viewing such a product sees the card fail instead of loading.",
+             "body": "Guard against a null vendor before reading its lead time.",
+             "reply_to": None, "suggestion": "if ($vendor === null) return null;",
+             "confidence": "high"},
+            {"path": "src/javascripts/Badge.tsx", "line": 10, "severity": "nit",
+             "title": "Use const instead of let", "impact": "Style only — no effect on behavior.",
+             "body": "Prefer `const` over `let` here.", "reply_to": None, "suggestion": "",
+             "confidence": "medium"}]}))
+    write(st / slug(REPO2) / str(PR3) / "status", "done")
+    write(st / slug(REPO2) / str(PR3) / "review.json", json.dumps({
+        "event": "COMMENT",
+        "summary": "Adds a token bucket in front of the lead-time endpoint. One blocker.",
+        "keyPoints": ["The limiter key ignores the tenant, so one tenant can starve another."],
+        "explainer": "- Rate-limits GET /lead-times per API key.",
+        "analysis": "- Traced the limiter key from the request to the store.",
+        "comments": [
+            {"path": "api/limits.py", "line": 18, "severity": "blocker",
+             "title": "Two tenants share one rate-limit bucket",
+             "impact": "A busy tenant can lock a quiet tenant out of lead times entirely.",
+             "body": "Key the bucket on (tenant, api_key), not api_key alone.",
+             "reply_to": None, "suggestion": "key = f\"{tenant}:{api_key}\"",
+             "confidence": "high"}]}))
+    # A repository profile for REPO, so the Skills page shows the "Repository profile" section
+    # as profiled; REPO2's last run failed, so the page shows the error state (the failure text,
+    # the log tail, Retry). Mirrors dashboard-ui/e2e/fixture.ts.
+    import rs_profile
+    prof = {
+        "summary": "A storefront: product cards read vendor lead times; payments and auth are "
+                   "the sharp edges.",
+        "critical_paths": [
+            {"path_glob": "app/payments/**",
+             "why": "Charges real cards; a silent bug double-bills or under-bills a shopper.",
+             "checks": ["Every amount is in minor units end to end",
+                        "Refund paths mirror the charge path"]},
+            {"path_glob": "app/models/Product.php",
+             "why": "Every product card and order line reads this model.",
+             "checks": ["Callers handle a null vendor",
+                        "Lead-time cache is invalidated on vendor change"]}],
+        "risk_paths": [{"label": "payments", "pattern": "app/payments/"},
+                       {"label": "auth", "pattern": "app/auth/"}],
+        "review_rules": ["Money is always integer cents; flag any float arithmetic on amounts."],
+        "do_not_flag": ["The committed pnpm-lock.yaml is intentional."],
+        "meta": {"generated_at": 1778000000, "model": "claude-sonnet-4-5",
+                 "dropped_globs": ["app/billing/**"], "head": "deadbeefcafe0000",
+                 "edited_at": None, "edited_by": ""}}
+    pdir = root / "profiles" / slug(REPO)
+    write(pdir / "profile.json", json.dumps(prof, indent=1) + "\n")
+    write(pdir / "profile.md", rs_profile.to_markdown(prof))
+    write(pdir / "status", "done")
+    write(pdir / "runner", USER)
+    write(pdir / "usage.json", json.dumps({
+        "model": "claude-sonnet-4-5", "input_tokens": 9120, "output_tokens": 1840,
+        "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0, "cost_usd": 0.055,
+        "duration_ms": 48000}))
+    pdir2 = root / "profiles" / slug(REPO2)
+    write(pdir2 / "status", "failed: the model produced no result (see "
+                            f"{pdir2 / 'agent.log'})")
+    write(pdir2 / "agent.log", "error: unknown option '---'\n\n(Did you mean --add-dir?)\n")
+    # Fake gh: every call fails, so the server falls back to the on-disk fixture.
+    gh = root / "fakebin" / "gh"
+    write(gh, "#!/bin/sh\nexit 1\n")
+    gh.chmod(gh.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    exp = int(time.time()) + 7 * 24 * 3600
+    sig = hmac.new(secret.encode(), f"handoff:{USER}:{exp}".encode(), sha256).hexdigest()
+    print("==> ReviewStage DEMO — offline fixture, nothing reaches GitHub or Claude")
+    print(f"    repos: {REPO}, {REPO2}")
+    print(f"    sign in here: http://localhost:{port}/handoff/accept?login={USER}&exp={exp}&sig={sig}")
+    print("    (the login form is disabled in demo mode — use the link above)", flush=True)
+if __name__ == "__main__":
+    main()