feat(ui): audit feed / skipped-PR viewer by kiannidev · Pull Request #831 · JSONbored/loopover

kiannidev · 2026-06-17T15:13:53Z

Summary

Adds /app/audit — filterable skipped-PR audit trail (reason, repo, PR, time, remediation)
Introduces reusable AuditFeed component (audit-feed.tsx + audit-feed-model.ts) for later agent-layer automation UI (feat(agent): automation controls surface (dashboard + CLI + MCP) #784)
Sidebar Skip audit nav + command palette entry for maintainer / owner / operator roles

Issue

Fixes #792

API

Consumes existing GET /v1/app/skipped-pr-audit (no backend changes).

Validation

npm --workspace @jsonbored/gittensory-ui run test
npm run ui:lint
npm run ui:typecheck
npm run ui:build

Test plan

Sign in as operator → /app/audit loads seeded skip rows
Filter by reason (bot_author, surface_off, etc.)
Apply repository + since filters
Empty state when no skip events
Miner-only session → maintainer access required state
Error state on forbidden repo filter (403)

Screenshots

Wire the existing skipped-pr-audit API into a filterable maintainer-facing audit page and reusable audit-feed component for later automation surfaces. Fixes JSONbored#792 Co-authored-by: Cursor <cursoragent@cursor.com>

ghost · 2026-06-17T15:14:27Z

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#831 is no longer open.	No action.

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

superagent-security · 2026-06-17T15:14:44Z

Superagent didn't find any vulnerabilities or security issues in this PR.

ghost · 2026-06-17T15:16:09Z

gittensory · advisory review

Reviewed 7 changed file(s) — two independent AI reviewers.

Changed files: apps/gittensory-ui/src/components/site/app-shell.tsx, apps/gittensory-ui/src/components/site/audit-feed-model.ts, apps/gittensory-ui/src/components/site/audit-feed.test.tsx, apps/gittensory-ui/src/components/site/audit-feed.tsx, apps/gittensory-ui/src/components/site/command-palette.tsx, apps/gittensory-ui/src/routeTree.gen.ts, apps/gittensory-ui/src/routes/app.audit.tsx

Suggested action: 🔍 Manual review. The changed route's preview could not be captured — review the rendered page manually before merging.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds a new "Skipped PR audit" feature: model helpers, a filterable feed component, a dedicated route, navigation entries, and comprehensive tests. The implementation respects role gating, private‑API boundaries, and uses safe URL handling.

Suggestions

Consider tightening the reason field in SkippedPrAuditItem to SkippedPrAuditReason for stronger type safety.
Verify that the ScrollText icon is exported by lucide-react; if not, replace with an existing icon to avoid build errors.
Add a simple accessibility test (e.g., ensure the table has proper ARIA roles) to maintain UI standards.

Worth double-checking

Missing or mismatched icon import could cause a compile failure.
If the route registration in routeTree.gen.ts is out of sync with the actual file path, navigation may break.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
This PR adds a new audit feed feature for viewing skipped PR events, including a dedicated route (/app/audit), UI component with filtering, and model utilities. The implementation correctly enforces role-based access (maintainer/owner/operator only), adheres to the public/private boundary by keeping audit details in a protected surface, and includes comprehensive unit tests. The code follows project conventions with proper TypeScript typing, reusable components, and careful state management.

Suggestions

Consider adding a element to the audit table for improved screen reader accessibility.
The loadMore function could prevent multiple rapid clicks by disabling the button during the request (though current implementation is acceptable).
Ensure the ScrollText icon used in navigation is properly imported and available in the lucide-react set (appears correct).

Worth double-checking

Verify backend endpoint /v1/app/skipped-pr-audit enforces the same role protection as the UI route (though UI guard is primary defense).
Check that normalizeSinceInput handles all edge cases of datetime-local input values across browsers (tested in unit tests).
Confirm that SKIP_REASON_OPTIONS matches all possible reason values from the backend to avoid UI mismatches.

Warning

Could not capture a preview of the changed route(s) — review the rendered page manually before merging.

Before = production · After = this PR's preview deploy.

Route	Viewport	Before	After
`/app/audit`	desktop
	mobile

Phase 3 (#784) MCP slice: `gittensory_get_automation_state(owner, repo)` surfaces a repo's agent automation posture for a maintainer's harness — the per-action autonomy levels, kill-switch / dry-run mode, GitHub write-permission readiness, the acting action classes, and the COUNT of auto_with_approval actions awaiting a decision. Repo-access scoped (consistent with gittensory_get_repo_context). Deliberately read-only and count-only: the full approval queue + accept/reject stay behind the maintainer-authed REST API (#779) and the dashboard/CLI surfaces, so the MCP tool never leaks the queue's action details. Does NOT close #784 — the dashboard slice is in flight via a contributor PR (#831), and the CLI `maintain` slice + the MCP accept/reject write path remain. Tests: a configured repo (autonomy, dry-run mode, write-ready, pending count) and an unknown/un-onboarded repo (unconfigured, not_required, no installation). New code 100% covered; MCP discovery/output-schema meta-tests green; full suite green (2120).

…/pause/resume (advances #784) Phase 3 (#784) CLI slice: a `gittensory-mcp maintain` command for the agent auto-maintain layer, thin-proxying the existing maintainer APIs (the API enforces authorization; the CLI never decides locally): - maintain status --repo o/r -> GET the agent approval queue (#779) - maintain approve <id> --repo -> POST .../accept (execute the staged action) - maintain reject <id> --repo -> POST .../reject (cancel it) - maintain pause|resume --repo -> PUT settings { agentPaused } (kill-switch, #130) The CLI exposes approve|reject; it maps to the route's accept|reject decision verb. --json for machine output. Wired into the command dispatch + completion registry + a maintain help command. This is one incremental slice of #784 (the CLI deliverable) — the issue stays open; the dashboard slice is in flight via contributor PR #831, the MCP read tool is a separate PR. Tests: status (plain + json), approve/reject, pause/resume, input validation (--repo required, id required for approve, unknown subcommand), and help. Fixture server gains the queue + settings endpoints. Full suite green (2123).

…surfaces (#854) Completes the CLI (maintain set-level) + MCP (propose-action, maintainer-gated) control surfaces of #784. The dashboard approval-queue panel stays with contributor PR #831; #784 remains open for it.

superagent-security · 2026-06-18T05:18:49Z

⚠️ Contributor trust inconclusive. Click here for more info: Superagent Dashboard

JSONbored

Good:

Useful private audit-feed UI for skipped PR/public-surface decisions.
Route/nav integration and role boundary are sensible.
UI build/validate pass.

Bad:

Invalid sinceInput crashes before validation: new Date(sinceInput).toISOString() throws RangeError.
Tests miss the reviewer-requested invalid-date path, enabled=false, load-more/max-limit, and malformed API cases.
Current checks are mostly UI-focused/skipped for broader suites, so coverage confidence is thin.

Change requests:

Validate sinceInput before toISOString; never throw from Apply Filters.
Add tests for invalid since, enabled=false, load more/max limit, and malformed/empty API response.

Validate since input before ISO conversion so Apply Filters never throws, normalize malformed skipped-pr-audit payloads, and add tests for invalid dates, disabled feed, load-more cap, and bad API responses. Addresses review on JSONbored#831. Co-authored-by: Cursor <cursoragent@cursor.com>

kiannidev · 2026-06-18T14:19:33Z

@JSONbored
I addressed feedback.
Please review PR again.

JSONbored

PR #831 — feat(ui): audit feed / skipped-PR viewer [kiannidev]
Action: APPROVE
Issue #792: FULLY CI: pass
Good:

normalizeSinceInput now guards Date.parse + try/catches toISOString — the RangeError crash the
maintainer flagged is fixed; applyFilters can no longer throw.
Tests now cover the previously-missing paths: invalid since, enabled=false, load-more/max-limit,
malformed/empty API response. Wired to the real /v1/app/skipped-pr-audit endpoint (verified on main).

feat(ui): add skipped-PR audit feed at /app/audit

7fc85a1

Wire the existing skipped-pr-audit API into a filterable maintainer-facing audit page and reusable audit-feed component for later automation surfaces. Fixes JSONbored#792 Co-authored-by: Cursor <cursoragent@cursor.com>

kiannidev requested a review from JSONbored as a code owner June 17, 2026 15:13

dosubot Bot added the size:L label Jun 17, 2026

ghost added the gittensory:reviewed label Jun 17, 2026

github-actions Bot deployed to preview/pr-831 June 17, 2026 15:15 View deployment

This was referenced Jun 17, 2026

feat(scoring): act on unmodeled-constant drift (Fixes #811) #832

Merged

feat(github-app): reviewer-routing auto_request action #833

Closed

JSONbored assigned kiannidev Jun 17, 2026

JSONbored added the gittensor:feature Gittensor-scored feature linked to a feature issue — scores a 0.25x multiplier. label Jun 17, 2026

ghost mentioned this pull request Jun 17, 2026

fix(crypto): reject malformed hex in timingSafeEqualHex #661

Closed

1 task

Merge branch 'main' into feat/issue-792-audit-feed

37d7f53

This was referenced Jun 17, 2026

feat(advisor): planning advisor with severity taxonomy, opportunity factors, and eligibility-gap view #834

Closed

feat(scoring): wire issue-discovery/issue-spam scoring constants into engine #835

Merged

github-actions Bot deployed to preview/pr-831 June 17, 2026 20:59 View deployment

This was referenced Jun 18, 2026

feat(agent): MCP automation-state read tool (advances #784) #851

Merged

feat(agent): maintainer CLI controls — maintain status/approve/reject/pause/resume (advances #784) #852

Merged

JSONbored mentioned this pull request Jun 18, 2026

feat(agent): automation controls surface (dashboard + CLI + MCP) #784

Closed

3 tasks

This was referenced Jun 18, 2026

feat(ui): render the authenticated /app/* UI in PR previews (preview-session escape hatch) (#authed-route-preview) #853

Merged

feat(agent): CLI set-level + MCP propose-action — finish the non-dashboard #784 surfaces #854

Merged

Merge branch 'main' into feat/issue-792-audit-feed

a76da87

github-actions Bot deployed to preview/pr-831 June 18, 2026 05:17 View deployment

Merge branch 'main' into feat/issue-792-audit-feed

940c076

github-actions Bot deployed to preview/pr-831 June 18, 2026 06:08 View deployment

JSONbored requested changes Jun 18, 2026

View reviewed changes

dosubot Bot added size:XL and removed size:L labels Jun 18, 2026

github-actions Bot deployed to preview/pr-831 June 18, 2026 14:14 View deployment

kiannidev requested a review from JSONbored June 18, 2026 14:19

Merge branch 'main' into feat/issue-792-audit-feed

20722f3

github-actions Bot deployed to preview/pr-831 June 18, 2026 23:08 View deployment

JSONbored approved these changes Jun 18, 2026

View reviewed changes

dosubot Bot added the lgtm label Jun 18, 2026

JSONbored merged commit e879ffa into JSONbored:main Jun 18, 2026
15 checks passed

Navigation Menu

Uh oh!

feat(ui): audit feed / skipped-PR viewer - #831

feat(ui): audit feed / skipped-PR viewer#831
JSONbored merged 6 commits into
JSONbored:mainfrom
kiannidev:feat/issue-792-audit-feed

kiannidev commented Jun 17, 2026 •

edited

Loading

Uh oh!

ghost commented Jun 17, 2026 •

edited by ghost

Loading

Gittensory Gate skipped

Uh oh!

superagent-security Bot commented Jun 17, 2026

Uh oh!

ghost commented Jun 17, 2026 •

edited by ghost

Loading

Uh oh!

superagent-security Bot commented Jun 18, 2026

Uh oh!

JSONbored left a comment

Uh oh!

kiannidev commented Jun 18, 2026

Uh oh!

JSONbored left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kiannidev commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issue

API

Validation

Test plan

Screenshots

Uh oh!

ghost commented Jun 17, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Gittensory Gate skipped

Uh oh!

superagent-security Bot commented Jun 17, 2026

Uh oh!

ghost commented Jun 17, 2026 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

superagent-security Bot commented Jun 18, 2026

Uh oh!

JSONbored left a comment

Choose a reason for hiding this comment

Uh oh!

kiannidev commented Jun 18, 2026

Uh oh!

JSONbored left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kiannidev commented Jun 17, 2026 •

edited

Loading

ghost commented Jun 17, 2026 •

edited by ghost

Loading

ghost commented Jun 17, 2026 •

edited by ghost

Loading