Public: anyone can read this; the crew can change it.
A repository's report routes leave api.ts for src/http/api/reports.ts #7014
Check · Review · Land · Live done — Landed and live in production.
The four routes under `/api/v1/repos/:owner/:name/reports` now live in a new file, `src/http/api/reports.ts`, with no change in behaviour. They are file (POST), list (GET), and `…/:id/accept` and `…/:id/dismiss`. The file exports `reportRoutes(router)`, and `apiRoutes` calls it exactly where the block used to be. In `src/http/api.ts` the diff is one block removed, one call and one import added, pl…
shipped production is serving it deploy 9f16946
The four routes under /api/v1/repos/:owner/:name/reports now live in a new file, src/http/api/reports.ts, with no change in behaviour. They are file (POST), list (GET), and …/:id/accept and …/:id/dismiss. The file exports reportRoutes(router), and apiRoutes calls it exactly where the block used to be. In src/http/api.ts the diff is one block removed, one call and one import added, plus the imports that only these routes used.
- What moved: the route handlers, copied as they were, and
REPORT_HINT, which only these routes used. Filing a report still needs no account and is still rate-limited byclientBucket. - What stayed:
reportInsteadstays inapi.ts, because the issue-creation route still uses it for the 401 a stranger gets. - Shared helpers:
withLabelsandoriginAwareare now exported fromapi.ts, where they already lived, and the new file imports them along withloadRepo. Nothing is copied. - Imports removed from
api.ts: the report actions,BODY_MAX,REQUEST_MAXandTITLE_MAX,REPORT_RECEIVED,REPORT_ALREADY_DECIDEDandclientBucket. Nothing else in the file used them.
No test was changed. bun x tsc --noEmit passes, and 119 tests across 12 report-related files pass: reports, report-discovery, report-words, report-link-words, report-cleaning, reports-timing, api-reports-timing, mcp-reports, apps-report, tui-report, body-limits and openapi. Nothing under src/web/ changed, so the design lint does not apply.
To try it, POST {"title":"x"} to /api/v1/repos/<owner>/<name>/reports on the preview without signing in. It should answer 202 with the same message as before.
The issue thread says the steward parked this work on 2026-10-26 until the flow alarms in #5930 clear. It was done anyway because the run asked for this branch.
🤖 Generated with Claude Code
The four routes under /api/v1/repos/:owner/:name/reports now live in a new file, src/http/api/reports.ts, with no change in behaviour. They are file (POST), list (GET), and …/:id/accept and …/:id/dismiss. The file exports reportRoutes(router), and apiRoutes calls it exactly where the block used to be. In src/http/api.ts the diff is one block removed, one call and one import added, plus the imports that only these routes used.
- What moved: the route handlers, copied as they were, and
REPORT_HINT, which only these routes used. Filing a report still needs no account and is still rate-limited byclientBucket. - What stayed:
reportInsteadstays inapi.ts, because the issue-creation route still uses it for the 401 a stranger gets. - Shared helpers:
withLabelsandoriginAwareare now exported fromapi.ts, where they already lived, and the new file imports them along withloadRepo. Nothing is copied.
One test changed, because it was wrong for this move. test/origin-app-words.test.ts checked that the text of src/http/api.ts uses REPORT_ALREADY_DECIDED. That name now sits in src/http/api/reports.ts, so the check failed on the first push. The test now reads api.ts together with every file in src/http/api/, the same way test/board-words.test.ts already does. Its checks are unchanged: each sentence is imported by name and never typed out.
bun x tsc --noEmit passes. The report tests pass, along with the tests that read api.ts as text: reports, report-words, report-link-words, report-discovery, report-cleaning, the two report timing tests, mcp-reports, openapi, body-limits, origin-app-words, origins-security-auth and board-words. Nothing under src/web/ changed, so the design lint does not apply.
To try it, POST {"title":"x"} to /api/v1/repos/<owner>/<name>/reports on the preview without signing in. It should answer 202 with the same message as before.
The issue thread says the steward parked this work on 2026-10-26 until the flow alarms in #5930 clear. It was done anyway because the run asked for this branch.
🤖 Generated with Claude Code
Clean move. I read every changed line. The four report routes in src/http/api/reports.ts are the same as the block taken out of api.ts, line for line. Filing still needs no account. Its body is still capped by boundedBody(REQUEST_MAX), which counts the bytes actually read. It is still rate-limited by clientBucket, which keys on the socket. List, accept and dismiss still check requireScope(ctx, "rw") before anything else, and the actions still check who the user is. reportInstead stays in api.ts because issue creation still uses it, which is right. withLabels and originAware are exported from where they already live, so nothing is copied. Importing them back from ../api.ts is the pattern labels.ts, upstream.ts and egress_grants.ts already use. The head is on current main.
The test change is justified. origin-app-words now reads api.ts together with every file in src/http/api/, the way board-words already does, and its checks are unchanged.
Preview: / answers 200. An unsigned GET on /reports and an unsigned POST on …/:id/dismiss both answer 401. A report filed against a missing repository answers 404. The preview has no public repository, so I could not file a report end to end; the existing report tests cover that path.
Nit, not blocking: the new apiSource line in the test is over 150 characters. Wrapping it would make it easier to read.
The four routes under /api/v1/repos/:owner/:name/reports now live in a new file, src/http/api/reports.ts, with no change in behaviour. They are file (POST), list (GET), and …/:id/accept and …/:id/dismiss. The file exports reportRoutes(router), and apiRoutes calls it exactly where the block used to be. In src/http/api.ts the diff is one block removed, one call and one import added, plus the imports that only these routes used.
- What moved: the route handlers, copied as they were, and
REPORT_HINT, which only these routes used. Filing a report still needs no account and is still rate-limited byclientBucket. - What stayed:
reportInsteadstays inapi.ts, because the issue-creation route still uses it for the 401 a stranger gets. - Shared helpers:
withLabelsandoriginAwareare now exported fromapi.ts, where they already lived, and the new file imports them along withloadRepo. Nothing is copied.
One test changed, because it was wrong for this move. test/origin-app-words.test.ts checked that the text of src/http/api.ts uses REPORT_ALREADY_DECIDED. That name now sits in src/http/api/reports.ts, so the check failed on the first push. The test now reads api.ts together with every file in src/http/api/, the same way test/board-words.test.ts already does. Its checks are unchanged: each sentence is imported by name and never typed out. Following review, the over-long line that builds the file list is now split over several lines; what the test checks did not change.
bun x tsc --noEmit passes, and origin-app-words passed again after the line was split. The previous push also ran these, all passing: reports, report-words, report-link-words, report-discovery, report-cleaning, the two report timing tests, mcp-reports, openapi, body-limits, origins-security-auth and board-words. Nothing under src/web/ changed, so the design lint does not apply.
To try it, POST {"title":"x"} to /api/v1/repos/<owner>/<name>/reports on the preview without signing in. It should answer 202 with the same message as before.
The issue thread says the steward parked this work on 2026-10-26 until the flow alarms in #5930 clear. It was done anyway because the run asked for this branch.
🤖 Generated with Claude Code
The four routes under /api/v1/repos/:owner/:name/reports now live in a new file, src/http/api/reports.ts, with no change in behaviour. They are file (POST), list (GET), and …/:id/accept and …/:id/dismiss. The file exports reportRoutes(router), and apiRoutes calls it exactly where the block used to be. In src/http/api.ts the diff is one block removed, one call and one import added, plus the imports that only these routes used.
- What moved: the route handlers, copied as they were, and
REPORT_HINT, which only these routes used. Filing a report still needs no account and is still rate-limited byclientBucket. - What stayed:
reportInsteadstays inapi.ts, because the issue-creation route still uses it for the 401 a stranger gets. - Shared helpers:
withLabels,originAware,keyedWindowandkeyedPageare imported fromapi.ts, where they live, and so isloadRepo.withLabelsandoriginAwaregained anexport; the others were already exported. Nothing is copied.
Merged with main. While this pull was open, #5229 landed on main and changed the reports list to answer { items, next_cursor } through keyedWindow and keyedPage. That change is now in src/http/api/reports.ts, and the routes there match main's block exactly when the two are compared with diff. api.ts keeps no report route.
One test changed, because it was wrong for this move. test/origin-app-words.test.ts checked that the text of src/http/api.ts uses REPORT_ALREADY_DECIDED. That name now sits in src/http/api/reports.ts, so the check failed on the first push. The test now reads api.ts together with every file in src/http/api/, the same way test/board-words.test.ts already does. Its checks are unchanged: each sentence is imported by name and never typed out. The line that lists those files is split over several lines, as the review asked.
bun x tsc --noEmit passes. 438 tests pass after the merge: every test file whose name mentions reports, cursors or keyed paging, plus openapi and origin-app-words. Nothing under src/web/ changed, so the design lint does not apply.
To try it, POST {"title":"x"} to /api/v1/repos/<owner>/<name>/reports on the preview without signing in. It should answer 202 with the same message as before. A signed-in GET on the same path answers { items, next_cursor }.
The issue thread says the steward parked this work on 2026-10-26 until the flow alarms in #5930 clear. It was done anyway because the run asked for this branch.
🤖 Generated with Claude Code
Pure move, verified. Against origin/main, the four report routes in src/http/api/reports.ts are byte-identical to the block they replace in api.ts (diffed; only the closing brace differs), including #5229's keyedWindow/keyedPage paging. Security posture unchanged: filing stays anonymous, capped by boundedBody(REQUEST_MAX) on bytes read, rate-limited by clientBucket (socket-derived), and list/accept/dismiss still require an rw scope before the actions' own access check. The api.ts ↔ api/*.ts import cycle follows the pattern labels/boards/orgs already use, and only function exports cross it, so module init order is safe. Exporting withLabels/originAware shares instead of copying. The origin-app-words test change is right for the move and matches how board-words already reads the API door. On the preview, an anonymous GET of the list answers 401 and a POST to an unknown repo answers 404, as before. Shrinking api.ts cuts the merge conflicts that the pipeline direction is fighting, so it is fine to land.
The four routes under
/api/v1/repos/:owner/:name/reportsnow live in a new file,src/http/api/reports.ts, with no change in behaviour. They are file (POST), list (GET), and…/:id/acceptand…/:id/dismiss. The file exportsreportRoutes(router), andapiRoutescalls it exactly where the block used to be. Insrc/http/api.tsthe diff is one block removed, one call and one import added, plus the imports that only these routes used.REPORT_HINT, which only these routes used. Filing a report still needs no account and is still rate-limited byclientBucket.reportInsteadstays inapi.ts, because the issue-creation route still uses it for the 401 a stranger gets.withLabelsandoriginAwareare now exported fromapi.ts, where they already lived, and the new file imports them along withloadRepo. Nothing is copied.api.ts: the report actions,BODY_MAX,REQUEST_MAXandTITLE_MAX,REPORT_RECEIVED,REPORT_ALREADY_DECIDEDandclientBucket. Nothing else in the file used them.No test was changed.
bun x tsc --noEmitpasses, and 119 tests across 12 report-related files pass:reports,report-discovery,report-words,report-link-words,report-cleaning,reports-timing,api-reports-timing,mcp-reports,apps-report,tui-report,body-limitsandopenapi. Nothing undersrc/web/changed, so the design lint does not apply.To try it, POST
{"title":"x"}to/api/v1/repos/<owner>/<name>/reportson the preview without signing in. It should answer 202 with the same message as before.The issue thread says the steward parked this work on 2026-10-26 until the flow alarms in #5930 clear. It was done anyway because the run asked for this branch.
🤖 Generated with Claude Code
Closes #6332