{summary && flagged {summary.hits}/{summary.analyzed}} {summary && summary.strongHits > 0 && {summary.strongHits} strong} {summary && summary.notRegression > 0 && {summary.notRegression} additive (set aside)} {seconds !== null && ran in {seconds}s}

{/* The card fills the pinned workspace; only this body scrolls. */} {mode === "highlights" && view ? (

) : window.marked ? (

) : (

            {deepScout?.markdown || ""}

)} ); } function App() { const [t, setTweak] = useTweaks(TWEAK_DEFAULTS); const [config, setConfig] = useState(null); const [configError, setConfigError] = useState(""); const [client, setClient] = useState(null); const [session, setSession] = useState(null); const [githubToken, setGithubToken] = useState(""); const [isAdmin, setIsAdmin] = useState(false); const [screen, setScreen] = useState("root"); // Admin status (server-computed from KAVAL_ADMIN_EMAILS) gates internal-only // UI like the cold-email copy button. Mirrored onto a window global so the // deep-report tree can read it without prop-threading; the state change forces // the re-render that makes the global take effect. useEffect(() => { window.KAVAL_ADMIN = false; if (!session?.access_token) { setIsAdmin(false); return; } let cancelled = false; fetch("/api/me", { headers: { authorization: `Bearer ${session.access_token}` } }) .then((response) => response.json()) .then((payload) => { if (!cancelled) { window.KAVAL_ADMIN = Boolean(payload?.admin); setIsAdmin(Boolean(payload?.admin)); } }) .catch(() => {}); return () => { cancelled = true; }; }, [session]); const [connecting, setConnecting] = useState(false); const [repos, setRepos] = useState([]); const [selectedRepo, setSelectedRepo] = useState(null); const [fit, setFit] = useState(null); const [changes, setChanges] = useState([]); const [selectedChange, setSelectedChange] = useState(null); const [result, setResult] = useState(null); const [labels, setLabels] = useState({}); const [loading, setLoading] = useState(""); const [error, setError] = useState(""); const [runStage, setRunStage] = useState(""); const [runEvents, setRunEvents] = useState([]); const [runRepo, setRunRepo] = useState(""); const [notifyState, setNotifyState] = useState("idle"); // idle | sending | sent const [notifyDefault, setNotifyDefault] = useState(false); // server auto-registered the run email const [deepScout, setDeepScout] = useState(null); // { view } once loaded, { error } when the fetch fails — null while loading. const [prReport, setPrReport] = useState(null); // { installations, prRuns } once loaded — null while loading or signed out. const [dashboard, setDashboard] = useState(null); const [examples, setExamples] = useState([]); const [authReady, setAuthReady] = useState(false); const screenRef = useRef(screen); const reposLoadedRef = useRef(false); const autoRepoRef = useRef(false); // Public example reports for the gallery (no auth needed). useEffect(() => { fetch("/api/examples") .then((response) => response.json()) .then((payload) => setExamples(payload.examples || [])) .catch(() => {}); }, []); // --- URL routing ----------------------------------------------------------- // /examples gallery (public) // /examples/:slug one example report (public) // /run/:owner/:name start (or re-open) a deep-scout run (public) // /pr/:owner/:name/:n PR advisory report — a check's "Details" link (public) // /dashboard installations + PR checks (in-screen sign-in wall; // the GitHub App's post-install redirect lands here) // /try URL-only demo hero (public, linked from nowhere) // /connect kick off GitHub OAuth immediately // /repos repo picker (requires session) // / authed -> /repos, anonymous -> marketing landing function navigate(path, { replace = false } = {}) { if (window.location.pathname !== path) { window.history[replace ? "replaceState" : "pushState"]({}, "", path); } handleRoute(path); } function handleRoute(pathname) { track("$pageview", { path: pathname }); const example = pathname.match(/^\/examples\/([\w.-]+)$/); const run = pathname.match(/^\/run\/([\w.-]+)\/([\w.-]+)$/); const pr = pathname.match(/^\/pr\/([\w.-]+)\/([\w.-]+)\/(\d+)$/); if (pathname === "/examples") { setScreen("examples"); } else if (example) { openExample(example[1], { fromRoute: true }); } else if (pr) { openPrReport(pr[1], pr[2], pr[3]); } else if (run) { const repo = `${run[1]}/${run[2]}`; // Re-entering the URL of a finished run shows its report; the server // caches completed jobs, so this never re-runs the analysis. if (deepScoutRef.current?.repo === repo) setScreen("deepReport"); else runDeepScout(repo); } else if (pathname === "/dashboard") { setScreen("dashboard"); } else if (pathname === "/try") { setScreen("try"); } else if (pathname === "/connect") { pendingConnectRef.current = true; setScreen("connecting"); } else if (pathname === "/repos") { setScreen("repos"); } else { setScreen("root"); } } const deepScoutRef = useRef(null); const pendingConnectRef = useRef(false); const clientRef = useRef(null); const configRef = useRef(null); useEffect(() => { deepScoutRef.current = deepScout; }, [deepScout]); useEffect(() => { if (autoRepoRef.current) return; autoRepoRef.current = true; // Legacy query links (?repo=owner/name) redirect into the path scheme. const legacyRepo = new URLSearchParams(window.location.search).get("repo"); if (legacyRepo && /^[\w.-]+\/[\w.-]+$/.test(legacyRepo)) { navigate(`/run/${legacyRepo}`, { replace: true }); return; } handleRoute(window.location.pathname); const onPop = () => handleRoute(window.location.pathname); window.addEventListener("popstate", onPop); return () => window.removeEventListener("popstate", onPop); }, []); // /connect fires OAuth as soon as the Supabase client exists. useEffect(() => { if (pendingConnectRef.current && client && config) { pendingConnectRef.current = false; connect(); } }, [client, config]); useEffect(() => { const root = document.documentElement; root.setAttribute("data-theme", "light"); root.setAttribute("data-density", t.density === "compact" ? "compact" : "comfortable"); root.style.setProperty("--accent", ACCENTS[t.accent] || ACCENTS["#2f6df0"]); }, [t.density, t.accent]); useEffect(() => { screenRef.current = screen; }, [screen]); async function loadConfig() { setConfigError(""); try { const response = await fetch("/api/config"); const payload = await response.json(); if (!payload.ok) throw new Error(payload.error?.message || "Config failed"); setConfig(payload.config); configRef.current = payload.config; if (payload.config.urls?.landing) window.KAVAL_LANDING_URL = payload.config.urls.landing; // InstallBanner (deep-report.jsx) reads the app's install URL here. if (payload.config.githubApp) window.KAVAL_GITHUB_APP = payload.config.githubApp; // Launch-day source tag (?ref=hn|ph|twitter) survives SPA navigation so // the install banner can carry it into the GitHub App's `state`. try { const refSource = new URLSearchParams(window.location.search).get("ref"); if (refSource && /^[\w-]{1,32}$/.test(refSource)) sessionStorage.setItem("kaval_ref", refSource); } catch {} initPosthog(payload.config.posthog); if (payload.config.supabase.configured && window.supabase?.createClient) { const supabaseClient = window.supabase.createClient(payload.config.supabase.url, payload.config.supabase.anonKey, { auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: true, flowType: "implicit", }, }); setClient(supabaseClient); clientRef.current = supabaseClient; const current = await supabaseClient.auth.getSession(); const nextSession = current.data?.session || null; setSession(nextSession); setGithubToken(nextSession?.provider_token || ""); supabaseClient.auth.onAuthStateChange((_event, next) => { setSession(next); setGithubToken(next?.provider_token || ""); if (!next?.provider_token) return; if (_event === "SIGNED_IN") track("github_connected"); // Fresh OAuth return lands on "/" or "/connect" — move to the // picker. Direct links (/examples, /run/...) keep their screen. const entryRoute = ["root", "connecting"].includes(screenRef.current); if (entryRoute) { window.history.replaceState({}, "", "/repos"); setScreen("repos"); } if (entryRoute || !reposLoadedRef.current) { loadRepos(next.provider_token, next.access_token); } }); if (nextSession?.provider_token) { if (["root", "connecting"].includes(screenRef.current)) { window.history.replaceState({}, "", "/repos"); setScreen("repos"); } loadRepos(nextSession.provider_token, nextSession.access_token); } setAuthReady(true); } else if (payload.config.supabase.configured) { setConfigError("Supabase browser client did not load. Check network access to the Supabase JS CDN."); setAuthReady(true); } else { setAuthReady(true); } } catch (err) { setConfigError(err.message || "Unable to load config"); } } useEffect(() => { loadConfig(); }, []); async function apiPost(path, body = {}, tokenOverride, accessTokenOverride) { clientLog("api.start", { path }); const response = await fetch(path, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${accessTokenOverride || session?.access_token || ""}`, "x-github-token": tokenOverride || githubToken, }, body: JSON.stringify(body), }); const payload = await response.json(); if (!response.ok || !payload.ok) { const missing = payload.error?.details?.missing?.length ? ` Missing: ${payload.error.details.missing.join(", ")}` : ""; clientLog("api.error", { path, status: response.status, message: payload.error?.message || "Request failed" }); throw new Error(`${payload.error?.message || "Request failed"}.${missing}`.replace("..", ".")); } clientLog("api.done", { path }); return payload; } async function connect({ redirectTo } = {}) { // Refs, not state: connect can be reached from the mount-effect closure // (deep-link straight to /run/) where client/config state is stale. const supabaseClient = clientRef.current || client; const cfg = configRef.current || config; if (!supabaseClient || !cfg) return; track("github_connect_clicked"); setConnecting(true); setError(""); try { const { error: authError } = await supabaseClient.auth.signInWithOAuth({ provider: "github", options: { scopes: cfg.github.scopes.join(" "), // Front-door runs round-trip through GitHub and come back to the // exact /run/ URL so the run resumes without re-pasting. redirectTo: redirectTo || window.location.origin, }, }); if (authError) throw authError; } catch (err) { setError(err.message || "GitHub auth failed"); setConnecting(false); } } // After the OAuth redirect lands back on /run/, the session parses // out of the URL hash asynchronously — poll briefly instead of firing an // unauthenticated request that would bounce to sign-in again. async function waitForSession(ms = 6000) { const startedAt = Date.now(); while (Date.now() - startedAt < ms) { const supabaseClient = clientRef.current; if (supabaseClient) { const { data } = await supabaseClient.auth.getSession(); if (data?.session?.access_token) return data.session; } await new Promise((resolve) => setTimeout(resolve, 250)); } return null; } async function loadRepos(tokenOverride, accessTokenOverride) { setLoading("repos"); setError(""); try { const payload = await apiPost("/api/github/repos", {}, tokenOverride, accessTokenOverride); setRepos(payload.repos); reposLoadedRef.current = true; setSelectedRepo((current) => ( current && payload.repos.some((repo) => repo.id === current.id) ? current : payload.repos[0] || null )); } catch (err) { setError(err.message || "Could not load repositories"); } finally { setLoading(""); } } async function loadFit() { if (!selectedRepo) return; setScreen("fit"); setFit(null); setLoading("fit"); setError(""); try { const payload = await apiPost("/api/repo/fit", { repoFullName: selectedRepo.fullName }); setFit(payload.fit); } catch (err) { setError(err.message || "Could not scan repository"); } finally { setLoading(""); } } // Full pipeline: local clone + executed evidence lanes + pickaxe causality. // The server runs deep-scout as a child process; we poll until the report // is ready. Same artifact `node scripts/deep-scout.mjs` writes. Works with // or without a session — logged-in runs also persist to Supabase. async function runDeepScout(repo) { setScreen("running"); setLoading("analyze_repo"); setError(""); setDeepScout(null); const startedAt = Date.now(); let wasQueued = false; setRunEvents([]); setRunRepo(repo); setNotifyState("idle"); setNotifyDefault(false); setRunStage("Cloning (first run only), replaying recent fixes, executing changed handlers at base and head…"); clientLog("flow.deep_scout.start", { repoFullName: repo }); track("run_started", { repo }); try { // Starting a run requires a GitHub sign-in (viewing reports doesn't). // Returning from the OAuth redirect, the session may still be parsing // out of the URL hash — wait for it instead of bouncing back to GitHub. let accessToken = session?.access_token || ""; // The GitHub provider token rides along so the server can clone the // user's private repos (the whole point of Connect GitHub). It's sent // per-request and never stored server-side. let ghToken = githubToken || ""; const resuming = window.location.hash.includes("access_token") || sessionStorage.getItem("kaval.resumeRun") === repo; if (!accessToken && resuming) { setRunStage("Finishing GitHub sign-in…"); const restored = await waitForSession(); accessToken = restored?.access_token || ""; ghToken = ghToken || restored?.provider_token || ""; } sessionStorage.removeItem("kaval.resumeRun"); const start = await fetch("/api/deep-scout", { method: "POST", headers: { "content-type": "application/json", ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}), ...(ghToken ? { "x-github-token": ghToken } : {}), }, body: JSON.stringify({ repo, commits: 200 }), }).then((response) => response.json()); if (start?.ok === false && start?.error?.code === "auth_required") { sessionStorage.setItem("kaval.resumeRun", repo); setRunStage("Redirecting to GitHub sign-in — your run starts the moment you're back…"); track("run_signin_redirect", { repo }); // Deep links reach here before loadConfig finishes; wait for the // Supabase client rather than silently doing nothing. for (let i = 0; i < 24 && !clientRef.current; i += 1) await new Promise((resolve) => setTimeout(resolve, 250)); await connect({ redirectTo: `${window.location.origin}/run/${repo}` }); return; // the page navigates away; the /run route resumes on return } if (start?.ok === false) throw new Error(start?.error?.message || "Could not start deep scout"); // Email-when-ready is ON by default — the server already holds the // signed-in runner's verified email and seeded the notify list. The UI // just reflects it ("you can leave"); no click needed. if (start?.notifyDefault) setNotifyDefault(true); let payload = start.status === "done" ? await fetch(`/api/deep-scout?repo=${encodeURIComponent(repo)}`).then((r) => r.json()) : null; for (let attempt = 0; !payload && attempt < 720; attempt += 1) { await new Promise((resolve) => setTimeout(resolve, 2500)); const poll = await fetch(`/api/deep-scout?repo=${encodeURIComponent(repo)}`).then((response) => response.json()); if (poll.status === "error") throw new Error(poll.error || "Deep scout failed"); if (Array.isArray(poll.events)) setRunEvents(poll.events); if (poll.notifyDefault) setNotifyDefault(true); if (poll.status === "done") { payload = poll; break; } const seconds = Math.round((Date.now() - startedAt) / 1000); if (poll.status === "queued") wasQueued = true; // Scout runs share a small server-side worker pool; while queued, the // honest thing to show is the visible line position, not a misleading // elapsed clock. Queue theater beats a spinner. const inLine = poll.queue && !poll.queue.running ? poll.queue.position : 0; setRunStage(poll.status === "queued" ? (inLine > 0 ? `You're #${inLine} in line — runs take a few minutes each; yours starts automatically` : "Queued — another analysis is running; yours starts the moment it finishes") : `Replaying recent fixes with executed evidence — ${seconds}s elapsed (typical repo: 1–3 min; large monorepos up to ~8 min)`); } if (!payload) throw new Error("Deep scout timed out after 30 minutes"); setDeepScout({ repo, summary: payload.summary, markdown: payload.markdown, view: payload.view || null, elapsedMs: payload.elapsedMs }); setRunStage(""); clientLog("flow.deep_scout.done", { repoFullName: repo, elapsedMs: payload.elapsedMs, summary: payload.summary }); track("run_completed", { repo, durationMs: Date.now() - startedAt, queued: wasQueued }); track("report_viewed", { repo, isExample: false }); setScreen("deepReport"); } catch (err) { setError(err.message || "Analysis failed"); setRunStage(""); clientLog("flow.deep_scout.error", { repoFullName: repo, message: err.message || "Analysis failed" }); track("run_failed", { repo, durationMs: Date.now() - startedAt, queued: wasQueued, message: err.message || "Analysis failed" }); // Failed run: examples screen can show the error to anyone; authed // users land back on the picker. navigate(session?.provider_token ? "/repos" : "/examples", { replace: true }); } finally { setLoading(""); } } function analyzeRepo() { if (selectedRepo) navigate(`/run/${selectedRepo.fullName}`); } // "Email me when it's ready" — register the signed-in user's email against // the running job. The server reads the email from the verified session, so // we only send the repo. Stays "sent" for the rest of the run. async function notifyWhenReady() { if (!session?.access_token || !runRepo || notifyState !== "idle") return; setNotifyState("sending"); track("notify_requested", { repo: runRepo }); try { const response = await fetch("/api/notify", { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${session.access_token}` }, body: JSON.stringify({ repo: runRepo }), }); const payload = await response.json(); if (!response.ok || !payload.ok) throw new Error(payload.error?.message || "Could not set up the email"); setNotifyState("sent"); } catch { setNotifyState("idle"); } } // Pasted GitHub URL or owner/name, no login required. function tryPublicRepo(input) { const match = String(input || "").trim() .replace(/^https?:\/\/(www\.)?github\.com\//i, "") .replace(/\.git$/i, "") .match(/^([\w.-]+\/[\w.-]+)/); if (!match) { setError("Paste a GitHub link like github.com/owner/repo"); return; } track("repo_submitted", { repo: match[1], source: screenRef.current }); navigate(`/run/${match[1]}`); } async function openExample(slug, { fromRoute = false } = {}) { if (!fromRoute) { navigate(`/examples/${slug}`); return; } setError(""); setLoading("example"); track("example_opened", { slug }); try { const payload = await fetch(`/api/examples/${slug}`).then((response) => response.json()); if (!payload.ok) throw new Error("Example not found"); setDeepScout({ repo: payload.example.repo, summary: payload.example.summary, markdown: payload.markdown, view: payload.view || null, elapsedMs: null, isExample: true }); track("report_viewed", { repo: payload.example.repo, isExample: true }); setScreen("deepReport"); } catch (err) { setError(err.message || "Could not load example"); setScreen("examples"); } finally { setLoading(""); } } // The page a PR check's "Details" link opens. Public by design — anyone on // the PR can read the verdict; errors render in-screen, never a redirect. async function openPrReport(owner, name, number) { setError(""); setPrReport(null); setScreen("prReport"); track("pr_report_viewed", { repo: `${owner}/${name}`, number: Number(number) }); try { const payload = await fetch(`/api/pr-run/${owner}/${name}/${number}`).then((response) => response.json()); if (!payload.ok) throw new Error(payload.error?.message || "No Kaval report for this PR yet."); setPrReport({ view: payload.view }); } catch (err) { setPrReport({ error: err.message || "Could not load this PR report" }); } } // Dashboard data needs both tokens (Supabase session + GitHub provider // token) — the effect fires once they exist, so a deep link or the OAuth // round-trip back to /dashboard loads as soon as the session lands. useEffect(() => { if (screen !== "dashboard" || dashboard !== null) return; if (!session?.access_token || !githubToken) return; let cancelled = false; (async () => { track("dashboard_viewed"); try { const response = await fetch("/api/dashboard", { headers: { authorization: `Bearer ${session.access_token}`, "x-github-token": githubToken, }, }); const payload = await response.json(); if (!response.ok || !payload.ok) throw new Error(payload.error?.message || "Could not load the dashboard"); if (!cancelled) setDashboard(payload.dashboard); } catch (err) { if (!cancelled) setDashboard({ error: err.message || "Could not load the dashboard" }); } })(); return () => { cancelled = true; }; }, [screen, dashboard, session, githubToken]); // Previous API-only scan (no exec sandbox, no pickaxe) — kept for repos // that cannot be cloned locally. // eslint-disable-next-line no-unused-vars async function historyScanRepo() { if (!selectedRepo) return; setScreen("running"); setLoading("analyze_repo"); setError(""); setRunStage("Screening 150 commits, deep-analyzing 35 candidates, and ranking evidence"); clientLog("flow.history_scan.start", { repoFullName: selectedRepo.fullName, scanLimit: 150, deepLimit: 35 }); try { const payload = await apiPost("/api/history/scan", { repoId: selectedRepo.id, repoFullName: selectedRepo.fullName, defaultBranch: selectedRepo.defaultBranch, scanLimit: 150, deepLimit: 35, }); setFit(payload.fit); setChanges(payload.changes || []); setSelectedChange(payload.selectedChange || null); setResult(payload); setLabels(Object.fromEntries((payload.findings || []).map((finding) => [finding.id, finding.label || null]))); setRunStage(""); clientLog("flow.history_scan.done", { repoFullName: selectedRepo.fullName, selectedSha: payload.selectedChange?.sha, attempts: payload.attempts?.length || 0, findings: payload.findings?.length || 0, }); setScreen("report"); } catch (err) { setError(err.message || "Analysis failed"); setRunStage(""); clientLog("flow.history_scan.error", { repoFullName: selectedRepo.fullName, message: err.message || "Analysis failed" }); setScreen("repos"); } finally { setLoading(""); } } async function loadChanges() { if (!selectedRepo) return; setScreen("changes"); setChanges([]); setSelectedChange(null); setLoading("changes"); setError(""); try { const payload = await apiPost("/api/changes", { repoFullName: selectedRepo.fullName, branch: selectedRepo.defaultBranch, limit: 150, }); setChanges(payload.changes); setSelectedChange(payload.changes.find((change) => change.base) || null); } catch (err) { setError(err.message || "Could not load changes"); } finally { setLoading(""); } } async function analyze() { if (!selectedRepo || !selectedChange?.base) return; setScreen("running"); setLoading("analyze"); setRunStage("Comparing selected base/head and extracting evidence"); setError(""); try { const payload = await apiPost("/api/analyze", { repoId: selectedRepo.id, repoFullName: selectedRepo.fullName, defaultBranch: selectedRepo.defaultBranch, sourceType: selectedChange.sourceType || "commit", baseSha: selectedChange.base, headSha: selectedChange.full, }); setResult(payload); setLabels(Object.fromEntries((payload.findings || []).map((finding) => [finding.id, finding.label || null]))); setScreen("report"); } catch (err) { setError(err.message || "Analysis failed"); setScreen("changes"); } finally { setLoading(""); setRunStage(""); } } async function downloadReport() { if (!result?.run?.id) return; try { const response = await fetch(`/api/runs/${result.run.id}/report.md`, { headers: { authorization: `Bearer ${session?.access_token || ""}` }, }); if (!response.ok) throw new Error("Could not generate report"); const text = await response.text(); const blob = new Blob([text], { type: "text/markdown" }); const url = URL.createObjectURL(blob); const anchor = document.createElement("a"); anchor.href = url; anchor.download = `kaval-report-${(selectedRepo?.name || "run").replace(/[^\w.-]+/g, "-")}.md`; anchor.click(); URL.revokeObjectURL(url); } catch (err) { setError(err.message || "Could not download report"); } } async function labelFinding(findingId, label) { setLabels((current) => ({ ...current, [findingId]: label })); try { await apiPost(`/api/findings/${findingId}/labels`, { label }); } catch (err) { setError(err.message || "Could not save label"); } } const setupBlocking = config && (!config.supabase.configured || !config.results.configured); const authed = Boolean(session && githubToken); // "dashboard" is listed so the post-install redirect shows its own sign-in // wall instead of bouncing a fresh installer to the marketing landing. const publicScreens = ["running", "deepReport", "examples", "connecting", "try", "prReport", "dashboard"]; // No hero in the app: anonymous visitors on private screens go to the // marketing landing. Waits for the initial session restore (authReady) and // never fires while an OAuth callback hash is being processed. useEffect(() => { if (!config || setupBlocking || !authReady) return; const oauthCallback = /access_token=|error_description=/.test(window.location.hash); if (!authed && !connecting && !oauthCallback && !publicScreens.includes(screen)) { window.location.replace(LANDING_URL()); } }, [config, setupBlocking, authReady, authed, connecting, screen]); if (!config) return ; if (setupBlocking || configError) return ; // Public screens — deep-scout runs, reports, examples — need no session. if (screen === "running") { return ; } if (screen === "deepReport") { return ( { if (deepScout?.isExample) navigate("/examples"); else if (authed) navigate("/repos"); else window.location.href = LANDING_URL(); }} backLabel={deepScout?.isExample ? "All examples" : authed ? "Back to repos" : "Back to start"} /> ); } if (screen === "prReport") { const prView = prReport?.view || null; return ( {prView ? ( ) : prReport?.error ? ( ) : ( )} ); } if (screen === "dashboard") { const installed = new URLSearchParams(window.location.search).get("installed") === "1"; return ( { track("dashboard_signin_clicked"); connect({ redirectTo: `${window.location.origin}/dashboard` }); }} onOpenPr={(run) => navigate(`/pr/${run.repo}/${run.prNumber}`)} onRetry={() => setDashboard(null)} /> ); } if (screen === "examples") { return ( ); } if (screen === "connecting") { return ( ); } if (screen === "try") { return ( navigate("/connect")} onExamples={() => navigate("/examples")} busy={loading === "analyze_repo" || loading === "example"} error={error} authed={Boolean(session)} /> ); } if (!authed) { // Redirect effect is in flight (or OAuth callback processing) — hold. return ( ); } if (screen === "fit") return navigate("/repos")} />; if (screen === "changes") return setScreen("fit")} />; if (screen === "report") return navigate("/repos")} onDownloadReport={downloadReport} />; // "repos" and authed "root" both land on the picker. return loadRepos()} onAnalyzeRepo={analyzeRepo} error={error} />; } // Same cross-file mechanism as ui.jsx/deep-report.jsx: screens that other // surfaces (or the preview harness) may mount directly. Object.assign(window, { DashboardScreen, RunningScreen }); ReactDOM.createRoot(document.getElementById("root")).render();

Kaval is ready to run only against real repos.

Paste a repo. Kaval shows the last bugs it shipped — and which ones it would have caught.

{summary.incidents} incident{summary.incidents === 1 ? "" : "s"} (revert/hotfix/fix-shaped) · culprit flagged on {summary.hits} of {summary.analyzed}

{finding.title}

{title}