📱 Expo v0.2.0 (@reprojs/expo)

📱 Repro Expo SDK — @reprojs/expo@0.2.0 on https://www.npmjs.com/package/@reprojs/expo/v/0.2.0

compare changes

🚀 Enhancements

• ✨ Add two way sync for github issue labels (89d3d9e)
• webhook: Add size cap helper for github webhooks (8886440)
• db: Add github_webhook_deliveries table for replay protection (f210471)
• webhook: Add delivery dedupe for replay protection (f91987b)
• webhook: Check installation id against known integrations (f1ad47e)
• webhook: Enforce size cap, replay dedupe, installation allowlist (3865559)
• db: Add user_identities table (github provider) (63cd11d)
• db: Add github_write_locks table for loop avoidance (e16f5c5)
• db: Add report_comments table (not yet wired) (80cb4d4)
• db: Add milestone, sync timestamps, and toggle columns (964601e)
• db: Extend report_event_kind enum for assignees/comments/milestone (fcc4a8b)
• identities: Signed oauth state helper for link flow (e416b4d)
• identities: Resolver + upsert + unlink helpers (c5796b2)
• identities: GET /api/me/identities (3d1211b)
• identities: POST start endpoint generates signed oauth url (dddb5f9)
• identities: Callback exchanges code and upserts identity (2d1527e)
• identities: DELETE endpoint unlinks the identity (855bcc5)
• identities: Backfill user_identities from better-auth account rows (c511746)
• identities: /settings/identities page with connect/disconnect (c52520f)
• db: Report_assignees schema + backfill migration (unapplied) (44299e0)
• shared: ReportSummaryDTO.assignees (array); TriagePatchInput.assigneeIds (572ae66)
• github-cache: Generic per-repo cache with TTL + SWR + single-flight (4ad1071)
• github-adapter: List labels, assignees, milestones (367f0aa)
• api: GET repo labels for a project (2e615b4)
• api: GET assignable users with linkedUser resolution (fb19d2c)
• api: GET repo milestones (091d610)
• webhook: Invalidate picker caches on label/milestone/member events (69cfba2)
• ui: Composable exposing github integration state per project (fbc29c3)
• shared: Add milestone + githubAssigneeLogins to reports DTOs (4c64078)
• triage: PATCH + read endpoints support milestone + github-only assignees (a278a30)
• ui: Labels picker backed by repo label set (9374bcc)
• ui: Assignees picker — dashboard-linked and github-only in one list (52269e7)
• ui: Milestone picker (db4f968)
• triage: Wire live pickers into drawer for linked projects (56848b0)
• github-adapter: Issue-write helpers (title, milestone, assignees, state) (0e3f571)
• github-diff: Signature + assignee-diff helpers for write-locks (09da9bc)
• write-locks: Record/consume/cleanup helpers (c94dd5d)
• tasks: Daily cleanup of expired github_write_locks (57190e1)
• reconcile: Diff + push title, labels, state, assignees, milestone with write-locks (91e4768)
• triage: Enqueue github sync on qualifying PATCH when push_on_edit=true (a673712)
• webhook: Assigned/milestoned/edited branches + write-lock echo skip (9cfddd6)
• integrations: PushOnEdit UI toggle for GitHub integration (dfd32b2)
• integration-api: Expose autoCreateOnIntake toggle (1574a7d)
• integration-ui: AutoCreateOnIntake toggle (51fc8b7)
• intake: Auto-create github issue on new report when toggle is on (30b7674)
• github-adapter: Issue-comment wrappers (create/update/delete/list) (f395f3d)
• comments: Bot-footer serialize/strip/detect helpers (9364473)
• github-diff: SignCommentUpsert + signCommentDelete (e664a1d)
• sync-jobs: Carry comment-sync payloads (021a0f7)
• api: GET/POST/PATCH/DELETE report comment endpoints (76e6fb1)
• shared: Comment DTOs (2485a18)
• reconcile: Handle comment_upsert and comment_delete job kinds + backfill on first link (7514d3c)
• webhook: Issue_comment branches with write-lock echo skip (2ce422e)
• dashboard: Add marked dependency and use-markdown composable (aa39cf9)
• dashboard: Add Comments tab to report detail page (1b8a7a2)
• dashboard: Live report stream via SSE with memory-safe lifecycle (92e6a2f)
• security: XSS-safe markdown rendering with DOMPurify (d43df70)
• dashboard: Render reporter description in overview tab (4f621a3)
• sync: In-process trigger + shared outbox runner (4b59420)
• github: Create custom labels in linked repo from the picker (18ad810)
• sdk-utils: Add canonical theme tokens shared by web and expo SDKs (989d8e3)
• sdk-utils: Add Attachment shape and validateAttachments helper (a6c8159)
• ui: Add themeToCssVars helper that emits flame/mist tokens as CSS vars (1a2e692)
• ui: Inject flame/mist CSS vars into shadow root at mount (91a883b)
• ui: Add PrimaryButton, SecondaryButton, FieldLabel, StepIndicator, WizardHeader (61404b5)
• ui: Add StepDetails (replaces step-describe in 3-step wizard) (1077c55)
• ui: Add StepReview with 'Included in this report' summary (da15040)
• ui: Replace 2-step wizard with annotate → details → review flow (25c916f)
• db: Add report_attachments.filename and user-file kind (9fd59b1)
• env: Add user-file intake size budgets (01c0f9e)
• server: Add sanitizeFilename + rollbackPuts helpers (f4bc566)
• intake: Accept attachment[N] parts as user-file attachments (bceae0b)
• ui: Add AttachmentList with hybrid thumbnail + chip rendering (b8070d6)
• sdk-web: Add user attachments end-to-end (46af0bb)
• shared: Add user-file kind and filename field to AttachmentDTO (dd715e5)
• dashboard: Include user-file filename in report detail response (4242d52)
• dashboard: Add AttachmentsTab for user-file attachments (f046de2)
• dashboard: Expose user-file attachments tab in report drawer (125760a)
• expo: Add pickFiles wrapper over expo-document-picker (d664505)
• expo: Add AttachmentList for the mobile wizard (b2162d3)
• expo: Add attachments to the wizard's Details step (9e64cea)
• expo: Submit user-file attachments as attachment[N] multipart parts (716d4b6)
• ui: Side-by-side details layout + paste-to-attach screenshots (4452729)
• intake: Virus-scan user attachments via ClamAV sidecar (53f97a3)
• ui: Inflight toast + clamav scan visibility (23b9349)
• dashboard: Show clamav scan report on user-file attachments (368d63b)
• expo: Pick attachments from Photos / Files / Clipboard (0cc0bf5)
• extension: Retheme popup + options to flame/mist tokens (2708f72)
• deploy: Add clamav sidecar to production compose.yaml (3690065)

🩹 Fixes

• Update paths for drizzle-kit commands in package.json (893bfdf)
• reports: Use drizzle exists/notExists for assignee filter subqueries (00c9fb7)
• dashboard: Test suite fixes for Phase 3 comment sync (f91f617)
• github-app: Drop in-process credentials cache for cross-process consistency (9b77abf)
• github-app: Mark webhook active in manifest when baseUrl is public (5a159e0)
• github: Subscribe to issue_comment/label/milestone/member events + activity feed tag rendering (40e160c)
• webhook+ui: Label sync publishes SSE events + assignee avatars render (a8f8672)
• csp: Allow https: in img-src so github avatars render (67f569a)
• github: HMAC-sign bot footer, consolidate cache, extract test shims (854089e)
• api: SSE cleanup-before-subscribe + defer post-commit side effects (7c174fa)
• test: Seed github_app row for cross-process webhook-signing tests (0731805)
• github-app: Require OAuth pair in envComplete + CI-safe state secret read (4214368)
• github: Warn when GitHub silently drops assignees (7c6f178)
• docker: Bundle SDK iife in the published image (cb9f80c)
• api: Cache-Control private, no-store on /api/** (65d5309)
• github: Pre-flight check before assigning users to an issue (c6393f7)
• github: Gate test-only reconcile shim on __hasClientOverride (cc3b0e8)
• dashboard: Reject ?id= when authed via signed token (2485200)
• docker: Pin clamav sidecar to linux/amd64 (7971214)
• expo: Make clipboard paste actually work (641faad)
• intake: Scan user-files BEFORE inserting the report row (67f0dbf)
• ci: Isolate SDK tests per-package to prevent globalThis pollution (d829cc2)
• build: Bump expo:build heap to 6GB (dadcb27)

💅 Refactors

• reports: List endpoint reads assignees from report_assignees (f32fec0)
• reports: Detail endpoint reads assignees from report_assignees (81bb184)
• triage: Write assignees to report_assignees with diff + events (dfa9ee3)
• bulk-update: Write assignees via diff into report_assignees (058a6c1)
• ui: Bind assignee UI to assignees[0] (single-select preserved) (4e4fa9b)
• dev: Move hardcoded tunnel host + demo endpoint out of tracked files (17ae31c)
• github: Per-signature sync-job dedup with composite PK (6eca61c)
• assignees: Github-only, drop dashboard-user linking (557d2d6)
• ui: Switch styles to CSS custom properties from sdk-utils tokens (ede8899)
• expo: Re-export shared theme tokens from sdk-utils (9ddc528)

📖 Documentation

• Add Buy Me a Coffee link to README and docs site (4b8bd1e)
• spec: Deeper github integration design (76b241a)
• plan: Deeper github integration — phase 0 (backbone) (233a93f)
• Webhook rotation + reserved phase-N toggle columns (e541088)
• plan: Deeper github integration — phase 1 (live pickers) (2322dba)
• plan: Deeper github integration — phase 2 (push-on-edit) (8f88ec3)
• plan: Deeper github integration — phase 3 (comments two-way) (2207954)
• env: Document test-friendly GitHub App + rate-limiter env defaults (b496fd4)
• sdk: Fix the <script async> init race (10a3dc3)
• specs: Add SDK wizard redesign + user attachments design (d8a9b2e)
• plans: Add SDK wizard redesign + user attachments implementation plan (6327f12)

🏡 Chore

• Fixups from phase-0 verification (0dbf409)
• github-app: Manifest default_events: add sub_issues, drop member (7d9a90c)
• github-app: Default auto_create_on_intake to true for new installs (a7fbab1)
• sse: Strip diagnostics + revert to useEventSource from vueuse (5d78dbd)
• repo: Drop stray top-level server/ migration artifacts (0fdd5a0)
• security: Gate nuxt-security rate-limiter opt-out on non-production (f91164e)
• release: V0.3.0 (8f8d95a)
• release: V0.4.0 (e7dbedb)
• release: V0.4.1 (46de4a5)
• release: V0.4.2 (36d5cef)
• Refresh bun.lock after clamav + expo peer-dep churn (50c4cec)
• release: Sdk-v0.4.0 (5868b7e)

✅ Tests

• webhook: Integration tests for hardened auth stack (688bb19)
• Rewrite assignee assertions for report_assignees shape (0917b75)
• assignees: Multi-assignee persistence, clearing, role guard, cap (ed2ed59)
• webhook: Raise timeout for oversized-body transfer (b077006)
• api: Github picker endpoints (0e3ecf1)
• github: End-to-end push-on-edit roundtrip integration test (8fe5b60)
• github: Align webhook secret across tests with env config (45eb032)
• intake: Auto-create on intake respects toggle (049b233)
• comments: API endpoint coverage (8dc9ee8)
• dashboard: Add comment roundtrip integration tests (e837753)
• shared: Align ReportSummaryDTO test with new assignees/milestone shape (9dca620)
• dashboard: Route setup() through local no-op shim + env-agnostic safeHref (216c5e6)
• extension: Rename Playwright e2e spec to .e2e.ts so bun test skips it (11149b5)
• Wait for in-process sync trigger to settle before asserting (29489d0)

🎨 Styles

• triage: Redesign sidebar with divided sections + cleaner chips (03661ae)

🤖 CI

• docker: Don't fail release on flaky GHA cache export (76221d2)

❤️ Contributors

• JJ teohjjteoh@gmail.com
• Jer-tan (@jer-tan)