feat: console board view — two-tab Issues/PRs panel (themed)

[mabry1985]

Stacked on #7 (which is stacked on #6). Base is feat/issue-command; GitHub retargets to main as the stack merges. Review the last commit for this PR's delta.

What

The plugin's own console board view — a quick read of a project's board, modelled on protoMaker's github-view but rebuilt in our design system (--pl-* tokens, no host build).

• view.py — a self-contained, themed PAGE (vanilla JS): two tabs Issues / Pull Requests, a repo picker fed from the configured github.repos, an open/closed/all state filter, list rows (state dot, #number, title, author·date, label pills; PRs add draft/review/branch), and a New issue form.
• api.py — two routers (the notes-plugin pattern): the PAGE on the PUBLIC /plugins/github prefix (iframe-loadable — a page-load can't carry a bearer) and the GATED DATA routes on /api/plugins/github (config/issues/prs/issue), fetched with the DS plugin-kit's apiFetch bearer handshake. POST /issue reuses the same file_issue gate path as the /issue command, so the dialog and the command can't diverge. Data logic lives in plain async fns (host-free testable); fastapi imports are lazy.
• __init__.py — registers both routers when the host exposes register_router, guarded so an older host still loads the tools + /issue. The manifest's views: entry opens it in the right dock (placement: right; views are drag-sortable in the console).

Theming

Page links the DS plugin-kit.css/.js; initPluginView applies the operator's live --pl-* theme (and re-themes), apiFetch attaches the bearer + is slug-aware (works through the fleet /agents/<slug> proxy). Slug-aware base, escape-on-render.

Tests

• Data fns (fetch_issues/fetch_prs) with run_gh mocked; the routes via FastAPI TestClient (config/issues/prs/issue, incl. the gate + default-repo path); register wires both routers; legacy-host (no register_router) still loads tools; the page references the gated endpoints + the DS kit.
• Gate green: ruff check ., ruff format --check ., pytest -q → 78 passed. requirements-dev adds fastapi + httpx (test-only; the host provides fastapi at runtime).

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #8 | feat: console board view — two-tab Issues/PRs panel (themed)

VERDICT: WARN (CI non-terminal; observations below)

---

CI Status

• test: queued ⏳

Diff Review

• __init__.py: Board view registration via dual-guard (hasattr + try/except), degrade-safe on older hosts. Clean.
• api.py (new): Two routers — public PAGE + gated DATA, the notes-plugin pattern. Data fns (fetch_issues/fetch_prs) are plain async + testable, bad_repo validates before run_gh, state filter uses an allow-list, error output truncated. Lazy FastAPI imports.
• PROTO.md: Docs updated to reflect new modules + ADR cross-refs.

Observations

• GAP: Diff truncated at 200/627 lines — view.py PAGE, POST /issue route in build_data_router, and all test files are outside the review window.
• GAP: Clawpatch structural review unavailable (repo not in project registry).
• LOW: _norm_state allows "merged" for both issues and PRs; gh issue list doesn't support --state merged, but the error surfaces via non-zero exit (not silent).
• LOW: shutil.which("gh") is sync in an async context — only called at config-time, negligible impact.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #8.

[protoquinn]

CI terminal-green, no blockers on prior review — auto-approving on green (#748).

[protoquinn]

QA Audit — PR #8 | feat: console board view — two-tab Issues/PRs panel (themed)

VERDICT: WARN (CI non-terminal; comment-only pending test completion)

---

CI Status

• test: queued — non-terminal; formal PASS/FAIL after checks settle

Diff Review

• New api.py (153 lines): clean separation — data fns (fetch_issues/fetch_prs) in plain async (host-free testable), FastAPI imports lazy inside build_* routers
• __init__.py: router registration hasattr-guarded, degrade-safe; lazy imports; log line correctly reflects the view flag
• PROTO.md: docs updated with ADR references
• Input validation solid: bad_repo check, _norm_state whitelist, limit capped 1–100, error output truncated, JSON parse in try/except

Observations

• LOW (clawpatch): repo not in project registry — structural review skipped; diff-based review only
• NOTE: POST /issue reuses the same file_issue gate path as the /issue command — good, prevents divergence
• NOTE: view.py + test files are in the remaining ~400 lines of diff not shown in the summary; no findings from what's visible

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #8.