Feat/tool integration beta

.air.toml

@@ -8,21 +8,21 @@ tmp_dir = "tmp"
 [build]
 # Just plain old shell command. You could use `make` as well.
 # Build with debug symbols enabled for delve debugger
-cmd = "CGO_ENABLED=0 go build -gcflags='all=-N -l' -o ./tmp/livereview ."
+cmd = "if [ -z \"${SKIP_TYPED_GEN}\" ]; then make generate-openapi; fi && CGO_ENABLED=0 env -u GOROOT go build -gcflags='all=-N -l' -o ./tmp/livereview ."
 # Binary file yields from `cmd`.
 bin = "tmp/livereview"
 # Customize binary - run through delve for debugging
 full_bin = "dlv exec ./tmp/livereview --listen=127.0.0.1:2345 --headless=true --api-version=2 --accept-multiclient --continue --log -- api"
 # Watch these filename extensions.
-include_ext = ["go", "tpl", "tmpl", "html"]
+include_ext = ["go", "tpl", "tmpl", "html", "yaml"]
 # Ignore these filename extensions or directories.
-exclude_dir = ["assets", "tmp", "vendor", "ui/node_modules", "livereview_pgdata", "lrdata"]
+exclude_dir = ["assets", "tmp", "vendor", "ui/node_modules", "livereview_pgdata", "lrdata","docs", "internal/api/mcp/generated", "internal/api/docs/spec.go"]
 # Watch these directories if you specified.
 include_dir = []
 # Exclude files.
 exclude_file = []
 # Exclude specific regular expressions.
-exclude_regex = ["_test.go"]
+exclude_regex = ["_test.go", "internal/api/docs/spec.go", "internal/api/mcp/generated/server.go"]
 # Exclude unchanged files.
 exclude_unchanged = true
 # Increase build delay to avoid rapid rebuilds during debugging

.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

.dockerignore

@@ -56,6 +56,7 @@ Thumbs.db
 # Test files and documentation
 tests/
 docs/
+!docs/openapi.yaml
 examples/
 README.md
 *.md

.env.example

@@ -26,6 +26,16 @@ LIVEREVIEW_FRONTEND_PORT=8081
 # When true, the app trusts X-Forwarded-* headers
 LIVEREVIEW_REVERSE_PROXY=false
 
+# =============================================================================
+# WORKER / QUEUE - Background worker settings
+# =============================================================================
+
+# Number of concurrent review jobs the worker process handles (default: 10)
+LIVEREVIEW_WORKER_CONCURRENT_REVIEWS=10
+
+# Set to 'true' to mock AI LLM calls (prevents token usage/costs and runs instantly for testing)
+# LIVEREVIEW_MOCK_AI=false
+
 # =============================================================================
 # MODE - Selfhosted vs Cloud
 # =============================================================================
@@ -51,19 +61,33 @@ LIVEREVIEW_IS_CLOUD=false
 # -----------------------------------------------------------------------------
 
 # Payment mode: 'test' or 'live'
-# RAZORPAY_MODE=test
+# Production deploy targets should use live mode.
+# RAZORPAY_MODE=live
+
+# Pricing profile when RAZORPAY_MODE=live:
+# - actual: normal production pricing
+# - low_pricing_test: temporary low-price live validation profile
+# LIVEREVIEW_PRICING_PROFILE=actual
 
 # Webhook secret for validating Razorpay callbacks
 # RAZORPAY_WEBHOOK_SECRET=your_webhook_secret_here
 
 # Test environment keys (for development/staging)
 # RAZORPAY_TEST_KEY=rzp_test_xxxxxxxxxxxx
 # RAZORPAY_TEST_SECRET=your_test_secret_here
-# RAZORPAY_TEST_MONTHLY_PLAN_ID=plan_xxxxxxxxxxxxxx
-# RAZORPAY_TEST_YEARLY_PLAN_ID=plan_xxxxxxxxxxxxxx
+# RAZORPAY_TEST_MONTHLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_TEST_YEARLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_TEST_MONTHLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
+# RAZORPAY_TEST_YEARLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
 
 # Live environment keys (for production)
 # RAZORPAY_LIVE_KEY=rzp_live_xxxxxxxxxxxx
 # RAZORPAY_LIVE_SECRET=your_live_secret_here
-# RAZORPAY_LIVE_MONTHLY_PLAN_ID=plan_xxxxxxxxxxxxxx
-# RAZORPAY_LIVE_YEARLY_PLAN_ID=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_ACTUAL_MONTHLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_ACTUAL_YEARLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_ACTUAL_MONTHLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_ACTUAL_YEARLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_LOW_PRICING_MONTHLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_LOW_PRICING_YEARLY_PLAN_ID_USD=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_LOW_PRICING_MONTHLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx
+# RAZORPAY_LIVE_LOW_PRICING_YEARLY_PLAN_ID_INR=plan_xxxxxxxxxxxxxx

.github/workflows/gitleaks.yml

@@ -2,7 +2,6 @@ name: gitleaks
 
 on:
   workflow_dispatch: {}
-  pull_request: {}
   push:
     branches:
       - main
@@ -16,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      statuses: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -53,3 +53,17 @@ jobs:
           .github-tools/bin/gitleaks version
       - name: Run gitleaks
         run: .github-tools/bin/gitleaks git . --redact --exit-code 1
+
+      - name: Report status to commit SHA
+        if: always() && github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STATE: ${{ job.status == 'success' && 'success' || 'failure' }}
+        run: |
+          gh api \
+            --method POST \
+            repos/${{ github.repository }}/statuses/${{ github.sha }} \
+            -f state="$STATE" \
+            -f context="gitleaks" \
+            -f description="Gitleaks completed with status: $STATE" \
+            -f target_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

.github/workflows/govulncheck.yml

@@ -2,7 +2,6 @@ name: govulncheck
 
 on:
   workflow_dispatch: {}
-  pull_request: {}
   push:
     branches:
       - main
@@ -18,12 +17,44 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      statuses: write
     steps:
       - uses: actions/checkout@v4
+      - name: Read Go toolchain version
+        id: go-version
+        shell: bash
+        run: |
+          TOOLCHAIN=$(grep '^toolchain ' go.mod | awk '{print $2}' | sed 's/^go//')
+
+          if [ -z "$TOOLCHAIN" ]; then
+            TOOLCHAIN=$(grep '^go ' go.mod | awk '{print $2}')
+          fi
+
+          if [ -z "$TOOLCHAIN" ]; then
+            echo "Failed to determine Go version from go.mod"
+            exit 1
+          fi
+
+          echo "version=$TOOLCHAIN" >> "$GITHUB_OUTPUT"
       - uses: actions/setup-go@v5
         with:
-          go-version-file: go.mod
+          go-version: ${{ steps.go-version.outputs.version }}
+          check-latest: true
       - name: Ensure optional Make env file exists
         run: touch .env
       - name: Run govulncheck via Makefile target
         run: make security-govulncheck
+
+      - name: Report status to commit SHA
+        if: always() && github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STATE: ${{ job.status == 'success' && 'success' || 'failure' }}
+        run: |
+          gh api \
+            --method POST \
+            repos/${{ github.repository }}/statuses/${{ github.sha }} \
+            -f state="$STATE" \
+            -f context="govulncheck" \
+            -f description="govulncheck completed with status: $STATE" \
+            -f target_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"

.github/workflows/mcp-testcases.yml

@@ -0,0 +1,107 @@
+name: MCP Integration Test
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  mcp-test:
+    runs-on: ubuntu-latest
+
+    env:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      JWT_SECRET: ${{ secrets.JWT_SECRET }}
+      TOKENROUTER_API_KEY: ${{ secrets.TOKENROUTER_API_KEY }}
+      LIVEREVIEW_API_KEY_TR: ${{ secrets.LIVEREVIEW_API_KEY_TR }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Install Python dependencies
+        run: |
+          pip install -r tests/mcp/requirements.txt
+
+      - name: Build LiveReview
+        run: make build-ci
+
+      - name: Start MCP server
+        run: |
+          nohup ./livereview api > server.log 2>&1 &
+          echo $! > server.pid
+
+      - name: Wait for server startup
+        run: |
+          for i in {1..30}; do
+            response=$(curl -s http://localhost:8888/health || true)
+
+            if echo "$response" | grep -q '"status":"healthy"\|"status": "healthy"'; then
+              echo "Server is healthy"
+              exit 0
+            fi
+
+            echo "Waiting for server to start..."
+            sleep 2
+          done
+
+          echo "Server failed to become healthy"
+          cat server.log
+          exit 1
+
+      - name: Run MCP test script
+        run: |
+          python tests/mcp/mcp-testcase.py
+
+      - name: Check MCP test result
+        run: |
+          python - <<EOF
+          import json
+          import sys
+
+          with open("tests/mcp/test_results.json") as f:
+              result = json.load(f)
+
+          status = result.get("suite_summary", {}).get("overall_status")
+
+          print(f"Overall Status: {status}")
+
+          if status == "PASSED":
+              print("MCP test passed")
+              sys.exit(0)
+
+          print("MCP test failed")
+          print(json.dumps(result, indent=2))
+          sys.exit(1)
+          EOF
+      - name: Upload MCP Test Results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcp-test-results
+          path: tests/mcp/test_results.json
+          retention-days: 30
+      - name: Print server logs on failure
+        if: failure()
+        run: cat server.log || true
+
+      - name: Cleanup
+        if: always()
+        run: |
+          kill $(cat server.pid) || true
+

.github/workflows/openapi-validation.yml

@@ -0,0 +1,46 @@
+name: Validate OpenAPI YAML
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-yaml:
+    name: Validate YAML Syntax
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check if OpenAPI YAML changed
+        id: changed
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if git diff --name-only "origin/$BASE_REF"...HEAD | grep -q "^docs/openapi.yaml$"; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Install yq
+        if: steps.changed.outputs.changed == 'true'
+        run: |
+          sudo wget -O /usr/local/bin/yq \
+            https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Validate YAML
+        if: steps.changed.outputs.changed == 'true'
+        run: |
+          yq eval '.' docs/openapi.yaml > /dev/null
+          echo "✅ Valid YAML"
+
+      - name: Skip validation
+        if: steps.changed.outputs.changed != 'true'
+        run: echo "No changes to docs/openapi.yaml, skipping validation"

.github/workflows/osv-scanner.yml

@@ -2,31 +2,50 @@ name: osv-scanner
 
 on:
   workflow_dispatch: {}
-  pull_request: {}
   push:
     branches:
       - main
       - master
     paths:
       - go.mod
       - go.sum
+      - osv-scanner.toml
       - .github/workflows/osv-scanner.yml
 
 jobs:
   osv-scan:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      statuses: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
+      - name: Install osv-scanner
+        run: |
+          curl -fsSL https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 -o /usr/local/bin/osv-scanner
+          chmod +x /usr/local/bin/osv-scanner
+          osv-scanner --version
       - run: mkdir -p security_issues
-      - run: osv-scanner scan source --recursive --format json --no-call-analysis=go --experimental-exclude=debug --experimental-exclude=scripts --experimental-exclude=tests --experimental-exclude=.livereview_pgdata --experimental-exclude=.lrdata --experimental-exclude=livereview_pgdata --experimental-exclude=lrdata . > security_issues/osv-scanner-ci.json
+      - run: osv-scanner scan source --recursive --format json --config osv-scanner.toml --no-call-analysis=go --experimental-exclude=debug --experimental-exclude=scripts --experimental-exclude=tests --experimental-exclude=.livereview_pgdata --experimental-exclude=.lrdata --experimental-exclude=livereview_pgdata --experimental-exclude=lrdata . > security_issues/osv-scanner-ci.json
       - uses: actions/upload-artifact@v4
         if: always()
         with:
           name: osv-scanner-ci-report
           path: security_issues/osv-scanner-ci.json
+
+      - name: Report status to commit SHA
+        if: always() && github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STATE: ${{ job.status == 'success' && 'success' || 'failure' }}
+        run: |
+          gh api \
+            --method POST \
+            repos/${{ github.repository }}/statuses/${{ github.sha }} \
+            -f state="$STATE" \
+            -f context="osv-scan" \
+            -f description="OSV Scanner completed with status: $STATE" \
+            -f target_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"