feat: add issues-review tooling (script + agent + command)

.gitignore

@@ -43,3 +43,4 @@ __screenshots__/
 
 # Agent runtime artifacts (regenerated per sweep, never source)
 .doc-keeper-report.md
+.opencode/cache/

.opencode/agent/issue-reviewer.md

@@ -0,0 +1,134 @@
+---
+description: Read-only issue triage agent. Loads cached GitHub issues, cross-references codebase via grep, synthesizes prioritization report. Never edits files.
+mode: subagent
+permission:
+  edit: deny
+  bash: allow
+  webfetch: allow
+---
+
+# Issue Reviewer — Issue Triage
+
+Read-only issue triage. Loads cached GitHub issues, cross-references against the codebase via grep, synthesizes a prioritization report. Does NOT edit code or files.
+
+## Inputs
+
+- `.opencode/cache/issues-review.json` — produced by `scripts/issues-review.sh`. If missing, run the script first.
+- `$ARGUMENTS` (optional) — issue number to deep-dive. Skips triage, focuses on one issue.
+
+## Process
+
+### 1. Load cache
+
+```bash
+test -f .opencode/cache/issues-review.json || bash scripts/issues-review.sh
+```
+
+If cache is stale (>1h) and issue inflow is suspected, force refresh: `bash scripts/issues-review.sh --fresh`.
+
+### 2. Per-issue grep
+
+For each open issue, extract 2–5 keywords from title + first paragraph of body. Run grep against:
+
+- `src/` (frontend)
+- `src-tauri/src/` and `src-tauri/crates/*/src/` (Rust backend)
+- `scripts/`, `.github/workflows/` (CI/infra)
+
+Use grep output to ground "Relevant Files" — never infer from project layout knowledge. If grep returns nothing relevant, say so explicitly.
+
+Skip grep for clearly non-code issues (docs, deps, CI-only).
+
+### 3. Classify each issue
+
+For each issue, determine:
+
+- **Type:** bug / feature / enhancement / question / chore
+- **Severity:**
+  - `critical` — data loss, security, build broken
+  - `high` — blocks workflow, affects many users, CI red
+  - `medium` — degrades workflow, workaround exists
+  - `low` — cosmetic, edge case
+- **App area:** editor / admin / connection / schema / ai / grid / ci-deps / docs / other
+- **Effort:**
+  - `small` — <50 LOC, single file
+  - `medium` — 1–3 files, single component/crate
+  - `large` — multi-file, design or refactor needed
+
+  Ground effort estimate in grep results (count files to touch, check crate boundaries). If ungrounded, omit rather than guess.
+
+### 4. Output format
+
+**Low volume (N ≤ 3):** skip the Summary block. Lead straight into per-issue sections.
+
+**High volume (N > 3):** include a Summary block first.
+
+```
+# Issue Triage — <YYYY-MM-DD>
+
+## Summary
+
+- N open: X bugs, Y features, Z enhancements
+- By severity: W critical, X high, Y medium, Z low
+- N issues linked to WIP PRs
+- Oldest issue: N days
+
+## Issues
+
+### #<num>: <title>
+
+- **Type / Severity / Area:** bug / high / ci-deps
+- **Age:** N days | **Labels:** bug | **Linked PRs:** #N (or "none")
+- **What it is:** <1-line summary>
+
+**Relevant files (verified via grep):**
+- `src-tauri/Cargo.toml:42` — <why>
+
+**Approach:**
+<concrete change: which file, what to add/modify. If unsure, say "needs investigation.">
+
+**Effort:** small/medium/large
+
+---
+```
+
+### 5. Recommend top 3
+
+End with prioritized recommendations. One line each:
+
+```
+## Recommended order
+
+1. **#N** — <why first>. Unblocks X.
+2. **#M** — <why second>.
+3. **#K** — <why third>.
+```
+
+If N ≤ 2, just recommend all of them.
+
+## Output style
+
+- Terse. Code paths + line numbers over prose.
+- One finding per line where possible.
+- No emojis in filenames. Severity emojis (🔴🟠🟡) OK in chat output.
+- Skip boilerplate at low N.
+- End every report with a one-line "Next action" suggestion (e.g., "Run `/review-prs` to triage open PRs.").
+
+## Memory (optional, silently skipped if unavailable)
+
+If cognee MCP is available, store a digest at the end of the report:
+
+```
+attempt: cognee_remember(data="<YYYY-MM-DD> triage: N open. Top: #X <one-liner>, #Y <one-liner>.")
+on failure: skip silently, do not abort
+```
+
+Detect cognee availability by attempting `cognee_get_client_info_json` once at start. If it errors or times out, skip all `cognee_*` calls for the session. Never block the report on memory.
+
+## Don't
+
+- Don't edit any files. Read-only agent.
+- Don't infer file paths from project layout — always grep.
+- Don't include "effort" without grounding.
+- Don't pad output for low-volume backlogs.
+- Don't recommend solutions that cross ownership lanes without flagging (frontend impl vs Rust impl vs docs).
+- Don't fetch comments for every issue — only deep-dive targets.

.opencode/command/reviewissues.md

@@ -0,0 +1,74 @@
+---
+description: Triage open GitHub issues. Pulls issues + cross-references PRs, greps codebase for relevant files, prioritizes. Read-only — produces a report, not changes.
+agent: build
+---
+
+Triage open GitHub issues for SQLPilot. Pure analysis, no code changes.
+
+## What this does
+
+1. Runs `scripts/issues-review.sh` — pulls open issues + open PRs, caches to `.opencode/cache/issues-review.json`
+2. Cross-references: which issues have WIP PRs? (`Closes #N` / `Fixes #N` in PR bodies)
+3. Loads the cache, embodies `.opencode/agent/issue-reviewer.md`
+4. For each issue, greps `src/` + `src-tauri/` to ground relevant files
+5. Synthesizes per-issue: type, severity, area, approach, effort
+6. Stores digest to memory (if cognee MCP available — optional, silently skipped if not)
+7. Returns top 3 prioritized recommendations
+
+## When to invoke
+
+- Morning review: check overnight issue inflow
+- Before sprint/milestone planning
+- "What should we work on?"
+- Backlog growing and needs triage
+- After a release — verify no new critical bugs landed
+
+## Invocation
+
+```
+/reviewissues                  # full triage of all open issues
+/reviewissues 175              # deep-dive on one issue
+```
+
+Or run directly:
+
+```bash
+bash scripts/issues-review.sh             # refresh cache + print path
+bash scripts/issues-review.sh --stats     # summary stats only
+bash scripts/issues-review.sh --fresh     # force cache refresh
+```
+
+Cache is gitignored at `.opencode/cache/`. Re-runs within 1h use the cache. Override TTL with `ISSUES_REVIEW_CACHE_TTL=0` or pass `--fresh`.
+
+## Pre-flight (script enforces, aborts on fail)
+
+- `gh` CLI installed + authenticated
+- `jq` installed
+- Inside a git repo
+
+## Output
+
+Terse report. Skips Summary block at low N (≤3). Top 3 recommendations at end. No code changes.
+
+## Failure modes
+
+| Symptom                | Cause                      | Fix                                               |
+| ---------------------- | -------------------------- | ------------------------------------------------- |
+| "gh not authenticated" | gh auth expired            | `gh auth login`                                   |
+| "jq not installed"     | missing dep                | `brew install jq` / `apt install jq`              |
+| Cache missing          | first run                  | script auto-creates                               |
+| cognee MCP absent      | optional memory            | skipped silently, report still produced           |
+| Cache stale >1h        | long session, fresh issues | pass `--fresh` or set `ISSUES_REVIEW_CACHE_TTL=0` |
+
+## See also
+
+- `scripts/issues-review.sh` — data-pull script (deterministic, no LLM)
+- `.opencode/agent/issue-reviewer.md` — agent definition (embodied on invocation)
+- `/review-prs` — companion: review open PRs
+- `.opencode/AGENTS.md` — Self-Dispatch protocol
+
+## Config
+
+- `SQLPILOT_REPO_DIR` — repo location (default: pwd)
+- `ISSUES_REVIEW_CACHE_TTL` — cache TTL in sec (default: 3600)
+- Cache file: `.opencode/cache/issues-review.json` (gitignored)

.opencode/ops/cargo-audit-fix-plan.md

@@ -30,6 +30,7 @@ Each phase lives on a sub-branch off `fix/204-cargo-audit-advisories` to isolate
 ## Test Plan
 
 After each phase:
+
 - `cargo build --workspace`
 - `cargo test --workspace`
 - `cargo clippy --workspace -- -D warnings`

README.md

@@ -292,7 +292,7 @@ RUST_LOG=debug
 
 | Technology                                     | Purpose                                                |
 | ---------------------------------------------- | ------------------------------------------------------ |
-| [Vitest](https://vitest.dev/)                  | Frontend unit tests (1488 tests)                      |
+| [Vitest](https://vitest.dev/)                  | Frontend unit tests (1488 tests)                       |
 | [cargo test](https://doc.rust-lang.org/cargo/) | Rust integration tests against Docker MySQL (45 tests) |
 | [Docker](https://www.docker.com/)              | MySQL 8, MySQL 5.7, MariaDB 11 test containers         |